{ "Event": { "published": true, "date": "2022-01-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-30", "timestamp": 1643587382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fe7f42f2-842d-45dc-a725-1bc9bd229748", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a34de0-8198-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1643525183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525183, "uuid": "81f59e93-da10-4717-acd6-878f0fd812e6", "comment": "Malware payload (GCleaner)", "value": "b38f807fc02e26c295c37f41f448352e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525183, "uuid": "39872ba0-e0d2-4478-bcb0-97fc45b1adeb", "comment": "Malware payload (GCleaner)", "value": "001a5a474bbbd8f905626617e612861e7f1de5286b009960c0deefbf06508723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525183, "uuid": "f8992105-c504-48ea-8f1a-e40b9a15f425", "comment": "Malware payload (GCleaner)", "value": "afb5b26b9409cf228e12bfa3f4a63c64ca9949cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525183, "uuid": "a9637baa-6d4c-4b94-bd04-24486817c6b8", "comment": "Malware payload (GCleaner)", "value": "9cd9864797a93e842bcbc0bfd64c6ca577c1e5f968534977132853712452f15e82178eefb30d6c6b81646e3e7b574434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525183, "uuid": "5bf25114-8234-47d8-8d68-a37556c0df80", "value": "T1A57633F667429F51E7EE6972816F90060471FA079A82F21A4F3A145F22476F4FB12F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525183, "uuid": "7f2ebf5e-6888-474d-864d-62fcded774a2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525183, "uuid": "e71deba4-5be9-4d2f-ac87-26da1580dfe1", "value": "196608:J/CTEC8IEE4pW73zw5pG3PwrA1wkNK0fsZkcG1VUA8m83xj4DE0:J/11hW73zw56IIwkNfUZ7GX38mexr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643525183, "uuid": "33cb2422-9dc4-4a56-b415-ecd86162937d", "value": 7263053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643525183, "uuid": "7de862fd-de88-4d30-bacf-5353c3abd46b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525183, "uuid": "9efb1cce-b3c4-4949-925c-d4beb76fae78", "value": "b38f807fc02e26c295c37f41f448352e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0893fc45-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574014, "uuid": "2a1841f6-1747-4f36-8b4e-2bf0af4a0cfa", "comment": "Malware payload (SilentBuilder)", "value": "466a35a9fa93195d8f85283a9c3d458c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574014, "uuid": "10542e91-af5b-440f-b59b-51fabdf4c0af", "comment": "Malware payload (SilentBuilder)", "value": "00242082c64ee9247a13ca2846aeb792133f1e7cebbfb81f231bb79959375a72", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574014, "uuid": "cf7b210d-6a8b-42ce-abb5-c88293669bec", "comment": "Malware payload (SilentBuilder)", "value": "0289894bf87d78cb9829500b3747c9e583e3cbd1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574014, "uuid": "e8b1d11d-fffe-4217-96b8-3fd248083457", "comment": "Malware payload (SilentBuilder)", "value": "681881582507857add5f9fb869fba6ad6e5389edd1344edbeb1d1fee1580000d62f3b45a48fa115b8a81ae86f865f948", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574014, "uuid": "fa173680-3df8-40a0-a701-135fb5eab53d", "value": "T14C839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574014, "uuid": "0ea41651-d652-414d-a16a-698166ed3333", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574014, "uuid": "a3f703bc-a391-4451-b290-bb67f15f95a8", "value": 87460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574014, "uuid": "450370ac-0705-4493-8568-d2b79b8dfd92", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574014, "uuid": "7309a395-8445-4c9f-9b55-73907e82f143", "value": "2022-1-29-466a35a9fa93195d8f85283a9c3d458c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c9b4f-815f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643500871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500871, "uuid": "7329aa4b-0bf2-46c4-ace7-8110baf118c5", "comment": "Malware payload (Heodo)", "value": "3b884af02c4eab3fea2760d227e87f3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500871, "uuid": "022546e3-ab36-4a4f-9e0b-7fd82d18a8e7", "comment": "Malware payload (Heodo)", "value": "006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500871, "uuid": "8d0461c6-f5d5-4a27-ade6-66feac05f78c", "comment": "Malware payload (Heodo)", "value": "9a7aacf9bfaaaf6ba332b87ab67e12b5a312ee74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500871, "uuid": "867d4078-aa07-41ab-a739-84a38d6aafde", "comment": "Malware payload (Heodo)", "value": "4aafa22ca7b1b1ccb494614e1713da2f9a4b9d47dc1067633f267ba56837f7b116786a5fb38c0d2a74bca18d92abe436", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500871, "uuid": "f6484ab4-748a-4160-a0e0-9b2ff8f8f95b", "value": "T144C48F3D71A0A435C27B34F475FAA3B3859FBD524B28469B97FC112B1E395818E3860B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500871, "uuid": "5d34c2ce-c9a5-48d0-bb59-74b93e54aa80", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500871, "uuid": "2b5b8eb4-78fa-415a-ad63-f3da32fea22c", "value": "12288:FMEB4sjSekFwPNWzomLEX/9XzA+UeV84+iw:FMuXNkFwPNYEX/xWeV84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643500871, "uuid": "5ba9491c-61f5-4975-b960-89f1d4dd24a3", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643500871, "uuid": "79257fa9-c128-4f10-83b4-1f547aa409b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500871, "uuid": "8a331a37-9922-44cc-84d4-16051573c6f8", "value": "emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc023a0-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643569778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569778, "uuid": "5cd71ad9-08eb-4868-97ae-108e63869a3e", "comment": "Malware payload (Heodo)", "value": "99551c1f008d548436fb5d21b6ca57e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569778, "uuid": "8ba85329-7b49-4371-9c1b-4a74a00eb52a", "comment": "Malware payload (Heodo)", "value": "00999eff536f8bbcd5b550d713478dc5d54b8fc52bc1831f103afe76ed5dbcbb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569778, "uuid": "68e38815-55df-47fd-ab1d-3adb36be9048", "comment": "Malware payload (Heodo)", "value": "395030730d82f79efb084c5bf91fb70294370079", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569778, "uuid": "fda5830d-2580-4481-8a65-6a9f1f7d9bdb", "comment": "Malware payload (Heodo)", "value": "56afb1a8cd41e14e52f3c7a467a96880c18e6a7995ed913fa8740465ae39669d4bceb54a3b748468f31a282453b71f47", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569778, "uuid": "5757717a-3eb0-4db0-bbdf-98044bd92d7c", "value": "T1A1233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569778, "uuid": "abc065f0-0fd3-4d5a-8324-be3e256e0d69", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569778, "uuid": "108b960e-c346-446a-9bfd-5ccda5a79191", "value": 47882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569778, "uuid": "026242d5-2d31-4101-a73f-63e36418fc97", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569778, "uuid": "822917eb-8645-4e51-adf7-fddeecc38b18", "value": "2022-1-28-99551c1f008d548436fb5d21b6ca57e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc660e1-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643573382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573382, "uuid": "3e688ccb-c2a2-449f-b128-66ae34ad4eee", "comment": "Malware payload (Heodo)", "value": "0f808cff4128eb699c240763c9b838fb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573382, "uuid": "0e95fa64-32fa-4718-94ff-339fe461bd34", "comment": "Malware payload (Heodo)", "value": "00b606d6e7b463752fd9d618e6ee2aa81a9b233f909498811fe2a3aaa8c8f600", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573382, "uuid": "8dee5e40-c348-4f0c-a38e-ce63f7396acd", "comment": "Malware payload (Heodo)", "value": "cb88526794417f777288b497adceb2cc9ade8c57", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573382, "uuid": "f2c3f940-8027-4b77-868c-a0e6b2a58f81", "comment": "Malware payload (Heodo)", "value": "872e3abbd74dd7d03de329659adf84e75b1039850122d7c84acfad5bd6bf8e3ddaa5665bddeddebd5dc1b60cd77e4400", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573382, "uuid": "749056f0-ff9e-4ae3-afe1-93ab01e32912", "value": "T1AE934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573382, "uuid": "8705ba81-62c0-4e8a-b36a-aaa2393f3bd9", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573382, "uuid": "f2bdeb52-7c80-4a57-8747-c53bb4718c38", "value": 93188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573382, "uuid": "8f3d4d84-0187-41e9-82b2-543d33e8c26d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573382, "uuid": "22b98082-3897-4d3a-b699-70e673ddef5a", "value": "2022-1-29-0f808cff4128eb699c240763c9b838fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af321f6-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562073, "uuid": "f06ddbb1-e938-4424-8a19-86e540b72a91", "comment": "Malware payload (SilentBuilder)", "value": "9e425cda7837e976c20a38282bae3bdc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562073, "uuid": "a21733d4-cd8e-4282-b39c-1fe712a4f8ac", "comment": "Malware payload (SilentBuilder)", "value": "00d8cf0d91338776e4596b4b158114525e25e4d9324078ae5b0892645a3fee7b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562073, "uuid": "62ffc4af-0e7e-41a7-af7d-f181064166b1", "comment": "Malware payload (SilentBuilder)", "value": "2273a0b198c01213cf8e729359c4b1ae1244bacc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562073, "uuid": "4c1d8ae7-3747-42a0-8fcc-d0db761440e5", "comment": "Malware payload (SilentBuilder)", "value": "963ebeb21db415e93400f85df4793bab44d3a5b953d26e6024b7a720bdd886c11c9c94418e33115d098d5aca2075007a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562073, "uuid": "e958bc77-305f-4163-84b4-77494d15cefd", "value": "T19BC37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562073, "uuid": "58adfdd9-e172-4319-9d22-da511bb0e023", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562073, "uuid": "25638ea0-7deb-4538-a558-6bf33fbc4a5a", "value": 119208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562073, "uuid": "1fda3edf-75eb-4cf6-8719-136f28af5f6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562073, "uuid": "23637bfd-c2ef-4091-93bc-d34898c3da24", "value": "2022-1-27-9e425cda7837e976c20a38282bae3bdc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70aeb97-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574736, "uuid": "d4d9254a-71ad-460a-a6e8-870c71140b94", "comment": "Malware payload (SilentBuilder)", "value": "7eb8998a2cf1ac1112d7d7f6720b7fb0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574736, "uuid": "3de4fb3a-43be-48e3-870e-fe270e0ee052", "comment": "Malware payload (SilentBuilder)", "value": "00f7cbf0438947c271e04ed91cc5284c70212e17206561b5ff6012173fb77c9a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574736, "uuid": "b477e501-eba1-499c-85e7-4b78459791f0", "comment": "Malware payload (SilentBuilder)", "value": "00f5d99553a99a19bd1bad2df44710f0c897e250", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574736, "uuid": "357b4671-e30d-4b88-87fc-ff79eb89f995", "comment": "Malware payload (SilentBuilder)", "value": "5984d9f2ecf96c2ca2597bfa41cb1458ca082a7fa5ad4eafffb329a41b5c1ec54acace335c719fc145e54e9685823b56", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574736, "uuid": "e784387a-30a4-444f-ae54-4b1767e020e9", "value": "T1D9839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574736, "uuid": "8da25a61-9a55-42b3-ac18-5c5a9ef826d8", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574736, "uuid": "8e210657-9d52-47e7-843d-7a641c649896", "value": 86980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574736, "uuid": "6f253c78-5192-45ae-ac88-bea2d8c79de4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574736, "uuid": "be858094-459c-4099-b37b-98e96de06116", "value": "2022-1-29-7eb8998a2cf1ac1112d7d7f6720b7fb0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3026ded-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560100, "uuid": "8ac41102-fbde-410c-b664-4a4d53121372", "comment": "Malware payload (SilentBuilder)", "value": "8722752e03f20621917745979ae88ca4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560100, "uuid": "04c62e8e-582e-4a42-a5de-2a674a98a877", "comment": "Malware payload (SilentBuilder)", "value": "010b2f27db90a681affeee789aa760de89d39b33d6adc22e26ece73753f56214", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560100, "uuid": "e3f2f36b-d15f-4cc2-99dc-70796563b3ff", "comment": "Malware payload (SilentBuilder)", "value": "eefb331895378bca0334e08851b5b9e9678577b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560100, "uuid": "3a0d107f-b7a9-4ae8-964b-ee1036702ae5", "comment": "Malware payload (SilentBuilder)", "value": "9ea0ed22f48368ca287362bebcbd48edd802ab9d31b53c4035bab4da67a3238192cc5eb83cb85d65efcfc1fb18de5d84", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560100, "uuid": "3766482b-b1bf-4857-a500-2bc851ebeaf5", "value": "T1E7F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560100, "uuid": "8b4fe6c8-eed4-4042-b487-4548a8a721aa", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560100, "uuid": "ea6423fa-4feb-4837-950e-fa321e8bdf93", "value": 158355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560100, "uuid": "ba761d94-b02d-4e59-b1df-bf8ea7df26e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560100, "uuid": "21ad5b18-52d2-4816-8ed1-519a634ae635", "value": "2022-1-28-8722752e03f20621917745979ae88ca4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc45a1be-815f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643500872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "c09bb27d-b928-4157-9aaa-8023491fb7e3", "comment": "Malware payload (Heodo)", "value": "71c82ca16898fe95353561acba74edaf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "8f002a8f-c91d-4a94-a164-e8e5e8757da7", "comment": "Malware payload (Heodo)", "value": "012019a0709a7c268586b4322e19563942309d0a4621698875dc0d841acba19a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "8c667bbf-446c-4f33-8882-3b64192d8a2a", "comment": "Malware payload (Heodo)", "value": "9a2c968a81c4daca4f5707b9c41675234f804ccf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "a4a7b084-b473-4d16-a9b9-cba18e5f5d94", "comment": "Malware payload (Heodo)", "value": "37981fd18cd0f5afa9bb051370541b07e9ca0e584e4fad4e569cfdde3122bb15a7cb1f79d1bf708bfffbcd6b23c867b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "ba57c940-d428-464b-9f55-5996882d25f5", "value": "T117C48F3D71A0A435C27B34F475FAA3B3859FBD524B28469B97FC112B1E395818E3860B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "1c57fbd9-2319-45f9-97b9-6e7d94e058fe", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "c8b41dc6-4062-4aed-80a5-6d8979a2a698", "value": "12288:FMEB4sjSekFwPNWzomLEX/0XzA+UeV84+iw:FMuXNkFwPNYEX/KWeV84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643500872, "uuid": "2022b3e6-9716-4588-ab5c-2cfb8573132a", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643500872, "uuid": "56e1ed2b-08c3-4d94-8b47-3d184834a6c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "946b67dd-c8f1-461c-a032-83ce64935da4", "value": "emotet_exe_e4_012019a0709a7c268586b4322e19563942309d0a4621698875dc0d841acba19a_2022-01-30__000106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b6d039-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643569142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569142, "uuid": "8534af18-e49c-4f45-afc8-cb9aab4645ae", "comment": "Malware payload (Heodo)", "value": "7eeb38f085ccb154050fb7acd026480d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569142, "uuid": "32c2102b-43d8-4faa-8511-0742f541c3be", "comment": "Malware payload (Heodo)", "value": "012fa456657041a869c29fb0c76a584d2c7e1f30987b03c262a80f8c8bf4f7a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569142, "uuid": "6717acf3-2c5c-4e1b-a8e2-2e2038033f34", "comment": "Malware payload (Heodo)", "value": "72bd1e601533f30cac66afb50b49bf9d869c509d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569142, "uuid": "56502325-3bb1-4065-9fca-861597986e19", "comment": "Malware payload (Heodo)", "value": "4f722d85addceb585696e671bd571063d37b143c4dab67fc842dd9e7b74934fb92951ace2dc46065d5a502ff05090761", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569142, "uuid": "5006bbc8-1a2f-478c-948f-f3c6b9181e28", "value": "T126F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569142, "uuid": "3770ca44-37d5-4cf1-bd2d-923c0232dbd4", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569142, "uuid": "1bdf7607-8999-4d32-bd61-542848f47f2d", "value": 158296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569142, "uuid": "6673857b-ecbf-4e04-b41f-7b0207c894dd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569142, "uuid": "b9b056ae-18ab-41ce-8b0c-753030811e6d", "value": "2022-1-28-7eeb38f085ccb154050fb7acd026480d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0e2843-81ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1643548515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643548515, "uuid": "1e863ba7-31d4-4e49-8c7e-a116e885178b", "comment": "Malware payload (AsyncRAT)", "value": "c353463fd4ebfca3c9e68fd388e7662a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643548515, "uuid": "2f930f72-ae53-4e48-824e-bd56df0f08ac", "comment": "Malware payload (AsyncRAT)", "value": "0162b4457b84b9a3d7978bd41db509a734cb8d098b7b847dd37cd381c4af3d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643548515, "uuid": "b447c0b2-3c92-4e70-9603-742848dda4a3", "comment": "Malware payload (AsyncRAT)", "value": "4b26c42145976cc88208294d6f1eadf455b75a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643548515, "uuid": "23107ed9-72d1-437e-8bb1-8ccdc4728b15", "comment": "Malware payload (AsyncRAT)", "value": "af8fbbac2714c7b9eecc9f2a869d48a27c78ec5caaa896db3e8c8e438f101e43fe827cf630cf7faad4d0dfde0c77a500", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643548515, "uuid": "4f8d21b7-3b45-496f-8f7e-d0ac207849d7", "value": "T1EC536B003798C965E2AE4AB4BCF3950046B1D5372102DA4E7CC854DBAB9FFC65A172FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643548515, "uuid": "e77cac79-969e-45ad-ac75-4f153f8c87ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643548515, "uuid": "7b26d5e5-4229-4b78-b6fa-589508675b76", "value": "1536:nJmVTHUv8HtonZRKdUWJ5/WbbUwEZDxG9ZVclN:nJmVTHUv8HyZRKdXWbbUvDMzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643548515, "uuid": "3672513b-09a9-43a5-b86f-5187365cc1df", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643548515, "uuid": "2e5563dd-439d-4b4f-8b67-d7eda9f66506", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643548515, "uuid": "04d6b077-72d4-4999-903f-4adf52bcd1ef", "value": "c353463fd4ebfca3c9e68fd388e7662a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70770b24-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559586, "uuid": "fa59b4c5-74e9-4ab0-a00f-538d34234044", "comment": "Malware payload (SilentBuilder)", "value": "46d4c2a8c4dd1e29e4451546b69a435a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559586, "uuid": "f2dc0d6f-f672-46ff-9970-56d3e3152769", "comment": "Malware payload (SilentBuilder)", "value": "0164d3d8ff75f8b002af966bfde748448a02765c2af13b629195cbefb5880713", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559586, "uuid": "4662b73e-dc3f-453d-9372-c327415d04bc", "comment": "Malware payload (SilentBuilder)", "value": "c71eace6998ef681b43f723ca07bac5e884c02ab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559586, "uuid": "046eb770-6b93-4a12-bad5-7924417a2145", "comment": "Malware payload (SilentBuilder)", "value": "9c29f4e6d40dbf4eb147254565de17cbf366dd943c380b8b8a5b24340d3fcd0bbaf66f33105e5a6da62497cd63ff1703", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559586, "uuid": "4df6b727-69f2-4a49-a8a3-67e3ac01a77c", "value": "T171F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559586, "uuid": "626c18c1-9e5c-429e-8dc1-7a99ab6399a7", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559586, "uuid": "f5290189-e04b-4bf6-9b06-74f265d0f641", "value": 36833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559586, "uuid": "a2d2232b-fcfd-4e44-82e4-28173db87311", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559586, "uuid": "fd003c04-e468-4c9b-9dc4-487d9766a3ba", "value": "2022-1-28-46d4c2a8c4dd1e29e4451546b69a435a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d83e7-820e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643576027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576027, "uuid": "3cefc4cc-24ad-485f-aff4-28885139a66e", "comment": "Malware payload", "value": "db15baa305120f998b597a1fec61a15e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576027, "uuid": "09c6634c-3807-499b-b277-e9c409a02d2f", "comment": "Malware payload", "value": "016f533a1557a882871d8f27f9b820608c59d3da1fab4ae1fcb63958aab67f9c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576027, "uuid": "dd998168-adbc-4c9d-b710-fcb980b20594", "comment": "Malware payload", "value": "1c6fa12bd54b1ced6e440c10ca319d76c5e7a64d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576027, "uuid": "d0ce46f5-d035-4fbc-b734-0e6d10171484", "comment": "Malware payload", "value": "a882ed816edec4c746af66744f46c0d3bd2f9f540a1f4ef577a8eae128e310a21ea936012943e5d3f501d06c721d90df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576027, "uuid": "99e68ec6-b412-4f7a-9318-a77c74ceca63", "value": "T1A9934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576027, "uuid": "61dc4663-7c80-4be8-b4d2-e13b8d53ec8b", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576027, "uuid": "85d57979-c56a-4e5a-a75e-f4751ba7906c", "value": 92550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576027, "uuid": "3c6933a7-bb84-48ed-bf2e-9e1ce215ad0d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576027, "uuid": "1df5072d-e0f6-4cbf-9c42-225a3e453702", "value": "2022-1-29-db15baa305120f998b597a1fec61a15e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eba0121-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559019, "uuid": "e026c4fb-7ad8-4922-bae4-5657ae8f37dd", "comment": "Malware payload (SilentBuilder)", "value": "01bf2290a34d77a5446c8ccb3e19fb0a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559019, "uuid": "a3f21356-af42-4fa5-83a6-f7af66589284", "comment": "Malware payload (SilentBuilder)", "value": "017743398057c45aca0a0e6e4f60a14e2d5da65eb1c6660e7ac92e701529f7bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559019, "uuid": "f72310c0-bc0a-430a-8436-6250d9ebe734", "comment": "Malware payload (SilentBuilder)", "value": "cbb54fd7781bf14071a2e7a8c974faca263a8f5f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559019, "uuid": "7edf2b09-e078-4bfe-a361-34398aa43f21", "comment": "Malware payload (SilentBuilder)", "value": "bcfc13373772366f49c9d92fd5293782a0d472d37d0314216fd4b68deee7a5519a1d7ec09ac0cb153fdbad6698630326", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559019, "uuid": "5390f7c4-75c5-4554-9518-686a88ccbcbd", "value": "T192F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559019, "uuid": "f739ef1d-4be9-4dfe-ac5d-e57b73b932b4", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559019, "uuid": "84329d5e-a069-4bf1-98d7-819621c1ddd8", "value": 159138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559019, "uuid": "a9735aad-02fc-4b62-abd9-3b2c505746ae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559019, "uuid": "bf539b8d-60e8-4428-8d2c-4acf918dab5d", "value": "2022-1-28-01bf2290a34d77a5446c8ccb3e19fb0a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2446946-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572151, "uuid": "22a912be-0ead-4f82-ab57-a05c85e35845", "comment": "Malware payload (SilentBuilder)", "value": "e4468304db48edf143edff254a758001", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572151, "uuid": "d226430d-602c-409f-ad8b-ebd6e979fa08", "comment": "Malware payload (SilentBuilder)", "value": "01777732f5683dc343a9c930ae1e774e16b31ed63373266dd370dad4605bbbe5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572151, "uuid": "0bbf00e4-7f0f-4c1c-b9b3-eb11d7d7305e", "comment": "Malware payload (SilentBuilder)", "value": "40d6950c276b47c8ac114afe58c2c97f4990ed23", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572151, "uuid": "ac367b4b-fadd-4a98-a9e5-b96242723045", "comment": "Malware payload (SilentBuilder)", "value": "d612b3691c78c688966921faae827775397e7018bcba9082cd9ef0e509272dbd6ec853ef57173ee4ef602f584b664489", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572151, "uuid": "9dd6c4ef-a89e-4b7f-a86a-7fda1f26fb44", "value": "T135F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572151, "uuid": "da4e339f-9532-407b-880e-3ecdeaccedd6", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572151, "uuid": "ea16f4bc-61cb-46ad-a936-4b35086444d6", "value": 158589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572151, "uuid": "0bf23b72-bc7f-4025-942f-ea26a221e1ee", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572151, "uuid": "c391e567-bc53-4a0c-9da8-f9a4a3bb847f", "value": "2022-1-28-e4468304db48edf143edff254a758001.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9899b99-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562258, "uuid": "408a7a12-a795-4ef6-a0bc-87113752189e", "comment": "Malware payload (SilentBuilder)", "value": "a41fdd635b3b12a61cc0087a136d0820", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562258, "uuid": "3d98713e-b370-4047-bf42-9b9f58ec184a", "comment": "Malware payload (SilentBuilder)", "value": "01a896f4201aeb8ac508982a7685ef2eacba9c7667f0191b137b0cd05cc50186", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562258, "uuid": "0a6befba-cee3-41b9-9127-7fb6201885ea", "comment": "Malware payload (SilentBuilder)", "value": "79ef90b81a21ba0865ad3b7b22532d0765288725", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562258, "uuid": "eb3ec74b-b13e-4d9d-b3e4-1b3cc38958b5", "comment": "Malware payload (SilentBuilder)", "value": "39bdd1df284f2bbfbcc49abbeb7ccae2e36e9430473ac1df97c243e45473b1a19962dd226184d35e586918fae49637e3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562258, "uuid": "90bd4d3a-de9e-4305-86dc-7ca374adbc95", "value": "T15C735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562258, "uuid": "677c3390-e184-4c01-9bbc-d9159c6f0447", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562258, "uuid": "95682576-60be-43d0-8a15-f1ff56aea429", "value": 77857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562258, "uuid": "3b9acd81-b7d5-498f-a48d-6c049fd75d2c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562258, "uuid": "e916545c-6e04-4554-af81-336766b0e6c4", "value": "2022-1-27-a41fdd635b3b12a61cc0087a136d0820.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad33deb-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564220, "uuid": "b6a4f1fd-cde9-421c-a3d4-945ff7b81835", "comment": "Malware payload (SilentBuilder)", "value": "dc798fe69c025fe6312a29bac275a97a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564220, "uuid": "2b59ac92-9023-4fcb-943a-6a853ff74232", "comment": "Malware payload (SilentBuilder)", "value": "01b1b1422edd22989696174bb4926d2f6b803b22cf5a1558a429d43e030a72e3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564220, "uuid": "62d9b8e8-c5b2-41e8-a9e8-1505b37be4d7", "comment": "Malware payload (SilentBuilder)", "value": "81bb9aa25c4b7ca6076abce0c201ba9aa25ad462", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564220, "uuid": "23fa03a5-d5f2-4122-87b4-1d47f2b89b66", "comment": "Malware payload (SilentBuilder)", "value": "7f5278897df4abe43026aacc3fcf742cdc0db8b7000b9e7703128d292d7d9c08453fc9a1506c60cdbd4d40d1f2d23468", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564220, "uuid": "80c5b1e9-2ce0-45fb-89b9-6404fd3ffd4b", "value": "T11E131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564220, "uuid": "1030372c-8c4c-456f-b916-a188154f525f", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564220, "uuid": "2a55e236-d6ea-4063-a525-365c6eaa48bf", "value": 45229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564220, "uuid": "0db551d5-723f-4c6b-8fd0-abab8ae1e1ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564220, "uuid": "a3fa576e-b132-48a0-a387-c1136a3eabaa", "value": "2022-1-27-dc798fe69c025fe6312a29bac275a97a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c79ed5-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574780, "uuid": "4d79ee4f-ca45-4a60-b34e-2344c3d53783", "comment": "Malware payload (SilentBuilder)", "value": "7fe0ca7eaf7d7ec5f52ed40a9d3d543d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574780, "uuid": "7578738b-ba46-4897-b850-9d8535af0eb9", "comment": "Malware payload (SilentBuilder)", "value": "01b1ea9ac3b90f77e9b9c71c45e0d4b7449fd803e64d9969a0d7cd51fed7ae7e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574780, "uuid": "97baa186-5cde-4145-8fae-66b8f4acbee0", "comment": "Malware payload (SilentBuilder)", "value": "ce67b65034efb5933a55b161a3c45e87d1728fe6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574780, "uuid": "d4378dd3-a283-469b-9a5a-c603295a3f9d", "comment": "Malware payload (SilentBuilder)", "value": "c2c7e976824462e5ca93143b77c671b0aeb20c42bd21f686b1f921e52aab749042cb8af7ef5e2f8b2315fa518448d39b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574780, "uuid": "f3f20b57-b869-4b2a-8ca0-1efee2b7de7b", "value": "T18A934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574780, "uuid": "40fa7027-28ac-44fa-a08c-cd2bbc2e2dbc", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574780, "uuid": "4d2a5d1b-ae99-410c-802b-348f8c9f44df", "value": 92209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574780, "uuid": "50195d47-4d97-4d8b-b9a8-1434d046d339", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574780, "uuid": "a6aded16-89ba-49e0-8cf9-3046962f0db7", "value": "2022-1-29-7fe0ca7eaf7d7ec5f52ed40a9d3d543d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff9acee-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643560820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560820, "uuid": "f4470cdf-a1ae-447f-bfe9-1dc205e0159f", "comment": "Malware payload", "value": "b89b42bb227bf7e4cf5e06b3f2cee1d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560820, "uuid": "d5f6b708-07e2-4272-acc3-d88e9b8607e9", "comment": "Malware payload", "value": "01e765078fb00560f2091713dec33c257b948cfc4cfd490be32ac9bd0b91b873", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560820, "uuid": "960fb90e-1add-4ff6-846b-312b19615e05", "comment": "Malware payload", "value": "dcb96cb65b27d34669debde4565cea164a7496b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560820, "uuid": "ae6053f7-36e7-4e96-9669-44bd863259f0", "comment": "Malware payload", "value": "ced964c97fd4b88d38ac81f8398c1e377b23ba21483ee7979e25e756bfd8422164c7124043c55f4d3b9087877321d900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560820, "uuid": "3f836f79-aef3-4bac-ae15-a886d7e59d44", "value": "T192830897B901EAB7F40ED77604D74B247230FB624E931A32731779A6AE362D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560820, "uuid": "2f02d950-af82-4390-a040-474edceb0285", "value": "1536:uoEA0hVJxW/93584AWzab0y79N1xK19OTetUvZOJifUImzS02q2/cOfBgj:/H64/Nnzab0y79NPI9+OJemu02q2EOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560820, "uuid": "dbdbb335-3a0c-4fc3-926b-31cac478dee9", "value": 86519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560820, "uuid": "ac1caf73-e096-4e40-a4f8-57345684a1f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560820, "uuid": "7eb04306-3910-42da-8046-320adad5a8cb", "value": "Demon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363f9f06-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569366, "uuid": "d1a98a7a-4adb-4b12-a3b2-6d0453366ccf", "comment": "Malware payload (SilentBuilder)", "value": "8791852b0337049a3d469165ec59767b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569366, "uuid": "77d53213-c22a-4b63-987c-e985a408bb51", "comment": "Malware payload (SilentBuilder)", "value": "01e7ae7b752a10457d5388732601019929f861c4fe6b05288970bf86c6643018", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569366, "uuid": "6b0f9625-e8be-4ea0-9404-9b52e8fc8d81", "comment": "Malware payload (SilentBuilder)", "value": "5ce30d2e5a9980b9e068b9f295aef3261f4debc2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569366, "uuid": "572c6fe1-e17c-4fe1-becd-19322b854973", "comment": "Malware payload (SilentBuilder)", "value": "2d619d5e0716a09d054c29dc11f7120ac392b9115623be32112145423350676f89391e29cb0a16f5dba679e931d81b9b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569366, "uuid": "56df85b0-7f37-461b-9fa8-08a1747fe428", "value": "T1D7839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569366, "uuid": "260cfa84-95c0-4411-8c84-680cc683d5b3", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569366, "uuid": "149d049b-be01-4868-8094-227371d78a66", "value": 87182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569366, "uuid": "33cc0511-e47a-4008-aa8c-44636227971e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569366, "uuid": "946b052f-5236-4e12-9ad2-3f347fd61e51", "value": "2022-1-28-8791852b0337049a3d469165ec59767b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9caf1ab-81fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567896, "uuid": "b3f66434-4196-413d-92ce-334bab2e623d", "comment": "Malware payload (SilentBuilder)", "value": "554ac75ed47d6c127eee09f6a8fe8cd6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567896, "uuid": "260ee2a7-db5e-4927-a6c2-4977acb4987e", "comment": "Malware payload (SilentBuilder)", "value": "02176c3305fc761ae5bc4e1755e11791f92ee69e05d5d599bc1789d43f8ce71a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567896, "uuid": "e854f22c-5dee-45e7-a32c-94b7b70d2331", "comment": "Malware payload (SilentBuilder)", "value": "a2a009b4bb00e96cece71fa4a475a51b2b164335", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567896, "uuid": "e8f2fa27-6a76-43b2-8180-547d23216a3f", "comment": "Malware payload (SilentBuilder)", "value": "5a2feb9c5e77daa7eef122276e5a960ca8365bdf5066e40f14938ea3c865c8422f215ee7705e8d2cb9e48ad7ae1619db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567896, "uuid": "81851262-3e24-4d75-895a-e1822d220d6d", "value": "T109839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567896, "uuid": "06eafffc-7cd5-47ed-a676-f763f2ec76ba", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567896, "uuid": "c157a98b-0344-44fb-a5ce-349825b89b35", "value": 86883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567896, "uuid": "4cd2454d-8461-463a-a034-b9b914b35061", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567896, "uuid": "5d17d43d-c0cb-4a55-ad3e-d9c198edbe8a", "value": "2022-1-28-554ac75ed47d6c127eee09f6a8fe8cd6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488d220a-8209-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643573692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573692, "uuid": "b4388859-7bda-4508-8458-593e7f88c6ac", "comment": "Malware payload", "value": "27b196d8a7855791df30c51eb22881a8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573692, "uuid": "2e9fd636-9c7a-478f-9d1d-78f7b034d417", "comment": "Malware payload", "value": "0251be2f44fb3fc8e0414cb199554bd116c7ccf9502a95a52ed4c85c22ad3d5e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573692, "uuid": "43ddd799-cf43-4d96-9656-8e0825bb0fef", "comment": "Malware payload", "value": "cdd4fbe212cb3382820c33231bb81f022778419a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573692, "uuid": "7f7447dd-1fd1-4778-a43d-8a8a695c7815", "comment": "Malware payload", "value": "11161d5821efcbe62bab2d46fd8b810b1fff2a8052498004bac9c1a03a1f94dfebee894a17c9d7e1b28a8d0f2f5f8379", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573692, "uuid": "ca020d21-da35-4921-b3e3-42be31a8a639", "value": "T1CA934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573692, "uuid": "b3332501-3fa1-491e-b737-dcaecd63622e", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573692, "uuid": "c2bdc112-97fd-4bcb-bb06-137cbf3a3f7c", "value": 92566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573692, "uuid": "f23131f8-eb05-4a65-9924-f7071ed6e2b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573692, "uuid": "b768e0a2-b079-47ba-a7ee-778258483002", "value": "2022-1-29-27b196d8a7855791df30c51eb22881a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543c95d1-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559109, "uuid": "f1459d36-dcc1-4dc0-a4d7-012209d1af49", "comment": "Malware payload (SilentBuilder)", "value": "0b51a149d62f62659a5a433aeb22c58a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559109, "uuid": "4c8b0576-e346-437d-b9fc-4f846fc98b51", "comment": "Malware payload (SilentBuilder)", "value": "025656a101ad81df4c4ade8c52bf705e36bc0363b58068648d1acba1936a30d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559109, "uuid": "1f489e51-aab3-4c89-b14a-0f1c335e7671", "comment": "Malware payload (SilentBuilder)", "value": "4b3826650c2a4431976b9177bf6ef6e3f308233d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559109, "uuid": "a24f509e-b029-4a4e-bbf9-3d638c8e27ed", "comment": "Malware payload (SilentBuilder)", "value": "6cf69043ea17726249df2cbd1b1a4c233b4ee85fd3abaa492737071d83858b6a06e8c32640f47a20cfdbc5e7d2ac60f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559109, "uuid": "fc12827f-e69b-45cb-915e-afc994dec418", "value": "T116F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559109, "uuid": "0b8ed6a6-6a9e-4938-9719-dc2932e0214d", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559109, "uuid": "da6b6a97-6223-4c76-b795-3e5991a6c84f", "value": 37149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559109, "uuid": "44587465-119a-4d61-a32d-0366f460c27e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559109, "uuid": "731195ce-f6dc-4217-a5ae-f307849b916e", "value": "2022-1-28-0b51a149d62f62659a5a433aeb22c58a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c8f781-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560749, "uuid": "bcc265be-7641-4124-9cec-074b3a26f681", "comment": "Malware payload (SilentBuilder)", "value": "6dcc139d5fddf7a40c7964c84b56e9ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560749, "uuid": "4f20865d-3cbc-4aec-8000-53ef581175b1", "comment": "Malware payload (SilentBuilder)", "value": "025ce3ed3e1900490ae2bdeb0746a6e794a6b75440f2eab5162dc9ef5ee54870", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560749, "uuid": "b70eaa0b-a5df-4363-a451-4915cbb4533d", "comment": "Malware payload (SilentBuilder)", "value": "637112e1bab477d178da3de5930699bda6c2a870", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560749, "uuid": "27a6ca4d-eac1-4a03-af4d-c249fec77bb5", "comment": "Malware payload (SilentBuilder)", "value": "561abb006dc920814bf2c06a049720c287731649539044a907114eba1df5d5ba0c3d34679f2ba8348761175f0b5a9074", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560749, "uuid": "374a73cb-4abf-40ee-9da0-49f1846ab7f8", "value": "T1BC735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560749, "uuid": "c75e06bf-9b91-48a2-b6c0-fe9dae6f73af", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560749, "uuid": "c6008193-ff1d-4a1e-934a-310e42a26441", "value": 78210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560749, "uuid": "a5cc430e-2075-474a-a10d-0bbe33199209", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560749, "uuid": "ac8d1c14-dd47-46ab-9a32-d25965ebac75", "value": "2022-1-27-6dcc139d5fddf7a40c7964c84b56e9ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cb6ed8-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563754, "uuid": "399bacde-9a04-46e0-b9ef-d24416757f92", "comment": "Malware payload (SilentBuilder)", "value": "d4bdbf72e9170a5b522f84d589234e1e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563754, "uuid": "f23df42a-7a6f-4e03-84b9-6745e3b54f70", "comment": "Malware payload (SilentBuilder)", "value": "028e0c760474f5d75d588c19245f9e19a1fe24f2638278860e4354b936c565ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563754, "uuid": "d04fb2a1-f5f1-46cb-87ea-900a0718afed", "comment": "Malware payload (SilentBuilder)", "value": "9bc9686343aed7ce0054d47869c27bc6364b8407", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563754, "uuid": "42d2a532-9559-4394-a6a7-afb04162ca1b", "comment": "Malware payload (SilentBuilder)", "value": "1947238f0f4734353ec320faf01ecbd3caa791e78f5ee60ebe4684e8f623aabf6e12e147966ead64af0e45d988fe0d29", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563754, "uuid": "22b9ef11-b71c-43b0-8fa9-f7b0c644463f", "value": "T1B8231953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563754, "uuid": "06a19070-5071-40ce-ba98-b4ebde61638d", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563754, "uuid": "8500612c-76f4-49f8-95fe-2ff4f53addec", "value": 45650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563754, "uuid": "210fc8b7-d851-400f-96d2-382c82deb547", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563754, "uuid": "a4af4172-a7fa-4d0b-a927-78438224e557", "value": "2022-1-27-d4bdbf72e9170a5b522f84d589234e1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee88a8ae-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561086, "uuid": "7e248493-78fd-4259-a430-83d4ffef5160", "comment": "Malware payload (SilentBuilder)", "value": "60db741bc723fd4f2fdb5c6b8f41ed0a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561086, "uuid": "ca7f0999-e612-4c4c-a44d-52053916fea8", "comment": "Malware payload (SilentBuilder)", "value": "02b9c11a42f94e7351bcd16d7871e5a60a9d2c3efcea47a252a7969343664a59", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561086, "uuid": "2559e703-8a95-4a1f-a2a5-998dc64e7150", "comment": "Malware payload (SilentBuilder)", "value": "0b43a36bcb455f06727d6b14bd90913e43a799ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561086, "uuid": "3f6e546d-1105-447d-96c1-4dd828a57272", "comment": "Malware payload (SilentBuilder)", "value": "ce2b4ef49585dbeabcdfa94b60c7292d3e87532a24e495a92e29841e9252f123dd760626d29538339f16f378b17192b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561086, "uuid": "0d9c62ff-f756-4fa2-a99e-940b334fd88f", "value": "T1B123B6EB77CB4C89EE29037A8DB247186753EC669BE357473205B3169EB0AC08D03917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561086, "uuid": "6507bd5e-c183-4e07-9ada-efa3d4de3ec7", "value": "768:cUFN4Yg+Hyms5k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZcj6ehEnB7qrFBJ:cd+Hyms5k3hbdlylKsgqopeJBWhZFGk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561086, "uuid": "7558587e-46f7-4348-8a30-819fc01d6e2c", "value": 48751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561086, "uuid": "2cf574ae-43cc-4b4f-b45d-7181566718d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561086, "uuid": "82cd0f0e-8327-49a0-b487-9560029fe331", "value": "2022-1-29-60db741bc723fd4f2fdb5c6b8f41ed0a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45649f91-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560372, "uuid": "3d22ffae-abce-43f1-9b5a-503c2b547cf3", "comment": "Malware payload (SilentBuilder)", "value": "b07c64eb52edf2f79cbf65fb4ba5867c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560372, "uuid": "a9fc6766-11c7-4d79-90e6-eae75e412970", "comment": "Malware payload (SilentBuilder)", "value": "02c147426556648fe3220cea41d843fa1aebdc4309668fe970f36b15dd4133e4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560372, "uuid": "b9801967-45e2-468b-ba62-f9819e58a3dd", "comment": "Malware payload (SilentBuilder)", "value": "a7195d48132081923bda47765dff398b32a8ff1b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560372, "uuid": "a644780b-28bd-44d4-a3ad-78b5b9d204ee", "comment": "Malware payload (SilentBuilder)", "value": "c25cd4730af82c0ae22260a7ec18ba11cd0b832c2ef97633cdfb8c4b781cdea296cb38758809c8d56009b08913b16f15", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560372, "uuid": "0e9cd05c-132e-40f5-8577-9734ce25f5d9", "value": "T120F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560372, "uuid": "187aeb1d-22d1-4bce-8c77-99d0224b86cf", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560372, "uuid": "621ad7a7-cc8e-4474-8b1f-d5ff903809f6", "value": 158251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560372, "uuid": "8ae65c81-78bc-4694-8f12-ee357e433804", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560372, "uuid": "0e711b7f-537b-41ed-a190-02b59ce5bbb9", "value": "2022-1-28-b07c64eb52edf2f79cbf65fb4ba5867c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8204665-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643556324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556324, "uuid": "a510d32a-789e-4fb0-8348-2c55154aa585", "comment": "Malware payload (Heodo)", "value": "29dabf1129549b6d2d884ef72a62b011", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556324, "uuid": "e2869267-4471-4726-938a-67da901aa8d8", "comment": "Malware payload (Heodo)", "value": "02c54943cf79d2b57e95a28e0e4a7e8becdbf0eb09f2788d0c8969fd6f48dc41", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556324, "uuid": "5c1a887e-be24-4fbb-90df-b2185b9800de", "comment": "Malware payload (Heodo)", "value": "c9eed0c7c69546fb0b96b8dc8502c73dcf46ea18", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556324, "uuid": "0a191664-c0dd-45f5-afc2-0b9f3bb9dae0", "comment": "Malware payload (Heodo)", "value": "58b0df7aff2cbd1bc335ad74c56618fe853a22f535461c9c09cd2f7a61fc06b72e91ab100f0bbff2b5bca0ea33455eaa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556324, "uuid": "619e5529-c8ef-4ebe-98f9-262be06f4393", "value": "T1B8E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556324, "uuid": "6e0224c4-8096-4719-a872-04edf9be8ba7", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556324, "uuid": "feea0708-aa55-48bd-b925-259378624c9e", "value": 147087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556324, "uuid": "f2453801-a723-4dd6-9955-fb3b3533453c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556324, "uuid": "fd0ecd1b-17fb-4f9a-a6c8-4bb05835fcbe", "value": "2022-1-26-29dabf1129549b6d2d884ef72a62b011.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285aec27-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561183, "uuid": "09df93ca-7cd2-4f8a-9253-f2dec052f2ac", "comment": "Malware payload (SilentBuilder)", "value": "7cb334c95a580890427a6288ff62d8ca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561183, "uuid": "a8a9bf6d-8ead-4c9e-91e6-99717bba9589", "comment": "Malware payload (SilentBuilder)", "value": "02cdcbd443bf78e2aec776de0db8a377145932263c4f0a60181924586e857c86", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561183, "uuid": "325cb56e-979d-4a88-8723-1c89a0a04639", "comment": "Malware payload (SilentBuilder)", "value": "9050decc517a64c58d3ec400a4686a3365401e7e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561183, "uuid": "f21eec8d-c0f8-44a4-a376-b9758cf97eaf", "comment": "Malware payload (SilentBuilder)", "value": "afc733dc93470bed585809f9fc2d334da3e6561ad46a0be7ef12a4d9958c1450047e14a87d52429bfe09611b6551ab49", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561183, "uuid": "bdef58b1-beec-4324-96a3-68ff1d81e19b", "value": "T13D735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561183, "uuid": "c8dc0304-d888-4f99-99d3-d05f9693ffca", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561183, "uuid": "13238f55-744d-4681-8855-910bcc2adaef", "value": 77598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561183, "uuid": "0940aa36-0e87-49d3-a8a7-2b498b360eac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561183, "uuid": "9a018d8c-fe86-494e-b94a-aa23dd16fa03", "value": "2022-1-27-7cb334c95a580890427a6288ff62d8ca.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e5395f-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643571064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571064, "uuid": "ba6e933f-ca60-463c-8460-cae10de9f3ea", "comment": "Malware payload (Heodo)", "value": "c7188e1a8b1810622a546535f3af29d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571064, "uuid": "1e4dc432-f45b-47a1-82c9-066d2ca9733c", "comment": "Malware payload (Heodo)", "value": "02d170ef3744665b6aee75d3a442eccd7a862eac30732af4a5a33a04d8830607", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571064, "uuid": "a063c707-0b1f-4e68-b591-f6e71661ae2b", "comment": "Malware payload (Heodo)", "value": "0bd760e9c8c7d5f74e967a0bcf4541eaa1a923be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571064, "uuid": "1b682592-94ba-47b8-a1a9-656f1c4e8691", "comment": "Malware payload (Heodo)", "value": "18ce00333799ae5a92ce9ccef23dafb0be996447499c758956d33c69f5d43902412d873da0165a593fdbc426171bd612", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571064, "uuid": "416e5adb-4851-4f04-89f5-4717f1283038", "value": "T14B839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571064, "uuid": "7df66499-e02d-41e4-88d7-08578cd2e761", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571064, "uuid": "739dba41-3329-4db4-8a26-c76c3871ccd0", "value": 87434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571064, "uuid": "0797b6d3-cf20-4704-9592-6800ef3ba9d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571064, "uuid": "3036230e-b1b1-4adb-90f8-52c21b99431d", "value": "2022-1-28-c7188e1a8b1810622a546535f3af29d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1712d978-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643568455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568455, "uuid": "196c6df4-ce34-4a46-8552-bd9516ee8cdb", "comment": "Malware payload (Heodo)", "value": "69872400af32a36efec5c2a3732abfeb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568455, "uuid": "e477bee2-9e4b-434e-9056-7139c4a0edf4", "comment": "Malware payload (Heodo)", "value": "02d3942995583a058778831ce3469f498c8c8080662a4a0e05ecf9de7f440dbc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568455, "uuid": "ecd29733-f7aa-4694-b16c-2224d59d02ff", "comment": "Malware payload (Heodo)", "value": "143c7473346eb0baa13794a8c5c55d407dbcd7f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568455, "uuid": "7c590231-4f3f-41d0-92f3-dc9a13f44496", "comment": "Malware payload (Heodo)", "value": "8a3c07957b470bc6957e1d1681ab8905c7d9ab63ed02b2fdf6e6fef80cc4196b59866b006053891fbda0603209cdc897", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568455, "uuid": "29d88431-0c00-45fe-9fc9-fd4c7c663473", "value": "T11E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568455, "uuid": "ce38db96-134c-4aef-a862-1aa6f4e7b601", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568455, "uuid": "caf2682f-5572-4809-96f0-0cb6bad18d57", "value": 86718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568455, "uuid": "91b550a7-1e67-4f5d-bc5f-4037df8ef086", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568455, "uuid": "61a47da7-c0f1-4a73-a799-6e0c236aaffa", "value": "2022-1-28-69872400af32a36efec5c2a3732abfeb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87360ffb-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567355, "uuid": "91e0ca0a-3014-45c0-a937-9133dd547ad0", "comment": "Malware payload (SilentBuilder)", "value": "43a7666dae199c9274287b3aa94b5bf8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567355, "uuid": "f8570eba-211b-419c-9ee3-711e5a225535", "comment": "Malware payload (SilentBuilder)", "value": "02f8e7f7d28592f18e144268f5088b2aa8342e5b2fec550f3911627373d1c610", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567355, "uuid": "68240942-fa10-4e3a-b4e0-190e5ba07cee", "comment": "Malware payload (SilentBuilder)", "value": "0f3aaf56e65bcd427966824047caf3cb2d16c1f4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567355, "uuid": "81e3b2c1-21de-4105-a4a1-7e89c73146f0", "comment": "Malware payload (SilentBuilder)", "value": "b9049459faa442771031a8c5779d8d83f8881733e869abb4d44f0cb286ef401b434520ed42b3d4ef6a31d35524c9cff1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567355, "uuid": "abeee998-6e45-4621-930a-d86be97f2750", "value": "T17C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567355, "uuid": "9009620b-c0a6-4b0f-b6b0-0bb633a0bd08", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567355, "uuid": "fb26becb-add2-457c-ba99-c1557d6cb06a", "value": 47825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567355, "uuid": "16858424-ea7c-478b-953b-f88a366a22b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567355, "uuid": "7d9587f3-8b68-4571-8f03-d5f548780de7", "value": "2022-1-28-43a7666dae199c9274287b3aa94b5bf8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e920f2-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567104, "uuid": "fc3eff82-82f8-450d-b178-addbe3e17079", "comment": "Malware payload (SilentBuilder)", "value": "3842a1ac92b5680104db9c4eae34d605", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567104, "uuid": "b4ba250a-ac40-4c42-8455-4ea5a2779ff2", "comment": "Malware payload (SilentBuilder)", "value": "03003e7186e5f802ee3366fb65c07ddebe63e7f394e30843472d809a332e7d7f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567104, "uuid": "b1a0cd5c-505b-4246-8304-79763eac6e69", "comment": "Malware payload (SilentBuilder)", "value": "4ccccef107033ac25a0c586e1d6a1cab86b4acbe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567104, "uuid": "89a19b79-6d60-4a92-a744-4d3d6193948d", "comment": "Malware payload (SilentBuilder)", "value": "257123b0512aab5786ab57ef359827c61a50f0ce21c172d72d2d5b0b46378c7306c303ff6554e77a0889bea5d2ba3e5f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567104, "uuid": "9a1bfbdc-9a72-4ca5-b006-f448bbb525bf", "value": "T142839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567104, "uuid": "a33e084a-b705-401e-b9be-b3bcc90215aa", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567104, "uuid": "8db96220-7847-486e-add0-d334bb7dfe3d", "value": 87368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567104, "uuid": "4b846799-fd7a-4d67-8492-c8658d0fecd4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567104, "uuid": "8a4915d5-de44-4185-bbaf-3b0f641cf9cf", "value": "2022-1-28-3842a1ac92b5680104db9c4eae34d605.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52783fd0-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571991, "uuid": "35ac665d-03d6-49f3-aa15-11be1f0b2e4c", "comment": "Malware payload (SilentBuilder)", "value": "df97432187b194e1eee196a5862e3072", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571991, "uuid": "05a547c2-acf1-4cac-91f7-22d356e8efc9", "comment": "Malware payload (SilentBuilder)", "value": "030e641ddf1ff8f84dc5864bb012d3cd2627ae6c4505142ebec758fde6001586", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571991, "uuid": "b1302719-d701-44fa-bd8d-9cd942d90630", "comment": "Malware payload (SilentBuilder)", "value": "568e6593c16cc469205ec31546f4b852f8e1a857", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571991, "uuid": "83947ed8-e1f3-47d5-8642-2c5dd9ec4bdb", "comment": "Malware payload (SilentBuilder)", "value": "fa11bd7630be55c800b23953372d14be13454fe59ce94d33e6133fccf24a5227a29f69a7c153c36aaca147fc0bd6a841", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571991, "uuid": "e1cbb9d7-999c-4d45-be51-4fd96c354bcb", "value": "T1CFF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571991, "uuid": "9aee6d47-13a8-42ce-8f01-8f1e8e4196fc", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571991, "uuid": "69fdab5b-aa38-4fcd-8d01-ff4ca66ec864", "value": 158288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571991, "uuid": "7ba768be-5d1a-4da9-adf6-04dadb760a24", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571991, "uuid": "1d2f2c8c-12b7-4e14-83b5-c9a85261ccb0", "value": "2022-1-28-df97432187b194e1eee196a5862e3072.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7677a992-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558737, "uuid": "2dece87a-e5ee-44d7-bf80-65d65c951c9e", "comment": "Malware payload (SilentBuilder)", "value": "31da93a1388b93cf4c9f6cb6238d1847", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558737, "uuid": "fe80e2ba-ca8a-41de-a62c-0cc0101b20bc", "comment": "Malware payload (SilentBuilder)", "value": "034c0595372fa93b71298d0fe6c3e671e54a956a18447d1ef00f04b16790f2ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558737, "uuid": "fc92a45a-7fcd-464e-a76d-7d2bed883f0c", "comment": "Malware payload (SilentBuilder)", "value": "c4f3269c761fe9140ec11c591dc1783f1aee1b5e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558737, "uuid": "0d1bf2e5-5fcf-4636-9b51-33010c998791", "comment": "Malware payload (SilentBuilder)", "value": "5cf1dc3d791c20e4e8988651f56b373383febe862635464c0f13c33d783bd1605666a6120f5f3c11a39eeeeb5464bfe3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558737, "uuid": "4193c6e2-f95a-4c67-b2d2-ece7bb6c497b", "value": "T14B131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558737, "uuid": "1730715f-cd08-4255-8b2f-4bd7c3977a72", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558737, "uuid": "a34bbc5d-e5e9-49e9-8552-ae62dbc06063", "value": 45183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558737, "uuid": "2cd49af9-db9b-4c65-b986-789d55dcce44", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558737, "uuid": "a541c254-13ca-461c-849c-ca02b9f33fe9", "value": "2022-1-27-31da93a1388b93cf4c9f6cb6238d1847.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67360340-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570737, "uuid": "46199d68-70b4-4724-a48f-0293191c5de0", "comment": "Malware payload (SilentBuilder)", "value": "b82bed88bbe5fc5206c88ef97e3c72ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570737, "uuid": "ca338ea7-c694-4ca4-aefe-bdd192b41f79", "comment": "Malware payload (SilentBuilder)", "value": "038605cabff6a612c106b911ed0ecbd175d251aedaf9df3dca399eba50fd902b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570737, "uuid": "d2aa11bf-f6fd-4f7a-a0d5-f89cab759ed6", "comment": "Malware payload (SilentBuilder)", "value": "7c37c945ad20137586fd0445c8116b351e8bd9ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570737, "uuid": "7d4a3b06-c2f6-4b43-905d-d2763d137165", "comment": "Malware payload (SilentBuilder)", "value": "9283fd4be967a4f7226d53ee86f86004342a5f55523ae2afcd6fb122e88714f6cdcaee5e2083ab88129af39c3ff59db1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570737, "uuid": "82c0266d-31c6-49fa-853f-a8a4d5a10c02", "value": "T187233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570737, "uuid": "5af51c61-dd01-471f-bd7c-d19d459b7321", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570737, "uuid": "9365bbbf-7105-4292-ae0c-e4870a115663", "value": 48267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570737, "uuid": "917b50b1-c83a-4ce8-b321-54472e896dc6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570737, "uuid": "649bab6f-83bc-4008-a383-fae567544b62", "value": "2022-1-28-b82bed88bbe5fc5206c88ef97e3c72ed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c47c41-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570540, "uuid": "004f3694-ef1f-4c44-b25f-b5cdc82be48e", "comment": "Malware payload (SilentBuilder)", "value": "b219b02cb056825f987ca6784bcfba51", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570540, "uuid": "9ea59b37-94ec-433a-98b1-f355ae8e88a7", "comment": "Malware payload (SilentBuilder)", "value": "03b4e9481ca495d1daaadb038dd3d20ca467467d24625234c9c50720f92c2047", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570540, "uuid": "772863d4-c357-415d-b5a5-8ce03cb0fbd1", "comment": "Malware payload (SilentBuilder)", "value": "9e77b7d64a81c49b5bbe565edc798b6727895eeb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570540, "uuid": "b831a13e-d621-4349-b2c2-85e8e9c0f693", "comment": "Malware payload (SilentBuilder)", "value": "c8079cc97c7f249f22004f936d661c5073b3fbaf339a70fb00cca899da8ef1986f99c18ede4c1fa6816d7a2ecebab8d7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570540, "uuid": "48cfb086-c90d-4b2e-90f7-142b2b5f09bd", "value": "T183233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570540, "uuid": "84c9ecb4-6b9c-4206-a522-616b2dc1436f", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570540, "uuid": "bae0ccff-967d-4344-93e7-6138bd9dea9d", "value": 47829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570540, "uuid": "dc5198f7-1aaa-4df5-b8fe-0613590af419", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570540, "uuid": "cb36b6e9-42e0-48bc-9162-2ab887ab67b7", "value": "2022-1-28-b219b02cb056825f987ca6784bcfba51.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acafd901-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572142, "uuid": "2104faf6-dc41-4b01-a393-0f3675b47c45", "comment": "Malware payload (SilentBuilder)", "value": "e40b71415908cb167527b7f6468f41a4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572142, "uuid": "2687fdb2-d67c-439b-83a6-a9b4db64346c", "comment": "Malware payload (SilentBuilder)", "value": "03d7dbaf2f5e5d395c97431e2a19e44cb521f0640c2821fde2f8633c0368b707", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572142, "uuid": "ad499c8f-a506-43d0-8740-d28f1b659fd0", "comment": "Malware payload (SilentBuilder)", "value": "9a939c93ee56d8043ecc061354ee99f3b58d6ae4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572142, "uuid": "876a38ea-9595-4031-8a22-83fff36d3c0a", "comment": "Malware payload (SilentBuilder)", "value": "e552bc1213bc427387dd55ec91fb9475b678af0ba95fbd3435f87223365780715f3bdeb090c433fcf0b52a14a779336b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572142, "uuid": "9b2b5e68-8d93-45fa-aa33-719a63659a64", "value": "T1EB233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572142, "uuid": "af7b2cbe-e31e-4047-9491-a5fc3c2c52bf", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572142, "uuid": "e6b5abdf-ee0e-486b-9b20-58649d174126", "value": 48170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572142, "uuid": "66ee9359-d64e-41d1-bfa6-9702f4e0d2d6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572142, "uuid": "bed6f83d-418a-4e0a-a638-45a8c6725b95", "value": "2022-1-28-e40b71415908cb167527b7f6468f41a4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67bd660-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570118, "uuid": "f922f0dc-2a1e-44e2-80a5-177784f64aee", "comment": "Malware payload (SilentBuilder)", "value": "a4fa5dca2020894fbb7b7e4b98f3cd8b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570118, "uuid": "58a50005-efb8-4db1-99e4-3edb1a319be4", "comment": "Malware payload (SilentBuilder)", "value": "040fbe0cd3f34078785681dd77f94db8b4eec83437f9efc2f2aeab057de306c2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570118, "uuid": "50e37682-cb50-4d6c-a0a6-31e0159ee91c", "comment": "Malware payload (SilentBuilder)", "value": "651e694d4b8754bed88f693a3b1f05ed3dbbf0c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570118, "uuid": "1cea12f7-a0ea-40fc-814c-9361ddc7ae13", "comment": "Malware payload (SilentBuilder)", "value": "35884acb02b1c5b4713d47bb1eb4fec45060ba2882ac7cfd64c2b4747decdad9f799f80cb1687b06f34e33959dc04a04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570118, "uuid": "2522e6b8-ef1e-4aad-bf1b-6c2a816090ed", "value": "T1C2233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570118, "uuid": "2cffd50e-17d8-4134-857b-d1f6532193dd", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570118, "uuid": "2972ced2-1e8f-419d-a6e8-d52a0fcda52a", "value": 48506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570118, "uuid": "56f09524-79ee-4e9f-a07d-c273ffdf340a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570118, "uuid": "e691052e-437e-459c-85a2-902a62a7964e", "value": "2022-1-28-a4fa5dca2020894fbb7b7e4b98f3cd8b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d74c5d-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561153, "uuid": "a2bcaf41-cb9a-40b1-ba1a-47d16db4d407", "comment": "Malware payload (SilentBuilder)", "value": "d2e9938953eaf18e6b0ed9e14bf62b50", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561153, "uuid": "1bb9fc1d-4589-4654-be10-a50767e04ae6", "comment": "Malware payload (SilentBuilder)", "value": "04211e6811a9b3b9bf71f9eb8937da01b2f6c72b4db4a4da993ee8265c0a0276", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561153, "uuid": "6a36f411-4ada-4aa0-9e58-dc4560339a9e", "comment": "Malware payload (SilentBuilder)", "value": "f1b72a767f7868a258c46bda221f7a3cabd3152d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561153, "uuid": "5f159800-6023-4494-913f-aab79c37b358", "comment": "Malware payload (SilentBuilder)", "value": "4e3fb82262dc5a396355a9e378bc4f30b8ba2069aadb0e823127d491092444ce774907e617d64df73201ebea5ad9a8c8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561153, "uuid": "502e737a-f5c3-4234-98d9-43716b3221a4", "value": "T15523B6EB77CB4C89EE29037A8DB247186753EC669BE357473205B3169EB0AC08D03917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561153, "uuid": "2c9b0845-fb21-4bd6-9eb8-a7285b12294f", "value": "768:cUFN4Yg+Hyms5k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZcj6ehEnB7qrFBJ:cd+Hyms5k3hbdlylKsgqopeJBWhZFGk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561153, "uuid": "c9e820de-4100-4075-a6ec-c3c2d71bb003", "value": 48277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561153, "uuid": "8b96ee1e-a548-43c3-95ee-47f1e1570e4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561153, "uuid": "50285fd2-168c-4797-a729-2ea6b0405a47", "value": "2022-1-29-d2e9938953eaf18e6b0ed9e14bf62b50.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e91721f-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566535, "uuid": "c94d54f9-add9-4ae8-9fea-28fab3182059", "comment": "Malware payload (SilentBuilder)", "value": "25d7191b483d7a716bf680f30e6b22e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566535, "uuid": "cfbbef6c-dc36-45b0-b239-5b73dcf73c34", "comment": "Malware payload (SilentBuilder)", "value": "0423542ccbdd2fd836a77d71b0e3485ca8184befdbf038a605063cbb4a9b91eb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566535, "uuid": "db29a481-2a44-4d14-ae01-b62a160b8ff5", "comment": "Malware payload (SilentBuilder)", "value": "b16b43611b564762b78d380b6bca13bf252da8fa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566535, "uuid": "6fce8485-202a-4d8a-825b-b47a221890b3", "comment": "Malware payload (SilentBuilder)", "value": "0778f41a4798f513dc1d6c7fa98e4676fa5972a9a6bca505ebec07cb56060b0ce3be78a72b6299f636f48202220c00ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566535, "uuid": "94fe3c26-75c1-4e97-a65e-2943475b9d8c", "value": "T185839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566535, "uuid": "66080ba9-5bf2-45d2-827e-11bdcaac5e15", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566535, "uuid": "15b27b96-559b-41d2-a2ff-c3b218e765f5", "value": 87166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566535, "uuid": "687ad3d6-363a-4dba-9df6-e84c7657a003", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566535, "uuid": "51f9c147-f0ef-4fbe-9902-04377c80340a", "value": "2022-1-28-25d7191b483d7a716bf680f30e6b22e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79dd68a-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561906, "uuid": "961b3daa-1e0b-48e8-bd65-b07f445cbe97", "comment": "Malware payload (SilentBuilder)", "value": "9688acaa3c1c40deb642360fb1bad1c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561906, "uuid": "3c5f030d-39ae-4305-9104-ed8be28d5fc3", "comment": "Malware payload (SilentBuilder)", "value": "04323600c8d999542e12a7dc8ed60d693934edf5caa464cf9b9c30b16d741d5d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561906, "uuid": "681e31c6-e7af-4569-8c12-e15731bc67ad", "comment": "Malware payload (SilentBuilder)", "value": "b8ea07ae0e819eff554332e6aee8e988c6201dcc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561906, "uuid": "65c8795d-3fcc-41b7-ab03-7fba8b54f2f3", "comment": "Malware payload (SilentBuilder)", "value": "9cfe0a24b8ee2185d1621bdf523d27b8639058cc151042126b9623b34e85cd96c99d4e0e83ea18aba8886e00bf80d560", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561906, "uuid": "a847cdfb-ea94-49c4-a6b6-3bbc30b5bed5", "value": "T171735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561906, "uuid": "b2da29a3-1808-4e1b-a459-cb68dab7357b", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561906, "uuid": "454159f5-1111-451a-b489-21a1e31561bc", "value": 78293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561906, "uuid": "fe144642-0cf7-49bb-ad0d-99da89e0260c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561906, "uuid": "f56c96dc-8c0a-4a22-bd69-18376c65506f", "value": "2022-1-27-9688acaa3c1c40deb642360fb1bad1c0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62043ff-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566655, "uuid": "108d1447-7f60-413b-a849-b893a4f4f25d", "comment": "Malware payload (SilentBuilder)", "value": "2857ebed144321097330ceae91d8a5ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566655, "uuid": "0fe507b1-77ad-428c-a86a-65c1490bb197", "comment": "Malware payload (SilentBuilder)", "value": "043e3189db2138dbf17fd89d4bcf9c62ee305871bbb07877fc20a2e867e70f6a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566655, "uuid": "9368f462-44e4-4fc2-a202-e6b42c937692", "comment": "Malware payload (SilentBuilder)", "value": "6fa82aace8704ca8ec5a3a7e30fccd3938a82aaf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566655, "uuid": "48736412-8081-4d05-a134-2c6697574eb7", "comment": "Malware payload (SilentBuilder)", "value": "d82bf909fdf98c8895d56dfa1a00b4bd378d89ceefd3190dc57d02f043d093f29e930bf833c193a5824ab29981791d63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566655, "uuid": "45ba2532-9973-40df-83c3-0c64a8d1ba47", "value": "T1B7839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566655, "uuid": "7d5203bf-df7b-4ed3-87eb-b1721b1a4156", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566655, "uuid": "61c55c5c-adde-49f0-8674-9453b8f8d248", "value": 86585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566655, "uuid": "169024c3-9dae-436a-b53e-38a63ef0861c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566655, "uuid": "43bbbd38-d7df-4e0c-882e-aa8f59999d6c", "value": "2022-1-28-2857ebed144321097330ceae91d8a5ac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d82d0-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561935, "uuid": "208355b4-dd73-49a3-abd0-683ac64c5616", "comment": "Malware payload (SilentBuilder)", "value": "985f5bcc59795f0bd22950066665bf8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561935, "uuid": "e179e705-32bb-4967-ab3f-d830fcc0b08a", "comment": "Malware payload (SilentBuilder)", "value": "0447b87324592633b89d8be22ee2ca6b1df806d13d9a0d96d89976f59ef01f0c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561935, "uuid": "ffd6e47f-176a-4145-a822-55aabc0e3b2b", "comment": "Malware payload (SilentBuilder)", "value": "ffd753e8dd747c763d17c7a1afaf8bb1e48c68b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561935, "uuid": "938ffb69-f87e-4c2d-94f2-318e2f2d67dc", "comment": "Malware payload (SilentBuilder)", "value": "5c03c149164ab7556d71fc5d4d537f34677a63dbe5a434280f81cdfb79a69303a885a1462aa5bddd5949698bc9cdf413", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561935, "uuid": "0b3c24db-a70e-43df-b656-3450d7a62b38", "value": "T1BF735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561935, "uuid": "73532cc1-f494-4529-88ad-966e930a80ac", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561935, "uuid": "fab069b6-1832-42b4-800e-ae9432a195f1", "value": 78048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561935, "uuid": "f780c6de-bae1-443f-81ad-ecfc16247e47", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561935, "uuid": "77edabd2-dee4-4e68-be26-4cbce1140ea7", "value": "2022-1-27-985f5bcc59795f0bd22950066665bf8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf8af1e-81c0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643542643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643542643, "uuid": "6edfc0cb-d941-4d80-893b-5614552e27ef", "comment": "Malware payload (RedLineStealer)", "value": "49b46a724177014d2dcc43cbdc1586f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643542643, "uuid": "fec42cec-e0a4-40cd-a93e-7a7accf90d15", "comment": "Malware payload (RedLineStealer)", "value": "0456056c570a6e91167dbbcf46a074d6cb2ba1d11f8913cbc58c31ea0e641be6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643542643, "uuid": "e29c67bc-a7fe-45d0-a7eb-97b10ef03aea", "comment": "Malware payload (RedLineStealer)", "value": "443e1ec35d4878f30f67ceceeb786b69600bd984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643542643, "uuid": "f75467ff-a741-4761-9d7b-184ef3408cbe", "comment": "Malware payload (RedLineStealer)", "value": "624ecd7b52d8bb840eb08b533ee631c257e959cd2797c94d4e9f2a8e783206cf25e591fbd1abd9c0f60054427697f18d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643542643, "uuid": "48345d64-d4ae-4bc8-ba1a-98f94d21c3fd", "value": "T1CBA34A9427DC5620E2FE8F7568B821A443F0F5076402EB8F9DC960EA0F76B80E6567F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643542643, "uuid": "e7403e84-21c5-4eee-a457-d40824b2da40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643542643, "uuid": "e19c1561-ffa5-4903-99ce-aec55fd75ed1", "value": "3072:kGUUJZfCuYt0lLOBfyXgyEzLRz0TyckXbvVT:kGUMMYEztz0HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643542643, "uuid": "8baa00d2-120e-4c54-8f6b-fb2846e7f0e6", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643542643, "uuid": "72589b02-d1ac-4f16-87b6-82c3c980e334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643542643, "uuid": "ade7ca1c-843d-4f08-8b32-45da45e4f5db", "value": "49b46a724177014d2dcc43cbdc1586f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412fe87f-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557788, "uuid": "6461b251-2930-48da-bef8-215a47daf7f2", "comment": "Malware payload (Heodo)", "value": "a112d7664e2e87ef006577bafed2473c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557788, "uuid": "7c2fc0e6-6cb1-4f20-866d-9850cce2de1c", "comment": "Malware payload (Heodo)", "value": "045f9ae4de33a271717eda3a3d052ae8347a3896843c93d85d8bee8388371702", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557788, "uuid": "acd99b85-8815-4977-8fbb-dbf874179381", "comment": "Malware payload (Heodo)", "value": "f7c1de5369c26ecc8836dc6e27036c7489882063", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557788, "uuid": "168ad3b0-c079-4fc8-8a0b-f3e7bd6606dc", "comment": "Malware payload (Heodo)", "value": "ee85a06ceaeaf03d91c7feb925a2544bf5d223d7a93058910f315d77d10d128e41d888e26078fd5824bf2bfc3b8194ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557788, "uuid": "efbed972-159d-40e3-95a0-169c30fd275d", "value": "T1CFE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557788, "uuid": "36092f9b-69ed-4fee-b44f-ad8278c29cac", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557788, "uuid": "db1c901d-17f7-4592-bf70-7d1ed566cb7f", "value": 145822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557788, "uuid": "f440a50f-834f-4050-a974-81a3b3172b53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557788, "uuid": "d464d832-d8fa-4ae7-b90c-313926d4dcad", "value": "2022-1-26-a112d7664e2e87ef006577bafed2473c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90686d41-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558351, "uuid": "c2238d44-456f-4b94-8368-1e8624245668", "comment": "Malware payload (SilentBuilder)", "value": "25067942f3f8e8e990ac61eea142de27", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558351, "uuid": "47f41612-e8b9-43c2-82c5-81658bce2f3b", "comment": "Malware payload (SilentBuilder)", "value": "048351227513cf24d40af90541e2527be4bf041e77d8b9aa9c47a7f318f1f288", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558351, "uuid": "544c8e7f-8833-417e-9c7b-da90bc622074", "comment": "Malware payload (SilentBuilder)", "value": "60ac6a7371eae8d48e2fee8dfc4a92217afe92cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558351, "uuid": "ed34cc26-7d78-43f9-b1a7-28102429f12a", "comment": "Malware payload (SilentBuilder)", "value": "7ad615a208637ddb63edcf4fca71afef7c19dd74e33584d478b5739b40c89c236d0278f635959bf5ed34f20bee979bea", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558351, "uuid": "2f9650e9-4e5e-4e2b-bd47-8bdacf97764f", "value": "T138735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558351, "uuid": "bdce7340-b379-4766-89f5-d4129ef750d6", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558351, "uuid": "b4f2b8d1-30a3-4d2f-8fde-e503160fd6dc", "value": 77348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558351, "uuid": "ad8e4446-4876-47d9-8f1d-28400eec8ff1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558351, "uuid": "76d6fc9b-0d57-4724-bf37-14f2168979ee", "value": "2022-1-27-25067942f3f8e8e990ac61eea142de27.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b24be9-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576209, "uuid": "254905f3-c819-496f-ab89-ee5ac63ba720", "comment": "Malware payload (SilentBuilder)", "value": "eb3a90428a953ba0129a378cf7a0f668", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576209, "uuid": "a39e6877-7233-4aba-b4ae-988e0241237b", "comment": "Malware payload (SilentBuilder)", "value": "04b60f40fba24165345a842554132a3fdb21f7d0be2a3145c328f2f54de50b26", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576209, "uuid": "f92628c7-b797-4180-b633-2ab9bfdf25d9", "comment": "Malware payload (SilentBuilder)", "value": "b5638284622deb3f713e3b9f719e4604689d70cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576209, "uuid": "24791530-dc27-47b5-bc1e-60cab0af1fcc", "comment": "Malware payload (SilentBuilder)", "value": "320e1ac9815071190e07f3107efa42e9e8a6bf46794f8060dfd1f129defc5d2fbd43eff7c2e0754277fcb5706249619c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576209, "uuid": "097c2491-066e-458e-ac53-c52272d12fb0", "value": "T18E934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576209, "uuid": "699fcd18-6691-4cb2-8d66-5b401605cc8d", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576209, "uuid": "a7f6eb98-3ce3-4b8d-b0ce-acecb9fb602d", "value": 93217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576209, "uuid": "bf285851-3363-4935-9b1b-b47058ffe269", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576209, "uuid": "05bb8c6b-5c63-45c6-8392-702ab7cde9c0", "value": "2022-1-29-eb3a90428a953ba0129a378cf7a0f668.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b228b24-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571468, "uuid": "76d24e8c-7ec4-41e8-9eb6-aa4df2d742e9", "comment": "Malware payload (SilentBuilder)", "value": "d07cce5f21ff9bbf48ef21f5fe6c6c7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571468, "uuid": "46182791-9cba-4b6f-aae5-132abb6e584a", "comment": "Malware payload (SilentBuilder)", "value": "04bacaca7b1828bd8ac6c6fe99839201d0ae7ba040308af4db52d64d66ad6fac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571468, "uuid": "1fc59e2f-3847-4d47-848c-f69d576e117d", "comment": "Malware payload (SilentBuilder)", "value": "9e0cd13c4e9803a627d7072dbc862285e44b4109", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571468, "uuid": "7b3e6350-9cbb-4cf9-91f8-9fa1cce61f21", "comment": "Malware payload (SilentBuilder)", "value": "b8c34d444ec39e65b043d751ac76198040f95c62279fbd345dfc8847f86f375f4f58b5dbd1872084ab926a838e78f0f8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571468, "uuid": "d74be4ff-8b5d-4458-a120-45c874b1857c", "value": "T187233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571468, "uuid": "c98b1639-ca64-4fda-bbab-52ea15159b2e", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571468, "uuid": "c85c536f-e737-4a37-8260-3963e70b1ea6", "value": 48327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571468, "uuid": "c3979971-699a-40d0-9db4-048bd3d41bab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571468, "uuid": "90b426f8-acbb-4a83-b369-db7a7cc86b64", "value": "2022-1-28-d07cce5f21ff9bbf48ef21f5fe6c6c7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50efc770-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643559962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559962, "uuid": "2a03664a-a13d-4cfc-836a-333ae4bd85f4", "comment": "Malware payload (Heodo)", "value": "564119b811bf5d9adf5de6b6b585ea0e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559962, "uuid": "44917966-de8b-44bf-a75a-d73568e92580", "comment": "Malware payload (Heodo)", "value": "05056954c3e92416c4ec0024599abd48b5d46b9edb50f7b3c3d4a906904f3dfc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559962, "uuid": "dad3bc1b-5185-44a7-8be9-77ecc25e24ea", "comment": "Malware payload (Heodo)", "value": "3e601beef008aa1a4497c8cd5a9786bab1c4ed22", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559962, "uuid": "cca5a63d-cb3a-4b91-9a9f-973472aa285a", "comment": "Malware payload (Heodo)", "value": "fac97f3f3de45defe2090b7c2eca6e7a235a23954688c1e164f06372aaa30dad8a069a42e2d230c1cda1b1ddcd00a0cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559962, "uuid": "9c70665f-f079-4547-b2d3-02e3d93019fa", "value": "T127735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559962, "uuid": "eac0fe87-6144-47fc-aa13-21151e80ea86", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559962, "uuid": "3b6c53d0-9cb6-47bf-9bd5-793abf14fb7e", "value": 77386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559962, "uuid": "c6842119-9249-46ca-9ced-a4c60c6c656f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559962, "uuid": "3906a003-b49c-4499-98b3-3cee1332ab7c", "value": "2022-1-27-564119b811bf5d9adf5de6b6b585ea0e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c0df95-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1643560796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560796, "uuid": "52b373c6-7f50-4b48-9e93-759fc2918ac0", "comment": "Malware payload (Gafgyt)", "value": "89adb06cf27988f37e2c8bfa53f3b8e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560796, "uuid": "a94f0926-6984-46ce-aba2-2edc4ceaf071", "comment": "Malware payload (Gafgyt)", "value": "05243c7a9e18925c0a76ccc84a4a43a78df4171c79fd5c891a26a06f7d2ae895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560796, "uuid": "13e030fb-84a7-4efe-bc9a-b3544c5c2ab1", "comment": "Malware payload (Gafgyt)", "value": "a3b23883b28a471a0669bca616f175ae8a3e15f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560796, "uuid": "800b1215-b095-4179-84c1-6d627769dbc2", "comment": "Malware payload (Gafgyt)", "value": "28fee06e1b1d061c6a177c9ecdeba0b31c271103751d95c88565b8f6bb6e9c29f673bd18c0da78058812144f3b5d1e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560796, "uuid": "c140dad0-891d-4bca-9c12-3b04709a74cb", "value": "T153830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560796, "uuid": "def1dd81-b55c-42a2-8a49-625a7b32b7df", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1T8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3Z8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560796, "uuid": "ede1ac26-6caa-4510-833b-db38892acc07", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560796, "uuid": "118b878d-3dca-4b77-9184-3c8623909032", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560796, "uuid": "db322f53-5f6f-4f75-8690-5dba5cce933c", "value": "Demon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b338d795-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564852, "uuid": "bcb78494-34d0-40e4-afb1-c5a8a9db6bc3", "comment": "Malware payload (SilentBuilder)", "value": "f4c6fd42d7e808dfde0961451dcf96c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564852, "uuid": "4cabd278-fc4e-49b0-83c8-6de3823d618e", "comment": "Malware payload (SilentBuilder)", "value": "0529b4cf3b51bf195238d476e8d7aadbf6aeede38772e511483095f4d548ee78", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564852, "uuid": "cf19c3a3-97f2-4dcf-8d2e-90c50ce433ab", "comment": "Malware payload (SilentBuilder)", "value": "49f48a90a9ae94380f5523a7ed41815fdb302ad3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564852, "uuid": "da9062e0-fb34-4f60-b941-c1f91093d206", "comment": "Malware payload (SilentBuilder)", "value": "882de9475e32976d521f2a7114d97f401e7523ea7ff6047f1a2bb9f4c24c77c8d5904b1ea2d5b42088ea370955909b58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564852, "uuid": "14086ed5-5812-4594-9904-a219b717ea8f", "value": "T127C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564852, "uuid": "eb580c1e-881c-4ebc-ab4b-37a0248c9a48", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564852, "uuid": "5f8b461b-4bc9-4ba9-ada8-e5f9f76db977", "value": 118288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564852, "uuid": "eb26d78d-1c6f-4d06-bf58-ec80a555a511", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564852, "uuid": "c3db6a08-c5b3-407b-a866-19a365e2d143", "value": "2022-1-27-f4c6fd42d7e808dfde0961451dcf96c3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0c17ce-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561320, "uuid": "667e8329-29f6-4812-98d6-2a635de60819", "comment": "Malware payload (SilentBuilder)", "value": "7eea1058664ae83e7e35d14fc8f43b0d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561320, "uuid": "056fa2f1-017d-42d7-bfa1-98b0bbcc7b85", "comment": "Malware payload (SilentBuilder)", "value": "0536579e868e4eb5e6b8ec591477b87bcaee4c02b4c40a46b5601766641ebe49", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561320, "uuid": "dd3614c6-3029-47ad-8bc4-a4859da28343", "comment": "Malware payload (SilentBuilder)", "value": "e15dc613063160c57b665a646c0e458fe90a6a41", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561320, "uuid": "6fbbac78-d91c-4ec1-a651-a3384dcb6f28", "comment": "Malware payload (SilentBuilder)", "value": "9fb36e7549a23a46fcdb29f68f6ab2d51aef2398131ca57833339d83f560bae29baa15596df2a2803a43050c33f41b82", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561320, "uuid": "21ada9f1-3205-4c2d-96b3-a9b4e5a186f8", "value": "T14D735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561320, "uuid": "97398281-ef39-42ed-9e7d-94bed6da76f5", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561320, "uuid": "3e18c227-dd6b-40a3-a64e-b867f85b79c2", "value": 77603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561320, "uuid": "e932e64b-9899-4d69-b8a0-5a0c44f7d75d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561320, "uuid": "fe99962f-8383-4f90-8bbd-4a8ee01306ef", "value": "2022-1-27-7eea1058664ae83e7e35d14fc8f43b0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c749691-81e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557324, "uuid": "35d42227-2f56-4d3c-8c0c-f57a10709da5", "comment": "Malware payload (Heodo)", "value": "737aabd46f82d4d0fd23fa167c0bc390", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557324, "uuid": "470af166-0b84-421c-b224-d2dc64979ae6", "comment": "Malware payload (Heodo)", "value": "053f73e9761a01ca322b2cfb7dcccd0a9c32c34dfefed7e75b6bc75d5275fe38", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557324, "uuid": "ad67d0f4-0ff9-44e7-b64f-127fa78912e1", "comment": "Malware payload (Heodo)", "value": "fae04f36659d3639b55825d565bfdfba660cbb24", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557324, "uuid": "c75a7dc2-c559-4ab8-8da0-5c0e8c03b894", "comment": "Malware payload (Heodo)", "value": "1731245557d4f192f76bb59fb49c2bb40deb3508dd60bec5910455bf75900a6fc6914bd7dbeae6189d9979e3ea82ff77", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557324, "uuid": "779a8961-6ea7-4679-9e57-5bbf91db74fd", "value": "T1D6E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557324, "uuid": "fc363c8c-cb3a-4878-9fe2-8f6dd272666c", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557324, "uuid": "7207ac42-05cf-4c54-87d3-9bab9077fa64", "value": 147110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557324, "uuid": "aaa466ed-9cc8-4e1c-86dd-4b05ef97a9bc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557324, "uuid": "7067a640-b16d-403e-ae47-81ca3d976924", "value": "2022-1-26-737aabd46f82d4d0fd23fa167c0bc390.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e238bd2-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559447, "uuid": "e414c23a-98c5-4e85-afa3-88afe77b50c0", "comment": "Malware payload (SilentBuilder)", "value": "488f996a6ac07d53cac88dfc8d4b8e0b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559447, "uuid": "dd196c13-c050-4872-b000-9534d2ee7158", "comment": "Malware payload (SilentBuilder)", "value": "05496bb1f5afbdeaae5c79964e5294e92500ca7f6c430f1051e4dd71449667ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559447, "uuid": "ebb86a8f-6003-4514-a385-398585bad02d", "comment": "Malware payload (SilentBuilder)", "value": "fa316d5505166a51f3241cdee8f74596bcb142d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559447, "uuid": "1c3b9f76-318e-40b9-bb13-e824c30ad76d", "comment": "Malware payload (SilentBuilder)", "value": "e800d92b999c251c9f7aa5552c93410c67657a68e09fec149a7151c254c91160d071207a96746b471c27db57ffc826ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559447, "uuid": "b06d13cb-c19e-4fa5-8589-6841c7ecf1a3", "value": "T1BC735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559447, "uuid": "957aa5a7-4133-4e68-a837-4aa1bad3f228", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559447, "uuid": "46df4b81-c7af-4d53-8e57-1c8a3793cc8a", "value": 77910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559447, "uuid": "e27d53a8-dc8c-4c73-9ece-39951eaa63fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559447, "uuid": "fc3b55d4-c1af-4346-87ba-bcf28830ba68", "value": "2022-1-27-488f996a6ac07d53cac88dfc8d4b8e0b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58641110-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558257, "uuid": "8ab6a9b4-c766-46ac-8ef0-0c348c003b84", "comment": "Malware payload (Heodo)", "value": "be2145bd470a20d16f90930b7007927d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558257, "uuid": "d3e6aa5e-25da-41fc-bdc0-610ba7f6816c", "comment": "Malware payload (Heodo)", "value": "05c605b1a12689d74dc1351f66672c2b361d94283fdb55a3e6400b317d63fc71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558257, "uuid": "2045faa0-2d4d-4163-ae14-9d3a453729da", "comment": "Malware payload (Heodo)", "value": "efea4b647c10d9d2e7c5a500c7bd30cd8344d259", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558257, "uuid": "acb3eaa6-db29-49ae-9908-9d7dde305b2f", "comment": "Malware payload (Heodo)", "value": "7ee4d770c18e1f410d36bf0cf7d8fce69f477a01bc9f5b00fa5cccb3e183b6abfe4a34526aa22995557c498681c78793", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558257, "uuid": "97704738-d849-4c44-b16c-8e884d24fc06", "value": "T1E1E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558257, "uuid": "a63dbf54-bcf9-4827-8189-e2266cdd040c", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558257, "uuid": "00f6d05e-ad47-4512-a38c-1bf1f9e1f0b3", "value": 146238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558257, "uuid": "d421e055-b3b0-4328-9523-27bb34bed8a2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558257, "uuid": "b92f8d97-4783-44e3-a027-817eec154299", "value": "2022-1-26-be2145bd470a20d16f90930b7007927d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d4df83-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643563774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563774, "uuid": "42e83558-f361-40af-a5c1-e440beaf8339", "comment": "Malware payload (Heodo)", "value": "d5228d00b9de6efbc1a06835d313fd31", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563774, "uuid": "277b9f10-3bc3-493e-ba14-2ffa0e11ea92", "comment": "Malware payload (Heodo)", "value": "060eb9e83e03647015ea05096c77fc395c75031251263aec404414c3d621a103", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563774, "uuid": "0e7ec0d2-5969-4bd3-a99b-3c11bfa139fd", "comment": "Malware payload (Heodo)", "value": "54b442d40ac1d4dd29acb3cffc9c172f7a600126", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563774, "uuid": "401051d1-065a-4f80-892a-280b1e2b25c2", "comment": "Malware payload (Heodo)", "value": "06ac9dde93d9630e8c4c54e59d5de2c17b457cfd9ddd688fe9440f4c44a0359cc26095537957a8ba7187f65053753db3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563774, "uuid": "86832aba-6dfe-4eae-937c-cd79c9d5f8fe", "value": "T17A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563774, "uuid": "9beb0836-1061-4afe-bb1b-2882f96e5ef4", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563774, "uuid": "b5dcbf86-7d1c-495e-b9d7-e5052165bb7b", "value": 78385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563774, "uuid": "3cc2e926-a275-439f-9a9e-ba3025b1e2b5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563774, "uuid": "4066a7b0-db39-4de4-be7b-3ee3f6a40ee7", "value": "2022-1-27-d5228d00b9de6efbc1a06835d313fd31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74ed43b-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564402, "uuid": "dc1f0e17-900d-4552-89d3-001688b821bb", "comment": "Malware payload (SilentBuilder)", "value": "e3a6dff84dce2da5fa2e589267bc54bf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564402, "uuid": "a408bd28-1d11-4b56-a2a9-94679a6698e3", "comment": "Malware payload (SilentBuilder)", "value": "06152ac902225c4376828b89e822904fa22ad2faae3a45f5505e874c406251ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564402, "uuid": "890868d5-2c03-45a0-911e-869b13e77c99", "comment": "Malware payload (SilentBuilder)", "value": "170ab1f263c17d456b98163c86b0c3cfc0d3fb56", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564402, "uuid": "1dfcac4b-0993-4d17-888b-65b85e20c362", "comment": "Malware payload (SilentBuilder)", "value": "8758b7f4526a9c3cc61e41a0e0b9053221b156a19312220d3e121189f08f82a3feacc47246f89f418fd3384edf058634", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564402, "uuid": "a2ccfc4e-f035-4bef-a1d5-c5d5405bb562", "value": "T1D7F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564402, "uuid": "60765e04-4ef3-491b-bc92-a081da1acb8e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564402, "uuid": "b0e4545e-ff7e-42d3-ac3e-496024df8187", "value": 158834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564402, "uuid": "24f2186b-2f3c-4fc3-9452-74299cc4ac4a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564402, "uuid": "41166323-8af4-405d-810b-9a525541804f", "value": "2022-1-27-e3a6dff84dce2da5fa2e589267bc54bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676aedaf-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573314, "uuid": "0fda8f4c-44f0-40f5-b850-ca987ad72d26", "comment": "Malware payload (SilentBuilder)", "value": "0a99d96447d950cd0d3c56f9d8235954", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573314, "uuid": "f495af01-3b3b-462e-a867-c6245a459f02", "comment": "Malware payload (SilentBuilder)", "value": "062c715132810bcdce9c86225aa05112436b7f15f1b6046d5556d0976b73838e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573314, "uuid": "b1fb65f2-cfda-4ca9-874a-4e1001b24ec0", "comment": "Malware payload (SilentBuilder)", "value": "d3bcd83f5e943fc2be32f504f9ec8d6bd7791acb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573314, "uuid": "f836ca8f-110c-4a74-bacb-d315e87844ec", "comment": "Malware payload (SilentBuilder)", "value": "ca78d5c1e81cb09cacf16b020fb7b993c007a485cd9d39d4a82c3b396ef8509cd12a7749f8ea1b6e233097168cc55bb5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573314, "uuid": "b4e3e105-e19e-445c-993d-bbf607eb5f54", "value": "T1E7934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573314, "uuid": "5a5c3425-2727-4c6c-a80e-b27b5f009358", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573314, "uuid": "0b9e0840-4813-4cfb-adb9-5d18b0999a04", "value": 92318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573314, "uuid": "3b106783-ca02-4571-ab9d-e5bbde7dc591", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573314, "uuid": "24b0f1a9-dc4b-43fc-8646-b761c772e623", "value": "2022-1-29-0a99d96447d950cd0d3c56f9d8235954.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67df736-8201-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643570548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570548, "uuid": "f8810013-352b-4456-a9cd-3d235b7e0026", "comment": "Malware payload", "value": "b23b6032a7d2bdd94a13bb6b8d178317", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570548, "uuid": "30dd7a18-034a-4cb2-ba61-05d96e55bc47", "comment": "Malware payload", "value": "062dcb42a7fc8dc2f6eddc67990e79274e060cdd63ed144ee49aea51193219b4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570548, "uuid": "d992deca-5092-460d-8c5a-8a0bc26b0896", "comment": "Malware payload", "value": "a96d6308662b1924214295f1561c41002a37dc13", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570548, "uuid": "a5e3250a-5f87-4ffa-b33f-fcd6124686d0", "comment": "Malware payload", "value": "340c066dbbbc1ec8f0992b0929c269cb89ccfb57ad58240371887a893c935b33208abf0954f9f9a252b120af810c6b6d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570548, "uuid": "6c3a63c5-8292-4dec-94d2-f416b48d837a", "value": "T1E4233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570548, "uuid": "f9f82f97-2cd1-424c-acf6-727552aca324", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570548, "uuid": "88064279-2dc8-4314-b7da-e8561af47647", "value": 48667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570548, "uuid": "0b323d28-f407-4af3-bfb7-1e87ef037ddb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570548, "uuid": "3af90090-78fc-464c-a1cd-fc86147bfb70", "value": "2022-1-28-b23b6032a7d2bdd94a13bb6b8d178317.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf9f285-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562613, "uuid": "5bd8c97d-7e31-409f-a45b-ea29f476fd7f", "comment": "Malware payload (SilentBuilder)", "value": "ad42c76dcf77c8b731dd070d9a9672db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562613, "uuid": "d94c531b-7732-49f5-bf1c-db232770b1c3", "comment": "Malware payload (SilentBuilder)", "value": "064525afff47569fa550e5731f7633f8dbd58013cd4a64a94d177118df41661c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562613, "uuid": "e88dcaf4-2c5d-4e49-b1a9-2e2fca358321", "comment": "Malware payload (SilentBuilder)", "value": "07d4521463e76d821b69b4231177a5fa8c7b972a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562613, "uuid": "b58b3612-be9b-487b-8159-0b4ae4ba2510", "comment": "Malware payload (SilentBuilder)", "value": "b64300907e60c2ca7f22e68ff2602e1c4e4ac9f067292c2fa68ac7d2e1a9f56217c0cd8e2833cee129fef418c9a66f0e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562613, "uuid": "d946c7b2-811d-46f8-adf4-427843b41223", "value": "T124131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562613, "uuid": "0f44fc61-004a-4618-a909-2acd6cd71d5f", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562613, "uuid": "20f0313a-df3c-4e2b-9e2c-a1be954816d8", "value": 44927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562613, "uuid": "d8e0642a-ba88-4446-a2e6-684564014486", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562613, "uuid": "264568cb-4265-4b4e-a31d-b64ec60d6962", "value": "2022-1-27-ad42c76dcf77c8b731dd070d9a9672db.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d14fb4-8203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643571104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571104, "uuid": "2c2562aa-8910-4c5d-996c-037b50126723", "comment": "Malware payload", "value": "c8af991bbdca78709dd64e160dd96743", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571104, "uuid": "18349288-0035-4db9-b0ee-9e43e02cb394", "comment": "Malware payload", "value": "066788e61730a6ffb47c803f5e5941f3985e85ee9bda3b9875abfd557e92f4b4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571104, "uuid": "d71cbd13-e447-407b-be90-c698d4f96d2f", "comment": "Malware payload", "value": "a91ee4f148419a830ce93ca0f9d1a78df6fad6d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571104, "uuid": "382580a2-12e8-4bd3-b3ad-21b09dc90916", "comment": "Malware payload", "value": "e388fffe68b03f47f4a2cca1d206910051fd9148cc6ae1546875bc701bc029b70505e412013fefab200e904309bbd202", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571104, "uuid": "598248e7-cd31-4aad-aa9b-5cb0100ad95f", "value": "T127233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571104, "uuid": "7b6c7da9-1053-4c27-b1c3-3706a2fb3cd0", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571104, "uuid": "775058ac-4adf-44f7-8ad7-7599023bf0cc", "value": 47751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571104, "uuid": "defff17b-701b-4772-8383-a7ed983020e8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571104, "uuid": "7e4500e5-8ff7-48af-b254-c0052689f555", "value": "2022-1-28-c8af991bbdca78709dd64e160dd96743.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33530744-81fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567643, "uuid": "7ede6436-dc15-4093-b7bb-d2794ab51049", "comment": "Malware payload (SilentBuilder)", "value": "4ca978f85b02c9fcb27fb89d2cda2ab6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567643, "uuid": "3a34fb89-09ea-4b05-8490-cba8aedc7235", "comment": "Malware payload (SilentBuilder)", "value": "066896aa42e939731a2ca76a173870fe5a43877c780f579709622f5ff3b469d4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567643, "uuid": "bbcb04fc-ccbd-419b-9ccb-0d84ea43d676", "comment": "Malware payload (SilentBuilder)", "value": "740cf80055e8bb0e46d906e5737206b8436104dd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567643, "uuid": "80e2b1a2-c6e8-4820-9447-6f568741911a", "comment": "Malware payload (SilentBuilder)", "value": "e8f21a91f8fede8b145e644656eba62b149cbe91b8785a43db26ac48c06b4b70446f1513414f9890f7c27b7269b26ac5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567643, "uuid": "6b164cae-5f98-4389-85d6-da3e01245bb4", "value": "T12B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567643, "uuid": "882db2e1-cba4-4b91-af97-5dc13602425f", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567643, "uuid": "d7c9a900-9059-4d3c-94f9-b2f89513d898", "value": 47940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567643, "uuid": "604aaac4-cb4f-435a-913c-8fb81b488163", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567643, "uuid": "ed17c25c-283a-42ac-aaa8-605b380e9e7c", "value": "2022-1-28-4ca978f85b02c9fcb27fb89d2cda2ab6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd87dff-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559715, "uuid": "cb7422e3-7530-4ff3-9a55-05a147c1e56e", "comment": "Malware payload (SilentBuilder)", "value": "5709674329f8c0be97b906b19a72baa8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559715, "uuid": "0c2a3cf0-0cb3-42a2-9df3-65c5fb753ee2", "comment": "Malware payload (SilentBuilder)", "value": "06830dd9ce5f05d2eb37a996944c9571f26471a992192a459eaa9841abb5c751", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559715, "uuid": "edd7cd40-5fd7-4a57-96b1-12eb825dbe8f", "comment": "Malware payload (SilentBuilder)", "value": "6d55c35f7dcbf9e32aac5bd2567538985c8fb95e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559715, "uuid": "5c36a1ef-65b3-49ef-9124-b6765a9bf631", "comment": "Malware payload (SilentBuilder)", "value": "467ffb9b2ad8ddaa5217646f4e08800c2e29abe971cbde96315dcaabdc039febbddfb6f091dfaaba4a70013c533770c0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559715, "uuid": "6c5b8e81-6159-4357-a02c-692f0d7940cf", "value": "T121F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559715, "uuid": "76c74032-4f64-4419-aa6b-3ddb3c13109f", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559715, "uuid": "db66d41f-2702-4b8d-982c-9aee11c4506f", "value": 158874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559715, "uuid": "562f38c4-fb02-4466-bab3-6a06781fb2c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559715, "uuid": "23633091-dd90-4548-a139-6b81e1df438d", "value": "2022-1-28-5709674329f8c0be97b906b19a72baa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ad6146-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560536, "uuid": "eac6314f-a1bd-4b00-b861-ce10ab6b7bab", "comment": "Malware payload (SilentBuilder)", "value": "63692e9b68dbc20ab8b8fd33ed0f286e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560536, "uuid": "da58e277-d55a-40cb-a406-867983d13156", "comment": "Malware payload (SilentBuilder)", "value": "06836b4974a8f4d6024aee3693784e84f28790df3bc6f67d6e4e0817dc96fdfb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560536, "uuid": "cc682583-5266-44da-960e-f7408d2087a8", "comment": "Malware payload (SilentBuilder)", "value": "e19d75b3fede7a1832612910f4bfae995d6a129d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560536, "uuid": "b60a4f4b-b24c-4752-b103-575d9da6a215", "comment": "Malware payload (SilentBuilder)", "value": "70c8578aa71109b34f91d382b2c399a01e2a03ae2144b18babe591de4739f9d620e83db6e94a92680a585452e2044b0b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560536, "uuid": "92ab4ecd-3648-486f-b48c-603fdacd2b45", "value": "T12B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560536, "uuid": "d5af0b56-b05b-4421-8616-94ce431b0069", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560536, "uuid": "1f3c54a9-17d6-4d2a-9c7d-d0f6d2912bbf", "value": 77875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560536, "uuid": "382e8408-06fe-4259-ba40-3e18a3dfc4fa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560536, "uuid": "5d6f1181-f3f7-4766-8ed3-7d4e5e390172", "value": "2022-1-27-63692e9b68dbc20ab8b8fd33ed0f286e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6630a5f1-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564722, "uuid": "fc6e59c3-f2b2-4c9d-908b-c2b59b0a9293", "comment": "Malware payload (SilentBuilder)", "value": "ee5271da2f149624bd317307adea86dd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564722, "uuid": "dd2de3eb-fd93-47c9-aa95-639b517ea100", "comment": "Malware payload (SilentBuilder)", "value": "06d6df16c3b428d2cb1dfa5408d819dd0a670f672ad84eb53b8d29273de7b1bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564722, "uuid": "ea33ff73-ce73-44af-a3b4-9dec775296ec", "comment": "Malware payload (SilentBuilder)", "value": "07950eb8b3302368992cf5ce63e26850da97f29e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564722, "uuid": "b3a78791-bcb1-423a-aa91-15b2cab5a9c1", "comment": "Malware payload (SilentBuilder)", "value": "9c0ac208bb616be6e04ece50390f5f3a4edf29a3b47fbca35f2954fe76769fe69822df9056887adfb0c8453295afb999", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564722, "uuid": "4a4d17da-3aa2-4478-9520-aeb7c41f9814", "value": "T136131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564722, "uuid": "664fdf47-8d83-49f3-aecf-28de632d0682", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564722, "uuid": "58764519-ce89-4911-9eb5-f69f3096bb4a", "value": 44676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564722, "uuid": "887dd469-bbd0-41b9-ac24-3831ef8ceca7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564722, "uuid": "2783addc-3b45-42ea-b998-9c9887012228", "value": "2022-1-27-ee5271da2f149624bd317307adea86dd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bedf8e9-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560410, "uuid": "4753837f-36b9-454c-be62-3c8eb39db07a", "comment": "Malware payload (SilentBuilder)", "value": "62ea3d68e6302349f7be0faea6ae8788", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560410, "uuid": "0def296f-a09c-4087-9201-2aff9f16b12b", "comment": "Malware payload (SilentBuilder)", "value": "06df620e6d9051852a14a516576656bb1c124841a5cafb39c722cd25af5ab816", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560410, "uuid": "d0f2aa7e-5fc3-4d3d-9f08-19f1e84bb99f", "comment": "Malware payload (SilentBuilder)", "value": "493cf8b62f1eb9b9d7044429dd58342eeeaccd75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560410, "uuid": "e0935617-7f95-4557-8851-283a55f93489", "comment": "Malware payload (SilentBuilder)", "value": "f1088c957b6ff16f23267b9dc85b2c6d77fd29d38a80ab5d5395062387766e8a88341088ef32fd930fe18cb7fbf649e4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560410, "uuid": "5fb4c89f-edfb-4f6b-b96a-29a6ca1fd84f", "value": "T11F735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560410, "uuid": "f57c1dc2-a593-4a84-b6bd-54b51c87a5bb", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560410, "uuid": "fa657f53-19d8-406d-b86c-029568e9fcb9", "value": 77744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560410, "uuid": "8a1a6697-083e-46eb-8f2e-7e8611be2f3b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560410, "uuid": "66088390-b7a7-46b7-ba70-b7d68cd8b684", "value": "2022-1-27-62ea3d68e6302349f7be0faea6ae8788.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3962544d-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558634, "uuid": "d745e40f-f474-48e6-af03-e598c373ed93", "comment": "Malware payload (Heodo)", "value": "2e1bea924677490fad10b6cb2662ea31", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558634, "uuid": "2f21fa49-b854-479a-a803-d37c98d75b92", "comment": "Malware payload (Heodo)", "value": "06f890eaed1f3ec5b79cb9608fa5c6eb15f31bec3113b20246c02b8d73bdffd3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558634, "uuid": "906f4191-c3ff-4ed2-b142-021b4e30f897", "comment": "Malware payload (Heodo)", "value": "fbcc36acaa41cd5aaa73c18d0449ca65999ec555", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558634, "uuid": "97d9fe09-5d29-4afe-807c-b5e70598aa4b", "comment": "Malware payload (Heodo)", "value": "51c9da606c8d418437ef7e5396ef5510ee9753f115d1e6e3d9541556bb3549cfd36a4f7a9bb13e277ad9133b9c42df31", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558634, "uuid": "3f11160d-e888-478a-92cb-17c92b4fb7f8", "value": "T1A1735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558634, "uuid": "dcf9fbab-1df2-4ce4-946c-fa833d27839c", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558634, "uuid": "9789bf19-bb55-43e8-a637-6039d22f88d2", "value": 78177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558634, "uuid": "5be98390-9d06-4340-b750-42543340a34a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558634, "uuid": "f46dcd61-d786-4867-b639-84985e167f83", "value": "2022-1-27-2e1bea924677490fad10b6cb2662ea31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5045ba2a-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559102, "uuid": "265d3103-aad0-42f2-878e-b318f6f5b7e0", "comment": "Malware payload (SilentBuilder)", "value": "0a52dac1d95f3c8a481717487d159917", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559102, "uuid": "abc1cfa1-4f12-4105-bdf4-c5262910743a", "comment": "Malware payload (SilentBuilder)", "value": "06fa36aa947cbb2c1f29509d9b939629255457775558d0428dc0f98dae906e9c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559102, "uuid": "3c9eceb9-c9fb-4d54-9f6f-b7af75e2ef5b", "comment": "Malware payload (SilentBuilder)", "value": "b416d7ebdbfe7d3fc7c7ada260526ec3bf0ce58e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559102, "uuid": "74e18a2f-c3a1-4775-905c-9704a83e72a8", "comment": "Malware payload (SilentBuilder)", "value": "3182ac4694521f2c776d0c6d1c8d44e5239ccc01ce5d74f1fe55a72fcc09721c6518cef7f2d6416649980e7558a9bfe9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559102, "uuid": "348bc0b2-d5a7-4780-aca5-71d1389bdd19", "value": "T189F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559102, "uuid": "76c5d833-69bc-4e87-a2a8-a6cbab9d24e4", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559102, "uuid": "bb86bf51-768b-4052-bdf0-4a58e13839fd", "value": 159181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559102, "uuid": "1998d444-fd47-47fa-ad35-2dcf2f4d4246", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559102, "uuid": "0d388970-9ee9-4772-96e9-cc1a1e9f00cf", "value": "2022-1-28-0a52dac1d95f3c8a481717487d159917.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca1fbad-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563042, "uuid": "b3cf8eb1-5be7-4b88-9207-5c025d6f1309", "comment": "Malware payload (SilentBuilder)", "value": "be0165a6c79791e0ca0260915211bd62", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563042, "uuid": "188d7a45-43e3-48ac-b369-57f86472b523", "comment": "Malware payload (SilentBuilder)", "value": "06fd09aa12dc5fce9a1efc9a9918f98fce4f584d2a723941faac0da23997d75c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563042, "uuid": "d1552cfa-3952-44a2-a812-6c6d4a3d7128", "comment": "Malware payload (SilentBuilder)", "value": "27301afcb17dfe4a3dbc14067fc1016cc2d9c45c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563042, "uuid": "b73b5d28-b3d9-4d51-ace1-ba7110244b2f", "comment": "Malware payload (SilentBuilder)", "value": "14cb8cb4b898695d32b525cd068e454ccd124f328c6696a650d501690f4ab20032639d4b2a561fcc31fa718b681f11b1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563042, "uuid": "92da44e1-a966-49cf-bacd-78f83c865dc8", "value": "T119C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563042, "uuid": "333b544c-1fcf-4086-9e29-52922b6dd53c", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563042, "uuid": "a9cae929-1025-405a-9656-acac93f4c3ac", "value": 118439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563042, "uuid": "27301bbc-ec42-43e7-acf9-39353b8d0cae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563042, "uuid": "e1aa5720-dc61-45b2-b57b-bb34917fa2e2", "value": "2022-1-27-be0165a6c79791e0ca0260915211bd62.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c2b361-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568049, "uuid": "6e28fa84-cf5c-46b3-829a-81263eee26c5", "comment": "Malware payload (SilentBuilder)", "value": "5a79537ab26c7e8905e87a18b549aa20", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568049, "uuid": "bcf7b720-5657-4116-b932-e63bcb250e66", "comment": "Malware payload (SilentBuilder)", "value": "071d83f87133c96978a4e34bb79797da8e6b24bdd8f4e896d71fb2c83aa830f9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568049, "uuid": "34d29b39-e386-4341-a0fe-b9e9cb40d767", "comment": "Malware payload (SilentBuilder)", "value": "7f9a33a4645e06cdd2e7361bba795b5936b4a47b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568049, "uuid": "515c9530-ede1-45c0-9901-55fb7fbf3a9e", "comment": "Malware payload (SilentBuilder)", "value": "34f99d620af72337f07443d94c548760c41ea5324f9ffdafe6583b5ed4a7b483c9d0e18c1b6953aa868dadb5008318dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568049, "uuid": "40210fbe-0633-4c0b-b1db-57851e5bc3a7", "value": "T167233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568049, "uuid": "6f3e94d0-8f1b-4136-8fcb-71861e1c9b1b", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568049, "uuid": "489e22ac-0831-4b02-a45f-9ed1814fa65c", "value": 48440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568049, "uuid": "43fdbe09-235b-464f-9d58-bbfb75b52f3f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568049, "uuid": "5fb22643-d286-4553-b644-c7b66d14d634", "value": "2022-1-28-5a79537ab26c7e8905e87a18b549aa20.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911e6229-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574673, "uuid": "912d7d9a-a80d-45da-a61f-bf24d3e00ec5", "comment": "Malware payload (SilentBuilder)", "value": "794633c898fe93e26bc837c378169107", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574673, "uuid": "e7413fa3-d920-459a-a53c-3e75b0d0dd04", "comment": "Malware payload (SilentBuilder)", "value": "073234490cac1b000f441b9cc723ebba1882363d35de69fcd986e8216c205459", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574673, "uuid": "300448de-b781-4d25-a8bf-018cb8ffff23", "comment": "Malware payload (SilentBuilder)", "value": "510aba190cbdbe04caf53b059793f7062f1b606c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574673, "uuid": "ad748a6d-7e62-4591-815d-995a00fa0193", "comment": "Malware payload (SilentBuilder)", "value": "fc64857c61aa655b9036b862eebd107e3b749435a5edebd2b7900ff808782b6ea2bcffa6cfb889831955d296f624fb31", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574673, "uuid": "dc68e62a-31e2-46d3-a712-b1fdeac69d14", "value": "T1A0934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574673, "uuid": "0c695927-5143-4a77-b4cf-0cfa73a9f872", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574673, "uuid": "0b0ab612-ba39-4f4b-884f-51e9165715d8", "value": 92597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574673, "uuid": "6aefa81f-b9db-4ff1-b119-06ffe13a1738", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574673, "uuid": "250fe1b3-2baf-4f8d-b5ff-b1951284d846", "value": "2022-1-29-794633c898fe93e26bc837c378169107.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fed464a-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643568899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568899, "uuid": "22ef4d8d-974b-488b-a842-6c90027541f0", "comment": "Malware payload (Heodo)", "value": "782ed4a2d0027d3e735f3c83e382e658", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568899, "uuid": "b1a049fe-805e-43d4-996c-50950487bcbd", "comment": "Malware payload (Heodo)", "value": "0751b6f514105cb72ef137d2a2bb9da2dded4b360e29144bd81fa67eba3bbec2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568899, "uuid": "da6f28ab-59fa-4f17-8c83-20f1d61c97e0", "comment": "Malware payload (Heodo)", "value": "4aa0f1fd685aeebc9e3e69f180a7f7b0d3d092df", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568899, "uuid": "cc332705-8188-4ad7-8cc5-f7ad317ad942", "comment": "Malware payload (Heodo)", "value": "def06357a9a2800b3e94c7e29849a32987a9b62ceb9cf86df0ab8e9df194bb151717404621825f819d926b8515198c8a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568899, "uuid": "b7e459e0-b4be-44df-9270-ef32d855c1e9", "value": "T136839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568899, "uuid": "e165375b-7fb5-4338-bb5e-d1aebc86cf1c", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568899, "uuid": "50bebdb0-6ecd-475f-9716-952da65d8914", "value": 87435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568899, "uuid": "ea76e41f-ba8a-447f-91b3-5b4effc4aed9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568899, "uuid": "a23cbf17-9c51-4224-a6b3-d88e6d4c6f50", "value": "2022-1-28-782ed4a2d0027d3e735f3c83e382e658.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c25a91-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558519, "uuid": "81676ab1-65ff-41f4-9d09-6b22951cb619", "comment": "Malware payload (Heodo)", "value": "d6adb5a7f752664b9685fdd2dbc86dc1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558519, "uuid": "ac636c2e-c58d-48e3-9f2d-c229b84afc45", "comment": "Malware payload (Heodo)", "value": "0764f84de44f5f8a13c57f8f8fd2e93388004c10f064dfe2cab38cd8d047d02e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558519, "uuid": "54ffd055-083f-4473-bd91-a3aa70c27dd5", "comment": "Malware payload (Heodo)", "value": "38b4b334af01d1d3ae3d8982bb6eb74b084f6295", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558519, "uuid": "a8c77376-19c1-4bcf-ac45-8d6a1c588940", "comment": "Malware payload (Heodo)", "value": "c961288a70318b9be76d41a7f5dbd2aac7abde592f09450c3bb13e66b9eaf53c5e4b635bfa8b416e7345028163db1be8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558519, "uuid": "79ba7c76-f43f-463e-afc2-d62a5a3784b9", "value": "T11AE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558519, "uuid": "b82658af-7479-47ab-9c2d-6ade8935b5a4", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558519, "uuid": "d872e52b-8e90-4cbd-9903-de09b8bb75f5", "value": 146254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558519, "uuid": "f7227e5a-381b-4ab4-9bdf-a95526e39233", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558519, "uuid": "3d1587bd-c427-4de1-a28b-dc779d15d2ff", "value": "2022-1-26-d6adb5a7f752664b9685fdd2dbc86dc1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61e062b-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559246, "uuid": "1541ec65-14df-4123-9b61-6dfef88daf09", "comment": "Malware payload (SilentBuilder)", "value": "1d367be9c23367c66c5e52eeff25a03d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559246, "uuid": "e75cef2c-7091-4453-980c-19350b555a14", "comment": "Malware payload (SilentBuilder)", "value": "07795b2a5f60fd9a5e3ccfdd4fe3f7b1b092ffbf201ad8dccc708dccf77e08db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559246, "uuid": "7a8ce241-54c8-4b3e-855f-04dcd46976b1", "comment": "Malware payload (SilentBuilder)", "value": "a67af3d16dbbcf5c9df2493494925cfa53d7cdef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559246, "uuid": "4165f80c-c3d6-43d9-9d29-7e83398fdc3c", "comment": "Malware payload (SilentBuilder)", "value": "b5b5400f98a4bb8df177e04e4c94b16eb85f33b241d764d566da7e0add84980c2d0b7b98e26dafca45bfa5312fdb8528", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559246, "uuid": "4920893b-9c85-426a-b73e-023d60c7b46b", "value": "T135F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559246, "uuid": "1c1c32fc-a8da-4e48-b58a-848cc0ea3cb3", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559246, "uuid": "b6abf894-4624-4916-a319-fce0f8093e4a", "value": 159242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559246, "uuid": "3115ad2a-5572-4c37-9eaa-5c1bf8794021", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559246, "uuid": "8c1dfe7d-92d2-4efc-a60e-0243d3d35299", "value": "2022-1-28-1d367be9c23367c66c5e52eeff25a03d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e02ec9-8171-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643508568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643508568, "uuid": "29d91af8-c7d5-4e3b-a8fd-f3b7e304a87b", "comment": "Malware payload (Heodo)", "value": "8b5d22253ae0695b99b5f9ad83cc581d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643508568, "uuid": "820e4002-7fbe-4a26-897c-2598ea22f658", "comment": "Malware payload (Heodo)", "value": "077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643508568, "uuid": "e32cb86e-6b7b-4cb3-b7aa-23fa3448c16a", "comment": "Malware payload (Heodo)", "value": "d668a3e11d2b531d99a1a8040b946b0465ee3c7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643508568, "uuid": "6f0f779b-553a-4d91-9141-4a29377aab3e", "comment": "Malware payload (Heodo)", "value": "8797a2dde96836aa695fb6a38fe1ed7dd019ff2b06e72b282e09aa521621c1ba7c115bd0fa1f7424d767f7887d7d2362", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643508568, "uuid": "4e69d533-0a92-473f-ae2a-2bf66b779d4d", "value": "T1C8C4AE29B1F1E8B1D6FA00F929F992DBC2AFBE424B29519BD7FC110F19341814B35A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643508568, "uuid": "b452d9ac-e4b2-4ded-920f-6450b235a913", "value": "f4d2f65566a93075f8824e97bf321580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643508568, "uuid": "338381d3-7363-43ed-bcbe-282f7636b3ed", "value": "6144:HUNF4UQXTkkAiBuGKDU5PSczbmOTT0DaTMGwUylbdTN1itwRClN6RfcjJxX4R0Zq:AeAa4DU5PSczbmmTzTnJyDx6BrWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643508568, "uuid": "69ece2b9-f0f0-4966-b363-46a17531d9cb", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643508568, "uuid": "3d5d4c8a-7d1d-4ec7-a44f-64739f77eb9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643508568, "uuid": "bd44563a-0946-426e-bb26-16ee29ecc0d3", "value": "emotet_exe_e5_077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a_2022-01-30__020923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d2926-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572032, "uuid": "6c58ef8d-cc30-4b08-be4e-222f8a746566", "comment": "Malware payload (SilentBuilder)", "value": "e0e786c664e63c4e72c3eaaa697b127f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572032, "uuid": "5a3481eb-a87c-4da6-ad71-726ae5d50cb0", "comment": "Malware payload (SilentBuilder)", "value": "078059a96ea1c9a36d4c432d06422c779e84b1e16823b625c6ebebc59f46fee1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572032, "uuid": "a34985d5-f38f-4925-b7d1-05b2b25fd384", "comment": "Malware payload (SilentBuilder)", "value": "f0456ae2858406f03f59b14e24fd42ca7945e5bf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572032, "uuid": "3ad97b7e-263d-4f58-81d8-d84006d53eab", "comment": "Malware payload (SilentBuilder)", "value": "a5a710c06a08a737385ed7d2101ab8d201a6e802a95577618db9093a4dbc283ca692a7642ffc3fe54cd6d6d0718a83cd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572032, "uuid": "db819349-0e47-4350-ae7f-ca1cbb002cb4", "value": "T119233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572032, "uuid": "2818643a-5c67-434e-8e0e-6bb846a18c84", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572032, "uuid": "59da59b6-f607-4b04-8091-5bcf9a4292bc", "value": 48502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572032, "uuid": "8a27c215-014b-4b3f-a546-3c2f2abb7843", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572032, "uuid": "43ba3c56-e4e5-4228-b0eb-d7f754d98364", "value": "2022-1-28-e0e786c664e63c4e72c3eaaa697b127f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec81c7eb-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563230, "uuid": "41ff31ae-e4af-4e93-8810-c9ce67103d3d", "comment": "Malware payload (SilentBuilder)", "value": "c4b1aa2604388eb922c7e1f86da6f603", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563230, "uuid": "4732b37d-1af6-4778-855d-1d7e468392e3", "comment": "Malware payload (SilentBuilder)", "value": "079f384698b4552cf26c20a56823497018a3bf5b4d76aab4287adb9018866582", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563230, "uuid": "c181c795-a625-4499-adb6-3ed45961f79a", "comment": "Malware payload (SilentBuilder)", "value": "d4ebbf4898b767395ead4419dcb85f81ad7d979e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563230, "uuid": "08a8d65d-cd52-460a-be74-c3b13e414875", "comment": "Malware payload (SilentBuilder)", "value": "af1d851132007abc7db2d2e3a3965081ae47109bbca4bc423128b1dca6903c1421cbeed33df629fd2ddbae821fd5ce82", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563230, "uuid": "b9df12cd-6b1d-4f4a-902c-a388dd9a813b", "value": "T183C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563230, "uuid": "6d1d802e-bb57-49af-ab06-16b0bfffd16d", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563230, "uuid": "b14aad69-c88a-4b04-bec7-35475b0f98d3", "value": 118666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563230, "uuid": "9ed5fd08-8b15-4436-be2f-4f1b3fbc7eb3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563230, "uuid": "667af560-e55c-4d35-ace2-5edf0969ff98", "value": "2022-1-27-c4b1aa2604388eb922c7e1f86da6f603.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a22cf45-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559145, "uuid": "7a43b9d6-5eee-4e27-a7ee-c01c5ea67f31", "comment": "Malware payload (SilentBuilder)", "value": "0d89b5eab84843ea2ee145e351fd9780", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559145, "uuid": "03320486-60e6-4f61-80e0-4f60d83d5807", "comment": "Malware payload (SilentBuilder)", "value": "07ad687f3ec577dd2fac41211315a4dbcd2713c92ae0d75a73092a2e9f0c0526", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559145, "uuid": "10a6b3c8-d61a-45ff-8c64-ecf541af9e71", "comment": "Malware payload (SilentBuilder)", "value": "6d6e03ebcf7b44ce68bc1434ffaaf728c748dbf4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559145, "uuid": "bec4ee50-12cd-4289-adb2-58de2c498db2", "comment": "Malware payload (SilentBuilder)", "value": "aa481d0f7e4b1966a0155ad3cb5655c716bd6d1fd7468d58a281a940d1d9919fece570900aa358c9c88fe46d3da9f422", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559145, "uuid": "9f0aa45e-3677-4a4c-97eb-4d84e0a1151d", "value": "T168F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559145, "uuid": "3dc1da04-4d24-460e-95fa-99d2b2f06756", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559145, "uuid": "9d126a18-e71e-4f77-9455-5921ba5dc171", "value": 159145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559145, "uuid": "b307f8a5-5aa4-499c-8d29-1535f7042eeb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559145, "uuid": "9085d475-6819-401a-9a5f-6b44659cd423", "value": "2022-1-28-0d89b5eab84843ea2ee145e351fd9780.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a375cb0-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560864, "uuid": "b19e3335-7b25-4797-8930-bedbf044516a", "comment": "Malware payload (SilentBuilder)", "value": "e583c89dba8ecb6a028feccfa4adbf3b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560864, "uuid": "8bab836b-10f3-42aa-82f2-c332925ccff6", "comment": "Malware payload (SilentBuilder)", "value": "07bc5a0a4be1a071fc510d5b0a83f1a9bf7de4eab81a42a18279b090c25687d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560864, "uuid": "f0b2cdb1-3da7-42ec-8962-7759726b2898", "comment": "Malware payload (SilentBuilder)", "value": "767d71a3ffd134e1954311d6406b898781c86a3c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560864, "uuid": "6cd97c15-ea5a-4ad1-b3ae-add71a9951bd", "comment": "Malware payload (SilentBuilder)", "value": "27aaa60df811d2119cfdc9d479f8d95939d6073915fc725816f025a8ac2819d9de889e09a0163657b7e1df28cc606511", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560864, "uuid": "53b1dbd3-470e-4304-ad93-d06620f826d5", "value": "T10CF2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560864, "uuid": "6d7b868a-f2fa-4dcc-8ad3-f964e1cb1bbc", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560864, "uuid": "73745265-a386-4abf-9b89-4e2f7dfc212c", "value": 37348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560864, "uuid": "a1de2d55-3344-41a8-a513-53a0435eb617", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560864, "uuid": "2b7ceb9a-8a0a-4d0e-9210-aa0a70ece5ef", "value": "2022-1-28-e583c89dba8ecb6a028feccfa4adbf3b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed61a854-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643567097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567097, "uuid": "94513d1b-e3c3-4d8f-b3e6-27d572f0259f", "comment": "Malware payload (Heodo)", "value": "3810c5b0b0312d5f97be9ab72b1e5b87", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567097, "uuid": "ba0036a9-729e-4881-adbf-6ff40d932c84", "comment": "Malware payload (Heodo)", "value": "07e78844f55119ab4d3aa4cf0cc20cbf32b8a82e9cb13215bcf3620502f61551", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567097, "uuid": "ef73b8d2-0462-4274-9a39-fe673f1a0c65", "comment": "Malware payload (Heodo)", "value": "ab4339d80772e655a4bab9fe01264672355c15d3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567097, "uuid": "b0e521be-2588-4787-89b4-5d89a7fbd3f6", "comment": "Malware payload (Heodo)", "value": "082cc10a1db3b273c04815cfdd33145a8ccfc6ee121608234010efb026359e92f4d90e8c1a7c50350029c3548624ca88", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567097, "uuid": "f4abe332-4c2a-4723-9a3c-bc40a6df58be", "value": "T1FC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567097, "uuid": "a03684a8-7aa0-46b0-b43f-d7fa0ccd48e0", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567097, "uuid": "5ec0cfaf-67f7-4b7c-a4a8-d409ad478f06", "value": 48517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567097, "uuid": "50bfde12-86f5-417d-b483-d9b1e7f59d8a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567097, "uuid": "89889d01-d779-48c9-bdd8-3212a80888db", "value": "2022-1-28-3810c5b0b0312d5f97be9ab72b1e5b87.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2e5aca-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566986, "uuid": "e1bb8bfc-d5b1-465a-8efc-8605376cbb76", "comment": "Malware payload (SilentBuilder)", "value": "34d41fa27242bbf332fd03eba6bb6716", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566986, "uuid": "c8f0e25a-f113-4610-ab94-69c8acdd441b", "comment": "Malware payload (SilentBuilder)", "value": "0836c5bcc339382c6b6e7613b821cd9e7548db66de57b2bb4e7de63b4a0afaec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566986, "uuid": "e0399cd9-65a2-4eba-aec8-2c98ebf31436", "comment": "Malware payload (SilentBuilder)", "value": "3d2781e25bd49d02e18123e4c4375287299c0bd4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566986, "uuid": "ce0b4cfb-7061-48b6-972a-7ce70fad7d44", "comment": "Malware payload (SilentBuilder)", "value": "50ec76f1ccbf4f9cbb7c6de9bcf15ee035324b2759b3c02fe3bc7e802e1ab6241c9e9cb1e794f699f9783b72fb0efebc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566986, "uuid": "7f7ad858-5f63-4568-8a4e-9e94c16fafb1", "value": "T131233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566986, "uuid": "02c8f071-35f5-420f-a1a3-cd5026639879", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566986, "uuid": "d6a5c1de-17aa-4058-a297-12a0a6a396bc", "value": 47896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566986, "uuid": "5da465fc-442e-419d-9a43-02c6356e2bb6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566986, "uuid": "1e790bd4-4487-43b6-a504-9d40c3f652ab", "value": "2022-1-28-34d41fa27242bbf332fd03eba6bb6716.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58a3a91-81d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643552910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552910, "uuid": "3c177ff0-f6a4-447c-a56e-c94948a87b9e", "comment": "Malware payload", "value": "6dd10df6a5a99f88b7cd9a0d170d80aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552910, "uuid": "776c2e12-927f-485f-9d96-3ed59e53cc72", "comment": "Malware payload", "value": "083c3de1636358e4848f6c01f8e88fee5d98bbc7386580246985409eea6b8e25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552910, "uuid": "482ce1a5-8dc2-48f8-9d2b-26f32a07345e", "comment": "Malware payload", "value": "d734f42dec7318cc6d049127ea25223a12636a11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552910, "uuid": "0ca7f5cd-057d-4784-9768-bed30811d94a", "comment": "Malware payload", "value": "f5d692bb6a104927e4a0df8d04dbad75655ae5733dccac52f7fc6d5260a1de8e0c25d40d63a5af4574dd476c1259ee52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552910, "uuid": "82b53461-73fe-4bff-ab7b-3e93474ec1f4", "value": "T16B42AEC99936950AC351F33F27DA4F7B02EE262E8743B24965A1343EBB8F119215189A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552910, "uuid": "b40d155e-e19b-47ed-93f6-1f3aa3f8ea54", "value": "384:LHjVQeyVbO3prO686nHQKifslR4+amlsWHd:PcerlpnPlRApW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552910, "uuid": "2322f9dd-bb47-4cc7-9c1e-a50db7bd30ef", "value": 12796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552910, "uuid": "1a8e4bc1-ade5-4e32-9bcd-166bff436131", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552910, "uuid": "b89b9ded-e4a0-4ff7-8677-147050164374", "value": "Yofukashi.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea215ac-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561220, "uuid": "7c17daf4-638e-495d-ab7c-c85f0a46b963", "comment": "Malware payload (SilentBuilder)", "value": "7d1aabe34fa128cb20f2f0c32f1db58a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561220, "uuid": "1a35669b-6b96-4be8-86a9-16301f02f09a", "comment": "Malware payload (SilentBuilder)", "value": "086ad5d6ec97bac15b1cccc92280a6680e2b00ac099b44bb74ba9fc0fb0ab821", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561220, "uuid": "71bd8cb8-ad63-4bd0-a50e-25b9bdb98634", "comment": "Malware payload (SilentBuilder)", "value": "1f4d527d4a795e6757de6400b2def0a49b024e46", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561220, "uuid": "9c8b9814-f02a-4c13-b81b-b2efcf99dd83", "comment": "Malware payload (SilentBuilder)", "value": "625ef7e1da67a9594985630650027856209b505909f4fae03426a0a716dfd26f1e6ddb44eea62886ef47ecf684a3a113", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561220, "uuid": "2fc73b81-fa85-46ec-9899-0cd567f5bae3", "value": "T102131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561220, "uuid": "b9785325-c7b5-45af-9b40-2e7200b3f0d9", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561220, "uuid": "df80ec5f-fc53-41e0-b607-00dbb677f939", "value": 44935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561220, "uuid": "cea08cb4-31f3-4152-a4dd-b08b6e50877b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561220, "uuid": "c8417984-5f38-434b-9f7b-770dc98a1b4a", "value": "2022-1-27-7d1aabe34fa128cb20f2f0c32f1db58a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3519e096-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573230, "uuid": "088cbd58-e271-4341-88a5-6a353951fd73", "comment": "Malware payload (SilentBuilder)", "value": "060550e3c34a8f76a2811d8864dc66f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573230, "uuid": "1bfc5265-ca54-48b3-a46c-cf67bf254bca", "comment": "Malware payload (SilentBuilder)", "value": "086c27649b116a17905b09891a165b53d81ac9c09534a6f42e8a6fe0f90e2543", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573230, "uuid": "f6adc13e-f8a6-4d68-9b21-e4ed848d99c0", "comment": "Malware payload (SilentBuilder)", "value": "4a711feb3acc3928f74d70f7691a4d6be4200895", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573230, "uuid": "abec6e69-afcf-4211-aada-573b3ff93d51", "comment": "Malware payload (SilentBuilder)", "value": "011c080ec34ab09143a2cbe1a4f639589b6dfdb4d75dfe95bae697a11c28d917b750412a72e398c1dbefafb6d09ca91e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573230, "uuid": "f504c811-ee34-42c5-b8d1-0e14309dbf83", "value": "T198934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573230, "uuid": "3a6e41ac-c1bb-4656-8d58-9a71ab198a46", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573230, "uuid": "e2cbe3c3-21fd-4979-a842-1e4d8be01124", "value": 93010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573230, "uuid": "96853004-2f9b-498b-b9a7-92482b4caffa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573230, "uuid": "bc8d8c26-af5a-4d54-94cf-c159dd7267f0", "value": "2022-1-29-060550e3c34a8f76a2811d8864dc66f3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131221bd-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558999, "uuid": "8cee0640-5d3a-4dbb-bfcb-d1850033ab64", "comment": "Malware payload (SilentBuilder)", "value": "01753b8f7621c333454602e11468c6b4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558999, "uuid": "f1611e28-6bd3-433d-8c3b-61514ab2dffb", "comment": "Malware payload (SilentBuilder)", "value": "08849de55d0bbe4e62b1f9b2a1f9858c62c2c385ce07e0524b608f953a715081", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558999, "uuid": "375f3074-1380-45df-9710-8ad77efdeef2", "comment": "Malware payload (SilentBuilder)", "value": "9ac9c151a7b44b3bacd8ea6ef53a366447f83d04", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558999, "uuid": "ac69a83d-69ad-497e-a605-7bb5aaecaa16", "comment": "Malware payload (SilentBuilder)", "value": "7143b9c00b63b0e3210894b38cd0fa08d6482973be1529ad2782aeea5e0356d3206ddd486aa2f5b6580a958f79e48812", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558999, "uuid": "8fde491c-b99e-4de4-af43-0f4b1d091e38", "value": "T150F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558999, "uuid": "aa4f5acc-3660-43bf-86eb-1249d345a052", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558999, "uuid": "b8d5b45a-71a0-45df-9917-cdf5d1397fa9", "value": 159252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558999, "uuid": "94d09c52-0d28-4466-a0a3-ff70182b8045", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558999, "uuid": "2b6de5a8-e411-47b3-827d-f0293fb5b4b9", "value": "2022-1-28-01753b8f7621c333454602e11468c6b4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f786dd-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558736, "uuid": "e675f25c-d49f-4285-9b5a-38f3807ad303", "comment": "Malware payload (SilentBuilder)", "value": "ec18cffa443dee76d449de79c5a269a1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558736, "uuid": "c6ca8a47-8071-4258-8903-6f25de000365", "comment": "Malware payload (SilentBuilder)", "value": "088ce2dbf22f88987da1bab156153a678f7b2628bdb04323240be675ea313509", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558736, "uuid": "e4b1dcc6-63bd-4f85-8bb8-9a6f222ab1a9", "comment": "Malware payload (SilentBuilder)", "value": "d1770ffbd76afa992c5a7b627e2b6b8253dbee98", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558736, "uuid": "46865762-d8e2-46aa-928c-55122eb7552f", "comment": "Malware payload (SilentBuilder)", "value": "f29bcaa7b4d7cdc77b160be4c044931c04a8ce6b594cf6806460d1a8b2d35792976006bb73d475ff9ebff97deaa5edff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558736, "uuid": "1bb16b97-0814-4c39-913f-471c8e18c935", "value": "T11BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558736, "uuid": "f13574d8-7034-4ae2-a693-4a4d9b6f86af", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558736, "uuid": "5b9b60df-db2f-4901-a556-9bc561f7d83b", "value": 146596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558736, "uuid": "617ffe65-6732-4b01-8e6d-dffaf1e3d684", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558736, "uuid": "1045dbd1-4937-42a9-8b32-5d0591849215", "value": "2022-1-26-ec18cffa443dee76d449de79c5a269a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d90dc91-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575472, "uuid": "09ad744a-6ce7-4ebb-bdba-82e41f33d0e5", "comment": "Malware payload (SilentBuilder)", "value": "b2d4cacaa524a4bac1a0a5f0d8a654fb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575472, "uuid": "b92ef356-ef37-4ffe-8cb8-9784c9826698", "comment": "Malware payload (SilentBuilder)", "value": "08c36eca773bd08a836b943806ef271ada570f941a825bef8780cb3f0ded2c55", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575472, "uuid": "28b0d74e-a911-4141-91af-2ec09dbca0eb", "comment": "Malware payload (SilentBuilder)", "value": "0fb7e5813d781e6f865b3840ad4cb755ae97f034", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575472, "uuid": "5582399a-63be-4f73-8b47-143e79e35e40", "comment": "Malware payload (SilentBuilder)", "value": "617d6b00bdd0fe0da7dcaafb330cbe155e537b91aad484b4d76a6ac96af5b4a200b15bd0a20a9299303d8f4b2fec5f83", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575472, "uuid": "b4a1a836-a95f-4ab2-998f-0a74ef5e379d", "value": "T1B7934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575472, "uuid": "ce7d6a6d-81d0-4c04-b0c2-ed5f7dc55014", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575472, "uuid": "dfaa58d5-c027-41f7-aa83-c507e9b08aa4", "value": 92345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575472, "uuid": "7868f07f-0c62-4e44-8118-7d231670cd85", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575472, "uuid": "23979593-0ec8-48bc-ab02-5ff95a7776e8", "value": "2022-1-29-b2d4cacaa524a4bac1a0a5f0d8a654fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed2c87e-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558751, "uuid": "56fab815-a3fb-4beb-907b-abc6aefb2187", "comment": "Malware payload (SilentBuilder)", "value": "efa7ad83fce44ee4796773908376b7e1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558751, "uuid": "4a046f02-c2cd-44f4-ac12-69ed4182c775", "comment": "Malware payload (SilentBuilder)", "value": "08c670c333915296bbceec54f107f6289dd89f1fa60d1855130b4a9724681a38", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558751, "uuid": "841dc435-870a-4cf1-ad6d-5208548c4432", "comment": "Malware payload (SilentBuilder)", "value": "6fd8285f15b9c6c50aa4498e7c3facbbfab5d8ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558751, "uuid": "01025feb-e27d-4978-b373-03d0f896b1d3", "comment": "Malware payload (SilentBuilder)", "value": "a04d86d023c736f6f05d170fb9883492e41db494d4706767211e8302f525c6b7fb0fcd82c955fac30b9d64f0849b4472", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558751, "uuid": "a19bb3dd-cbb4-49f2-be96-b356624e27c5", "value": "T1FFE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558751, "uuid": "e316a80e-b4f0-4905-92c9-a9f97966f5b7", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558751, "uuid": "ed4591b5-c00e-4222-94c0-4b3e260f1a8d", "value": 145535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558751, "uuid": "416e2d45-a090-48b7-9c67-bc38ea639835", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558751, "uuid": "3ff4838b-d4e4-4884-9fb9-d8b9241c2dad", "value": "2022-1-26-efa7ad83fce44ee4796773908376b7e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b71fe3-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643572961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572961, "uuid": "55ee1174-a77d-4f74-b01e-0bfa9699b3a4", "comment": "Malware payload (Heodo)", "value": "fb70ed327a1d02ae521c757369044553", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572961, "uuid": "ea5727b5-792b-463a-9162-32c647ffc420", "comment": "Malware payload (Heodo)", "value": "08d555e154b3296be9338aa9241453cc2a0e6e02f3dc9bd6f42c88a7c08ac240", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572961, "uuid": "3fecceb3-ba0a-48ec-85b6-868dd6d52a26", "comment": "Malware payload (Heodo)", "value": "1639dcc027f508b1ac4e7bfe2dd86f3940cd2ac5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572961, "uuid": "d50711e7-ea74-48c0-95d7-6988b00a18b9", "comment": "Malware payload (Heodo)", "value": "10c7a4b7c42887daf2fc7a735cf86405f15e22db6f68f2a90b098b72e6c61816fd88b5f7ca3bb6deb7ef0d03d2204a2b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572961, "uuid": "638e8e3a-7bda-45ab-b07d-bae8e20ded23", "value": "T12D233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572961, "uuid": "f0421704-6667-47c0-bdb4-4c0d65aa3704", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572961, "uuid": "675c7e6d-6558-4613-b4b9-97e9f771950e", "value": 47921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572961, "uuid": "81585443-07ed-4b79-9ce3-82d1f64a31d4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572961, "uuid": "38986642-d630-419e-a594-3ab063a4b662", "value": "2022-1-28-fb70ed327a1d02ae521c757369044553.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8df716-81e1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556707, "uuid": "bce66c39-dd5d-456f-bc7b-628d06190240", "comment": "Malware payload (SilentBuilder)", "value": "4a632a7ba31eae52cb02215e033981e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556707, "uuid": "7a4fccee-bfa1-4237-8e5b-82ef43dd82c8", "comment": "Malware payload (SilentBuilder)", "value": "08e9e3c92fa291127d1dfa572d6c91b86e19f2fcbadd3d313cfbf48c51df617e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556707, "uuid": "b88c34fc-40bc-4ffa-944d-10ab7d5d19d7", "comment": "Malware payload (SilentBuilder)", "value": "7533fc7817090a5a7961d6bd8dafd3a589ce716d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556707, "uuid": "8ec76737-c391-4974-9da0-9020d39b1a31", "comment": "Malware payload (SilentBuilder)", "value": "25af40bb8ec55ff326385fa5acb1ca0aae07c36ec91dc670baf41984aad4b9717328196c68c80da01d17ac5a03bd22d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556707, "uuid": "fb0be8c8-978f-46ba-93e9-38da99182243", "value": "T120E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556707, "uuid": "dff337a1-8f09-4377-bc42-98764fee7bf2", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556707, "uuid": "09e7f4a8-c169-4c30-b408-689d76aebd68", "value": 146275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556707, "uuid": "6a3da25b-9361-4de9-af73-0b7500564222", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556707, "uuid": "34e2fb95-0852-4c1f-9528-8af01ab14ce9", "value": "2022-1-26-4a632a7ba31eae52cb02215e033981e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc72fd0-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574317, "uuid": "fe750c08-30ef-49db-9fee-4d166d613b92", "comment": "Malware payload (SilentBuilder)", "value": "60dfd81561406ea7bf8067fabb41abcd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574317, "uuid": "c54da4e0-a3f6-412e-b9c1-0cdfa9154a94", "comment": "Malware payload (SilentBuilder)", "value": "08ff59c8733a9263c8b86843f11356b20ed4cf683e22adf8eb81f1af96803107", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574317, "uuid": "699f03be-f46b-4081-bc75-36eb094dbcf1", "comment": "Malware payload (SilentBuilder)", "value": "0f7fd22b59dcdf4ce1bebf3858c83a48cd8c1d02", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574317, "uuid": "f37811b2-2fe5-42b3-b512-ce1f5e81b18b", "comment": "Malware payload (SilentBuilder)", "value": "75b35bbd506176bf22208aa417734743abaeffbd6bdf3c5e523702b37955167b29023f68fe0da742dbbfd2c656a3b28d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574317, "uuid": "15dc2c26-b426-4559-ae90-fb2929960dc2", "value": "T1F3839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574317, "uuid": "a7d58350-ddd3-4844-a3e6-4bf99d761c0c", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574317, "uuid": "3daa9cf1-2049-4e1f-9ea6-4624eb2158a7", "value": 87528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574317, "uuid": "09c00ef7-27ba-498f-a4dc-aa58370f3b06", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574317, "uuid": "062e6c83-8883-4ed8-996f-91acc618e3d0", "value": "2022-1-29-60dfd81561406ea7bf8067fabb41abcd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2814c8-81e1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556810, "uuid": "8e5e5603-56a7-4c65-a520-61e3fc25fefd", "comment": "Malware payload (SilentBuilder)", "value": "4e96ad8ac6746c026bd1730a563054d8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556810, "uuid": "e379d9c9-0625-4c41-b2b9-700107763c19", "comment": "Malware payload (SilentBuilder)", "value": "0909f13c728d5e87ab75f778c96d1d65a815561b0323a287594e00cc632ac473", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556810, "uuid": "a28ee9e9-fa9a-470c-b5f8-72e405685c7c", "comment": "Malware payload (SilentBuilder)", "value": "98a8a1797443f1c01876f9115bf1d2f202975084", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556810, "uuid": "8b29945d-e84e-4777-8a6d-fc4b13b85963", "comment": "Malware payload (SilentBuilder)", "value": "be71fbf96747ac81fbeb23a54819eab27ceee3698a52405aea3356cac2fc31c1d905258d0a9434fde29186a6930f8d2b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556810, "uuid": "cbab0ecf-6aa4-4c89-b0cf-132236eb3192", "value": "T136E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556810, "uuid": "45115bfc-7801-481b-b861-2df678d345ea", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556810, "uuid": "11c506b6-e65c-4ef5-9496-fc8bfbbbf834", "value": 146367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556810, "uuid": "a7c52b41-9638-41c7-8a1f-4421d490bbec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556810, "uuid": "594ce5bb-9a72-40c7-b82b-fe936897198f", "value": "2022-1-26-4e96ad8ac6746c026bd1730a563054d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792b34c6-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569908, "uuid": "430a0534-29f4-4f2b-8b5b-2104842abdf7", "comment": "Malware payload (SilentBuilder)", "value": "9c75b0f9c28d94676b562dce46e21582", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569908, "uuid": "3e9124d2-3232-4dc1-8d00-898929e04152", "comment": "Malware payload (SilentBuilder)", "value": "09237c2663fa6a578f01bb323683ce485710607e2f3647cc469303b24b750cb3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569908, "uuid": "cd852b41-1e39-4e20-a24c-e5d40d5f6b1e", "comment": "Malware payload (SilentBuilder)", "value": "6951f1ad079318ebe1e8a07e279f758c3ea90089", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569908, "uuid": "df146649-843b-4f33-9782-5659b5d95640", "comment": "Malware payload (SilentBuilder)", "value": "4f214f7023972a54e3421a6be4966341ab4d8f86b1cd7a1293f01ba47d8826b8a96568d80e3b3e87046b9f855f871ecf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569908, "uuid": "6cd0e383-4234-40ee-a1f9-f0f66abd4bd6", "value": "T1DC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569908, "uuid": "af161a4e-2ad8-4265-b360-a32f7f48392c", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569908, "uuid": "717b8ab2-e7e3-4103-9447-48cc384c0216", "value": 48385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569908, "uuid": "21003b09-f1b4-4bfc-becb-6381854cc076", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569908, "uuid": "f1194794-5c8e-4f99-b3ff-e57fabb6b397", "value": "2022-1-28-9c75b0f9c28d94676b562dce46e21582.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7072b208-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565169, "uuid": "fe030eb5-6cd3-4ba5-85b1-01503ceab567", "comment": "Malware payload (SilentBuilder)", "value": "fb63c8e302f27aae01c1ce3a7d3813fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565169, "uuid": "6ace343e-1f92-4120-b078-6ac64bc4eba8", "comment": "Malware payload (SilentBuilder)", "value": "092ab6f674f565198bbfda739db1d862fd5700318a8c633aaca17f975a612ccd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565169, "uuid": "55e9f76d-99de-4500-be79-c71ff46c2793", "comment": "Malware payload (SilentBuilder)", "value": "9108edc66e44bae0ac3b18bf4376984c6b20654a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565169, "uuid": "c20bca78-d10c-4923-98b5-13da9e5e55aa", "comment": "Malware payload (SilentBuilder)", "value": "0cd3111b38acf3bb258811f530e0a059045bd4fab6a2e6f17ae5d7e383c75d8534bd5ceb7570d33294c7ee3913f5a456", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565169, "uuid": "9c60aab7-2c32-4953-bdc4-3cd841d7f3dd", "value": "T171735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565169, "uuid": "c2f20c6f-f596-49f5-b4ed-1fe0168e39d8", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565169, "uuid": "4a709e2e-8cb2-479b-a3e9-52ca254c6514", "value": 78233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565169, "uuid": "18a88cbc-7b3d-4c1e-a39c-fb385d420037", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565169, "uuid": "7053770c-dbfe-4dcd-a541-81d6bc5c5324", "value": "2022-1-27-fb63c8e302f27aae01c1ce3a7d3813fc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eac648a-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643559636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559636, "uuid": "6e750602-9d6b-4ed6-8905-5dd29210aed9", "comment": "Malware payload (Heodo)", "value": "4d76075f15e868823baab4659a0d6d7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559636, "uuid": "20baa4b8-705d-4762-bcce-52a308d0f476", "comment": "Malware payload (Heodo)", "value": "092be1369549bd028a123fe3ee840e60be6c2b56010d05345f528f5060d78334", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559636, "uuid": "19594cc3-e90e-434e-a43c-25784ff07c07", "comment": "Malware payload (Heodo)", "value": "c82e8e0e423774b176284f89460e6767ade8ec34", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559636, "uuid": "4a1fe417-6c6e-4b66-bd4e-497364737cbf", "comment": "Malware payload (Heodo)", "value": "b3483d254c115a77dc25d3653385566415961f11811f63e3700a737b369871b29522d2417e2b7beedef82ef77878b326", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559636, "uuid": "a1899040-2249-4796-bd62-1e6d40c6056c", "value": "T193131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559636, "uuid": "80789811-bfeb-4e47-8705-d3210e016a1c", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559636, "uuid": "8a5f58e1-a599-42a4-8852-88fb604214a2", "value": 45362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559636, "uuid": "e2568430-cf9c-469a-bc4e-8f17fe070939", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559636, "uuid": "eaad814a-1c68-4d61-96a4-8a07ec4c623a", "value": "2022-1-27-4d76075f15e868823baab4659a0d6d7b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f87062-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559185, "uuid": "28d99778-ed35-4215-8ea3-0033a1713b21", "comment": "Malware payload (SilentBuilder)", "value": "19a402abe6c102fc9e6cb46886092500", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559185, "uuid": "d816fbf2-97e9-40c2-8f28-c489237fd852", "comment": "Malware payload (SilentBuilder)", "value": "093b82ad8bcbe05042c5d42df8d76f1338b625498c2d40c9df38b7167b3de4f3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559185, "uuid": "42f78b86-57fc-4c74-b6b2-3d9697662758", "comment": "Malware payload (SilentBuilder)", "value": "961efa5b9ec8add6bf78fa2cf6f50c9f107bdcb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559185, "uuid": "f9f280b6-3e44-4cac-a316-660aa486111f", "comment": "Malware payload (SilentBuilder)", "value": "533cab25e1fe2786391f1440be10bf43652ad6bf00b337999833e0314cbe04021d660542cf9df7fddbef1535cd1a124c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559185, "uuid": "22a23f43-4a0d-4ec3-a05d-be8b8854c46c", "value": "T12BF2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559185, "uuid": "7efe9cd9-c652-4247-b82d-2d48890011e7", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559185, "uuid": "878869cf-2911-4453-88b9-c5901f769ca5", "value": 37075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559185, "uuid": "f21018ff-91f4-4de4-b266-c6e4485e3b02", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559185, "uuid": "9d4853f0-1caf-44c0-960c-380e6ab88468", "value": "2022-1-28-19a402abe6c102fc9e6cb46886092500.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4f0d4b-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572787, "uuid": "ba4096be-1b38-49db-8fb0-281bedf1a244", "comment": "Malware payload (SilentBuilder)", "value": "f70181635b6321d67b82173c43965aff", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572787, "uuid": "59bcb9e3-7f41-4002-8e0c-8b888ac90b8a", "comment": "Malware payload (SilentBuilder)", "value": "097e10a10fddb3bfba40ec406265b8f55c7edc55d3187b87fc5c0c84631278d9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572787, "uuid": "0e93fd48-b864-44f8-b150-c2e325e1bb36", "comment": "Malware payload (SilentBuilder)", "value": "6adbbe2c6242758948ea7c07848102c4eb714e60", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572787, "uuid": "425bd79b-cb8d-47f1-ab8c-bff505d0dca6", "comment": "Malware payload (SilentBuilder)", "value": "4fc82104d381b2a1cde8929767acfea3cc69f473fd91abf2a762bc9737338d5699341684afc89ec03facf4033678ee58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572787, "uuid": "ffaa5359-da8b-4136-a331-342e538213d8", "value": "T16C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572787, "uuid": "7735b782-3356-460f-af4c-055e7897d427", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572787, "uuid": "0587ddf1-9f17-4a15-8e8d-675fe2f52171", "value": 47819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572787, "uuid": "78433da9-e5c8-47e4-b7e2-7a823612bca3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572787, "uuid": "ec79f256-5813-4226-a576-2913ce4913e0", "value": "2022-1-28-f70181635b6321d67b82173c43965aff.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d192dcd-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560358, "uuid": "4accda11-e4b8-41c3-844b-42fdf598f695", "comment": "Malware payload (SilentBuilder)", "value": "624e2a3a12aec17de99f01546e53d873", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560358, "uuid": "5c513545-03a2-4d56-b2e3-41d4b810a67b", "comment": "Malware payload (SilentBuilder)", "value": "09803d2a0b587e98c7dfb9384ecce7bb81fd0db59441dc7d2bc67512775a2e0c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560358, "uuid": "6a6efc39-1f0c-473b-9bb2-3d7ed3464c13", "comment": "Malware payload (SilentBuilder)", "value": "356f6de5dc52340f10eea9e8bd9ef322e3b5302b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560358, "uuid": "627a2d0d-2d5e-4f02-b427-9576519e8a57", "comment": "Malware payload (SilentBuilder)", "value": "e93a03bab64879709ef51d0c1521b9df2073011e0c1b53e794884258009c77f4f8bc630adbd9e05f8c5b14bc9a6d5d23", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560358, "uuid": "dec3718f-1ebe-4f1d-a26d-52b81fd505bf", "value": "T1F0C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560358, "uuid": "d4c2ab29-a770-4546-b870-e1e93fee3cd9", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560358, "uuid": "9f683367-3a04-4424-86ce-b761bb18959a", "value": 118312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560358, "uuid": "bf5752ac-e188-410e-b606-dcd0ba347c12", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560358, "uuid": "a1348780-03bd-40bd-a814-c8a8aa9cadeb", "value": "2022-1-27-624e2a3a12aec17de99f01546e53d873.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d020fd-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569850, "uuid": "456d2f3f-c3d6-44bb-8336-ff3ca701f39c", "comment": "Malware payload (SilentBuilder)", "value": "9aa6b426aa4dbb14c4c42f975e16a1c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569850, "uuid": "ce6b5447-8ce1-4617-9866-c5b86540d025", "comment": "Malware payload (SilentBuilder)", "value": "09895c7dc64f0082712f48664170e16d440dadeca152185b818c381191be3b6c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569850, "uuid": "6faffbf5-d34d-4148-8a7f-fa8ca1f23a1e", "comment": "Malware payload (SilentBuilder)", "value": "d06e01771e813fde6d492f6f618a09ec1843cc85", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569850, "uuid": "3ebab43b-7649-4c36-82ae-4fee80193a67", "comment": "Malware payload (SilentBuilder)", "value": "f3d7101e93d721b4dc5c6ea1acdac0e9e82b84dff4e47be1434689ac5cbe982c4d67f51904e4845d4981adf10d69043e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569850, "uuid": "5b55dc31-26fa-4015-9c7d-f8858862a9fb", "value": "T1A3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569850, "uuid": "ce523f73-3248-410c-8a78-7c62b1e766d8", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569850, "uuid": "9b3190af-5740-4064-8b8c-8c60d90919a7", "value": 158917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569850, "uuid": "b0625a39-d419-48d5-8f56-15fe6cf828cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569850, "uuid": "d9af2126-a658-4399-ac8d-431c9512ee5d", "value": "2022-1-28-9aa6b426aa4dbb14c4c42f975e16a1c1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4104927-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567537, "uuid": "99c8b51b-cbfb-4fa1-8118-c40e0e8049df", "comment": "Malware payload (SilentBuilder)", "value": "4aa1c049565b57e4b60b2f9f613a441a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567537, "uuid": "033c8cd6-67b3-4e2e-84c1-1112adad5de0", "comment": "Malware payload (SilentBuilder)", "value": "09c029756af330affd73575abe5d121e3e2e5ec1c0b19e68b56391db35e0e75c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567537, "uuid": "67bf6342-ded4-4f70-a857-f661461aa29d", "comment": "Malware payload (SilentBuilder)", "value": "d1da5748a68cca31a55008954117403a16e7e329", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567537, "uuid": "0e42018f-de56-4cc8-89f6-5b1299c4a52a", "comment": "Malware payload (SilentBuilder)", "value": "796d5b7e07fcd2a01476596897221eb16920bd2fda64a702c57d5c0c9de95df3ccacd0cd5f015903188465774ec0b93e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567537, "uuid": "603a59e1-5b74-41e9-ba7f-d8e72c8633ee", "value": "T1D3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567537, "uuid": "1424693b-dbc4-4c3d-a7e2-3e05878e68c6", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567537, "uuid": "067f4214-b015-451b-bd5f-ca8a3bc91c5b", "value": 159090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567537, "uuid": "42a827c2-59cc-48e8-a9d9-f36e1bfc7fb8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567537, "uuid": "a9a15b98-4177-476e-94b4-40315e233224", "value": "2022-1-28-4aa1c049565b57e4b60b2f9f613a441a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7c9589-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575232, "uuid": "b36d0ee2-9faa-468f-8e41-9baea1caee38", "comment": "Malware payload (SilentBuilder)", "value": "a105a9af429d87cc929ed067a710755e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575232, "uuid": "b8ebd783-46fc-4253-a626-38529452162e", "comment": "Malware payload (SilentBuilder)", "value": "09c8576cfa5fd5f269ad1677382ccf9a5b476e14bedc2ccef1ea4468d4bc9b0e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575232, "uuid": "a9fab1b8-cb79-4416-8cff-ad018c426e91", "comment": "Malware payload (SilentBuilder)", "value": "e42aefdf5f7e7e4a04983726d72301e75f8b4389", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575232, "uuid": "18cda505-4b01-4a19-8849-e04460290963", "comment": "Malware payload (SilentBuilder)", "value": "8ef83d156f29267586f73f9db9fa84bc6687e30fc39670025af5780b79c5389c297f22ac3a830909d94c0da55de87d83", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575232, "uuid": "48c5c06a-555e-4cea-80e3-f4ccef28e322", "value": "T10D934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575232, "uuid": "3f93ee1b-2f2e-4cb7-988e-89e398ab855a", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575232, "uuid": "e0be9f2d-d975-4467-af03-8bf7c95f4172", "value": 92773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575232, "uuid": "3b686b1c-25bc-4479-9321-1da1cf556c5c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575232, "uuid": "139f3e59-9163-449a-9137-7a607cd9e906", "value": "2022-1-29-a105a9af429d87cc929ed067a710755e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6736b72f-81ba-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643539813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643539813, "uuid": "6a1d9bc5-cf67-4a83-8a25-5217c59e9cca", "comment": "Malware payload (AveMariaRAT)", "value": "6cd50c936fa6fa1b438fee2fd094823a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643539813, "uuid": "9783db3a-93f6-44cd-80d4-58603fafd0e1", "comment": "Malware payload (AveMariaRAT)", "value": "09d532c22650e060bcf9d8e5c21f0b9e18c024af43a17a9b1399361b8e339bc9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643539813, "uuid": "a1254c8d-2959-4264-a2d8-7fbcd56f1a35", "comment": "Malware payload (AveMariaRAT)", "value": "8b59d1b3fc53dd46abc4e0ce7cb62f58c17539a8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643539813, "uuid": "0479af92-b25b-42d4-a375-096a8f09ac92", "comment": "Malware payload (AveMariaRAT)", "value": "1b955df223df3544d40f7110d1e5b4f89764b549a66053cb676d52358fec67bf1a5d7acc6ba69e377ed3931e531b6e22", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643539813, "uuid": "a6403efc-9d62-45f4-a55a-9687fea67884", "value": "T1F8E4238E2A580BEAA3E46EF59278818BB6B5717A100CB4955D160CCE0D7DFBD10CC5EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643539813, "uuid": "a076e00f-6825-4855-a0b1-3a2c755080e7", "value": "12288:1o6MqVB+vtEAxCrb8iZHUIpaRzTnxKg1d6J5f7Fecb6SWikQRlEJJc5La:RMEB+vGAxGb8iZHL0RzL31d6XRlWnkYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643539813, "uuid": "9b1f0924-d278-45a4-9ceb-bbed4b3d45a0", "value": 700605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643539813, "uuid": "ca606d43-f20b-4456-be90-fb3d3f1c7555", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643539813, "uuid": "dbc0325c-2284-457d-8463-34691799d544", "value": "Doc-Contract -agreement and Proforma Invoice.bat.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67274050-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643563865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563865, "uuid": "fa29ee9e-4569-4f19-9bd3-ea2ba2c7262f", "comment": "Malware payload (Heodo)", "value": "d66f9f8f830c26b5abfb263663d51b4c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563865, "uuid": "35c2261b-e225-4f73-bce9-1cb48622dab4", "comment": "Malware payload (Heodo)", "value": "0a03811def108e48a674bd877e62872bcac6bb0aa9839541a173060032c81f01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563865, "uuid": "e65ee1b3-76ec-48a4-a1ef-9a32a158f568", "comment": "Malware payload (Heodo)", "value": "45adf762745237bf459db0004a0e08f7f864e8f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563865, "uuid": "c7ff7bbe-bf87-4525-9732-ae05ad68a955", "comment": "Malware payload (Heodo)", "value": "d1ce23fde26447a172b7e785860d3f5e0e75290372e4f2ddedcdb902b67684991bd80954d3a6e031b07d889e673e9baa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563865, "uuid": "ef5ceb5d-a6e2-4dff-bab8-7febdf29b69f", "value": "T1FC735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563865, "uuid": "199c0af8-3b70-426f-a58b-a49ade352fac", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563865, "uuid": "92403568-eb50-40a5-a2d3-f2142a941bd1", "value": 77972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563865, "uuid": "eaf504d4-3666-4547-89a8-ee420c5329cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563865, "uuid": "7e197bba-dd6f-4ca9-a988-b3ed01c84db0", "value": "2022-1-27-d66f9f8f830c26b5abfb263663d51b4c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7816cd8a-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561746, "uuid": "d38ca6a8-90a9-411a-b7d7-c56adf082775", "comment": "Malware payload (SilentBuilder)", "value": "90699e11f2444be0b990303e05274084", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561746, "uuid": "7f70ec7c-afe0-42b3-931c-8a555261b7cd", "comment": "Malware payload (SilentBuilder)", "value": "0a071f2268693a54bd276736681b73d66d7f509225f4868c1332c70436b2cba0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561746, "uuid": "0ec5c236-7bd3-485f-9c0b-86dd14afaba6", "comment": "Malware payload (SilentBuilder)", "value": "5b6f23fb444487175eb26b0debefd0c687db1369", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561746, "uuid": "de92fd9c-0ed9-4312-b31c-11c0f8ca0306", "comment": "Malware payload (SilentBuilder)", "value": "286555a4217fe1987eb9b8f7700073fc13fa2dbecfe87ccce825e62e3f9fbbb0dc4371e32fe941e57427b1ded1de902f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561746, "uuid": "cf0a6aad-1da8-432c-8de6-f784aa7bbaff", "value": "T189231953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561746, "uuid": "0f963705-d4c0-431d-ae8a-ef1835ef8c20", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561746, "uuid": "418df39d-29fe-4a89-a1b8-0a6ca78747ea", "value": 45641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561746, "uuid": "f834b1bc-729e-4b56-b1bb-e32e21b53818", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561746, "uuid": "a2db7fab-bb4d-4dc7-b3cb-d4839929e4db", "value": "2022-1-27-90699e11f2444be0b990303e05274084.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11051ab0-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576176, "uuid": "227874b9-f5e3-42ea-a291-a860acda07d0", "comment": "Malware payload (SilentBuilder)", "value": "ea16758a02901ed94c6447a6229ece7f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576176, "uuid": "612e96a6-c1cb-49b6-a322-a726310913b9", "comment": "Malware payload (SilentBuilder)", "value": "0a12d4bbb0fd2949a581112f97c29d6a63ea07c91c7bee668af0bca9116cb6c9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576176, "uuid": "a2c5aeec-38ab-45cd-a901-8563d5ce3e04", "comment": "Malware payload (SilentBuilder)", "value": "8748df2d20d7eb4848f75fe17fdd73d511e3f511", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576176, "uuid": "fd4b07ed-13ac-4481-9960-15c7c88eaf50", "comment": "Malware payload (SilentBuilder)", "value": "03f371cc6b314824b62b33161e3f6fbb9ddaa4f080931614f9c8261d4a001e7586c9f0091cf0a0083682cd05ba507932", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576176, "uuid": "c1bd7d27-09e2-4577-9910-868a4e0d0ca7", "value": "T191934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576176, "uuid": "dd39816d-22e5-413c-84b7-aac07adeb2d5", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576176, "uuid": "156fee9a-7c20-4a18-b6e9-4607523662a0", "value": 92911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576176, "uuid": "0bc09fef-acb2-438d-beaa-7692330fc74e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576176, "uuid": "fa030a14-203a-4e20-a517-080b215ba0b4", "value": "2022-1-29-ea16758a02901ed94c6447a6229ece7f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dbef92-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571652, "uuid": "18755618-3da4-4e68-9b1f-179979f4910d", "comment": "Malware payload (SilentBuilder)", "value": "d4bba7e18e0b629a698e8b16a6942b39", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571652, "uuid": "4f03cc55-4fdf-4742-86fa-d813ac211e7b", "comment": "Malware payload (SilentBuilder)", "value": "0a289a4072726306dc5bbe72b621952ab3169c60cfc523eccac95903de39d91f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571652, "uuid": "21505138-6c05-44de-96cc-99728ccbd6c8", "comment": "Malware payload (SilentBuilder)", "value": "f59c0130321afc8083700f9ddf46728530a960aa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571652, "uuid": "67856676-35ba-4066-b226-1259cb484cf2", "comment": "Malware payload (SilentBuilder)", "value": "96696b38352d3c1bb035aaf25b6bc5efd6abbe68bf31e5572aa146babe49f869bdc38493e5292dca5be8f82fa16d9d0f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571652, "uuid": "e4009db4-5b16-4963-b7b4-38a5ef4591b3", "value": "T1DC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571652, "uuid": "36263a8e-43ef-4f82-815d-f3385e0b0b4a", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571652, "uuid": "ce780cae-3889-4c97-be05-266a6ecc7d7f", "value": 48625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571652, "uuid": "c7f48d3f-e9d5-4ab7-8bed-cb5c1e61c8d8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571652, "uuid": "acb424cf-5c22-4aa1-8358-fa567a5ea38b", "value": "2022-1-28-d4bba7e18e0b629a698e8b16a6942b39.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d85443-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558888, "uuid": "8470f269-efe8-4039-99e2-1a517807ffa1", "comment": "Malware payload (Heodo)", "value": "fbdee9aa5e8ac1e84b516971bdee979a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558888, "uuid": "827fb5f4-09cd-4960-9aa1-e0c06daf6db3", "comment": "Malware payload (Heodo)", "value": "0a6d0aaf398176b36623035d2a8567ef280a2d7ad42f34a428092ae0ec823be7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558888, "uuid": "1893f767-bb11-45f5-aab8-74e39ff6970f", "comment": "Malware payload (Heodo)", "value": "592c5dcd29dd85b5d2778a265e18dae34e936e81", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558888, "uuid": "524ed13c-8288-45e8-8bb3-80c22ff8f941", "comment": "Malware payload (Heodo)", "value": "1665af13c77d823ad181388eb693bd9d5777190e4486bdb1cd31374270f458cdfe00b112ee5b55dfab4734781f04b2cd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558888, "uuid": "edeb735a-3d77-48b1-8f70-32a99b8d6f07", "value": "T125E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558888, "uuid": "49ef6ce5-fbec-415d-8f53-2b6bf59c1615", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558888, "uuid": "75746acd-f356-4276-a956-a3ba52ec9d78", "value": 146776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558888, "uuid": "c3fb08f5-29b8-4335-8c03-d0af075d38c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558888, "uuid": "5ce9aad9-cde3-481e-b6ee-f42fa892b40e", "value": "2022-1-26-fbdee9aa5e8ac1e84b516971bdee979a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046cfad7-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561122, "uuid": "a1b25807-c80e-4e06-8426-b4b24f79d9cf", "comment": "Malware payload (SilentBuilder)", "value": "aec01f5188ee92b713b6c9f26b7a67f1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561122, "uuid": "3df1b054-e7aa-4462-ade1-63e66eb12a71", "comment": "Malware payload (SilentBuilder)", "value": "0a6f5df04ac31d195b367477d91e4cc9acb640a99fd71dede2d640d8e4301142", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561122, "uuid": "807c5707-52f6-4a96-bae6-76fa50dc99b6", "comment": "Malware payload (SilentBuilder)", "value": "a9aa6c536ba08ebbbd69bd9a6334984839d319d8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561122, "uuid": "bca2069f-9078-4676-bc21-dc09d54afcbe", "comment": "Malware payload (SilentBuilder)", "value": "9fa45f4d31332dea50e5c0c3246b07bd45e5ed709c73257dfcbd51c9b8999406d010ef1e51305caf3b6f6cde7af12192", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561122, "uuid": "a498286a-db4a-44ee-bb24-2ec79aabbc15", "value": "T184934B1BA98648C5E66D47F4E0625AE9BE63EF45FA433ED321107FC63AB41434C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561122, "uuid": "89c3374b-a6bf-4de1-896a-294632c11640", "value": "1536:8xIk3hbdlylKsgqopeJBWhZFGkE+cL2NdA/6yH5Eb7EdrpFkkGX/sGC6ORQQDBh+:8Sk3hbdlylKsgqopeJBWhZFGkE+cL2Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561122, "uuid": "fbfa6c95-dca2-44cf-92de-7ebc10553bbd", "value": 91666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561122, "uuid": "bedd638c-afd7-40be-bbfd-b16e571b43f4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561122, "uuid": "5f12c1f0-9d41-4f00-898b-5db6330abce7", "value": "2022-1-29-aec01f5188ee92b713b6c9f26b7a67f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d26c03-8207-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643572927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572927, "uuid": "e265921b-5595-48dc-b070-fe986cc1718c", "comment": "Malware payload", "value": "fb214a22f258ba87a442bd33ae0ba674", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572927, "uuid": "9238682b-ee20-4b6c-92f7-e44c4a6e58b7", "comment": "Malware payload", "value": "0a80830881cc46dfa44e91b6153c0fdf1e10f2e0b150c954cb5933eb964168f9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572927, "uuid": "4ccb4e45-e55b-4839-abda-3020ed99ae67", "comment": "Malware payload", "value": "e018a793ce9cb83e2191522937c1cf32473c49b9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572927, "uuid": "8c4a39fd-7f10-4019-8245-9082407025d4", "comment": "Malware payload", "value": "6e9012a152f43494c01e8ecdaab9b8dd4fad37cbe64fb676a8e11fa2cd7581b66454ee067cc811f42faf92b963f64bb2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572927, "uuid": "4647ec8f-38ce-47ee-82c2-681d5bb14949", "value": "T185F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572927, "uuid": "2446ddbd-df08-425d-8ffb-f5c8a193880d", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572927, "uuid": "dc3938ed-9faf-4b0c-a4fa-2ae2de83abd1", "value": 159072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572927, "uuid": "05e6e965-7c7d-4168-8dee-794f94dffca4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572927, "uuid": "00d21b47-a873-41c7-bb38-437eba7c77fe", "value": "2022-1-28-fb214a22f258ba87a442bd33ae0ba674.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fd7f15-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570926, "uuid": "52276491-7abe-4a17-99e1-9dfce6e035c3", "comment": "Malware payload (SilentBuilder)", "value": "c077f8c83e3bf977e6650e8a4834a7c3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570926, "uuid": "c2331f33-d815-44ad-90e0-7070f4dfede9", "comment": "Malware payload (SilentBuilder)", "value": "0a916b494809abd2c2746f3bf3f396c0f685b4e18de787e67f8c99218e1f6970", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570926, "uuid": "54f53693-6acd-4284-bbb3-797752bb9d15", "comment": "Malware payload (SilentBuilder)", "value": "0e753ca0ed9f1c8d4a1dacc28c9c28618130b659", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570926, "uuid": "b5fb87e6-36ef-4f3a-9c23-aca16fc80fc2", "comment": "Malware payload (SilentBuilder)", "value": "759b8a2c67f6fdd052c930795db58848bb1146080861854125033c49b72e13f241fcc95cea5568982a3dbdd7789d6a8c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570926, "uuid": "35b826ea-7de0-43c3-bc2f-0b7796d1ce31", "value": "T15E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570926, "uuid": "97d32f49-1b7c-4a44-8332-51e83237c25f", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570926, "uuid": "d3bc9250-58c5-4aa8-83f1-ff689b91e913", "value": 87110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570926, "uuid": "3533e108-e211-4145-b6b0-2b6f645db0f0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570926, "uuid": "d9da76fb-fc3b-40de-8c83-3043e7c2161d", "value": "2022-1-28-c077f8c83e3bf977e6650e8a4834a7c3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef3193b-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559127, "uuid": "b518ccf8-1c19-4ce0-b3f7-2f5a5de4c6fd", "comment": "Malware payload (SilentBuilder)", "value": "0ca0efabe752d867f8511224308c3ec5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559127, "uuid": "1bc662ec-b923-429e-b707-1d0643c3f456", "comment": "Malware payload (SilentBuilder)", "value": "0ac816383fca8efebfe4bc81500588beb9ab3b075257ef81d2835b62e0fb05c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559127, "uuid": "3d8f71ce-7a3d-484f-a571-06776ae9e6e4", "comment": "Malware payload (SilentBuilder)", "value": "7484bc6909cec459ffea88a7c52e3e729b69e6be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559127, "uuid": "b89df675-c0a0-4f25-89b9-a361c5eb73ca", "comment": "Malware payload (SilentBuilder)", "value": "ac0fd5d7aeb397f673669e542f5aafe376e20005588aeceb7e978ec93dd1883975329b6188459a6bbd15d7b9db871487", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559127, "uuid": "5a45a5df-1e6f-4498-a5a6-ce8f63fbb367", "value": "T141F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559127, "uuid": "82d43447-86dc-4f7b-9860-050de24e5f8b", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559127, "uuid": "7dde9199-4f01-4802-90b9-f6d37cd89969", "value": 36994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559127, "uuid": "ffdf197a-a19a-4db4-bb4c-6ab6baaeb8b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559127, "uuid": "e9226e34-ff52-489a-84e7-370b53e2335a", "value": "2022-1-28-0ca0efabe752d867f8511224308c3ec5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d27f62-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570785, "uuid": "8fbd5d20-50fa-4d20-aabb-37e9937d427a", "comment": "Malware payload (SilentBuilder)", "value": "ba291d86b71d9506f0349405fea92433", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570785, "uuid": "2f0134e8-1a9f-4d2b-8842-fee97be16208", "comment": "Malware payload (SilentBuilder)", "value": "0addf8bce65117d303d7b0a8f9e20e2a6e6266c61332613f84855730529c4352", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570785, "uuid": "2f8ee276-568d-44b2-a3e0-7e02a6984317", "comment": "Malware payload (SilentBuilder)", "value": "eb66376a50491f93caea920f49f59e464c791eed", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570785, "uuid": "d248cec7-9635-4c89-87aa-60742b37a3ec", "comment": "Malware payload (SilentBuilder)", "value": "9a59000c386a0aaf30fe180f4cb908a970f32a65079062c14bb7bcad7c51cab79a1024c010fda0158d5f41748fd32cda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570785, "uuid": "f58b520d-60ef-4d42-9715-7c3d1ddc7db0", "value": "T10DF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570785, "uuid": "b249596f-cd37-404a-b186-b6dde93f5d9e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570785, "uuid": "f47d337c-d142-49b1-b5f0-c42fe9968d5b", "value": 158919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570785, "uuid": "3881ad2c-79ec-44aa-b6e1-7734b3f83884", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570785, "uuid": "b9101be8-95b4-4077-a7cd-f83ab55d88af", "value": "2022-1-28-ba291d86b71d9506f0349405fea92433.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb017c43-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570019, "uuid": "4e4a8106-c934-43d6-bd0b-e3902ed4cfa9", "comment": "Malware payload (SilentBuilder)", "value": "a1465b9e27030fa71b863fcbbe264405", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570019, "uuid": "6cfbc6ae-40b8-49dc-a4a4-f6421128620f", "comment": "Malware payload (SilentBuilder)", "value": "0aeb1fed2a92309d35b4c1ee2f5a18ad9594fd5382f4ab9fe6fa431e9a426548", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570019, "uuid": "eaab1559-c590-4d39-be54-ba0cc8993a31", "comment": "Malware payload (SilentBuilder)", "value": "072615acb803b2f602222ba683b72ece4b1c5fec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570019, "uuid": "422df30e-9805-47ed-82ef-94a4f55ce951", "comment": "Malware payload (SilentBuilder)", "value": "a51575ce52fc314682d81e9a8616fceb5bada20daeb24e5e9098f96f65d060881e2bb3580b2e354df1a415bba4daab2d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570019, "uuid": "994994d9-5e75-4e20-991e-570148bcc45c", "value": "T1F0233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570019, "uuid": "364a7306-3baf-4d6e-8ed9-9177bb031294", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570019, "uuid": "bc59d83e-80e4-4fe3-a869-d4b20e70cae8", "value": 47775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570019, "uuid": "efd95a89-7deb-4d6b-affd-19f6a3ec2ad7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570019, "uuid": "c0d2aa14-f1ed-4d77-b93e-d7303b4948c5", "value": "2022-1-28-a1465b9e27030fa71b863fcbbe264405.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9de8903-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569641, "uuid": "c5ae4b4d-62b2-4fe7-92c6-bf5c1ce33e22", "comment": "Malware payload (SilentBuilder)", "value": "94ce7de79819a4087f762705d8aa9e1d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569641, "uuid": "be9e2d57-f79a-45ce-8980-20032817f06a", "comment": "Malware payload (SilentBuilder)", "value": "0b0b4cc2250472334bf9715053c37395b86bdd06e10c20eb58b10fb16c40e035", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569641, "uuid": "3c48a877-601b-4393-9409-f643f13e054f", "comment": "Malware payload (SilentBuilder)", "value": "c902398329b834b05fb6a1a689efb287f0638ef6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569641, "uuid": "a7ca16f3-adb1-44d5-8dc2-a83bd279b54c", "comment": "Malware payload (SilentBuilder)", "value": "d6342ee0ebe66adcbfdd39141f86b117d960399a2be6ae284817aabc23daf7d9f4f0d2d724c2302e7203f9a378e23eb9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569641, "uuid": "17d3e297-edc7-4fdc-b7a7-5e674cf304e6", "value": "T1A0F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569641, "uuid": "8e34c2f6-343b-4857-b96b-c4a2d7ba90aa", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569641, "uuid": "12ecd26d-db5b-49d0-8dcc-2c6a4c253db8", "value": 158489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569641, "uuid": "36d4a3dd-674f-46c6-b2f1-f352bb7c6135", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569641, "uuid": "18e145f8-7626-43dd-a68b-e96b0a10fd2f", "value": "2022-1-28-94ce7de79819a4087f762705d8aa9e1d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752cac9b-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571619, "uuid": "c700d2e6-2cf5-46f2-8307-14412702c99e", "comment": "Malware payload (SilentBuilder)", "value": "d424611267d7ff1cdd923369de3a42aa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571619, "uuid": "66e144b4-5108-46ec-8e2b-ab9d4ee291ed", "comment": "Malware payload (SilentBuilder)", "value": "0b0eab9351805ef6dd6a596e0ecf43e3ed8d786114ca26ea1fc7e5c9de45953a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571619, "uuid": "5c178bd9-411c-4adc-8bc0-53acc66a4947", "comment": "Malware payload (SilentBuilder)", "value": "d39ecb055f1778e9e206d33224a076bf1bf8d7b8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571619, "uuid": "a910ac4a-88c2-44f1-be71-a5e2f9940f09", "comment": "Malware payload (SilentBuilder)", "value": "aa7ea6f6a2bb1078a93bcb078031a9e931bb092dd57be63404e4f193da8b28512de79d637dfb6736dcdc499ab67f149a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571619, "uuid": "a0803524-8817-457a-b261-5e0b6023f6cf", "value": "T10B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571619, "uuid": "eff9411f-c7f8-4bc5-a652-355e5cb245c1", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571619, "uuid": "567ba1fb-f36f-4c40-8cc7-3db2551fe3a1", "value": 48186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571619, "uuid": "b7cc7fa1-c8cc-45c0-a845-fc27494ee132", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571619, "uuid": "69a923ab-f22b-4554-9686-595352464ce7", "value": "2022-1-28-d424611267d7ff1cdd923369de3a42aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4a4af8-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576191, "uuid": "0b174903-a8fd-4c30-ba9c-a792bb7d7e09", "comment": "Malware payload (SilentBuilder)", "value": "eaa0d7aa0d3b17e3ca01bda37a3b38d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576191, "uuid": "c44e17b0-351a-4355-b33e-70b294c4df7f", "comment": "Malware payload (SilentBuilder)", "value": "0b159d484081852ea995dec260457e45663df666a10728196e8cd5b9c413cc50", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576191, "uuid": "f029e70a-b3c4-48a8-a698-c011eed4c771", "comment": "Malware payload (SilentBuilder)", "value": "7df1d442fb360f434dd8be7851e42c1f24f8946d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576191, "uuid": "162a8685-73aa-4364-b19b-1bce29d7d4ec", "comment": "Malware payload (SilentBuilder)", "value": "994df5ad18746a6c9fb9504de2896f56244b01569f06baf4217f540cdee8ef98c376572ff2c25d84a92b0332fa8a5447", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576191, "uuid": "56eda109-6c39-4cdf-86e6-42d42550f066", "value": "T1D4934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576191, "uuid": "d9d68755-b59c-4284-832f-d622b25aa7ef", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576191, "uuid": "01b6d9fd-f4f3-4800-87ed-eeb7f05a8894", "value": 93160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576191, "uuid": "ea4ad803-3416-4635-9e54-56fb4adaf5d9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576191, "uuid": "3c4992bc-141d-4a04-ad99-6e7f27247f8e", "value": "2022-1-29-eaa0d7aa0d3b17e3ca01bda37a3b38d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cb3c7f-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562297, "uuid": "b434bc3d-7c87-42b0-b53d-97bd9a5d4a64", "comment": "Malware payload (SilentBuilder)", "value": "a4beb0890cb525b858c06599dca8213d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562297, "uuid": "b2653e6b-205a-40e3-8a37-9d819a63991d", "comment": "Malware payload (SilentBuilder)", "value": "0b22d5ef2773af7e591747bfdf41b49cbf7fff37766ef26a9e4a02059cad450c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562297, "uuid": "ddf732cd-2810-4d88-817b-70b3054ed80a", "comment": "Malware payload (SilentBuilder)", "value": "ebe06ef4d37ea739afd25426342a08a38e5d21fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562297, "uuid": "41365e0c-6350-41a8-ae91-565262dfb6be", "comment": "Malware payload (SilentBuilder)", "value": "b2bc832f0080d137ffc1319ce3046efb57447660cb353a289468e5f6cafd10a61dfaf3bc5e598ea50c26c4f2705fca8d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562297, "uuid": "8bfa46b4-94bb-4cc6-8d03-687ab8a924d1", "value": "T1C9131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562297, "uuid": "09ca9cbd-5052-48e9-b9bd-ea537818fc33", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562297, "uuid": "acdf8482-bcd7-42b5-b5cc-2a574c493f87", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562297, "uuid": "d7acd306-d1e7-4bb0-bfc2-d5200179f7c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562297, "uuid": "810ffa52-3180-4003-9254-8f50b0efe3d1", "value": "2022-1-27-a4beb0890cb525b858c06599dca8213d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a379ff71-81f1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563537, "uuid": "1d3c47be-aecb-4d12-aa89-03b9e3b8407a", "comment": "Malware payload (SilentBuilder)", "value": "cdcf1e14e532500cace527b87bd3a2f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563537, "uuid": "2a4a361b-7e73-4410-9305-5b00c36d2bbb", "comment": "Malware payload (SilentBuilder)", "value": "0b423f21619e9155d4b1053846dea84a0bf7ae41cba7c8e55c8771694286134e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563537, "uuid": "921963ae-cf9a-4f10-84f7-355dde05a925", "comment": "Malware payload (SilentBuilder)", "value": "65ec2a6014e22ada322348e3528ef0a85aa2a7de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563537, "uuid": "824f5009-d5ba-47cd-abc5-eb798e927dd4", "comment": "Malware payload (SilentBuilder)", "value": "438b4d607983c3c60f827b588ebdf33ef38155678f716efb69436d8c5280c6bdd818f6cee0f4fedadc32a72e6ab10d9f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563537, "uuid": "0f8b0333-320d-4d44-91cb-02c8a0b87c81", "value": "T127735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563537, "uuid": "902142bb-8706-4c4f-933f-d9abd56b4b67", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563537, "uuid": "12cb3702-36a5-43c4-adb3-fd47d0030e29", "value": 78286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563537, "uuid": "a830e51f-4582-4a36-bdcf-884141188809", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563537, "uuid": "76e6018b-8bd0-4b47-afb0-c95f14a5ee35", "value": "2022-1-27-cdcf1e14e532500cace527b87bd3a2f8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91a915d-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643575653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575653, "uuid": "ff7823f7-72a5-4a96-9bde-ad7439e21249", "comment": "Malware payload (Heodo)", "value": "befcb7364e25974fd182f5ce2c430733", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575653, "uuid": "a5230633-931c-4afd-acae-d0478d0ab83e", "comment": "Malware payload (Heodo)", "value": "0b48ca49ac4c18a58a2f58ad8ed6c278ea56aa14e45b9b5f787ce91e18233748", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575653, "uuid": "382b443c-bf60-4f5a-82a0-b144b34bf73a", "comment": "Malware payload (Heodo)", "value": "9dac70581baa0eef18085e68f2f9da2284deac1b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575653, "uuid": "bc436d08-d9e3-4062-b1f2-dff0f6751030", "comment": "Malware payload (Heodo)", "value": "365029c5a2e6509b108a58f9cd7107e8d49568166c2a14798c69e92a564ab67564da4bead5af396b7967f0fdc42408a2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575653, "uuid": "cfa1839c-6a7c-424d-ac8e-54b0a39e8f33", "value": "T1B8934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575653, "uuid": "8a8a957f-bfc6-4275-a30c-80eee4e3fe19", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575653, "uuid": "9c0f880b-8db5-4124-a890-82f5b0cab266", "value": 92899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575653, "uuid": "48296009-9d23-4245-9d3a-f069fe8a5ed3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575653, "uuid": "03f460f3-bafc-41a8-8e42-cf90950539bb", "value": "2022-1-29-befcb7364e25974fd182f5ce2c430733.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bda22f9-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558128, "uuid": "356a05cd-822e-40e5-b037-6c595305b5ae", "comment": "Malware payload (SilentBuilder)", "value": "b41d25868cc290aea661d2ed79599195", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558128, "uuid": "3d045494-10e5-4397-9961-10c74729fe4b", "comment": "Malware payload (SilentBuilder)", "value": "0b505368f2a99d2e6285fa9755207db2b98aa0b5b8f03b59f4d96ab2ebd7dcac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558128, "uuid": "869cfa83-5b8e-4bc8-987e-666d4620e3a3", "comment": "Malware payload (SilentBuilder)", "value": "89d5683550069c4bdc77651528e5429022055145", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558128, "uuid": "9078b8ba-2c27-49e4-9baa-6fc7f7c30d00", "comment": "Malware payload (SilentBuilder)", "value": "3f10a249f38d2d7f2e3c8b1f85a448027fa578d8dfa00ef448cca6be775472895678067a53677ee94b0a6d61c76bd0a2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558128, "uuid": "8f24a862-b093-407b-8c65-603f00193549", "value": "T10EE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558128, "uuid": "64046a7e-3399-4fa3-90b9-98d8f64a752e", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558128, "uuid": "c9c4b09d-ac17-4e08-aee9-c87d6b50c4b7", "value": 147049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558128, "uuid": "532a42a2-2d09-48f9-920d-b7bfbeb3096f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558128, "uuid": "cf6bb87e-c4fd-45fa-a477-450c94ce4de4", "value": "2022-1-26-b41d25868cc290aea661d2ed79599195.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7bf2b4-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566479, "uuid": "124a57f6-661c-4658-98c6-2ca0735fe8aa", "comment": "Malware payload (SilentBuilder)", "value": "24199298c3251dd2909363508c5aa8ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566479, "uuid": "f9b5009d-3e26-4cc4-bd2b-add3a7d65a8b", "comment": "Malware payload (SilentBuilder)", "value": "0b5b3a39270eb57e07101538b9a3379113d895fb62bdb9c6753b588242dd1293", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566479, "uuid": "d6dfecfd-59a8-4b90-9c16-af27039c0902", "comment": "Malware payload (SilentBuilder)", "value": "a573f852410e8cb7a8013a2d5e6e19f779f016a8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566479, "uuid": "c3af090b-2ad4-41e0-85cb-8a15a2d7f126", "comment": "Malware payload (SilentBuilder)", "value": "3afefe6eaefcc6fef2bde44b1805188095d4d2478f7b2e09de6b3716a287e332375dde888b32b8365760af870869e298", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566479, "uuid": "ca7221d8-bea8-486e-ab85-92ce2846b3bb", "value": "T17A233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566479, "uuid": "791780c7-3c4a-45df-9256-f97be4ca4fad", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566479, "uuid": "f20e2acf-b2b0-4659-9684-89061765300b", "value": 48630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566479, "uuid": "0da71f1b-2d0f-4708-90fd-40c3aacefbdc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566479, "uuid": "9ed38bee-4b25-4a9d-badd-4fc3e02aa970", "value": "2022-1-28-24199298c3251dd2909363508c5aa8ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffc11bf-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573221, "uuid": "2aee92be-2dc7-47c3-8a3a-f78e646ec2b4", "comment": "Malware payload (SilentBuilder)", "value": "0604dd4eee5d1505e9138a239c67c594", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573221, "uuid": "a78fa81f-8d46-4691-813c-0e63ff28247d", "comment": "Malware payload (SilentBuilder)", "value": "0b66a46dacd9a146845ac97fc13e2afc31b6ce3d81faf31e9acc1663ee9a1153", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573221, "uuid": "cfaecd90-5ac5-49e1-a193-65087a24e6d8", "comment": "Malware payload (SilentBuilder)", "value": "350989f417c01d7476c6f53233f479987b96ef26", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573221, "uuid": "a747953c-e323-42e4-be62-966b1025e3e2", "comment": "Malware payload (SilentBuilder)", "value": "86f13a8b4b0dd312ac5950196c2d84675c8d71773f3a1139694e156331780c66385542ab7c95ac9771f2ee4f717012f7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573221, "uuid": "70f2adc0-0f26-48ae-8a58-6a5d3e25febb", "value": "T1D4934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573221, "uuid": "a27b538e-4e8f-45c5-b7e5-2b2228696538", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573221, "uuid": "f22471af-35df-4824-9a23-72bfdb73ed9c", "value": 92906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573221, "uuid": "c6c604d2-7fe5-4891-afe8-808a59093aeb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573221, "uuid": "e9c77633-c609-4504-8375-8b9f056b3498", "value": "2022-1-29-0604dd4eee5d1505e9138a239c67c594.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc01c72a-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643561860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561860, "uuid": "b058aea5-1ce5-430b-bad6-5a5ddb29fdbe", "comment": "Malware payload (Heodo)", "value": "195e9560f7b29838d193bcc1c44e8ec7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561860, "uuid": "12b0f1f3-7b97-48c7-bf22-7e656c4f5c3f", "comment": "Malware payload (Heodo)", "value": "0b838ceae1bd3e85e5d256519815ca6d103f56c30565cc707668af384c1b308d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561860, "uuid": "cc581ea7-8bc3-4fca-bc4f-a3a57075e204", "comment": "Malware payload (Heodo)", "value": "8e7e6a23fd918e500e995acd7a49ce44f9336904", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561860, "uuid": "f1edcf9c-9917-4b9d-ae7b-8c028de2416a", "comment": "Malware payload (Heodo)", "value": "5e1b21ab732f853d77b4a09e4f466c1394039b20ffaca8360d79a6a63c9170b4fa1242e63850dd6240ad8ac2c1209baf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561860, "uuid": "3ef14d55-af30-47b6-87b1-428c99f9c159", "value": "T1CCC49E3D72A0A435C27A34F535F9A2B785AFBC524B29429BE7FC212B1E3D5414E3460B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561860, "uuid": "b1868381-3d71-48ed-8994-5226d551e159", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561860, "uuid": "f7764a5d-4bb3-4ee9-b765-fc0b345faf03", "value": "12288:G5Yfb6SGkFIPbKq1r26JQ6DraMA0ZaC87:GK21kFIPT26ZD2MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561860, "uuid": "eac20d31-3914-41c6-8fbc-3f0b4143d814", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561860, "uuid": "4eede8c8-26bc-4f18-a07f-b69ed1157588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561860, "uuid": "9a876bfe-9983-4755-801f-196b2ea9c122", "value": "Milossd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcf547c-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572443, "uuid": "f398eaf3-c14a-4c13-8bc2-24438b2de92e", "comment": "Malware payload (SilentBuilder)", "value": "ece179c1d30cbda14ef77d42c4f6f375", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572443, "uuid": "0fff6a75-ac62-4298-a441-8723b5ed58ed", "comment": "Malware payload (SilentBuilder)", "value": "0b8b57099cf7f30e40414cb93e811c3b01d2e56aff771741cb699aa7c4a05663", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572443, "uuid": "fab8c05a-ca2c-4421-8f54-741bcb0788eb", "comment": "Malware payload (SilentBuilder)", "value": "0af4b5c83c1a5afa4ddc2aef2b57209ae4932773", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572443, "uuid": "deb08023-4715-438e-9370-510013f3aefd", "comment": "Malware payload (SilentBuilder)", "value": "7fa36a8844878f98c4fbb2c281c75d4fbe219465f1161e6a2792ac351cb69593fb1b6e4bd228b4df53aa22352859b8d8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572443, "uuid": "8d819677-500c-465d-ad3f-49cb61ce3042", "value": "T1B3233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572443, "uuid": "ac44ea83-ec75-4b32-a136-5e7982decfcc", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572443, "uuid": "29ff90d6-b7ee-46c3-8e7e-d8b67f2807a4", "value": 48526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572443, "uuid": "51b5cba6-ea75-4516-b7d6-24e7fe8b8b5f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572443, "uuid": "1caebb26-ecee-458c-b356-5f26ef455ba6", "value": "2022-1-28-ece179c1d30cbda14ef77d42c4f6f375.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fd08ca-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643574627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574627, "uuid": "f95ecc40-1ff7-4d61-bb99-2f397de7f35c", "comment": "Malware payload (Heodo)", "value": "76b4717abca48c2418dd7a5c13c612e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574627, "uuid": "b2879bc0-5e4b-43ed-96f9-3de196b4f3c4", "comment": "Malware payload (Heodo)", "value": "0b9b6dceee5e53a2e333f0dc45b23ca7ca4b309bf58698851eda18b020024a9d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574627, "uuid": "1079849f-63f1-4399-b4de-720c7addb8e8", "comment": "Malware payload (Heodo)", "value": "b88e5c54778344fd93591ea3f827d9748e1cb56b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574627, "uuid": "a251f127-8af8-49c8-afe1-70c53c2095e9", "comment": "Malware payload (Heodo)", "value": "3594651b4b453b7a0178646c8283929ff73534580ee2bb203079660a749c711a1b30789e8389dcae192f9a0f2fc5171a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574627, "uuid": "aea73989-df1d-4710-8da4-8934ce80f1e1", "value": "T152934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574627, "uuid": "a24fabb1-d104-4519-82cb-a75ce3181e5b", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574627, "uuid": "d00b17da-8aae-4b5a-8d23-eef08e63369c", "value": 92161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574627, "uuid": "74aacfc7-d03e-410f-8718-f0d242db1e30", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574627, "uuid": "0285d525-dfde-443a-aa3b-10f16f0498de", "value": "2022-1-29-76b4717abca48c2418dd7a5c13c612e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea697b1-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558482, "uuid": "d9fe3247-9216-445a-b208-eb32ed55183e", "comment": "Malware payload (Heodo)", "value": "29d29988f313155142ef4695a4920d10", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558482, "uuid": "5bfe6619-14ae-443f-9886-3206a40849d6", "comment": "Malware payload (Heodo)", "value": "0b9f00ba49da4827b0c0e238b16873e7868f91129cd9c7505aa8f70efaba2cae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558482, "uuid": "1392ede0-745e-42b7-a365-9398e60ea3b4", "comment": "Malware payload (Heodo)", "value": "8dfbf4d28f9e1b0d7789e83d904718bc5ef9f682", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558482, "uuid": "7158e0ca-c9a6-437c-b29e-f548fff03ac8", "comment": "Malware payload (Heodo)", "value": "d721ba426ea831237ad92ebae67d8d4839c30c3749844b5f08f771edadab77b971ca67f11ef8d12d35f0b4d54a5ce659", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558482, "uuid": "4b9b963c-ca2d-4ac7-9c37-0ddb0cde5e77", "value": "T119735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558482, "uuid": "17d01242-e9c1-4b4e-a5d4-bcf0b88b2b2d", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558482, "uuid": "42a57b92-d339-4a63-83bb-fdbf7232831f", "value": 78017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558482, "uuid": "4720d50c-29a5-4140-912c-228e8adca8d9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558482, "uuid": "95676c3f-d18f-4ae6-9954-f974f0380c48", "value": "2022-1-27-29d29988f313155142ef4695a4920d10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9b8d0c-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643569808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569808, "uuid": "9b7c4a80-087f-445e-a1e5-4154df9b67fe", "comment": "Malware payload (Heodo)", "value": "99ad1dbf5331f2ae242652130b04923b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569808, "uuid": "43ed56d8-ef3e-4ba1-b5bf-7c1d5ca14de8", "comment": "Malware payload (Heodo)", "value": "0ba4cf1b7e88c512fc1ffa966be6a5edca8012f992927c04e6399f3c7c6eec89", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569808, "uuid": "7d0301a6-46c1-49eb-b5fd-984412343c46", "comment": "Malware payload (Heodo)", "value": "67f81f9a6ba87395f8bd4fb7d5abd1ce56a2a3ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569808, "uuid": "665cf182-bb1c-404c-8235-3e2c5b6e3be2", "comment": "Malware payload (Heodo)", "value": "ae5decf4eedb3ec1ebf91a266a872c4f9f0ae82d4432e8f155f6a72ae6ec8ecd91e9b672a49cc3eab6f00c683bdeae8a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569808, "uuid": "b624db24-d2a0-4ae5-9cfb-a0d0dfecbc22", "value": "T1E0233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569808, "uuid": "f93a2dca-c8e3-40c0-bd50-f7bd2c02dee1", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569808, "uuid": "09741423-46b4-4f3f-abaf-fb5e7d49c2b2", "value": 48084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569808, "uuid": "6195cf02-313a-44b4-8047-921b1342d44f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569808, "uuid": "1e695284-51a0-4160-bfb5-853006c4bdf8", "value": "2022-1-28-99ad1dbf5331f2ae242652130b04923b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f40dff-8209-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573819, "uuid": "b89fb569-2175-4d21-a987-642fdfb72d5f", "comment": "Malware payload (SilentBuilder)", "value": "327310d518e6b8f334b30b6adc41b079", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573819, "uuid": "6a09aa87-cac0-4550-8c02-54263d5135cf", "comment": "Malware payload (SilentBuilder)", "value": "0bbe745d5bffcf2f086785d870607a4714e91d52299edb6a328166dbd0b7a4c3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573819, "uuid": "f19c9572-4fad-4fb1-93f8-bee416ffbe6e", "comment": "Malware payload (SilentBuilder)", "value": "ea70e2df0867476c1e7b0bad578e87ad81217576", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573819, "uuid": "f8cc8d8f-4925-4baf-901c-fa6258aa595d", "comment": "Malware payload (SilentBuilder)", "value": "d306af97c5a6f93a99f529527f0b4cdc4ac0afa782c7cfa12aaa5b667e492418bedb7476f5777590cca1eb76737947b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573819, "uuid": "b30b91b2-2105-4f8e-b410-2d51076a9ce7", "value": "T1BE934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573819, "uuid": "3df2d65d-a109-4b6c-a64b-3d03b6fe1f33", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573819, "uuid": "1ea0524f-de2f-4aba-9f9b-d83ef6cc2eaf", "value": 92905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573819, "uuid": "7099e1da-86cc-46e9-877c-906846eec2cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573819, "uuid": "dcf6708e-fb33-4483-8fe8-91b91880cac8", "value": "2022-1-29-327310d518e6b8f334b30b6adc41b079.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448f4c4b-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572397, "uuid": "0a551728-82f7-4ead-b03a-bff61a423c33", "comment": "Malware payload (SilentBuilder)", "value": "ebc260f8bb111ee6ded0d709160befe3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572397, "uuid": "22d14834-192f-4c7b-b99b-88da5fa63846", "comment": "Malware payload (SilentBuilder)", "value": "0bed90cb885b34931718c49087cbc01c957e5b6cb3d6409cd1a8bb774c46251e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572397, "uuid": "8d9fcf62-3624-4828-ad7a-4c603b8aef80", "comment": "Malware payload (SilentBuilder)", "value": "5df01040ef7e1baeea6c92b7ec89c726ac96d994", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572397, "uuid": "f452e760-e7cd-4b92-adaf-ccb9ba69b204", "comment": "Malware payload (SilentBuilder)", "value": "ca6ca0b9e51a6a8edcb33edbf149dc4f60e55748d4b8665fc2d2a9e589e936f1afd6aff1229a8492663d256bbf59942d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572397, "uuid": "3251b920-c6c1-40df-9980-f3a8ec07c33e", "value": "T19CF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572397, "uuid": "56beac53-9030-4307-bbc8-16e489d4fa51", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572397, "uuid": "4280c8f0-f5df-4b88-9530-45b3859bedfe", "value": 159302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572397, "uuid": "39cbe474-f50a-439a-a19b-b21b17df7716", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572397, "uuid": "b511ebaf-21a9-4510-8430-17c005787dcf", "value": "2022-1-28-ebc260f8bb111ee6ded0d709160befe3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e247980-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566427, "uuid": "28c26eef-2bdf-430e-89f7-30239c473ca9", "comment": "Malware payload (SilentBuilder)", "value": "226970046fc37bfd5eb0f447fe7396d7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566427, "uuid": "afb81962-56cb-4947-b9a5-50e25df0ffbf", "comment": "Malware payload (SilentBuilder)", "value": "0c03554709fdde064333945370a92bed630828ac07b1eee7b87571b9a9d1ec45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566427, "uuid": "44b7cf70-b6a6-457d-9293-2cbb56f5370e", "comment": "Malware payload (SilentBuilder)", "value": "07ec093f476988b0b4b83abc797fc7bc4067e3b6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566427, "uuid": "7960459f-2b92-4f17-ab16-58e3cf8a9d1d", "comment": "Malware payload (SilentBuilder)", "value": "d57451d6f98eb788d8e8890fe7e169605e5f299ced319f9bc8c24a9bc7e0a0692b262f3f2777c04d1938c1bba80578ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566427, "uuid": "a286c5a3-c972-4a65-a000-a84ccab59cad", "value": "T1CAF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566427, "uuid": "955aa5ce-b30c-404f-bbd0-469b61354963", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566427, "uuid": "813f20dd-2be6-4237-8fa1-c5df50db89f0", "value": 158839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566427, "uuid": "2799e681-dcbd-4722-b5df-b27d7f807a9a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566427, "uuid": "241b9ad7-315b-4c72-9e7a-56194d16dc03", "value": "2022-1-28-226970046fc37bfd5eb0f447fe7396d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da298eb-81e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557058, "uuid": "33fad411-6c2b-4e67-972d-4c4fdfbf45db", "comment": "Malware payload (Heodo)", "value": "5bbd2204325698acc02fd312d6cbe93c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557058, "uuid": "f4f8d9f8-6710-4182-8042-1237a6587330", "comment": "Malware payload (Heodo)", "value": "0c25307f12be0dfa0137b6b0316f5317342ffd7999a1716f51a3bb8b6f47ff10", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557058, "uuid": "0ab7b582-4e88-4744-9694-2586e379ae69", "comment": "Malware payload (Heodo)", "value": "0f555914d12bf3e3a14097aa880847ea1caecca5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557058, "uuid": "eb0c8601-8e51-476b-b8f2-80556d32597e", "comment": "Malware payload (Heodo)", "value": "81c5dbc4d486e91239257f42f23e5e75e813585a39aa182e786634cb245a92947b35eb91d3924a748df0be1f8a1327f5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557058, "uuid": "5189fe39-87f3-4a6f-a2e4-2456fae3f6fd", "value": "T1A6E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557058, "uuid": "856e4fbb-66aa-424f-9b8d-1fe3c61b0efd", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557058, "uuid": "c8ee776e-6ff0-4a05-b175-89dfd9cf0ae6", "value": 145673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557058, "uuid": "9ba470e9-1743-45ae-8c7b-bc31cc639637", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557058, "uuid": "f74ddd95-5990-4fff-89c6-b0bf05183891", "value": "2022-1-26-5bbd2204325698acc02fd312d6cbe93c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901d151c-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567370, "uuid": "c1dbdfb6-194e-4471-90ef-6803ea491bd7", "comment": "Malware payload (SilentBuilder)", "value": "44ae56c386f661abaae382de66ba2c52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567370, "uuid": "5fa33d0f-b2ac-46b4-8b8b-01b16f3c69c2", "comment": "Malware payload (SilentBuilder)", "value": "0c2a68421753ba0355c3f9871ed9daff6824c8ba0e28d340f2129df18f7fa06d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567370, "uuid": "de9a7d1e-513a-4947-98fd-d5ced807283e", "comment": "Malware payload (SilentBuilder)", "value": "3e99d69d231e9a7d90a222c97be2aed2f10c556a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567370, "uuid": "6255fbc4-da45-43d3-93c1-6e5307387b5c", "comment": "Malware payload (SilentBuilder)", "value": "e6934c751aa5ae7f5dd9bf5c559c33d6ecacc78457a0d8974b63fdc3a146252952d0b254b874fc997a84df55598412f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567370, "uuid": "39b8293b-9d1f-470c-956f-98669cb4ffaf", "value": "T1E5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567370, "uuid": "309dcdae-1290-4819-9487-42fc63cdcbe0", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567370, "uuid": "b57d4010-e8bd-45be-814e-6c61ca542098", "value": 47695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567370, "uuid": "7d9f50e0-5e84-4f84-9412-cfbbf1566ffd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567370, "uuid": "29a6176e-0376-49f3-b2ed-dee0ad35a515", "value": "2022-1-28-44ae56c386f661abaae382de66ba2c52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4945e645-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574982, "uuid": "25b68b67-36a8-4e30-a83d-c8ee3adc5a49", "comment": "Malware payload (SilentBuilder)", "value": "84b14f3b7281f4c712a4dba0358c61b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574982, "uuid": "7fbb9064-11c6-4530-bcb5-072a5a480897", "comment": "Malware payload (SilentBuilder)", "value": "0c51b6dce603ce4f9ce001897b2625e549f2d9e261aa671ac63ea6abe5c59a27", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574982, "uuid": "1086e656-c641-45b3-bc4e-211be03d7cbd", "comment": "Malware payload (SilentBuilder)", "value": "f927831b3b64878d7aff17bcf177abe2699a755d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574982, "uuid": "c76c90a8-57e2-4d0f-8908-2ff5b8dcd4ec", "comment": "Malware payload (SilentBuilder)", "value": "621506febaf294a4448abf70c3eb269f0b9ea0fb9963620fc4fcf4c14ba43ccfb31dc2970f73d4692f74437b27bd7f02", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574982, "uuid": "fed0769a-82b0-425a-ba37-301338f1eaab", "value": "T149934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574982, "uuid": "93b0629d-bddd-4ecb-9314-4e8b24e099c6", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574982, "uuid": "f599ac48-81db-4752-9b8d-3d6b77fa0610", "value": 93083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574982, "uuid": "2dbcdbd7-debd-48da-b629-bf2b0e3064e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574982, "uuid": "ac845074-4982-4068-bea2-52fe54064244", "value": "2022-1-29-84b14f3b7281f4c712a4dba0358c61b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f505499-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574455, "uuid": "8f6415fa-3dd0-4f67-9693-8f490cc3b5b2", "comment": "Malware payload (SilentBuilder)", "value": "69477714a3fff5ac7e2488ea1e7fd392", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574455, "uuid": "14e35e80-b587-4d1c-b5cd-3c7a5e05a915", "comment": "Malware payload (SilentBuilder)", "value": "0c52e545a0cccbd47325b9f270c512ad5f6961d424af588a88e0cb395bd6616b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574455, "uuid": "671e077c-00f6-40cc-8883-0f5a6cf19508", "comment": "Malware payload (SilentBuilder)", "value": "b6fbaf3461b989dc666db9922846b662fbb33d1f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574455, "uuid": "982249c8-9877-4ce9-ae17-4688480a1392", "comment": "Malware payload (SilentBuilder)", "value": "fbe2cd3802ad702d65431e3340c299a2b880044bf1ed26e4d8348c249cab9dbbbe60b70be33faa7eaed1e8a1dee77017", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574455, "uuid": "6adfd889-b54c-496e-bfce-09032f8d6675", "value": "T186934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574455, "uuid": "88333c60-123d-42d2-ada2-6101f51fa9f9", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574455, "uuid": "deb45d8a-b585-408a-8d9b-244a875d5694", "value": 92606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574455, "uuid": "24df1eca-d288-4c32-873b-7f2e502b05d1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574455, "uuid": "0c9a5855-310d-4033-8624-fa565cd0f7d3", "value": "2022-1-29-69477714a3fff5ac7e2488ea1e7fd392.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2cc22d-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570849, "uuid": "ce8e1df3-0e20-45f3-af78-0b3833c922ac", "comment": "Malware payload (SilentBuilder)", "value": "bbeb2041d6eb6b4250a18a0013093fe9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570849, "uuid": "edbd0c46-ef3a-42fb-8c3a-42d50819c140", "comment": "Malware payload (SilentBuilder)", "value": "0c5ed06eefa0e8674dbcb4e03b2fff219048e14da084caea056f4f9e3cc3ff6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570849, "uuid": "218eb5b2-6374-41d5-8fa3-5016b4854af9", "comment": "Malware payload (SilentBuilder)", "value": "9451072a32a012e39f60af3b49e388f30d4e4732", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570849, "uuid": "58b36a3c-0529-4e44-86b3-77cefe3e9c5e", "comment": "Malware payload (SilentBuilder)", "value": "85ccacdda813888a77d1cfd28e13d258786bcdfa83e0ccf3b4b1f8fc43570292b30d7e5d4728e321936f6499c54ce128", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570849, "uuid": "3881718a-3785-4362-bcad-c71df26d3c38", "value": "T1D9F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570849, "uuid": "a569eeb1-332f-4fc1-bafb-244204222c9d", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570849, "uuid": "54ddfd4a-03ac-4eff-81c6-987a5fdbe322", "value": 158632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570849, "uuid": "fc1b31fd-3ecb-4e3f-858c-9ac9077b55b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570849, "uuid": "178de844-aa1e-4f4d-a984-c7bec109e2ae", "value": "2022-1-28-bbeb2041d6eb6b4250a18a0013093fe9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c52ca8-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566570, "uuid": "11eff385-a07e-4ca6-b90e-4b63bb3df595", "comment": "Malware payload (SilentBuilder)", "value": "26980baaa937807459e75d434a75aa19", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566570, "uuid": "e7adeda5-08c9-4e3c-b982-9475caf61651", "comment": "Malware payload (SilentBuilder)", "value": "0cce7ccfd9419f3709d66fe83d54693f44c3d44b36f3d631765e8f994e12af24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566570, "uuid": "59a6b113-18ee-4522-add0-c886e85f2940", "comment": "Malware payload (SilentBuilder)", "value": "913a3e83c96ec2e3154c616900db90f3b17d32f4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566570, "uuid": "aa9edf37-df9d-4735-9e82-1c0c5a3c2563", "comment": "Malware payload (SilentBuilder)", "value": "42694d411e32730388121a1593a2e78da00c9879cf52bf5ed8e1e86ab5f658bd05417a88c1d2aeded4718da797ceca14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566570, "uuid": "f2274b15-a27e-4147-afef-161ac0e72828", "value": "T187233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566570, "uuid": "7ad008bf-2782-4c26-8f27-fc542698c6c7", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566570, "uuid": "c5e1be09-44bf-4542-a15d-bd4d2811f287", "value": 47847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566570, "uuid": "638c10eb-c532-4ac4-94bf-c1c933c4b620", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566570, "uuid": "303052ec-aca8-4190-ba9d-4e5df1360fc0", "value": "2022-1-28-26980baaa937807459e75d434a75aa19.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385dd305-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561639, "uuid": "e856c906-2594-4d2d-be8b-879bcac0a5e3", "comment": "Malware payload (SilentBuilder)", "value": "8bb1018e78e7358bcd39798d5901c9aa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561639, "uuid": "186ba6e4-e881-4811-9da9-ad42f2019867", "comment": "Malware payload (SilentBuilder)", "value": "0d1bcfb796ccc9f724c46d3b24c57ac10d257f9bebfa063862655916bfc319dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561639, "uuid": "2b177c45-5c04-492c-9909-44c53835a9f8", "comment": "Malware payload (SilentBuilder)", "value": "15e6653b85574cb8899205619586d41121aa24b4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561639, "uuid": "2e76e4dc-1338-4532-b401-9e0fc2167a34", "comment": "Malware payload (SilentBuilder)", "value": "cd28f45ea6901115c0dd145c3c5cb4fd0b72035b463cfd740b145e0c76a46ca379b6d52cba7bf9b53e5640699d864c68", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561639, "uuid": "69af715f-8022-4c68-94d8-67efd0412759", "value": "T1F0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561639, "uuid": "48b18c55-4370-4bdc-914f-82880623edc4", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561639, "uuid": "6480b9fa-2b44-4a0d-9f8f-d64627d8e308", "value": 77470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561639, "uuid": "1f9ee07e-b03d-4dd5-a321-b53548e19d4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561639, "uuid": "f9def825-4fe0-4626-bc3b-1dafb6f0d125", "value": "2022-1-27-8bb1018e78e7358bcd39798d5901c9aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9183a2e6-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559641, "uuid": "0fc3c43d-02db-4286-93af-8f0578d1bc40", "comment": "Malware payload (SilentBuilder)", "value": "4eedc564a3a9122719a9a3b917b16300", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559641, "uuid": "f018d49c-9e0a-4071-ae7d-549a5ec16797", "comment": "Malware payload (SilentBuilder)", "value": "0dc7b6fc634390850e88ab9aa89f7b94b50d95e3e97439b80a4c91adcd31f886", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559641, "uuid": "41908a8f-ccd2-4136-8639-6742a95b597c", "comment": "Malware payload (SilentBuilder)", "value": "add70cf7614aea5b8cf424b4a6f0a69cfa821df8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559641, "uuid": "04d5c1f9-2669-4c2b-bf40-b3036bafd5f9", "comment": "Malware payload (SilentBuilder)", "value": "d6fba5caa4a0363fe6eaeacc6ec8871d33aeb4471a34a7d1ae660196516587e3097801f075edbef4c2eac922dfdaf241", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559641, "uuid": "c540cf6a-62af-4944-b12d-1af2092bd708", "value": "T188F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559641, "uuid": "6806012f-ae86-4289-89f2-6b7b33bb1025", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559641, "uuid": "44c9ecec-872f-4415-83b4-037de76b681e", "value": 37379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559641, "uuid": "50708430-eb5f-4286-b86e-b852022ec949", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559641, "uuid": "38c03c0c-f098-4086-9468-787a8c163fd2", "value": "2022-1-28-4eedc564a3a9122719a9a3b917b16300.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc74163-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643564921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564921, "uuid": "56de8d04-fdbb-4738-9470-80b213eb798a", "comment": "Malware payload", "value": "f727033433598bf0ea0a6ca0aef8b92e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564921, "uuid": "1006e319-843a-4888-8197-0a0903acb933", "comment": "Malware payload", "value": "0dc9fed764b706fec2074b4a0e036c8dd72bedc95dd1e00e9a7c8e38ad21436b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564921, "uuid": "ab385fba-7a7e-45c8-bef3-99d8adceb131", "comment": "Malware payload", "value": "50e698c37574b28cc7ad9924693e48bbcab27eab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564921, "uuid": "c5d54d9e-a0ea-46fd-be97-5130863ffc6c", "comment": "Malware payload", "value": "d40a90aa6e800adb0fb54d55c2a64c6816e982e414367259dcf47156f14c97b376554cc074c8724542695f34b5de8f07", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564921, "uuid": "0f4b2334-57ab-4685-ad05-60654cc3638a", "value": "T1FBC37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564921, "uuid": "0eb1be0a-e7c6-4bb9-aa28-1abb8b3262dd", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564921, "uuid": "4da31186-6562-4f70-b1f2-ef6145f63197", "value": 118600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564921, "uuid": "b0b89e8f-3d1d-461e-ac9f-a98f2718f4b4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564921, "uuid": "a2b2af7b-fd19-41e4-ad4e-314f1926fdc2", "value": "2022-1-27-f727033433598bf0ea0a6ca0aef8b92e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abb85ea-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564998, "uuid": "bd9b021e-0ccf-4a6e-816c-e8b249fca487", "comment": "Malware payload (SilentBuilder)", "value": "f942ae3f4620296b73a475722921d14b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564998, "uuid": "6e618893-8b01-4f7c-a714-b9c2fea3cc75", "comment": "Malware payload (SilentBuilder)", "value": "0de3dd8236fe221049e73cd451cfe93b09733e1c04a867d2030aedc348ce4bba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564998, "uuid": "4d775c99-76e9-4404-86e6-36d98640d8ad", "comment": "Malware payload (SilentBuilder)", "value": "c59cbe2c70c9e3571763226921fcb61d5120e0cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564998, "uuid": "cd66f675-dd00-48ec-b613-3c1d3a59ffbe", "comment": "Malware payload (SilentBuilder)", "value": "68143fcf88134ba651ea4fc13c5b7074e95806bf70b6195aeb79c5203d0ede3d790ba5cda8b774eb40e1a6aa711558cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564998, "uuid": "ecabeaf0-6bb9-43bb-b07d-06e3919e8e8d", "value": "T1B3735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564998, "uuid": "726ef393-0a53-4947-bdb6-eec923c55788", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564998, "uuid": "c81ae5aa-c45e-473d-8c22-03fec084f36e", "value": 77801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564998, "uuid": "f6a0ae5c-db16-46c8-b834-164b3e0c2c8f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564998, "uuid": "309ed576-2936-45ed-84f8-7d6eebf7fb73", "value": "2022-1-27-f942ae3f4620296b73a475722921d14b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fabf504-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559101, "uuid": "874cfce7-9b44-499d-a7e9-df637a95ff30", "comment": "Malware payload (SilentBuilder)", "value": "3ef66cf2745ada47914ae140703d855c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559101, "uuid": "d3f3dfe5-307e-4108-a305-1b605352d731", "comment": "Malware payload (SilentBuilder)", "value": "0def937a8464cd45c137c64818113a38367b991908ac218877afa31508592354", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559101, "uuid": "e008399c-26fb-4794-9aa3-6dfb667f8956", "comment": "Malware payload (SilentBuilder)", "value": "59ef0be24487a94a4a787bc9470e7474b82bc3be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559101, "uuid": "e7e670a6-b9e4-4b5c-882e-c6ae1afb818d", "comment": "Malware payload (SilentBuilder)", "value": "5a61729fd5e82114fefea89c5d1d3f495894fe3a140fc26087f07db488c9b9441ff9ff2cc85005c0c1273e353f6ddabb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559101, "uuid": "40be6be7-0831-4ee8-a1e7-a370ee6966dc", "value": "T1B8131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559101, "uuid": "523be941-f651-4145-afa8-c43af3f65265", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559101, "uuid": "66cbfd36-5ab8-45a0-9614-cb5ccb01e3e3", "value": 45015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559101, "uuid": "065fe2f0-9bc9-40c3-8a70-c97e768563ef", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559101, "uuid": "81369f72-5a88-42a9-a869-4bfb31e90363", "value": "2022-1-27-3ef66cf2745ada47914ae140703d855c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281726e9-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562900, "uuid": "2c8e0422-550e-4224-b9f4-94aca70d1ee9", "comment": "Malware payload (SilentBuilder)", "value": "b9495e9cf91258fa627c381da37e61fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562900, "uuid": "45d1abe1-40be-45c6-9112-80f40ad95c5a", "comment": "Malware payload (SilentBuilder)", "value": "0e0b8e47b24e0a2bf4258f4fceb975436f34267872fb16a69b1f7bcdf076e2fa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562900, "uuid": "754e1913-1996-470d-84b0-52a5bfc6c5ea", "comment": "Malware payload (SilentBuilder)", "value": "d0555c3eb8c438d9c6e1ebf287824be85152c2a9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562900, "uuid": "b78c3364-960c-4843-af39-caa468730b26", "comment": "Malware payload (SilentBuilder)", "value": "0f2cc2046d14fa408a5d3bef805a5883383bd2e9f1c955e2c4b7626b39d8e51cb257cac275cb1f78f5571f3ae6ac8020", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562900, "uuid": "97ce12a4-a5e2-41a2-9f3b-1c3a14f7a632", "value": "T116735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562900, "uuid": "879a5a7f-0d83-4fc7-a7c1-de74ff5821b4", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562900, "uuid": "373c1fe1-11a1-4d78-80ba-05e3237a1735", "value": 77829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562900, "uuid": "25ec5a13-ae91-43ae-b2da-25aef62fffe7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562900, "uuid": "e508f905-fd8a-4c5c-a6e2-969665fb24f0", "value": "2022-1-27-b9495e9cf91258fa627c381da37e61fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1521e0b-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561493, "uuid": "82219585-e5cb-453a-9fbb-0653cab8a4d3", "comment": "Malware payload (SilentBuilder)", "value": "8609e81e368e47ff9f70c246597cf0bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561493, "uuid": "204d768d-c93d-4753-85bb-d0ba8b23ac42", "comment": "Malware payload (SilentBuilder)", "value": "0e2af78b24e60d8207c77729678aa7f623959c4bc5b8351777fd7fee8c25e55b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561493, "uuid": "dd5cb17d-5aff-46b5-a79e-63098a4971ce", "comment": "Malware payload (SilentBuilder)", "value": "63ef99bf8c3f3b948d4d2cb23a2b0a3a9867fbf5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561493, "uuid": "d2587433-91d1-4573-b7c3-ed1ac8efbd6a", "comment": "Malware payload (SilentBuilder)", "value": "740d5ca64672b7fad078ffea37b76c0533dbea61ae0410c3d84b61d244582c08bdbbd38b289e909c80f5c0031e2712e2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561493, "uuid": "5b463229-7f52-4ec9-b49b-6bbbca495a96", "value": "T167735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561493, "uuid": "a40098c6-d242-4eea-846c-e6f9af46f8ce", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561493, "uuid": "eb3d23c1-30bc-40fc-8f74-8f1bfa0fcd01", "value": 78135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561493, "uuid": "735e2d73-d070-4ebf-9cd0-78658b6e17f4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561493, "uuid": "fa8f02ed-740c-40a8-aa13-7c5586b9acbc", "value": "2022-1-27-8609e81e368e47ff9f70c246597cf0bb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbc9f9a-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572894, "uuid": "135b7a96-4d2c-4533-85bf-99cfe23829f0", "comment": "Malware payload (SilentBuilder)", "value": "fa4de7db9f879ff64f61ec8b047052ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572894, "uuid": "587d6816-688a-40f2-8fec-c7f3b42718ac", "comment": "Malware payload (SilentBuilder)", "value": "0e54420b556e1e45f2c7330542c85b7c64623bd61e8cf610a00269b9f1f5db0a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572894, "uuid": "12f7e80d-8b63-4324-b91c-bc67cab6887c", "comment": "Malware payload (SilentBuilder)", "value": "985c5716a64a20fb74a5916ab4f0454441bd920f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572894, "uuid": "307407cb-0db5-4692-8ac0-8bfda7792c3e", "comment": "Malware payload (SilentBuilder)", "value": "d0774233427bec93fe5ccdfaebb6385af9c2a9ae265901d056b122c1449089bed425eec907501020fecdd98365eadf03", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572894, "uuid": "3e82488f-d9b1-45fa-bbc9-3fe8231f9a08", "value": "T1BC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572894, "uuid": "1c10ffc2-f337-4418-8c6b-bfec3653789d", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572894, "uuid": "7bf27166-6e59-4397-8060-23c059521a7b", "value": 48215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572894, "uuid": "624af74a-cb62-45d5-8995-5912eb7b8cae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572894, "uuid": "8c97a4fd-df80-414d-a7bf-640ad301cadd", "value": "2022-1-28-fa4de7db9f879ff64f61ec8b047052ef.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c691d8cf-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561448, "uuid": "d3dc08fb-0fed-4ea8-ba82-274de47f4129", "comment": "Malware payload (SilentBuilder)", "value": "84408520aec7b0d86ce436466944373e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561448, "uuid": "63093e8d-2a14-4349-8ac7-cb6f4949d7b0", "comment": "Malware payload (SilentBuilder)", "value": "0e72dcef3794e94782d2ab095d1fae2563b81e8ffb4f875c07de4fa5df4cf0e6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561448, "uuid": "b4a21114-2165-4674-8cc8-3e956020c78a", "comment": "Malware payload (SilentBuilder)", "value": "52629d204c2a4f05a1e88a5a9c929282a47c5090", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561448, "uuid": "7a5c86f0-f6e7-4989-8469-3e1a6cd04e89", "comment": "Malware payload (SilentBuilder)", "value": "9604b1e270aeb02d7e14c1d5fb6990e841a580111470ff570fd8396356418c995540261319330ad5a5cbbbae4a1e9e42", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561448, "uuid": "20a82d7b-2748-438b-8d53-8c6c2d665618", "value": "T1F7131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561448, "uuid": "5ce6e4fd-0d27-47da-a756-12b83f3215f1", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561448, "uuid": "13ca8bfa-6e79-43ca-938c-f4fd371c0291", "value": 45381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561448, "uuid": "d7366494-c130-42ab-946a-0728ad14783b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561448, "uuid": "6b31b8ea-876a-4768-941e-ca3a60613924", "value": "2022-1-27-84408520aec7b0d86ce436466944373e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f0aa76-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571455, "uuid": "5a5f5253-6b9b-4d83-9b81-48accd56197f", "comment": "Malware payload (SilentBuilder)", "value": "d05c1b7df3208e6109cf40060a11733f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571455, "uuid": "ef8b1632-e3a2-4183-ae14-01c683fdf071", "comment": "Malware payload (SilentBuilder)", "value": "0e84f648cb5073e7b8dcdd4c535d7cd6759683da7d8497366c61a7371c4d2a5e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571455, "uuid": "3e8cbe41-93e6-4df6-aa03-056d872abcba", "comment": "Malware payload (SilentBuilder)", "value": "d0fb7645ca6f777087057961f89d841b798eff69", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571455, "uuid": "d2d159f2-c394-4b71-ab50-73c8efc22c4c", "comment": "Malware payload (SilentBuilder)", "value": "b335b66d3901745e556031b1f93983ea1c272fb249111aae790bdd37e83d0f00ccf7e5befa8ba9d46d836ae6234c1637", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571455, "uuid": "92342f1d-f051-4b19-9dde-239a45204d43", "value": "T17F839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571455, "uuid": "a4e41fb9-9cd7-42b5-9db3-356eeb0e1ce0", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571455, "uuid": "5ff2b856-87eb-450f-8741-c0a6d0e72b48", "value": 86862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571455, "uuid": "49675830-6605-4d16-abe3-2b1318d013bf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571455, "uuid": "e61e4bb3-b4ca-4a86-b068-6874c27a4918", "value": "2022-1-28-d05c1b7df3208e6109cf40060a11733f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762620c8-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643569474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569474, "uuid": "0e250139-cfc4-4086-88bb-16d0e4d1ed86", "comment": "Malware payload", "value": "d227e289fbb2493e6deb25ee5a17991c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569474, "uuid": "bd446fcf-e3f3-4c25-a95c-8bf6be8dac50", "comment": "Malware payload", "value": "0e8e6fc94e6eb17cfd8993b3dcfd9acd11ee32f1b4e956df3097ae3259be4f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569474, "uuid": "3f8e1858-1d50-4cab-8f63-cef1c9debada", "comment": "Malware payload", "value": "7c56887b7152f0f710cd8153ed0f8cce692f3c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569474, "uuid": "fe18acbf-aeb2-4c4b-b8e4-8ecb19ccd3e9", "comment": "Malware payload", "value": "65737535eddbce75fd2b6fbebf3bbfc7138f93091b3799483af64e9799fcf8c06f615e56f1321739612db90665d71f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569474, "uuid": "b91ede19-309b-4a64-b095-15a2badb193f", "value": "T18BF54C43F8A1A9E4C8E7D2748D2662E4BA303449273573E7175093B52F7ABE45F7A320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569474, "uuid": "16539deb-05a3-47ae-9132-5788677badc6", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569474, "uuid": "7c14fedd-2d1c-4102-9b20-02efbd37006f", "value": "49152:tOqD48lEd4orb/TPvO90dL3BmAFd4A64nsfJIPUG3qn7UXIONccRvC99Pr8bg11N:tOndbPU4q6ISi4JAOYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569474, "uuid": "599028c7-c7f3-45ea-b0cb-c0baf0e4a07d", "value": 3447808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569474, "uuid": "8562ff96-08de-47e9-8177-91a604736af9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569474, "uuid": "34969f6f-8e5d-4088-9611-e9d4e2cca890", "value": "0e8e6fc94e6eb17cfd8993b3dcfd9acd11ee32f1b4e956df3097ae3259be4f9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d679e74-81e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557299, "uuid": "e0c3963b-0a23-475d-8131-d9241fc653bb", "comment": "Malware payload (Heodo)", "value": "6d9919bd84d790eb62b081f8c3f504e4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557299, "uuid": "c0acc1c8-c7d8-4c60-b789-c018167d4c43", "comment": "Malware payload (Heodo)", "value": "0ec5e101b05cfbf0a4d8b3e5bc49e4a59e2e6142f9ae03ea99ba1fc6ec82658b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557299, "uuid": "853e4a16-f002-43eb-b7bf-ce67b7f918d7", "comment": "Malware payload (Heodo)", "value": "1971ae91da0a62c5d3482f2245fa1fb793a01a43", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557299, "uuid": "25c31c40-a648-41e8-8847-6f2d4e669345", "comment": "Malware payload (Heodo)", "value": "f04d338117830b00d30f8863edef448969fcc4abe61a55047734c486a694b755b85c77714bf834eccb577ac09a228633", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557299, "uuid": "5c0f95e0-85b7-42f5-a8ea-7f4ff77142cb", "value": "T11AE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557299, "uuid": "384e2573-fc89-4e44-a15b-f684cab01429", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557299, "uuid": "479a35dc-d0d9-4892-9d45-c386cb95f35c", "value": 147270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557299, "uuid": "ca1674a1-2b63-49ca-aca3-d38398d6dcd4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557299, "uuid": "a459702b-87b6-4d97-b3ef-55c1f0ab8a51", "value": "2022-1-26-6d9919bd84d790eb62b081f8c3f504e4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4708c16-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569578, "uuid": "751a6ac9-cdc5-45a9-a045-a5fb1e00729e", "comment": "Malware payload (SilentBuilder)", "value": "91c1cb1a6fcf6c5db392752fb2ebc9df", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569578, "uuid": "5fcb550e-b274-497c-8e3c-83f7872b96fd", "comment": "Malware payload (SilentBuilder)", "value": "0ed5bd1d6bde5ba2242c1454abfc0d584f4534f61b97abf9293a99cf232edd2c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569578, "uuid": "bd58e822-f355-4923-baca-4ff768f62f9d", "comment": "Malware payload (SilentBuilder)", "value": "86da6414f071aeb99eed0d74661298ae7c39009c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569578, "uuid": "50bd1d82-82b4-4d4f-a9f1-cc8f587348b7", "comment": "Malware payload (SilentBuilder)", "value": "c9af2ea337eeeedb9f15a0b9d6156c23cd8442f6fd5014440612bf2533a30d02781c2073b203fd3acf0fd586979d0dd7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569578, "uuid": "3d391850-1ffc-4c17-af03-31dbcacf5254", "value": "T1C5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569578, "uuid": "7ba34d76-1fef-4c76-8f04-028049ce5786", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569578, "uuid": "c76692ef-5c07-44de-b434-358e60661985", "value": 48552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569578, "uuid": "a7597c4f-9ea9-4681-8413-8ea9b59d567c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569578, "uuid": "5fdcde9b-b5c3-4276-8690-21c62603bc93", "value": "2022-1-28-91c1cb1a6fcf6c5db392752fb2ebc9df.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c5d39f-8183-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643516192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516192, "uuid": "d13763ef-416e-4fd1-8bc5-253d2df736af", "comment": "Malware payload (Mirai)", "value": "bf67cf3023824301f64fc90729770fab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516192, "uuid": "5eb9ed01-278c-48ec-bb63-212da6c41ecd", "comment": "Malware payload (Mirai)", "value": "0ee624c35a2e4832a0f2e7244a46739463b8fa9a719c76609815d58afaabafb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516192, "uuid": "72519208-1862-4220-ba1e-9c683c331226", "comment": "Malware payload (Mirai)", "value": "96ae0032deb7154a6956aa7e23471f51038432e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516192, "uuid": "0cfd790f-4c62-423a-bae6-8382fa1a65fe", "comment": "Malware payload (Mirai)", "value": "1c1bf9e87d282ccb06867db9a56557b331133423f0f6f61143e7667e3d6d736a989b8b2f8a30e03970868e705c0cb796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516192, "uuid": "9e7a9547-a61e-43da-b966-f1b6e496a687", "value": "T1FF732A25B9791A26C0D0A57E11FB8B11F6E1238E26F4C55A3DB20E4EFF247406912FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516192, "uuid": "5e311e12-3d49-48bc-8a20-c6fb8f90a3ae", "value": "1536:MV6+Rd8R7GojhhESz9o5DCT0IE806v8zn37KU:k6JzmdCFFv8zrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643516192, "uuid": "b7a88c32-6745-4685-9b34-837d729734e1", "value": 75472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643516192, "uuid": "8096d2c6-ec14-4cf7-8d56-bd7e4b6ec8ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516192, "uuid": "4862029b-b98b-4a39-9726-43e735d78bd9", "value": "bf67cf3023824301f64fc90729770fab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f431382-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568925, "uuid": "44e72944-ce30-41a6-8118-a19b1f6a6a66", "comment": "Malware payload (SilentBuilder)", "value": "7892eeee7a0e515166c33e648f3c6226", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568925, "uuid": "420b1ffe-4658-47a7-9a84-11c9f02bf517", "comment": "Malware payload (SilentBuilder)", "value": "0f0a5cb7a10025040c3c29197d55b0a0867f165e1ffa5c28afb46c63a1d7bf5a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568925, "uuid": "bae1fd9b-4da1-47ed-bc66-0adb723d44f7", "comment": "Malware payload (SilentBuilder)", "value": "6d29679a772226b98ca266bfdd407897689a38d4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568925, "uuid": "e6706796-bdb3-4c59-90d8-8e407038a1cd", "comment": "Malware payload (SilentBuilder)", "value": "782c4fd018a48db70bac1a6bc4341e412250e3c12c1e0263c1f0e629da5d9566a510081cb30a76d518b95017d5ff698a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568925, "uuid": "2efe561c-a5ae-4621-bcdf-e3db7df06ff5", "value": "T1FFF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568925, "uuid": "f7bbdc9c-8e8f-4424-9752-8d5b2403c7e5", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568925, "uuid": "8b10a153-2b24-40ed-a34c-c00849110f22", "value": 158636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568925, "uuid": "e0e99dbd-37c4-466c-9125-5bb756ebd649", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568925, "uuid": "9a8d387f-b420-4b62-b300-c71b38748769", "value": "2022-1-28-7892eeee7a0e515166c33e648f3c6226.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf8b697-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643575711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575711, "uuid": "054c243d-c6ca-4364-b076-66f913b5b2b0", "comment": "Malware payload (Heodo)", "value": "c58f2971e70bddc253acd37e0f5ab49e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575711, "uuid": "e1425068-8071-4997-b6dd-70f537075690", "comment": "Malware payload (Heodo)", "value": "0f410399249a7b1f5dc9f44c6857a677235ba9fa16f8de7e1ba9ac9acb77d0c8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575711, "uuid": "ff9c58a0-a225-4a92-ab81-2a693a3ab10a", "comment": "Malware payload (Heodo)", "value": "e301bba338e78f2d8e731a78a689fc0a96e1111c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575711, "uuid": "b9513b75-f7e0-42d8-a5ba-86be2899aa6f", "comment": "Malware payload (Heodo)", "value": "d3fd870ae207e649ed55179da50f3d737492b49358abc6571d36d32c023b960ff31c40ea59c9ded7c6caed7a228364c0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575711, "uuid": "be4462ac-459d-44ef-ab33-cc3e083b52bc", "value": "T1D4839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575711, "uuid": "9df0d946-f597-429f-a1a9-184c1123f0cc", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575711, "uuid": "c825aa84-e638-4c0d-8dde-094f41ea4ddd", "value": 86765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575711, "uuid": "2e076dab-677c-4d77-90a9-735f29bca8a7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575711, "uuid": "8c5ae71e-16bf-4d00-b9be-d66d45ad6e6f", "value": "2022-1-29-c58f2971e70bddc253acd37e0f5ab49e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a7cb20-81de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643555355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555355, "uuid": "0502d729-6dfb-4025-b0b3-1971cfb1c0f8", "comment": "Malware payload (Heodo)", "value": "06005f8065da73eaaf842522691d0667", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555355, "uuid": "04c39b2e-a3c5-4bb7-a38b-02709e31e086", "comment": "Malware payload (Heodo)", "value": "0f550429f77ebcb1e5fce719b9bbfce2f5ea0e0787f2e013635335b3d584d51a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555355, "uuid": "7701f50f-1008-4233-803c-bc7e3c0182ae", "comment": "Malware payload (Heodo)", "value": "eae99998acfdb5c6f140c1f851b1a171181a79b8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555355, "uuid": "980c6b58-e4d8-4121-9532-bcd307965f23", "comment": "Malware payload (Heodo)", "value": "351070d223be70aa114c48f759baab00134d01cb4f347a8458efa406b87e11ede5c3fcfccba21fc2ab8807cd30dce77f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555355, "uuid": "46e4cd30-4dbf-44b8-9f61-15cbb8086ee3", "value": "T16BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555355, "uuid": "2ac0a0d2-d910-4638-b477-9b85239894c6", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643555355, "uuid": "9d105d15-e0d9-4754-8594-0bdd4d17fb17", "value": 145589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643555355, "uuid": "ccf9f8eb-27cd-4a58-b977-8a14461898bd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555355, "uuid": "1167730b-cf50-4a59-8eb5-d1ef94696691", "value": "2022-1-26-06005f8065da73eaaf842522691d0667.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f346025c-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643561094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561094, "uuid": "1e3f6a32-c719-4f8c-a551-1816b952b7a1", "comment": "Malware payload", "value": "d5b48d08030864b23cb0442d78578088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561094, "uuid": "a06b0f6c-2f5c-48a7-ad92-9ed0168394b7", "comment": "Malware payload", "value": "0f6fa79ed074253ac07004389ce1be7bf9fd6f5f6cb43690c309493987b7f405", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561094, "uuid": "769dcb98-b0e8-4cc9-a8de-57ddc81f7414", "comment": "Malware payload", "value": "2f4e031acd0e2c386d53f9d4f97233d1c6aa790c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561094, "uuid": "8fb1fc49-98e7-4338-8fdf-8025bf0011d3", "comment": "Malware payload", "value": "d00fcdb83698e7afc31771a98681ac435de1abb36e6e1e85443d2e0e9d16e46bae359057e8c323126e6cef2e65c56b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561094, "uuid": "b2eb1a67-1bce-4fe7-9c36-c4cff915b659", "value": "T106830897B901EEB3F40ED67604D34B247230FB624E931A32731779A6AE362D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561094, "uuid": "e7c86e2c-1deb-49cf-86ba-a5a440b15c46", "value": "1536:umEF0MVJxW/93584AWzab0y79N1xK19OTetUvZ8JifUImzS02q2/cOfBgj:JmP4/Nnzab0y79NPI9+8Jemu02q2EOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561094, "uuid": "dfc58420-791f-4287-9ea6-92f1719bb82a", "value": 86519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561094, "uuid": "898e69aa-8d2f-41ca-b598-2f7c12731a9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561094, "uuid": "af2bf47b-4c75-4410-b42c-965cde8a4552", "value": "Demon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e055c3-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643575110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575110, "uuid": "cb0caf7f-ebb2-4e8f-9e03-d4b52337e327", "comment": "Malware payload (Heodo)", "value": "98aba49657fc18e6100fdef422ec7c2c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575110, "uuid": "a5dc76df-1374-48fc-bbfe-179e09ef7c82", "comment": "Malware payload (Heodo)", "value": "0f893f14faa1d8306966f5e78c793fde8674c4d31066845a42bd9df29bd9be89", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575110, "uuid": "772aa59b-28e9-4e33-b78e-4cd4ff98ec83", "comment": "Malware payload (Heodo)", "value": "0a258e1313925235194233dbd4229c245c07b979", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575110, "uuid": "c27c514b-ba9a-4325-8a11-7af218448559", "comment": "Malware payload (Heodo)", "value": "36ed364e19e9cf28fcd0f494e1027ab6de1e7dbf9f5974b9b3ed27aba7bbd0804a2bb27db986ce1648250d7d65d17367", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575110, "uuid": "78ba472f-c427-4368-a4d5-7d9ee571b318", "value": "T16A839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575110, "uuid": "69403147-7d53-4601-8ad2-2a8ab661c4d8", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575110, "uuid": "d4bf9aa5-8662-4bc6-a860-7e28ba67f6f8", "value": 86953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575110, "uuid": "b0d18cb5-67a2-4ae3-9c4a-308f60778361", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575110, "uuid": "a99e7ca1-6bd6-4f4b-8fc0-cbe28d415eee", "value": "2022-1-29-98aba49657fc18e6100fdef422ec7c2c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868ef278-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564347, "uuid": "cfd1228c-a896-4a13-9a6f-ffa0448a252a", "comment": "Malware payload (SilentBuilder)", "value": "e1bf5dfc6e51bbdf75ebd1ed18e28eeb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564347, "uuid": "0f5566c5-eedd-4b90-8792-6e708a9ab755", "comment": "Malware payload (SilentBuilder)", "value": "0f9ad30b28b48ba7204738655327aae62b125e281b2ff4bf40d0b6d8a1e7596a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564347, "uuid": "0d5219ca-006a-4238-a477-8e8f2ed16ab0", "comment": "Malware payload (SilentBuilder)", "value": "8e8e996a33dd0ca63d1a5242d6dc3726850a2f7b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564347, "uuid": "1b3bb687-30a4-4aa7-ac7c-aff6593e2523", "comment": "Malware payload (SilentBuilder)", "value": "60d4864125b79f1e7dbf21ea8dad046a664a19014455e525b43826d07d35f19e5f8297533d5a65ca35c80d75c2ece470", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564347, "uuid": "38991743-599d-4895-b553-c2b347406b09", "value": "T1A5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564347, "uuid": "f5278d9a-2e31-48ce-a477-4b34056c6830", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564347, "uuid": "2630cb88-e248-4620-b5d7-1e9861d3244a", "value": 78040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564347, "uuid": "ccdbf6cf-f22f-4387-ac84-3ef095c37af3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564347, "uuid": "7de2a3e5-71d2-44e7-9545-2ceedb130c7e", "value": "2022-1-27-e1bf5dfc6e51bbdf75ebd1ed18e28eeb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3867ec80-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560780, "uuid": "e055e681-a775-4550-8544-cb48952bc4f4", "comment": "Malware payload (SilentBuilder)", "value": "6e7b12e7c015fe6f3ea16715d41dfc7e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560780, "uuid": "4f9f9c78-34f2-4438-b3a3-aeeb6d5d2ed4", "comment": "Malware payload (SilentBuilder)", "value": "0fb62441705fff16de2e1759fc1a46c6f46cce622ad3b67ee1ac94a7517d176a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560780, "uuid": "61723639-f15d-4b31-a839-37befc425bc3", "comment": "Malware payload (SilentBuilder)", "value": "cdd18e76c43498ec704895f66ec022268360024a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560780, "uuid": "2021d613-3187-4f4d-85ca-f8a4116d0c09", "comment": "Malware payload (SilentBuilder)", "value": "c02b7f005524d3c894ccbde1d100a57711853010ae03ba2ec039c9b4841b418c5c7a38d0c908fb6764e33da39c36d273", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560780, "uuid": "8f2c6345-f4df-45ba-911d-4a46d192116d", "value": "T1B3C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560780, "uuid": "6135de71-1418-4a3a-a703-e858739e31ef", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560780, "uuid": "7860a257-d318-43e4-a21a-01a15f66ad10", "value": 118943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560780, "uuid": "73d5ae78-420b-4b61-958b-3356bb0d0436", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560780, "uuid": "a3bedb1c-13d2-4d7c-95fc-7498a1e8e03d", "value": "2022-1-27-6e7b12e7c015fe6f3ea16715d41dfc7e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4cc9c5-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643566531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566531, "uuid": "934bc092-2a44-4523-b9f4-2a2d5f2db830", "comment": "Malware payload", "value": "eedf6dfacedb0384af3a3061b5fcac1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566531, "uuid": "987e777f-9f4f-428d-956d-df384da5d07a", "comment": "Malware payload", "value": "0fdbf9f6ed8df3efeec799321b84f3d633fc6e33f40ab8663b36b26a929c525f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566531, "uuid": "2bdb6524-4264-40f8-acd9-3bb8b60e6699", "comment": "Malware payload", "value": "06ae2848348f00c8c7f981de5602bd6a67b94b23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566531, "uuid": "1994353d-ce0f-4909-8124-fd3435fba436", "comment": "Malware payload", "value": "0d2be7855753354f40ce21b1fa08e2891e25c2afcfd4e4d2b90f4aec1d0e89511a46e61811c899dd9d00fafb58cc5835", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566531, "uuid": "8a8fe046-22c2-43f0-bd72-90f266a17e2c", "value": "T1BC34AE2636C7C076CAA311725601577EB3F2A6509BB98AC38FE10D48AF74697D33D389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566531, "uuid": "9a6b5975-da9b-498a-96c0-8db382ea4874", "value": "3072:AKhiZO9IVV9yuq1lGiHF1Ba5Cbec0Xl2l6l6Afh6vje/RVjzSn5u7yqUmm:KVVVs71lG81QCbetXlvl16ATfU8bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566531, "uuid": "5beed63e-725a-4417-8b56-dfbc076fee26", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566531, "uuid": "7923e390-2705-45ee-b9bd-b25898fd4d11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566531, "uuid": "ca7b6218-f25a-4294-bb46-e1b469d04069", "value": "emotet_exe_e5_0fdbf9f6ed8df3efeec799321b84f3d633fc6e33f40ab8663b36b26a929c525f_2022-01-30__181527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208e0179-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643571048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571048, "uuid": "60aa2395-6cf6-41cc-9281-76183b3f40a5", "comment": "Malware payload (Heodo)", "value": "c6faee590d793ba8ec37ecb1a8dbf4cf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571048, "uuid": "37744a53-4a02-4d6d-a148-0fdb8f5fe625", "comment": "Malware payload (Heodo)", "value": "0fdc3f12352f64f566a81d611d1dfc3db8e04e33f783027a4cee9922d695a6bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571048, "uuid": "0627ab18-e1b5-4eb4-9c08-0f20a7707bc7", "comment": "Malware payload (Heodo)", "value": "94ac0c1b3bd705e34ba6334ad67e4a6a5152fc00", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571048, "uuid": "5073803e-caaa-4494-ac02-d8829b13ea94", "comment": "Malware payload (Heodo)", "value": "d5d64bcdc1e25acd40d38acd6e542ab3649f07fdf4e71a10eca39a4ff21ba7bd06909434c20778ab17f6085f0d435e89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571048, "uuid": "3c23095c-efae-44d3-af2b-f1e373fbd27e", "value": "T1A5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571048, "uuid": "c04069bd-3e66-47d9-8141-609e8338adcf", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571048, "uuid": "395cc89e-c6c9-4441-b47c-5e2f538ca27a", "value": 47625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571048, "uuid": "d462ae72-75b9-42f4-9ecd-c2d276be89fd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571048, "uuid": "fd96d35b-a0e4-4aa6-b323-4012f524a96d", "value": "2022-1-28-c6faee590d793ba8ec37ecb1a8dbf4cf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4601d7-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575525, "uuid": "7e3c2f4f-8eea-4f69-a7b4-23f51355da72", "comment": "Malware payload (SilentBuilder)", "value": "b738bc1c6e43352400e68eaeb3c4c88b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575525, "uuid": "52495b98-f76d-4ecf-a627-075dc6dc4960", "comment": "Malware payload (SilentBuilder)", "value": "0fe9b840d44d4be2326a6f73f64f2e02c54fae2bf1fc307b88e9924a6bad8e5f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575525, "uuid": "af7a67bc-7fa4-463f-88bf-04ad25dfea12", "comment": "Malware payload (SilentBuilder)", "value": "6f318ca973ad726905225d648ba20e0913b87c0c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575525, "uuid": "85d5f598-c6c5-4ed9-be35-2424919997d1", "comment": "Malware payload (SilentBuilder)", "value": "d1b84a49fe8a78f65da68f445c8f31edb84cc7377be5b87286f65fd6d6469e64d1b8e33dc4bfbc9dde65a0560f47d669", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575525, "uuid": "2b06b8c2-397c-499f-a92e-e975f6ea00d3", "value": "T121934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575525, "uuid": "36b66ba0-1084-4912-b04c-50bd0fd5934d", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575525, "uuid": "a777b568-e0be-455b-bb22-0d31fbfbc684", "value": 92710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575525, "uuid": "d8caed1e-24b1-4a56-9b34-29b81a59ff48", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575525, "uuid": "bc0f8124-495e-4e0e-9c1a-10636f7fba6f", "value": "2022-1-29-b738bc1c6e43352400e68eaeb3c4c88b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6529e1ed-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570304, "uuid": "7f325b26-a4eb-4004-9293-7d99eb6156ce", "comment": "Malware payload (SilentBuilder)", "value": "aacf33328ad9d89c79806917583c9987", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570304, "uuid": "d2ea07bc-fa04-497e-ad71-5bd5f6791949", "comment": "Malware payload (SilentBuilder)", "value": "0ff45879e3df2a557833ec55161d20bb561c136aec01ddcba2c96aaec1ee18b7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570304, "uuid": "1895a8f3-5bea-40bf-920e-dde803ebf29f", "comment": "Malware payload (SilentBuilder)", "value": "a4d42b173b500d0fd82249a53f59154c9aea4fab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570304, "uuid": "c3064c0a-5cd3-4e13-bc79-bd47bed7647f", "comment": "Malware payload (SilentBuilder)", "value": "e95a5693045a50165089cc1f6c8c49538abf0bb30b5659c72a32e86c16ae01e30cf8c442d0308026b6a7dd41d052ae99", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570304, "uuid": "fba79667-c594-485a-bf2f-cf5c45fc026c", "value": "T1C7F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570304, "uuid": "81ffdbf9-afee-41e7-b4b1-1d2aeec743c0", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570304, "uuid": "d8a24f51-1426-4ca4-9487-5ca7b4482dcc", "value": 159142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570304, "uuid": "e48cfd91-f00d-4a53-b5b8-76ccd4915e4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570304, "uuid": "f61a5a36-8cc8-46bf-b451-8733f96f1374", "value": "2022-1-28-aacf33328ad9d89c79806917583c9987.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c3cd2f-81de-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643555435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555435, "uuid": "1f737e16-1a6a-46dc-84bf-65ae3c2cac2a", "comment": "Malware payload (SilentBuilder)", "value": "5dab86f7e6de6679faae0f4cb274f27a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555435, "uuid": "6cf98e44-8c24-48fe-842a-5a3dab3a49c1", "comment": "Malware payload (SilentBuilder)", "value": "101df16d1a881ba33c4e1bf43fac66f23f8a6f595cda7613c6e53928f6e549e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555435, "uuid": "754edf3c-e277-4b42-9b8d-178e420fbbc8", "comment": "Malware payload (SilentBuilder)", "value": "cc9c5c46c6ee5c7267f1bb3c58a69cccb1449c6f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555435, "uuid": "e277456a-173b-4228-9c19-d872c3b63db5", "comment": "Malware payload (SilentBuilder)", "value": "a66ecb470809e09f7efba33c252fea6ba6fa5a4f33b05fab20a961540c5d67f7376e80345b2b2ede693480f45005d4f1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555435, "uuid": "ceb4adaf-6737-450d-b5eb-904c45dcd365", "value": "T103131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555435, "uuid": "f539f955-edfe-49fc-b265-3d156af2bf84", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643555435, "uuid": "6fdc9d4b-36d1-41d9-bad1-d4d4d4649705", "value": 45139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643555435, "uuid": "0cc5f2be-dd8f-447a-945a-23dfa4637dfe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555435, "uuid": "dd2bd6d2-6747-433b-b82b-0faf85496290", "value": "2022-1-26-5dab86f7e6de6679faae0f4cb274f27a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730a3a3e-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570327, "uuid": "47f83ff2-29e1-4560-ab0b-7aa4dbce214e", "comment": "Malware payload (SilentBuilder)", "value": "ab9b67f591e3a5c3fc6157b90115c585", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570327, "uuid": "19d7f728-83be-4bca-babf-27880fc1231a", "comment": "Malware payload (SilentBuilder)", "value": "1041a44dc7807163ca8a9c41a7c09e9effa9b7c60331cb7a2d4db40b2601da4c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570327, "uuid": "4fcc2de2-c9a7-4fc2-bdb1-85ac508ea657", "comment": "Malware payload (SilentBuilder)", "value": "19b9e37dcb15eed395862bb1c66bead71f8a3c0b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570327, "uuid": "764c6e99-ed09-4855-ba48-fbc1866c6ffe", "comment": "Malware payload (SilentBuilder)", "value": "7b51e685a20453ef913c5b98da5ccbd3d1ce9d3b55137cf82d50cd9fc8230c5d46cfa39c0d3da886602cbd22cd93606c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570327, "uuid": "5d77a696-ce61-4eb9-8c4a-6db4dd8e9bc6", "value": "T1FB233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570327, "uuid": "7ad7bcb0-f017-40e4-bfb3-a8a4c8ad5442", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570327, "uuid": "15c163a4-bc18-42cd-91d9-715656b66511", "value": 48003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570327, "uuid": "eeb33f11-2812-4e20-82e8-2578b47379f3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570327, "uuid": "2f7062ef-d5d2-4ed4-85fc-0784bdd40473", "value": "2022-1-28-ab9b67f591e3a5c3fc6157b90115c585.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d82ac5-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572969, "uuid": "0d1c68f3-9379-4fb4-a278-21aa0ec4ae6d", "comment": "Malware payload (SilentBuilder)", "value": "fbb72e379de7f5a5690160542a26dad4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572969, "uuid": "e0eaaea7-766b-4964-80a1-d11a13e47565", "comment": "Malware payload (SilentBuilder)", "value": "109df51ffc5b8ece887d27e76348bf6bfec50f1a9922ebedd5fc8ee48946787f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572969, "uuid": "f6b60a75-a34f-4fe9-96bc-17b433dd5e11", "comment": "Malware payload (SilentBuilder)", "value": "7ceaba76b943e140d82a3650bf9e998c0219d2d7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572969, "uuid": "0bb9354a-c208-41f4-b394-4832374f0dfa", "comment": "Malware payload (SilentBuilder)", "value": "46b7ce8d11758a0d3d42de2c11a295f9401570cc8915ccbe5bd9471ab84ab51bd34b2786bdeabb832a9bb5067462dcfc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572969, "uuid": "7dcf5dcb-07bb-418f-a373-b731481fdecd", "value": "T1BEF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572969, "uuid": "52768354-2d6e-40ed-a598-d18e70cf919a", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572969, "uuid": "7afa2380-714f-43f8-9870-bce8a1b092ae", "value": 158289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572969, "uuid": "300686a0-25c6-41d1-b7cf-d33463deb103", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572969, "uuid": "b3b6f15f-dfec-46d3-a264-68dec0fc1ad6", "value": "2022-1-28-fbb72e379de7f5a5690160542a26dad4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5a0dab-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566909, "uuid": "9a6e844b-0200-4851-b6ef-2ec4d7b01457", "comment": "Malware payload (SilentBuilder)", "value": "304ac94dd79743b0c1c28fb094dde288", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566909, "uuid": "97b3a15b-3efc-481c-be3f-5550a295c5f2", "comment": "Malware payload (SilentBuilder)", "value": "109ed760a2d58e733f5a5fc6f5ff1c6eb316b5be9a38560a265fbb772e4bd119", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566909, "uuid": "427427de-e12c-432b-8357-e7c7dd3e1c64", "comment": "Malware payload (SilentBuilder)", "value": "3d8f1b37b52f90826fc2268684069cef5722ba83", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566909, "uuid": "b19896c3-7d6b-43aa-b1ac-552b8cf65bd3", "comment": "Malware payload (SilentBuilder)", "value": "a24289f674a997e84c8d18bc99b5b30ce45b3517f275cf16b0f64e82b52d7063df5d45c6ae8fb8b56adc7ff3c0e58d68", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566909, "uuid": "e3414781-9f3b-40e4-bb9e-75d1a88d99c9", "value": "T183233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566909, "uuid": "aba40e79-88fc-4b43-a639-3036df6a39e3", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566909, "uuid": "65fe1288-f5d8-4cfb-ac2d-29c710433096", "value": 48489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566909, "uuid": "e50fb4fd-c14d-4860-a3f6-8b2d75edc3b5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566909, "uuid": "a276124a-5739-4cc1-892c-6925e52b2ace", "value": "2022-1-28-304ac94dd79743b0c1c28fb094dde288.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b6fa02-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561655, "uuid": "1d366362-1885-4ea8-b4c4-e0bbae4f5ccb", "comment": "Malware payload (SilentBuilder)", "value": "8ccb57d20a8e181f825cb79bc8ea6095", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561655, "uuid": "89585e75-38dd-43c5-8a82-d97b4501e483", "comment": "Malware payload (SilentBuilder)", "value": "10aa2ea070358d39d5876f384f357a432078ac5f7704b029b12097f91b87e7c8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561655, "uuid": "9f541a60-1416-497f-aa2c-df38bcb91fc9", "comment": "Malware payload (SilentBuilder)", "value": "a20bd20cb71e1441e391d86fc5ab693087dcdf4a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561655, "uuid": "f811909a-13a2-4250-8b21-d8844f16f8c3", "comment": "Malware payload (SilentBuilder)", "value": "5b04f457399964a2fc56814b7efde6e12ba33db183cd6ad260924605b557e89309476557f9ed59f0c0324d19664c97a9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561655, "uuid": "374388de-beb8-4234-ac87-ffe67423b568", "value": "T145131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561655, "uuid": "9f74c692-7355-4b7a-88f1-ee425921baf4", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561655, "uuid": "7f1c7108-0496-4cb5-9b8c-02c33d7c08ab", "value": 45045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561655, "uuid": "bd3ea347-242c-4223-b7a2-d605bee019be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561655, "uuid": "bebe2c72-77bd-4677-88dc-c0b13100638f", "value": "2022-1-27-8ccb57d20a8e181f825cb79bc8ea6095.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cf9bc8-81e1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556771, "uuid": "34c8cf28-4847-440f-a946-5e6910a0d23e", "comment": "Malware payload (SilentBuilder)", "value": "04de07d05332547b24c3782f5769b1ec", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556771, "uuid": "aaff9a76-3589-4dd1-9d86-48b349185ead", "comment": "Malware payload (SilentBuilder)", "value": "10ab47e405202afcdcbc9bc699d41a78f452562399f0dae0a6bc53602899ed8b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556771, "uuid": "c08efab5-b3a2-41c4-948b-d332a1436507", "comment": "Malware payload (SilentBuilder)", "value": "6104aa17a500392b14d7b966c8f9a576302c4cb3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556771, "uuid": "2574523f-b3d9-45eb-ae5a-bdc2cb27569a", "comment": "Malware payload (SilentBuilder)", "value": "be26a7da97eb73f27f8de295725ce715684311286765623004f372e8306bea1a1d4d2e1bbe8e53b3253c622436e12598", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556771, "uuid": "cd345026-84db-465e-97c6-1cf692cda30c", "value": "T144735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556771, "uuid": "446a4e41-f56c-4eaf-8b15-4112ec4dd28e", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556771, "uuid": "65516be9-14a7-430b-bfc0-f796106d9bf9", "value": 78176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556771, "uuid": "3ac4ea63-6329-4381-8040-fc48212bf33b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556771, "uuid": "abd28096-19a4-43a3-9a92-e2d50d066d5d", "value": "2022-1-27-04de07d05332547b24c3782f5769b1ec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b23b9c1-8198-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643525217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525217, "uuid": "b3680063-02f1-4a98-a8bd-abd52b3ca3db", "comment": "Malware payload (njrat)", "value": "b1c7b650bbc3b2984deb6415ab055afe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525217, "uuid": "fa806579-4a2a-4e7b-9c64-b28297b468bf", "comment": "Malware payload (njrat)", "value": "10c45c38f68ac15f1f370b65ecd719fe6c3a722f8e14d2f1ca1bf1ee07e089f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525217, "uuid": "8bf00d0f-4d78-4386-b436-f576c6941487", "comment": "Malware payload (njrat)", "value": "b3d9b70ad376956e0350bddab17ba36cd1fef079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525217, "uuid": "488411ee-d84c-4028-a115-6958fca942ce", "comment": "Malware payload (njrat)", "value": "485f1e1d631a19d57c926aee4fb9ded8290b304b00e8b5fbf39294ab31f58cb7e874273cf5ae577682a09b03a4d916f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525217, "uuid": "9651d1f8-3737-4e06-a36b-4fd27e4de7db", "value": "T147032A4D7BE181A8C5FD0A7B05B2D413077AE04F6D23D90E8EE164AA37636C58F54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525217, "uuid": "9155db27-72ba-4896-975c-b2a2eec51ddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525217, "uuid": "b67c1391-a1c6-4826-8e41-63193dc715c3", "value": "384:djleJaNitNFbOn0aH2ykruUXpZqzXwEErAF+rMRTyN/0L+EcoinblneHQM3epzXw:plPmNWtkruU5UTwBrM+rMRa8Nuz6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643525217, "uuid": "bb994239-83e8-4262-a278-33f124cb93f3", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643525217, "uuid": "e4141080-209b-4af6-b906-c0c57c8ab196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525217, "uuid": "e61bf8a9-7d2d-4475-b1eb-e6d70e133c25", "value": "b1c7b650bbc3b2984deb6415ab055afe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bc2cf6-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558709, "uuid": "552a8fc3-51d5-487f-bc49-e4ebbeed7667", "comment": "Malware payload (SilentBuilder)", "value": "30f25cc2afc97b2b8d655716d7884ac7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558709, "uuid": "9d5b180c-7c21-4d03-9921-4c37ff2b8642", "comment": "Malware payload (SilentBuilder)", "value": "10e306b39425d09ab72f17b3ef4f6eb4cd35abddd0805aa1a935c7e5afd772cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558709, "uuid": "d9ce6105-a5b5-434e-a54a-d0e95ee2f7c0", "comment": "Malware payload (SilentBuilder)", "value": "52596f59deca1d6a3740a2cc46b8e97255e38347", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558709, "uuid": "6b588681-bd19-417a-84d3-71ac605267d5", "comment": "Malware payload (SilentBuilder)", "value": "d839075cc0e1e016d15a83a4fb4b7636acdc92891c82824afa6ae443b8e70ebf45cc59b2ac367f2e49571935742c7d7b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558709, "uuid": "0c36daa7-410a-4ed1-905c-620214e66ab7", "value": "T187735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558709, "uuid": "79424a85-b0b5-449f-8eb1-d2d45c84d319", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558709, "uuid": "2d63f520-34f9-4b0d-8f8f-0196133e2d59", "value": 78262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558709, "uuid": "e8dc954d-e548-42e8-81e3-ed4898d8cf29", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558709, "uuid": "27a7ea1f-99a7-494c-9b17-b3ba8f8016d0", "value": "2022-1-27-30f25cc2afc97b2b8d655716d7884ac7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ccdbe2-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643561469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561469, "uuid": "1a469c79-2b4a-4821-b8e6-a5c8715eebbe", "comment": "Malware payload (Heodo)", "value": "849b8e8c30170bbc1079d1dcb9d7a0bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561469, "uuid": "38f442f8-d78c-4283-b552-1f554efbf0cf", "comment": "Malware payload (Heodo)", "value": "10e788df93088beefacdbf20c7418be9e7a2363635ef531ae6ca3a278dde8405", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561469, "uuid": "48b6b747-660c-4daf-ab90-46005740e346", "comment": "Malware payload (Heodo)", "value": "e771e502f96425295e36d6c7121528989134ea7c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561469, "uuid": "13c8714b-9305-48c9-9dd7-9d42ec3b0c74", "comment": "Malware payload (Heodo)", "value": "8300c89041f7f9de64d7985b09b46bab80f5f553d6e001a4f9fab0e3dff73ad82169f5ac0e6dcdbc1c1205ade1b16eeb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561469, "uuid": "5e23b43f-a1b8-4063-b685-ca20e142719f", "value": "T1C0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561469, "uuid": "59ac45c0-c8dd-4d4a-9e76-f0ad9ecdfd84", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561469, "uuid": "05dd2658-d641-4f43-9d3b-d365eb88f2c8", "value": 77969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561469, "uuid": "e5bebfbd-d80a-43cf-84a6-70a6f5622f77", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561469, "uuid": "71818004-2dcc-4f97-ba53-fb85455585a3", "value": "2022-1-27-849b8e8c30170bbc1079d1dcb9d7a0bb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccd47c8-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568545, "uuid": "bb43d65e-6a2d-4521-a3bb-11d2da2ce7f7", "comment": "Malware payload", "value": "6bef02762a063c8a847d6250bcad9a3b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568545, "uuid": "29096f13-cf01-4a18-9e6f-3efd2c08721e", "comment": "Malware payload", "value": "1112b6323dd9dbc410b39c4b3ec1d204e5ab2bb9fe9977ebe21109bd4083d611", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568545, "uuid": "4d626036-7622-439c-8f05-76f8a07849f8", "comment": "Malware payload", "value": "ab2d9069670020e77086e612f6235454eb4fb759", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568545, "uuid": "21cbd47b-8747-4867-90b9-268968fbb10c", "comment": "Malware payload", "value": "5b42a95187280f03d0e7d6ad617cb7018050969c6f488282bfc0d0f3eb6905b1fe145bb39b9c01b605a4ed3453636ee6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568545, "uuid": "36d31487-12d1-459d-8287-fcf4900ab347", "value": "T10D839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568545, "uuid": "c93553bd-163d-4fe5-824d-c27ece269cfa", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568545, "uuid": "7bd9a8e3-c0f8-4d4b-9da7-fe4ca6aac702", "value": 87013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568545, "uuid": "da35c675-b958-4e67-b732-90cddbdc5f80", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568545, "uuid": "ee98eee7-c231-4c1a-a989-578f54b38ea6", "value": "2022-1-28-6bef02762a063c8a847d6250bcad9a3b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5938264-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575217, "uuid": "28651687-a8ec-44d5-b83b-8089c58c245f", "comment": "Malware payload (SilentBuilder)", "value": "9fb0fa974cfbf694926b6bba2886e919", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575217, "uuid": "594b271a-e806-4a05-ae1b-8b44cc7eb841", "comment": "Malware payload (SilentBuilder)", "value": "1169268d723eff45595ec27c83734fa7cc049596887f6976cac41ce156c51095", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575217, "uuid": "af9dff58-5b95-4ea3-8f82-df84a841f1e3", "comment": "Malware payload (SilentBuilder)", "value": "5c452b75d824c60ef4718e153dded4004f362d16", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575217, "uuid": "e9169088-c64f-49ed-8873-063f651af234", "comment": "Malware payload (SilentBuilder)", "value": "6a28a7aaa71ec7cb2fcc8c4e1b38c316101086e873d5e3dfc77faa71d47930c4a23cc197ffc725b77baf271058caa4b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575217, "uuid": "9e8e3948-4bcc-4041-86e6-b8b96e50e158", "value": "T1DA934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575217, "uuid": "195e570e-a9ce-4a5b-8817-55b78c352da9", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575217, "uuid": "2c7d1fc9-4a02-4867-a7fa-22f51bfc1f67", "value": 92659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575217, "uuid": "0f292747-4c0b-4e81-a8d2-f408cd910d99", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575217, "uuid": "910b07f0-91b8-4795-92be-6c2f63a9159a", "value": "2022-1-29-9fb0fa974cfbf694926b6bba2886e919.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0ae09b-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643562959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562959, "uuid": "959f8019-f589-467a-aa65-02e413033872", "comment": "Malware payload (Heodo)", "value": "ba40802ed5e29fa7f49ef5f8e071663a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562959, "uuid": "d67dbc50-a3f0-46b3-a896-211aa3438092", "comment": "Malware payload (Heodo)", "value": "11769a44d7fd14a5efe30de08608b7f852710bf8f82d8d2e9f85b0b2366d17ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562959, "uuid": "73012ba8-aa99-4b6f-8ca4-e5932f753674", "comment": "Malware payload (Heodo)", "value": "f4570acdc6b077dcbb857be0de3a5cc2522b82c6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562959, "uuid": "5137a25c-4b04-4ce0-966b-833580ad2b9f", "comment": "Malware payload (Heodo)", "value": "15427332253693f7a9ab08211401e27609c99e78b2f85eb2869e987d13fde2458b283d5df1ebafffc9a368d473645395", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562959, "uuid": "622efce1-fe3b-4e71-aecf-4509e4ef42fa", "value": "T168131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562959, "uuid": "f1c66af5-eea6-4d44-9c2a-b525af986031", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562959, "uuid": "cd23b4f0-3e30-4920-84d1-b841b6dc559f", "value": 45478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562959, "uuid": "460f88c7-b563-418f-8c62-f8bf12fb8da9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562959, "uuid": "e4f956b1-5074-4595-b2ec-86ec4aaedbfb", "value": "2022-1-27-ba40802ed5e29fa7f49ef5f8e071663a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894afb09-81e1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556621, "uuid": "8594f8bb-eceb-4f9d-bcd4-24d602d71d15", "comment": "Malware payload (SilentBuilder)", "value": "ef3b0f16c2e1f322fbed317227ae72f1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556621, "uuid": "6fe8a142-1522-49fe-87ed-a936064dfb25", "comment": "Malware payload (SilentBuilder)", "value": "117f5e0f1290f7df3a77258ad976c5452937b46f7f0dd1ecf5468420ff3d643d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556621, "uuid": "ec96b2cc-88ab-45c5-a0c5-47f0dd4e2c29", "comment": "Malware payload (SilentBuilder)", "value": "5a19c7e422be142053dc489ed6f3ada13aaa4216", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556621, "uuid": "f200a49e-4ee3-44ee-9d85-f9abf71dc329", "comment": "Malware payload (SilentBuilder)", "value": "e31f421d950e60b6cf3042e5775acddf557d8b67f6297205b7348c4cdd4c14d0a1f04edf28fa879e7d5aec7d81fa4961", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556621, "uuid": "7261bd10-4df3-44dd-aff0-c09920d35ba6", "value": "T1B8131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556621, "uuid": "53237b31-e448-49dd-bb97-8c30c683348b", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556621, "uuid": "d975e23c-a1f4-4a22-adb3-3563dee8b9ba", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556621, "uuid": "e64d230b-671c-45f6-9548-d4e8df1769d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556621, "uuid": "1cc2d6f3-8872-4d2f-bbba-8481da42b4be", "value": "2022-1-26-ef3b0f16c2e1f322fbed317227ae72f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e3c20c-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566358, "uuid": "2897836d-9031-4b83-8923-df950f4159e8", "comment": "Malware payload (Heodo)", "value": "1e771850db5b3df136332acaafdf1881", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566358, "uuid": "d29aad4a-b1d6-428a-8975-3f0383ec45b3", "comment": "Malware payload (Heodo)", "value": "11946e57150a52af9aa32992d5096e7a415aeca6fe73f2ef7e401a4c46ccd759", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566358, "uuid": "ff08a32d-5871-444f-a952-3a818fbef1b7", "comment": "Malware payload (Heodo)", "value": "159d78e559274a1b57900caee70c4a9e1fb7b8c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566358, "uuid": "b4b430c7-a04a-4fae-9b77-1d7f7c5328b6", "comment": "Malware payload (Heodo)", "value": "eba06db086f840a96aa39c20f9b90550078e020ea8da9a8d7ed63c42137e8859544401bc6545543b5643e9bdad71f5f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566358, "uuid": "cec5226f-7b85-48b9-aaec-ff171b29bb4f", "value": "T147233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566358, "uuid": "25855182-f945-4e67-b3f3-464a676b371f", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566358, "uuid": "38fa74ab-f604-4aab-8e9e-7e84dc4220b3", "value": 48501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566358, "uuid": "db413ce0-8088-4543-a754-fc1a3bb17799", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566358, "uuid": "40136abd-c529-4495-90ed-50ece4ca1e8e", "value": "2022-1-28-1e771850db5b3df136332acaafdf1881.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494260e5-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575841, "uuid": "9a2db3fc-10b9-4142-bd9b-9e29ed5e32d5", "comment": "Malware payload (SilentBuilder)", "value": "cebffb3edba7a0507ac1e380505ba4cb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575841, "uuid": "b011a54d-405c-4f9a-aee5-2016760d1ccf", "comment": "Malware payload (SilentBuilder)", "value": "11c8d637544a7603b2e7b676fb179eb4d3230718e7893db4bad72d5ec6c13c23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575841, "uuid": "ae66709c-fd09-453b-940e-eacdfeeca2b7", "comment": "Malware payload (SilentBuilder)", "value": "dc93c9b16bd0ae63df8b4f99afa3e8c75bf9f881", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575841, "uuid": "ae0e1310-2048-479b-b9d6-649f315fa180", "comment": "Malware payload (SilentBuilder)", "value": "eddec30fd69525fde2626e23e0696a2849d01d545b2b2b830221273cd0a7620313b1f4e752927fb97d3b100bb264bf7c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575841, "uuid": "9a73126c-8b2b-4bb3-93aa-e174effaf807", "value": "T182934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575841, "uuid": "69127093-b05c-494e-bfd8-6a2998019f92", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575841, "uuid": "d1c23dad-11fc-4a95-b5c3-5851e93340e8", "value": 92330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575841, "uuid": "d7916a9f-b976-43c7-95b9-6f6db718a8cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575841, "uuid": "c6dfb243-5c0f-479f-89cd-ee0050af8910", "value": "2022-1-29-cebffb3edba7a0507ac1e380505ba4cb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3901048-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573120, "uuid": "9733a58a-3157-4c08-9fe4-7e2169f6f479", "comment": "Malware payload (SilentBuilder)", "value": "000a38dd00b5011d31b273de4d0a32bc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573120, "uuid": "8336d398-75ab-4c17-b6f2-40318e9077ef", "comment": "Malware payload (SilentBuilder)", "value": "11f1b872d95bf6e4a71c3c9492393a6d11c380b2f72cd94f0376a149574e89ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573120, "uuid": "c701faa7-8059-424d-bcf2-5386a604abdb", "comment": "Malware payload (SilentBuilder)", "value": "ccc5068e06ebd77af74358ed03b1ed56e3798306", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573120, "uuid": "058986e9-92ca-4429-b142-3c4b36e57fa1", "comment": "Malware payload (SilentBuilder)", "value": "0f16e8efd8ce51e22b3fe3713860235a1d68cf02f3cf46e9d5f7b196a13a8a5dd448464e2c1b093bdf2b8c0206b03203", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573120, "uuid": "83aeab3d-7ae8-44ec-82e6-7a400380c99f", "value": "T17B934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573120, "uuid": "d57ae1a1-f941-4cd1-865a-cc512d520af7", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573120, "uuid": "9db5746e-db41-4fca-b7f2-79c81ed11e23", "value": 92696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573120, "uuid": "4164a2f8-9013-4c0b-8c23-420f8024a182", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573120, "uuid": "217df3f1-8b70-40ce-a504-43092da973bb", "value": "2022-1-29-000a38dd00b5011d31b273de4d0a32bc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca905c20-81d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643552865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552865, "uuid": "83b469d6-dbcc-4a29-84ce-644735a73f63", "comment": "Malware payload", "value": "cd4243b9acbc5ce87346c38b4fa8cdac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552865, "uuid": "b5ccfb29-d3e8-4c03-84db-26d4384cc297", "comment": "Malware payload", "value": "120050467eaf8c03deeb1dbe52453893b14b8ed143d8a94703c6b95a9aa85860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552865, "uuid": "9a9ebd36-700a-450a-a480-e713a8685cb6", "comment": "Malware payload", "value": "1ca8f13dc3970df8ddf740b040039dd591db4e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552865, "uuid": "802a84ff-6ad2-408f-a862-161f8581b840", "comment": "Malware payload", "value": "a1f27499961a335e18bb611e1874020c2f0e463be5118b7667b8e5cde15ca3b14cc737a6ee71692c31203a4cd1c83907", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552865, "uuid": "114d9879-5673-44c7-a9e2-19479c1645e4", "value": "T1C1329EE9FEC4AA48E26171F1681F0381DC988F5D92E603222B558B207FBC7D2F315462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552865, "uuid": "d9b1ab73-9853-480c-a0db-259880dffbbf", "value": "192:m40iciu1+Zk9Syp3ZQiIPqi2OjAq/0yG081cJ91JhEh+mhGADYpM/p1tWXt66fsM:r01iu1ykAy0iIPl2CfG0mcJbzEhcADYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552865, "uuid": "25130117-6217-4c01-b349-b949c6898477", "value": 11212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552865, "uuid": "c1a3c5a9-392e-4995-89ac-29ba5e1339d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552865, "uuid": "4bbccb66-337f-4bad-a369-3959ea20d368", "value": "Yofukashi.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babe160f-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568730, "uuid": "a3cced46-6baf-44fe-8c85-f71c0c90c724", "comment": "Malware payload", "value": "72709b61eb11ae797127cf1dc7412471", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568730, "uuid": "80a7caf3-cdf5-4582-8ea4-e6532821ae32", "comment": "Malware payload", "value": "123f8eb7b2334b005aebfa36af3173f0ec329c08703ab486c93de57e68e00f3d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568730, "uuid": "d6dd02fb-3971-4e41-83aa-258e1e4efa5f", "comment": "Malware payload", "value": "9e03ed13eb66c21346852f1abff08c0d6f268be1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568730, "uuid": "c55b3de5-e598-4516-875e-edded8c6b6f8", "comment": "Malware payload", "value": "e5ce766b9d89a7c6db0d635cdef6742c4cab6db00d3bbddcb4a6b202e1076bb59b5c90913c382e6d2081e741e40284e2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568730, "uuid": "a54a8196-06a7-46e7-9a8f-189d3113b8aa", "value": "T141233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568730, "uuid": "f74019e7-1482-4a79-9faf-59fe47626efa", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568730, "uuid": "4b51145c-a13d-4087-a10d-8beab74b116a", "value": 47679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568730, "uuid": "a319212f-f2fa-4ee0-a1d6-d9b57dfa5306", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568730, "uuid": "519197ee-f148-4aa2-8d15-8d7a77debc5f", "value": "2022-1-28-72709b61eb11ae797127cf1dc7412471.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ece709-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559672, "uuid": "efbb9d61-64ef-40eb-a28e-11f13d124794", "comment": "Malware payload (SilentBuilder)", "value": "4e1b4d40cd7acaa34e9e75973083dc69", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559672, "uuid": "995c1800-49db-49bc-b847-f7059f44e97a", "comment": "Malware payload (SilentBuilder)", "value": "124d2228ef4971b046c961a28b206513a053e9b89c40dc6a0d02efea14dc9220", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559672, "uuid": "e2f783eb-0d1a-47e8-ae17-28bcec4c572c", "comment": "Malware payload (SilentBuilder)", "value": "4eebcf9ceb1e3e8ef768a75522372a7d18026704", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559672, "uuid": "8c7b887c-c993-40a8-b019-0f076bccf0a9", "comment": "Malware payload (SilentBuilder)", "value": "ddbd97f2d6a12a09723b2c42e63a488de441faa9da9ac0f806914ba68091f4452c68459d594883d32c04794925a9cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559672, "uuid": "87ca4397-2b07-4c80-8dfa-564ea6fecb3c", "value": "T12E131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559672, "uuid": "2b3dec3a-968e-433e-b12c-c84074e5ad13", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559672, "uuid": "408c328d-59e2-4b34-a88e-d099a3340258", "value": 44650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559672, "uuid": "dacce0e6-620e-4f72-9d52-cb8adbad41e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559672, "uuid": "d0cf3b2c-4a03-4aae-8fc3-b8d74f11959a", "value": "2022-1-27-4e1b4d40cd7acaa34e9e75973083dc69.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030be265-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570139, "uuid": "734af120-76c9-4147-b427-bf8df45b64f4", "comment": "Malware payload (SilentBuilder)", "value": "a644589e48d3e5ccfb26ea9f73006d71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570139, "uuid": "9ceb393c-b32e-4d98-ac7d-f663b8f1b875", "comment": "Malware payload (SilentBuilder)", "value": "12996d6140a8176ae80ff7aaad7be5f75bfae0ff06ec47e60e2a5f3828b3e7a0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570139, "uuid": "c569bd66-3c39-4401-9f16-7d3b2da3facf", "comment": "Malware payload (SilentBuilder)", "value": "baf6b3018f85b448c574cda1d493948e34cb074c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570139, "uuid": "b72e90e2-946a-4b25-b514-01029a462d52", "comment": "Malware payload (SilentBuilder)", "value": "67af0375934483ad5a38ffaf785d43164a94029d2237641e35029f8fc9394f7265ae79da30b92f6c0db789fde85f4c87", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570139, "uuid": "73953d97-2f83-4f09-8c69-ab62253a4a3b", "value": "T1BF233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570139, "uuid": "edf12bea-ef35-41e3-94eb-61875587dd35", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570139, "uuid": "fda986f5-b971-4f57-af9a-9f16c5c6bdef", "value": 47633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570139, "uuid": "0947ce5c-1170-42ec-8a55-5a71f25e5430", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570139, "uuid": "fdfb2bab-8327-42ec-8351-e1928bf221c5", "value": "2022-1-28-a644589e48d3e5ccfb26ea9f73006d71.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1f4868-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643560038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560038, "uuid": "75e49f2e-183c-4b15-9046-a564b41a0d31", "comment": "Malware payload (Heodo)", "value": "57946ec32ff0acfc7847c900f19384a2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560038, "uuid": "bf5203e8-3ab9-49bc-b764-78a4798b77c7", "comment": "Malware payload (Heodo)", "value": "12a95d62ed0a17cb3c3318f01c1f70324740e157ed3553d3e60eb649cffef3fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560038, "uuid": "0f4299b5-a829-43b5-a60b-29d1e9ca3bd8", "comment": "Malware payload (Heodo)", "value": "e1ab62a7592219db186b661fcbe8fee50247c937", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560038, "uuid": "dc152c39-c5a6-4c94-bc5e-9f4a22d39d7c", "comment": "Malware payload (Heodo)", "value": "10ce88287a22f31e3893418f04b5852688ac6cf4c22e75bf9583be411ffe6a4147248762fe85a0da0431946d42165cf8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560038, "uuid": "4cffe1af-3ec0-4135-b2b2-fe9ae318f345", "value": "T13FF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560038, "uuid": "9acf8b8c-1439-4127-8dd7-bedf61361fb7", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560038, "uuid": "379e7ad3-35b8-4479-8342-67c60ff0254d", "value": 158675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560038, "uuid": "7331d7d1-4a8d-4d83-8fc1-b36c42255516", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560038, "uuid": "8792fb1a-de8f-4316-867d-3f629da0eafb", "value": "2022-1-27-57946ec32ff0acfc7847c900f19384a2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b40397-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576345, "uuid": "57f38a24-3225-46d1-b55d-22e8ec3afa9b", "comment": "Malware payload (SilentBuilder)", "value": "f427fdaa645c12c20e3daca8e2c5214f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576345, "uuid": "9575de34-10bd-43cf-8a08-4a80a5c5386f", "comment": "Malware payload (SilentBuilder)", "value": "12e35526da05040b737c0bce274fdb9292f07992b4fbd18d4fb5d4490f7a7eab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576345, "uuid": "67903eab-514f-4ff7-8854-f4a1e8c6192c", "comment": "Malware payload (SilentBuilder)", "value": "3d6ba068c140259a28ab668ff9579b7f0e58d497", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576345, "uuid": "4e8c1ef9-2d4d-4da6-aa8f-3df3b3916571", "comment": "Malware payload (SilentBuilder)", "value": "745551d1d48a8d341f5c9f7771c84c12467a1a392039a7e40a10af668852585f2611e843f67cae9aa3daa24466af1134", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576345, "uuid": "bc298e6c-bdb9-449f-a994-ba0dc98b0332", "value": "T109934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576345, "uuid": "d010b91d-c2d9-48c5-a188-83c7924289e3", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576345, "uuid": "197b4374-812d-4ec1-9d01-25baa54e45c1", "value": 92516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576345, "uuid": "add24c7e-d760-46e0-a0e5-3f0bc3c29772", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576345, "uuid": "0d6ee6d3-58d9-473d-855f-cf7893836e82", "value": "2022-1-29-f427fdaa645c12c20e3daca8e2c5214f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0a2b90-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567230, "uuid": "6d0cb87d-999a-413e-acc0-f9ad8693c947", "comment": "Malware payload (SilentBuilder)", "value": "3daec4888a6bccc3490fc1642e108d13", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567230, "uuid": "d0e24d6b-6655-4e87-80c6-0f62606fa947", "comment": "Malware payload (SilentBuilder)", "value": "12ffa36dfd5bab34e1dcfed55453894e6d59f21e159dce3019447ffd50bc6d2f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567230, "uuid": "bbcb2db6-4f38-4aff-8373-51a9b70d0911", "comment": "Malware payload (SilentBuilder)", "value": "8478d753ee5d2f88e477fd9e9224511a556d772e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567230, "uuid": "2932fa8f-f815-4638-9a23-60988fe38f29", "comment": "Malware payload (SilentBuilder)", "value": "55736718aa58cac4195979f1a1a8a99e6460bb68d7a623b0a7d6b01fc8bf60df634d8d08f1cbfd9e0a44b9b0f844a0dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567230, "uuid": "8f56c7e4-e407-4d6b-8e23-a5545a358057", "value": "T122F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567230, "uuid": "f13ea75d-dfc9-4f26-bb10-023620019318", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567230, "uuid": "f87a670e-1d60-494a-a96b-73d6456bf132", "value": 158257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567230, "uuid": "27bacfae-cfcb-434e-bd4f-77999fb0bbfd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567230, "uuid": "92c425be-db62-432d-89ed-8b9d1154f812", "value": "2022-1-28-3daec4888a6bccc3490fc1642e108d13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9dabfc-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559094, "uuid": "a5c9a080-8a06-4299-8f03-fe45db5cd389", "comment": "Malware payload (SilentBuilder)", "value": "3e5b3454e8b7ce8054fe61a0d046c25d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559094, "uuid": "ae971b71-44ad-4457-b0cc-dccef71cd512", "comment": "Malware payload (SilentBuilder)", "value": "1316669ebfce6a12661c744f5a840d0535b35882b94d863f13ff16a8a021cb4a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559094, "uuid": "ad9cad4f-f511-4911-8b76-1bec9b9cf04c", "comment": "Malware payload (SilentBuilder)", "value": "6b756e13c73e4432225253c540c8b20a919507f3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559094, "uuid": "3d6408b1-b218-4560-a619-2f6421e7d915", "comment": "Malware payload (SilentBuilder)", "value": "7757913554060573a764685925f7afb64f97ccbfc7cf27c4f4c501a4b614de8e91a903cda0ea4d9bbd5426ea5c1a543c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559094, "uuid": "fa128217-846c-4c0c-b4fa-949690e66f2a", "value": "T191131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559094, "uuid": "aee2a813-d150-443b-91d8-2593d766ca00", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559094, "uuid": "2f4865df-3d22-465b-99e3-ab8c861e5fe1", "value": 45027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559094, "uuid": "94d78f2d-f3af-4da1-8587-d876b59eedd8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559094, "uuid": "c5ba612e-e76f-4dfd-91cf-4cfe4412afc9", "value": "2022-1-27-3e5b3454e8b7ce8054fe61a0d046c25d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7e921a-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560918, "uuid": "0bd1af7d-c584-4a03-9ee0-d43426ed9fb3", "comment": "Malware payload (SilentBuilder)", "value": "ee18ae138299ff0b130712d444681f7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560918, "uuid": "bd609573-e3bb-4916-85ea-49fc81c9df88", "comment": "Malware payload (SilentBuilder)", "value": "1321b64827d9023e2e5899992420ec6206468b00781a6d34613a1bb46ea2efe8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560918, "uuid": "b9237ab4-f5cb-45ac-bd2a-cbd258a097be", "comment": "Malware payload (SilentBuilder)", "value": "7d8bb4092b3b0a40a60fd9476854d3d400907f07", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560918, "uuid": "e0118374-8fe5-4cb7-a9ae-38b3e8f04970", "comment": "Malware payload (SilentBuilder)", "value": "d870565250dfeb87d88b522b6d8bd1755653f9aa675d6e69a868db08ddf3c6e4054df89997deeffa210757aa359fecee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560918, "uuid": "4b046d0b-ae40-4ae5-b9f8-d610bfbcaed4", "value": "T1D7F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560918, "uuid": "f7c6fcdc-ba5b-45f3-a167-8f150067965f", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560918, "uuid": "25084fc0-00ea-4a44-bcc9-53febe146aff", "value": 158598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560918, "uuid": "1795e454-97b2-475f-a446-626144d296b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560918, "uuid": "70447327-b670-40d3-9761-2d76532df7a7", "value": "2022-1-28-ee18ae138299ff0b130712d444681f7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49d798a-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571726, "uuid": "65fe5d8c-514a-4446-ad30-060cb9afe84a", "comment": "Malware payload (SilentBuilder)", "value": "d63196200c6cebd5a60685cb9ec3bf40", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571726, "uuid": "7b38f230-8ebb-4f21-b305-c00072731ca8", "comment": "Malware payload (SilentBuilder)", "value": "132e58424699cdfaf4d22e4c81a0b4e231aa76356b1496ae9e5bf6256b8fa2b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571726, "uuid": "49586d07-e484-4023-9806-c092df95279b", "comment": "Malware payload (SilentBuilder)", "value": "d66d256686185e88a8d5898df885049af9ce5fa4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571726, "uuid": "1fceb539-6cb4-43b9-a8dc-ce365ba31722", "comment": "Malware payload (SilentBuilder)", "value": "cd61d92674d54b8f9391d0b0ef3fde7acc8737d272ba3e155c6a5ce0d17597cda2baa71b94bbba0c44de20e4ec2f7c00", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571726, "uuid": "107db9c6-4fba-4685-95ea-36f66260f90c", "value": "T1AEF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571726, "uuid": "0d70f4e2-1ed3-4c2f-84a3-5c6ab8acd239", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571726, "uuid": "11a6b24a-d1c8-44bf-a789-e50f8965fa90", "value": 158826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571726, "uuid": "ba1c799a-ecaf-43bf-a611-59813a07eae4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571726, "uuid": "c319abc5-c622-4f43-b351-97b5ee2446da", "value": "2022-1-28-d63196200c6cebd5a60685cb9ec3bf40.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f5cba6-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559024, "uuid": "1b9b4020-4751-482b-8820-f6a620142f40", "comment": "Malware payload (SilentBuilder)", "value": "3a898582d304948ad84d7d5a032c3474", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559024, "uuid": "02b59e71-9c7e-4e4e-9d5a-2ac973cd08da", "comment": "Malware payload (SilentBuilder)", "value": "13b25664049bd5958c636e715e5dac1c3bb81f20c8622af4e46c346e5bdb6ec4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559024, "uuid": "45d5513a-741f-4dd0-b139-ec33339d65c4", "comment": "Malware payload (SilentBuilder)", "value": "777589037eb554eebc08dc705e71ac8302f77729", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559024, "uuid": "74366166-3872-42cf-b024-2cac14bf6287", "comment": "Malware payload (SilentBuilder)", "value": "f9d9cf4128082461f3a57fc32cf488d80575e184fe55980c3d4a1eabbd2a25acd7a796d8389d2a2fc3301564fab88d27", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559024, "uuid": "9d917bbb-26f8-405e-9290-2f21fd96eb54", "value": "T19F735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559024, "uuid": "c6e198cb-7b45-4626-8908-10a4521ff540", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559024, "uuid": "9dc8d64d-1770-4e65-9b31-1cc74d3af9e3", "value": 77793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559024, "uuid": "66dea155-8ebf-4a46-99fd-bfb6e830da60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559024, "uuid": "1c6e92ec-bd77-4e0f-a225-9e05cfbffb4d", "value": "2022-1-27-3a898582d304948ad84d7d5a032c3474.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc653508-815f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643500872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "b1b61202-aec1-4e94-b754-e7f743a3b655", "comment": "Malware payload (Heodo)", "value": "548b453d6fb0f9eff0d90c4eb7772379", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "8e10f834-24c8-4171-bd06-5dc52f9ae1a5", "comment": "Malware payload (Heodo)", "value": "13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "19e4cff3-c52d-4e88-a675-6932c1a6e2fd", "comment": "Malware payload (Heodo)", "value": "57c063eb9ac607c7b2894650cddf691f5859292c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500872, "uuid": "aba47a94-9999-45b7-a9a4-b3ad389e412f", "comment": "Malware payload (Heodo)", "value": "e1299cf0f30b07a8159349f21989ac09b63b52e9f168db6a9fd073aafe0f9c68401b224853ef747969150cda4785cd06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "dbecc593-62f7-408c-a124-beb2082e5549", "value": "T179C48F3D71A0A435C27B34F475FAA3B3859FBD524B28469B97FC112B1E395818E3860B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "7caf1ab2-da7e-4b69-b129-2d7b6aefd3aa", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "5b1bfa30-042b-4340-824d-2058e4b2200f", "value": "12288:FMEB4sjSekFwPNWzomLEX/RXzA+UeV84+iw:FMuXNkFwPNYEX/NWeV84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643500872, "uuid": "b3a193e6-4fa2-4097-86ad-c2cf5c834807", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643500872, "uuid": "aab453f8-3ecd-4217-b08c-6d9812a24576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500872, "uuid": "5ee852f6-56f8-483a-9056-83b526effbc7", "value": "emotet_exe_e4_13e58ef334cfe5c6c8e07a173f91c566a0279e6c4e13cd592b247c6528ac5caf_2022-01-30__000105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310c961f-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643574512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574512, "uuid": "082adec6-4926-4420-82ed-3259a12341d2", "comment": "Malware payload (Heodo)", "value": "6dd26cfcf81c1ff06d045f1790e73510", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574512, "uuid": "7f90b1b3-3f71-4a6e-a3e8-898a3639380e", "comment": "Malware payload (Heodo)", "value": "13efffe7a2e5cd58c35354c975198e8e8d1ee60d5c39199a5c96db4e30e87257", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574512, "uuid": "5831a3b2-bc7b-4945-bd33-7dc015d53f95", "comment": "Malware payload (Heodo)", "value": "8507cb534b924d467fddf94d350ce7ac585c85ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574512, "uuid": "09bdc792-7057-40be-a1e3-42f7841a2da2", "comment": "Malware payload (Heodo)", "value": "5aa7aa089e20052f7b4b2e791c1b95d4464bb9df442221275d0731a99632cf064ec28171070eb814f0d8fc70984bc5b1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574512, "uuid": "b205c5f8-04f6-4c1a-9327-22a997055138", "value": "T1D9934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574512, "uuid": "70cc6102-6036-4720-848f-41875869875f", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574512, "uuid": "5d2fd684-b017-42c4-8b8d-1455d00ac3a5", "value": 92359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574512, "uuid": "088e7c27-cccd-4774-8fe3-e0966cc6ac15", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574512, "uuid": "8ce20583-85e2-4e71-bb17-dc5577c1c7ce", "value": "2022-1-29-6dd26cfcf81c1ff06d045f1790e73510.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cad38d9-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643575390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575390, "uuid": "113f3466-31ce-4886-88c2-8b1d893a51ed", "comment": "Malware payload (Heodo)", "value": "b01310f233e861f4284922014a2e2d0c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575390, "uuid": "2e40b2c4-b812-4353-a64a-7a18c2b8573c", "comment": "Malware payload (Heodo)", "value": "13f6acd29262beabd4bef248fc42255c7faec6df4c4ee1361e08310945994c52", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575390, "uuid": "26b0be3c-1aa8-42fc-94c3-655074778dc6", "comment": "Malware payload (Heodo)", "value": "65ee8c70129626514abdfb713712f00a2f65cce7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575390, "uuid": "ea52127e-2292-4e01-87db-340e74aea208", "comment": "Malware payload (Heodo)", "value": "5587ff409fc837b85bef7cee29527760f47b67941237a1ce1ad72fbf3a6ce61a63d3c20b756f9077eb4f0e6eb5b1818f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575390, "uuid": "89a35bcb-b95e-48ed-967d-01be1722e348", "value": "T150839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575390, "uuid": "d9656432-de9c-4b76-b942-26db6320d61c", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575390, "uuid": "e8bd460f-4801-4bda-ba2b-9c1c74ec05a6", "value": 87328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575390, "uuid": "dca4924a-b3db-4794-9b80-446c263f01fc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575390, "uuid": "45df4a04-de32-4a20-a575-6339c27a2801", "value": "2022-1-29-b01310f233e861f4284922014a2e2d0c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33e806d-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558865, "uuid": "df0a709f-7c36-4691-bf4c-32abff99dfc8", "comment": "Malware payload (Heodo)", "value": "35da4436a66b4d3b6246f34051e29890", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558865, "uuid": "9d9d035c-fcad-44ac-82cf-724ac66759c2", "comment": "Malware payload (Heodo)", "value": "13f91977d3d402a088d81b69a8cd2c5cde4b0f283b74b004b4f28b4170994f87", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558865, "uuid": "7d90cdbe-58fa-46d3-809c-a76053e9b7a0", "comment": "Malware payload (Heodo)", "value": "3da6287379a952f0ceaacf00f41b23db68234cf7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558865, "uuid": "5550a776-5f38-4398-a4b8-846962996489", "comment": "Malware payload (Heodo)", "value": "7d8d23c63c22fd66ffaae19b6cdd08b24558e49df2ddf9334d0494bed9da6152d55f09fc0dbc8b0579711d99ff36a780", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558865, "uuid": "cfb59f4c-1907-4878-b2ba-35ccbb49e8ee", "value": "T1F0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558865, "uuid": "d9a4388c-1714-44f9-8cc4-c43c448695c2", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558865, "uuid": "8d750263-9660-4937-b865-4e1cb7d00f74", "value": 78010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558865, "uuid": "00a9b719-e7eb-4592-98fe-4e8eccef3c9b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558865, "uuid": "640ad75e-f538-4943-9b01-170d6d855c67", "value": "2022-1-27-35da4436a66b4d3b6246f34051e29890.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f573834-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568066, "uuid": "32f9bff4-9fbc-4f0c-9694-dff9b79c2d3f", "comment": "Malware payload (SilentBuilder)", "value": "5b0c3e58ffa21cf35cb13fe91ebe7151", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568066, "uuid": "20ce738a-4cf1-4d23-9a80-aa9161cc76d2", "comment": "Malware payload (SilentBuilder)", "value": "13f9d0db35e962984cec92a231df6f474bd18877c8aa852037e2c3db3759cc0d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568066, "uuid": "fb1b9ebd-5381-42d0-bd4e-251cc40b10b3", "comment": "Malware payload (SilentBuilder)", "value": "119e5e699153f667d93f8a90ddd6bac15620918d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568066, "uuid": "e999d68c-4611-4698-847e-319e5d58ea9c", "comment": "Malware payload (SilentBuilder)", "value": "807c799fdcc7fbd2251da45f3201fb58a8ab418cac29575713e9db2a3446405cc9a333878c8cad19e9443c2581c99ca7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568066, "uuid": "e833f215-3aaa-49e5-8885-47b2fa3e4924", "value": "T16C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568066, "uuid": "7694ded8-fcee-443c-8a31-22065564d565", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568066, "uuid": "1fa641f4-2155-41ef-95d7-b78f9a57069b", "value": 48539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568066, "uuid": "c6e08d7b-174d-4dd0-be61-6772c0b55a63", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568066, "uuid": "acbbde1c-48ca-43d2-940b-1987c1be8f8d", "value": "2022-1-28-5b0c3e58ffa21cf35cb13fe91ebe7151.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c23eed-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557747, "uuid": "a0c814ce-7f1b-42cb-8a55-3a9826f2ff99", "comment": "Malware payload (SilentBuilder)", "value": "13a82ca42de3327efc88494559af135f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557747, "uuid": "42b8c745-f804-4d49-b5b6-bc8420995821", "comment": "Malware payload (SilentBuilder)", "value": "141144b15a12066d0ffec53f22d120de4d50a6ddea8f4dde48dff0bc0a45c36e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557747, "uuid": "15df2f6c-06df-4b8e-9e2e-27a966fa45c3", "comment": "Malware payload (SilentBuilder)", "value": "eaa784a4ea7b882ec294a1598bbc58612abd2b4d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557747, "uuid": "86a446bf-2526-40c4-83d1-b9c31f97c470", "comment": "Malware payload (SilentBuilder)", "value": "39de6a4be3aad8a7be86f37826455837dc9fe77eea4eb48452b8fcafbe552e159d468f480fbd0b86b0b9f270d77afd17", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557747, "uuid": "6e5a6c9e-8781-4c70-8ce9-39b695340b12", "value": "T115735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557747, "uuid": "fda739dd-a042-49ae-9184-cbd54ab35240", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557747, "uuid": "e394a296-c211-48a0-bcd9-850c3e1f5958", "value": 78313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557747, "uuid": "2e119cf1-13ac-4456-8f5f-55262553139d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557747, "uuid": "089c8eda-efcf-4ba6-8ba8-6bc5a13c45a6", "value": "2022-1-27-13a82ca42de3327efc88494559af135f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68d298e-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576105, "uuid": "30e94cd9-3078-45b3-8b3e-d41d2d180ba7", "comment": "Malware payload (SilentBuilder)", "value": "e55416ba9b4fa5d40e04c853cbeffce3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576105, "uuid": "95a821e3-510b-41e2-8f80-da1431573c9e", "comment": "Malware payload (SilentBuilder)", "value": "1432dbf42e32a6266328b8e1c6d5fa3c4f5a226122bf3d0756620e1033cb9d75", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576105, "uuid": "94eac116-01ce-4960-a6a3-e0b3947014c9", "comment": "Malware payload (SilentBuilder)", "value": "926bba988283fad2a20ad090ec834a17faf67ffa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576105, "uuid": "71aa52a2-46ab-45ba-9fe2-ee6ce6e0282a", "comment": "Malware payload (SilentBuilder)", "value": "801cbdddca5e606c5e304036da661c1232780856d55d52b05236a4d5d5b1a8a1febaef57bc649c3807f3586412157803", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576105, "uuid": "591d1e77-e8b6-491d-a581-04f6e2a75f6b", "value": "T154934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576105, "uuid": "10a6f440-b8fc-4257-9091-a4f1968ec4ef", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576105, "uuid": "f46de6be-9eba-4cf0-ac58-dad678517042", "value": 92943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576105, "uuid": "909b9b5c-5794-4e46-973e-80607610c507", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576105, "uuid": "8f113607-9436-4524-96de-6fde350a6d4f", "value": "2022-1-29-e55416ba9b4fa5d40e04c853cbeffce3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b65fb4f-8198-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1643525191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525191, "uuid": "354b4e92-83ec-4130-8586-b33075dc27ab", "comment": "Malware payload (RemcosRAT)", "value": "8a1c35b83588dba4d15708446e3c5df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525191, "uuid": "72e58e95-ab97-48d7-bee0-62f6a1bf0e39", "comment": "Malware payload (RemcosRAT)", "value": "143a5344cc0b0bec26f6a5b69710294856e326909f283ab3ae73630d88f45f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525191, "uuid": "60ceb2cd-887b-410b-917e-18e4daa34454", "comment": "Malware payload (RemcosRAT)", "value": "0ee48586660ec379a019ae1cae66a63f3f761705", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525191, "uuid": "c2c6ce73-adf3-4e51-a00e-f4d93b0240fd", "comment": "Malware payload (RemcosRAT)", "value": "70f74332eab7e422a31c8234a6c3103d136b573998bc5f3cbcff13342fab4af1882c0366a6cc4d0764502bc19524ad69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525191, "uuid": "5b70fb0c-b9dd-45cf-8258-b35efa688914", "value": "T1B1D412339B941423F0800EB20FE595A86674FC53BA11D8875A86F6144DBAED318F97FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525191, "uuid": "24df4f27-57b1-4325-947b-96ddd858e421", "value": "14b5dea9b4bf1f61429a6478edfe25b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525191, "uuid": "c7a738a4-3b2e-480c-864f-56f138532a12", "value": "12288:mfB7aNE5Su8N7pOk1JAQsjbgzs5Vw3f7I:mfkNEe/9ge8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643525191, "uuid": "18cc2a16-2171-4627-ac56-6185bd1bd6e0", "value": 600208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643525191, "uuid": "b9aeab5b-77d3-4c68-b18b-edf4bd976328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525191, "uuid": "4f82802a-d21b-4c1b-9ca4-6a8eb0c76be2", "value": "8a1c35b83588dba4d15708446e3c5df4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b09ca6-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574974, "uuid": "c732593a-e377-4396-a2d0-e6bded96ef0d", "comment": "Malware payload (SilentBuilder)", "value": "84a22c8ffe58139b5e531e3f76640ba1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574974, "uuid": "19ed804e-ee0e-4be1-94d2-7a346c404c29", "comment": "Malware payload (SilentBuilder)", "value": "1468f48406d42e6c072c780e29251b5f9b42631765a629e5fcd403b4c949831c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574974, "uuid": "7a135aca-f398-4158-a592-42336e6ed053", "comment": "Malware payload (SilentBuilder)", "value": "097c629c89851607564904eeabfb75927740dc13", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574974, "uuid": "76929b86-c732-425a-91a5-6160f2ffc5a7", "comment": "Malware payload (SilentBuilder)", "value": "8c48889116411b5b68142f25a3b2145951b95023599211c91be3a246b7b363a268e61e58f72c8965aa4c0bb020b0de60", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574974, "uuid": "152a1f8e-1414-473f-9a0f-4449dd18a265", "value": "T1E3934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574974, "uuid": "fb30643c-00ab-410a-b937-b7da267e0af8", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574974, "uuid": "6466727d-b165-425b-804f-94f8e6fff297", "value": 92286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574974, "uuid": "d1453085-b578-4ff1-bafb-796e481a491f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574974, "uuid": "b539d595-e5ab-42ef-bbcd-b07cfd10901a", "value": "2022-1-29-84a22c8ffe58139b5e531e3f76640ba1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecf51aa-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558375, "uuid": "5286d3c7-017a-4190-bc04-e7e2850e45fa", "comment": "Malware payload (SilentBuilder)", "value": "c6760cabe9dca3d06f721a4e25f58f81", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558375, "uuid": "b40939f3-7cfa-4a54-9baf-42c514ac1ae2", "comment": "Malware payload (SilentBuilder)", "value": "1478b1b53ff7b1941488489a5a5c07f51e3389119dc6635a0199efd7f337c123", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558375, "uuid": "80873320-f7a4-4916-8338-89c95a6ad549", "comment": "Malware payload (SilentBuilder)", "value": "82abec5aa62b585f3293f9890eb986b455231591", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558375, "uuid": "ce34447b-d7b4-4190-a122-8a1592a807d5", "comment": "Malware payload (SilentBuilder)", "value": "e1d3f0861b46737c0c7cd5769e8ff89c801ef9729fd36fa4d3c36d3a28f998b1a92a18dde763f3b33ea4bf7e71e80fce", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558375, "uuid": "bb24a4b7-ae91-4528-bbe8-d7eafb6dd190", "value": "T128E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558375, "uuid": "c70d1fb9-35fc-4131-b8fa-1e9d3f238a77", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558375, "uuid": "a442f00c-5ee3-4c2e-8fc5-98ff8aa3684d", "value": 146105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558375, "uuid": "7d3fb84b-ddf1-40d0-b100-ddbb926ae4db", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558375, "uuid": "81c73748-3afd-4225-9885-6222f8b685b9", "value": "2022-1-26-c6760cabe9dca3d06f721a4e25f58f81.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede747e0-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568386, "uuid": "ed5ea087-dcb3-4655-bc30-e721dbd0524c", "comment": "Malware payload (SilentBuilder)", "value": "67e7d38c4d261d91a0edeabca7277e72", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568386, "uuid": "2a85d53b-7a56-4727-8218-69afbcbd1953", "comment": "Malware payload (SilentBuilder)", "value": "147c47dfd753d96703c85365ba2e0094417e5f80ec9376b0b2f5d35a555d1826", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568386, "uuid": "ce264223-0e4e-4a32-a81f-a162d331885e", "comment": "Malware payload (SilentBuilder)", "value": "e1ecd4917e57716b27a377d116d0c85040eed933", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568386, "uuid": "43134007-ec0e-4438-ad22-f08224aa2945", "comment": "Malware payload (SilentBuilder)", "value": "7cbcd6bc8f2c3a3c062a273fc9996c05c3e1cfa45d17240bfd73c5be022282ef90fc11711aaee8b5f4e7f461e07cbcf8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568386, "uuid": "aabf6181-99e5-4bc4-b977-2946dc4771b5", "value": "T14F839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568386, "uuid": "c5be08e5-a02e-4989-9839-85483c820d8b", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568386, "uuid": "67510218-496d-44a4-9d71-f42bac4e72b7", "value": 87239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568386, "uuid": "75acd2af-a1c7-4a90-9b12-55354522ee1c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568386, "uuid": "5f4231c9-5591-436f-b4b5-3c60ab80a8f8", "value": "2022-1-28-67e7d38c4d261d91a0edeabca7277e72.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188ba237-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561586, "uuid": "86279ce3-5e24-46e3-b257-f008ed73871d", "comment": "Malware payload (SilentBuilder)", "value": "8a45f15c34272b37f4ff9d27c5435ae6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561586, "uuid": "c47bb680-4788-4c1b-b518-10c5894f3e6f", "comment": "Malware payload (SilentBuilder)", "value": "1498662b05c49eac29d9a125c0c235418f0ac4d71054f57b2ae548c8482575fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561586, "uuid": "dfaa5e03-0136-40fb-aefa-45e5fa8f8da9", "comment": "Malware payload (SilentBuilder)", "value": "1116054801de741ab516c72498ec69d827e3d2f5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561586, "uuid": "2617ee30-5567-4523-9f6e-6b080e2daea4", "comment": "Malware payload (SilentBuilder)", "value": "7085a515755e5aaa148605b1289cfa19252719b86841ac6e4e8a99f31d1d33787c1d3bf1637c7d861515f76c4b64510d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561586, "uuid": "d9164bf3-2a3a-4f4d-9505-2b4cc593a3d2", "value": "T1E4735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561586, "uuid": "fe03ec4a-3305-47f1-aad9-b3e38ae98885", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561586, "uuid": "6ca72e7b-85fd-4d78-82ca-e1e852ec16d3", "value": 78062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561586, "uuid": "160fbd55-0c85-4c79-a7f4-71ddba347064", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561586, "uuid": "11b055d3-1bde-4837-9398-3eea36178739", "value": "2022-1-27-8a45f15c34272b37f4ff9d27c5435ae6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689e658c-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574175, "uuid": "4fb22acf-3cf0-4654-a9d4-979ade01f290", "comment": "Malware payload (SilentBuilder)", "value": "561b2322ee46a54bb3d8ee3b2b5fc687", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574175, "uuid": "b4136e79-8c32-4c46-9dff-b27a3b80f78c", "comment": "Malware payload (SilentBuilder)", "value": "149aea199bca14f5861e289f1ceb8fb0034a240fcac69fdd379208af68c9598e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574175, "uuid": "28c8a0f7-fd51-4861-99ab-36917730de19", "comment": "Malware payload (SilentBuilder)", "value": "3d6a0ffa38405900eb8113556ee710cba3672e4d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574175, "uuid": "ecf02165-4b56-4b15-845d-57c3aa4a8cfe", "comment": "Malware payload (SilentBuilder)", "value": "a53c8c1c38be4d85c65f2e179127e501ae52e914f78590e353b700914bae8648bf660f9d7c9b26a95f9d1968765f806f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574175, "uuid": "63632fe3-f96d-4ee6-9dbf-185c3a5366e0", "value": "T154934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574175, "uuid": "771f0a88-0a69-470b-bb9e-007543791e09", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574175, "uuid": "63f3e7da-39d3-480b-926a-e6896e89547c", "value": 93197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574175, "uuid": "6d786642-11d6-4717-b0a0-95b62a4882ea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574175, "uuid": "fd783a25-28cd-4af7-9db8-58107a838362", "value": "2022-1-29-561b2322ee46a54bb3d8ee3b2b5fc687.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bee95d7-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575040, "uuid": "95685344-0747-45fe-b179-b52a5e897910", "comment": "Malware payload (SilentBuilder)", "value": "8c79312e5621cb5406e01a9ef6bb939b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575040, "uuid": "3a2c5ad5-0752-4e3d-856a-9ae4ea280ed4", "comment": "Malware payload (SilentBuilder)", "value": "149be60f238f013b65ab5dca38408eb88605f7cd6b0c067c780462790a037737", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575040, "uuid": "af357484-2ada-4d97-99fe-d8685725f931", "comment": "Malware payload (SilentBuilder)", "value": "5b17cb8c423ea01e98afd3e0580fe76117e6ea2e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575040, "uuid": "c18a6266-bcd3-4662-941d-f699c5c8a9c4", "comment": "Malware payload (SilentBuilder)", "value": "e239c7eba98342273bb493614e4521249c731a4621233a6d5683941b1c3f624aebf50375443752cab149935a0d1dcd8b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575040, "uuid": "883386c9-0d1f-4ae0-8799-19f52c2c3bf4", "value": "T191934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575040, "uuid": "6f27a579-04a4-4be4-a84d-1ce3ad3b9a85", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575040, "uuid": "b22287e0-00c8-4c92-9d72-3a9b9e363ef5", "value": 92657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575040, "uuid": "5a05769c-6434-4ff1-afd3-6b63d953bc23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575040, "uuid": "5a3ca51c-525b-402e-a45a-bd58a818c539", "value": "2022-1-29-8c79312e5621cb5406e01a9ef6bb939b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d51c06-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564821, "uuid": "0179e433-b95f-4874-bc76-df206cac3bf4", "comment": "Malware payload (SilentBuilder)", "value": "f3ad49c7e2358ec47e6060c2d50c35ad", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564821, "uuid": "776d65b3-3a02-410a-968b-475f259f1f09", "comment": "Malware payload (SilentBuilder)", "value": "14a22fdbcb42a0e76145371165c7f17c56b7da5b23e180d86d0e115fa7a0113a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564821, "uuid": "7c1e8e0d-87d3-4ea5-9d7a-34537c8300ac", "comment": "Malware payload (SilentBuilder)", "value": "e0a4c569e31dac278a5d2c5d49c81af11607ab2d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564821, "uuid": "0ccabb4a-7ec2-4cef-9edd-a9d39cec9047", "comment": "Malware payload (SilentBuilder)", "value": "edb0885acbd537485c97aa2e92461873b860f96c191be687a173136397df870031f48820be1968e62650c793ce6e229f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564821, "uuid": "3574a151-ad87-4f47-ade7-3b44133729f8", "value": "T160131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564821, "uuid": "f7ffa33b-0879-4489-b6b6-14403407eed8", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564821, "uuid": "471f5379-17c2-4244-8583-a2646df6945c", "value": 44638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564821, "uuid": "65e157a5-2cfa-4e88-afcd-b9afbf05b3c7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564821, "uuid": "4d4274e2-af23-4ff4-be0f-4b8a721a16d9", "value": "2022-1-27-f3ad49c7e2358ec47e6060c2d50c35ad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0879841b-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564565, "uuid": "dba807a2-02c5-4451-ad3c-274412eed106", "comment": "Malware payload (SilentBuilder)", "value": "ea2160c5834e64f57aaded3cc1a4f7ee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564565, "uuid": "d00e982a-e1a3-4bd0-aa39-c95bb355cd7b", "comment": "Malware payload (SilentBuilder)", "value": "14cd16417ec8e97605ec51f183d25c6b76633989ecfece3f715795daef317bfe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564565, "uuid": "3acce91f-a324-454c-bc25-d7294bd30e31", "comment": "Malware payload (SilentBuilder)", "value": "f8ac2210c6be8558e6e508f178c8f12e48470e4b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564565, "uuid": "231765cc-0a07-4f72-99cf-35af05fd720d", "comment": "Malware payload (SilentBuilder)", "value": "b326a8ccf86fc67514cb701e25a7e7e1de52a3bd96546c8317211f8a94417524cdaa8580a383d2e2e5106cad3852a24c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564565, "uuid": "65b0b482-c164-45d3-bd42-c70250c62694", "value": "T12B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564565, "uuid": "d4211690-4898-4784-b2ac-667d3086ecd1", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564565, "uuid": "2bfc64ce-4f62-4fa4-bb04-b09f49346223", "value": 77815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564565, "uuid": "abc331f7-d8fa-4089-bd49-4bfa5276c2c8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564565, "uuid": "9fb8c06b-dbb7-42c8-868a-3f75ad664e35", "value": "2022-1-27-ea2160c5834e64f57aaded3cc1a4f7ee.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f7bd43-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564554, "uuid": "b7b32b4e-096b-4b2c-b317-a78c9cfe1f1b", "comment": "Malware payload (SilentBuilder)", "value": "e95dbf07a5d2523002ee2e709cfbb648", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564554, "uuid": "8a7e259d-7ebf-4e3b-ab50-8255b1c9e118", "comment": "Malware payload (SilentBuilder)", "value": "14cfaa25ecf699a9299ceea1bbd4adfb0f2bbe9fd3e92655194c2e28426555e5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564554, "uuid": "fb3f04cd-6467-4288-83ac-d9255d0f2eea", "comment": "Malware payload (SilentBuilder)", "value": "74fc3336e52e313ebe5a542c579f44fb4e4ea7c9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564554, "uuid": "e9bc9dd1-5054-47d3-aab5-efbdff48f3e4", "comment": "Malware payload (SilentBuilder)", "value": "23d55586e53b591d856d737058a4c41b14050f8b32321342368f3f302b2cce24e79d7b05747e2dfa18aa37077540173d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564554, "uuid": "e8ece2c3-8fa8-4a28-9088-d84bc6a0dd22", "value": "T175735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564554, "uuid": "c43778a7-30e3-4a49-81c9-901108da2c29", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564554, "uuid": "1152420b-82d6-4ecd-83bf-8c98b4e417cf", "value": 78103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564554, "uuid": "6f92a599-ac6b-432d-b9c2-61747670a2db", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564554, "uuid": "8dea6f4a-58a1-4354-a76d-bf5e102ef990", "value": "2022-1-27-e95dbf07a5d2523002ee2e709cfbb648.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeee2b4-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559986, "uuid": "4d053410-0574-4729-ab9a-d18b8ee2fafc", "comment": "Malware payload (SilentBuilder)", "value": "56d8c19a94af213a9bed461566bb3fd0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559986, "uuid": "44953048-1a57-412b-81b7-27c8df436699", "comment": "Malware payload (SilentBuilder)", "value": "14e7bc610514bad78b150d9942781ebe8301fffdb100b97f0adf13229aa0cefe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559986, "uuid": "eb2a8222-7ee8-4649-87bd-e9bf3d4111d3", "comment": "Malware payload (SilentBuilder)", "value": "a911120069dc3975c0dfaae9ce495e906e0af850", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559986, "uuid": "c0085bf1-8317-40e7-8162-258389d1c469", "comment": "Malware payload (SilentBuilder)", "value": "b8d114bd9fdddbaa5166a8b9e884497fcb430f615a56b28ba45ed5ad2a1c25f4d7667b5cbdec1e4c1ce3ee75f0463da2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559986, "uuid": "41afa248-b80d-4846-bec5-7a5e2d61572f", "value": "T14D735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559986, "uuid": "bf876503-7d81-4204-91aa-70c9efcd4ad7", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559986, "uuid": "43f9076e-c64d-4c5c-b08e-d52d86117459", "value": 77423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559986, "uuid": "3e7e395c-843c-4c08-a942-e00ed32f67c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559986, "uuid": "1f57dca6-cb49-44d6-8f6a-9d9eca27c7b1", "value": "2022-1-27-56d8c19a94af213a9bed461566bb3fd0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00bc2f3-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561920, "uuid": "5da2dfe7-5a52-464d-9a4d-7307a8e7048c", "comment": "Malware payload (SilentBuilder)", "value": "9730bab83853bca2e92c7981eec02c8c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561920, "uuid": "e04d27a1-9d0d-4a9a-964c-aa23d09aaae1", "comment": "Malware payload (SilentBuilder)", "value": "14e96003ff2b34c7cc9095dadfc7b4e2ca18aa0b906ad45b080609870d7cce6f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561920, "uuid": "3b2ff0c6-d120-4f37-af67-141a43838b21", "comment": "Malware payload (SilentBuilder)", "value": "93e4aa943da04bdc792ae378d6029bf553960c98", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561920, "uuid": "0da137de-4b79-45f5-b410-30fb1d41ed1d", "comment": "Malware payload (SilentBuilder)", "value": "43905ecb062a21b724aae2db29719f8873608a9a27b3835449103535793629218fb2678a134a68c1e454f772a74dd26c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561920, "uuid": "5a441729-6135-4b01-9883-046907f687f2", "value": "T13C231953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561920, "uuid": "9da34f66-a3bf-4f19-b9c7-6fedb4ea92be", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561920, "uuid": "9e6cf620-4132-465f-8301-a765f79e2cfc", "value": 45581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561920, "uuid": "d51a1a05-c256-4b5a-ad6e-d16f1af0f477", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561920, "uuid": "7acde587-eab8-42ef-ace9-0e4cfff1ea9e", "value": "2022-1-27-9730bab83853bca2e92c7981eec02c8c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d8b26-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643567162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567162, "uuid": "011d850e-ab50-4560-add3-20d9ca95ac20", "comment": "Malware payload (Heodo)", "value": "3a09d54ad802d73a79d85f313dac99be", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567162, "uuid": "0e032543-9f94-4d64-85ac-76f783f66891", "comment": "Malware payload (Heodo)", "value": "14eb197a25fc2937c2910ac8e9c1a8c6406819d445046bd7dd6e8b706c58df59", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567162, "uuid": "ed692b54-0151-4a82-9100-644f2d04ceb2", "comment": "Malware payload (Heodo)", "value": "dcdf83a0df4f5b2a6804ca8ee96ab0ed2f8b543f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567162, "uuid": "87be8d2c-c93e-4116-9067-541ef02cc7b6", "comment": "Malware payload (Heodo)", "value": "5b3e24151b32fae14bed76ec7d1deef0f96d449f88f91e48b97c84750a216b7e9f69e03b572042c7e77e41149a4b2e19", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567162, "uuid": "6fe0bcb0-ef35-4aff-b137-83c6a6433683", "value": "T1D4F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567162, "uuid": "cc0247d2-439f-40c0-a032-2917ae287839", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567162, "uuid": "27ef7115-92cd-40fd-83d1-c1752da57edb", "value": 158290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567162, "uuid": "910331fc-9045-4aaf-b709-26887b9a7168", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567162, "uuid": "52b14e89-6f17-4c3a-b086-5fe129d62d16", "value": "2022-1-28-3a09d54ad802d73a79d85f313dac99be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c2d9de-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570818, "uuid": "e7538c83-d7a8-4fa2-9682-291f50babfda", "comment": "Malware payload (SilentBuilder)", "value": "bacb136ac127c1b2be895782929ff22c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570818, "uuid": "a20f1bbf-a046-44b7-93aa-feadd1ef21dd", "comment": "Malware payload (SilentBuilder)", "value": "1506918d8897105677c68c49a4518014e04079e04fb70b4e755c39d1b284ed7b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570818, "uuid": "fa70d005-ebdc-4fe3-a007-0e38d4998811", "comment": "Malware payload (SilentBuilder)", "value": "9da89068c41eeb4bfb8af3728f46c0919d4dff7c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570818, "uuid": "640775d6-dea4-496c-9897-0356f0be9b7c", "comment": "Malware payload (SilentBuilder)", "value": "84bd698a28da005681518af7e5056560e5041574a97885c6fa5acfa81879685b003607b67a2cfdcc45e2668eb55ab6dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570818, "uuid": "5bbb4d20-2b79-4050-a534-a6ec1ce36d7a", "value": "T122F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570818, "uuid": "eb195019-c90c-4390-b7f0-1af88d3d08fd", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570818, "uuid": "ce5dff3e-7453-4555-b568-3a6232818ac1", "value": 158892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570818, "uuid": "3a1dd982-9d8f-4af1-9346-bfd6c17cf3ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570818, "uuid": "ba4af50b-6879-4973-85b9-a4077cd5d75f", "value": "2022-1-28-bacb136ac127c1b2be895782929ff22c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca14eab0-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564460, "uuid": "be584d1f-e0c0-4c6f-aa21-4e7e69ebd697", "comment": "Malware payload (SilentBuilder)", "value": "e6137cf643f9915f958aa9021abbc8a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564460, "uuid": "551a8674-bdfc-4973-aa68-d82519d64d17", "comment": "Malware payload (SilentBuilder)", "value": "1525dc0bf4c116cd4805e07088168140641d998e4f2ce1793d2dc4cd9be9301a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564460, "uuid": "1d8e9e33-e3b2-4530-9463-b9e45b05c794", "comment": "Malware payload (SilentBuilder)", "value": "8e7cd4562d12e3184f653b774b4cecc1a475d62a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564460, "uuid": "520ebf28-df1e-4455-97af-af44c0cff8f7", "comment": "Malware payload (SilentBuilder)", "value": "25991fee9aefbd584592cd2e74565cd528aa1c5946a6200d1910ca5f45d4816684770d4b1debd2dcd85583a4d9b2c914", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564460, "uuid": "1fba4553-de63-4e66-a2db-4d0fff18e76d", "value": "T197735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564460, "uuid": "05612634-b87c-4c3c-9d7a-7038b7d80681", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564460, "uuid": "bdaffb87-f2fe-40f3-bd12-1945dd53c661", "value": 77971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564460, "uuid": "9c9ba072-7c36-4db4-a49a-3d5cd91ff3ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564460, "uuid": "e80eb168-0364-4bb6-912c-6f81db9b6777", "value": "2022-1-27-e6137cf643f9915f958aa9021abbc8a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703991a0-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575047, "uuid": "a6e3ccd2-4c2a-4797-bff9-07bcc26d187b", "comment": "Malware payload (SilentBuilder)", "value": "8d0ab016d38b0c4f54be43d77ae28fbd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575047, "uuid": "8c0904f4-6d46-4969-b2c6-640830f94498", "comment": "Malware payload (SilentBuilder)", "value": "154855604b1e44d32bc9aa4b49c88e37e24187cbe87b46cf2575da457c8a05ec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575047, "uuid": "5681f038-a98e-49e7-ba24-4ef97991b9b0", "comment": "Malware payload (SilentBuilder)", "value": "12974e27b475c6754986e8b3011066d85ca2afff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575047, "uuid": "9e0495f0-924e-4ffd-a152-7637a31b3795", "comment": "Malware payload (SilentBuilder)", "value": "cb3a911f807eb83c68c99bd23d804b2fc5d6467b9046b07ea9e749fa9a6c15f5505d8171b777dabfc34a76c109955533", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575047, "uuid": "64cdd42c-f8cc-4006-bd76-d8ef5d9f9418", "value": "T193934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575047, "uuid": "c8752f6e-5a96-4602-b123-b76e94b4c702", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575047, "uuid": "a42c6cc6-8f08-4372-b88b-8a7b96de0dbc", "value": 93119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575047, "uuid": "23111ef5-6bdb-468d-8263-25618d9092e9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575047, "uuid": "c3b30905-1e2c-4148-940f-761cbc72e6f1", "value": "2022-1-29-8d0ab016d38b0c4f54be43d77ae28fbd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9e3895-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570208, "uuid": "ee0835c3-357f-43cd-9370-f9936ab7e5a7", "comment": "Malware payload (SilentBuilder)", "value": "a761ea564a1ae022856015145c78e429", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570208, "uuid": "8fecd0be-4ae7-4613-8b81-ddf4f6277ce5", "comment": "Malware payload (SilentBuilder)", "value": "15660d55c4180ff32c6b3f8a52f3950f88a89c308e9880b08582fe29e6f44bff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570208, "uuid": "48992fb5-e257-4c18-b4b9-c884b6bf0f88", "comment": "Malware payload (SilentBuilder)", "value": "4806cf1cfc278619db624a1c5363a3c8d2e39f6f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570208, "uuid": "30b8f2c5-b115-4e26-a07a-cd65e4ff09a2", "comment": "Malware payload (SilentBuilder)", "value": "c1325666e45ad4fe4f69b97acb76901acf024cf8a3a6f024edb533907587234f58a5f6aa1b61449bfe04af41db926832", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570208, "uuid": "01ba7dde-b58f-4734-8401-56faf90bfa03", "value": "T1BF233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570208, "uuid": "8fd06613-deb5-4c77-af39-2dac4441bc8e", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570208, "uuid": "8072cac2-c6e7-4a9d-8b8f-f9654f7b470b", "value": 48233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570208, "uuid": "81493726-f3d4-452f-8187-cd9b6302d7e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570208, "uuid": "551902c1-de12-4ba2-9259-dbaa4280ab31", "value": "2022-1-28-a761ea564a1ae022856015145c78e429.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ef80ab-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560648, "uuid": "e38e9c45-f993-41dd-aa15-6a90967d3670", "comment": "Malware payload (SilentBuilder)", "value": "674a20531119234f1eb66901ecb3ab8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560648, "uuid": "ec7c1ce5-4e59-458f-97f5-e90bdcdf7536", "comment": "Malware payload (SilentBuilder)", "value": "157c5cfe44e8d1d68137aa5250dc13e72aaf1d6a715a338c70ee7ec52a08bc9f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560648, "uuid": "5aaeb1c3-7ce1-4074-a2bf-b63d28b529d7", "comment": "Malware payload (SilentBuilder)", "value": "9ed1551256476f6ac947d1bcb2f7484fde224f20", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560648, "uuid": "12f297bc-b932-4047-abea-e76f8c780257", "comment": "Malware payload (SilentBuilder)", "value": "784dae4c3389df699bb152b6f18f10e7bcf1fcd6f6b434d4123e02798a123a58342652dcbccdf61596f6cc4aa1bb9765", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560648, "uuid": "9bfde246-51a5-41c9-a922-5d7fa430de5c", "value": "T1E0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560648, "uuid": "efd007f0-c0b0-4e14-aecc-6f07f96fc0f8", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560648, "uuid": "ca79043f-7d09-4b39-bcd1-1bdb11aa7b8b", "value": 77359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560648, "uuid": "e8bb607d-2f94-4d7f-8909-1ac8d4f7f6f4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560648, "uuid": "466779c5-8113-4ec3-a15d-92aba36ffebd", "value": "2022-1-27-674a20531119234f1eb66901ecb3ab8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527b7df9-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565978, "uuid": "7f56f42e-7302-4c32-b4a4-bafe08c577a7", "comment": "Malware payload (SilentBuilder)", "value": "12eb93b14bae0cd9be140d712e9d2c1e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565978, "uuid": "df9757ce-655c-4b00-8870-591a36ec7b08", "comment": "Malware payload (SilentBuilder)", "value": "157d5e98f8eef7c4661b3018f473cfc8c9008864b76b58f65d09e2b45e3cdafc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565978, "uuid": "5148b19b-c7a4-4568-bcd7-d8271bbe44de", "comment": "Malware payload (SilentBuilder)", "value": "ddc30634b6efef785ea59dab07bea20b93d754e3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565978, "uuid": "19823689-5f71-487e-b1f3-2ce66c26292d", "comment": "Malware payload (SilentBuilder)", "value": "0fa817e0108af2da5319e831e5e2d81f746f3e2c3d46ce0ec24c9532b8837ca1d0cc3cb49e61b2e3a5b678aae74ab635", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565978, "uuid": "4cf264d4-a62c-4355-8435-ae8ff8125156", "value": "T15C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565978, "uuid": "2ebc15a9-8c3e-4a61-9ba0-159227f76887", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565978, "uuid": "36ba6432-8d1a-46f8-9df2-2da742e4ae75", "value": 48102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565978, "uuid": "68143e85-d943-4894-8028-190f741190be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565978, "uuid": "37fdabf4-b2bd-4b51-94a0-39c603cf62ea", "value": "2022-1-28-12eb93b14bae0cd9be140d712e9d2c1e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d29e018-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571176, "uuid": "b0e2ac84-c3bd-4b53-a9d0-feff6a7828f0", "comment": "Malware payload (SilentBuilder)", "value": "cb1ff6f765944568ed461ad520e6c945", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571176, "uuid": "0b70901e-159d-4ca3-8267-1eb59f0846ec", "comment": "Malware payload (SilentBuilder)", "value": "15ba3fe70f854e7162821364127e4e9f96bf5921f0d5b04f1e65d9be5f0eeb17", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571176, "uuid": "0df76d01-9be4-4afa-964c-56498a8a60b9", "comment": "Malware payload (SilentBuilder)", "value": "3a75dcfb8651fbbc714c43058b1ef5fd3e31a092", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571176, "uuid": "6ac01c23-7b38-476c-acbd-e00eba20a8e4", "comment": "Malware payload (SilentBuilder)", "value": "6b74eba3296e6398e7dbe0d0efd7566a19de8a12edb4cc4b6fea9d90eb60c1904370b809f8fc615d94e08995eee97f87", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571176, "uuid": "4fe4261c-fd73-4c73-b165-51571be51e05", "value": "T1FB233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571176, "uuid": "75fef7e8-62f1-448e-be67-12bfb194afce", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571176, "uuid": "12120881-c416-47f8-a435-182bdc42baeb", "value": 48603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571176, "uuid": "b0669ab8-e2df-48d5-b64b-913fac58f9c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571176, "uuid": "b753dd46-4f74-461f-a38d-97f8c3088aa9", "value": "2022-1-28-cb1ff6f765944568ed461ad520e6c945.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b602ec-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576128, "uuid": "a6e92914-f7ba-4500-9fb5-14e473866451", "comment": "Malware payload (SilentBuilder)", "value": "e6f63a16f5868f38ad84454d5a31d642", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576128, "uuid": "a60a7b0e-a788-4960-b6bd-cd81fc2cf320", "comment": "Malware payload (SilentBuilder)", "value": "15c07f0404676f4f6d63f22acaf97dadf5f6e16cba70d1187753cbf4ad1f094f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576128, "uuid": "48686d44-a68f-48ef-9de6-d3f1b6420bd9", "comment": "Malware payload (SilentBuilder)", "value": "fe19e3bafd16abdcef58a9f77a568129404783bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576128, "uuid": "45b90263-2f36-439d-a943-a5984fda0d7b", "comment": "Malware payload (SilentBuilder)", "value": "b893212d474b3e75170999d759be842a27d03f0994a76ef17d11272b0cc9aae6115b4ba18c213c655eb091adad686b77", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576128, "uuid": "3b30110d-214f-4e60-ab45-a2193c4e3c46", "value": "T102934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576128, "uuid": "ed743fac-2cf7-4dd2-9208-a7413cdd7287", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576128, "uuid": "7c0a9243-04bb-4d5a-b1a1-2abef5b8a918", "value": 92819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576128, "uuid": "c7a0f818-f613-48ff-827f-f4eac2967a81", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576128, "uuid": "32b6c840-e1c6-406b-9ecf-e0e0585d0324", "value": "2022-1-29-e6f63a16f5868f38ad84454d5a31d642.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13461737-81f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565442, "uuid": "1ee71804-32b5-474f-ba6b-5ac0da7fc9ef", "comment": "Malware payload (SilentBuilder)", "value": "066fe1ff41da9e26aa1ed6a5e2a73f84", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565442, "uuid": "a186ab3e-ca96-4e4d-ba66-dd3fbf8c5830", "comment": "Malware payload (SilentBuilder)", "value": "15cf258492a496a59755f4823f4c92e91041d406147bb27af72e661fd0f6cd7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565442, "uuid": "dc8922c3-e0fb-4817-aa90-ef5c8f7feb5b", "comment": "Malware payload (SilentBuilder)", "value": "3b372357317a82f74a3c56e2d20fe02e9d8aae37", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565442, "uuid": "954cbde2-6d68-453a-9f7d-1af53e0b88f2", "comment": "Malware payload (SilentBuilder)", "value": "374d045dd121b9788d911e06876bb9cf5100bc21bd6db020201d7fe1f0b583a1d5e6f30e801b2930aadf22a2449ff161", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565442, "uuid": "9ee6cb9c-18c8-4292-9644-aff194f5b376", "value": "T1FB233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565442, "uuid": "8031ed27-112f-43e0-8b22-16b8094bf522", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565442, "uuid": "ae19b5dd-0b31-4392-8d5f-3c4c4205715a", "value": 48723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565442, "uuid": "d7c88d1e-76f0-4003-9462-afb3f0e65eae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565442, "uuid": "201d7f8a-82f0-4563-9170-37a3e92c8635", "value": "2022-1-28-066fe1ff41da9e26aa1ed6a5e2a73f84.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27223b8-81d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643552905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552905, "uuid": "0c2206b5-7078-4ada-a4cf-a3398c0de400", "comment": "Malware payload", "value": "c5d1ec0878489d31b686ae24582f558b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552905, "uuid": "0a47a9cf-6a59-4314-8071-567c6a03e064", "comment": "Malware payload", "value": "15e83a97dc73a19d1fce1b853bcf8a27cca57cbf96438cfb7ff1eef7c24206a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552905, "uuid": "5cb626d7-affb-4a17-aa34-b61f1529de1d", "comment": "Malware payload", "value": "fdd65fa1817899e055e788b8bf400ebac76c90c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552905, "uuid": "f0c523aa-e77c-428e-86a4-8bafd7b5bfa0", "comment": "Malware payload", "value": "836811c6501d5df6cef746f3d4ada669940d5e1be736666e238e4b404b4feb2d1b1654ecf2de67ca13c119f318c74ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552905, "uuid": "6d90b785-0104-462b-ad60-7d9140769123", "value": "T1EF42BEE8DC09849EEE262077B1148E8A51E5CE52EDC2B41677542DA72A9FCD4050EFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552905, "uuid": "36ae74b2-8b2c-4f3a-b34d-f1fdacb22ddf", "value": "384:D3Y+Bbx8S/PnLAo3jDmNrq3+zJP0t6O9DI/v4JhuE:D3Y+B98ePcejDm03+ulmgJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552905, "uuid": "6aae6dbc-f990-41ec-80af-7bdbb577228a", "value": 12824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552905, "uuid": "0d0b0102-88ba-492e-a7f3-b8dd617d76f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552905, "uuid": "aa6c3255-cd0c-45de-98d5-3d550adb5349", "value": "Yofukashi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e43617-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562115, "uuid": "a426463b-bd58-4bd5-a492-ccd97a4d380d", "comment": "Malware payload (SilentBuilder)", "value": "a04fbdbbb37d6677e074dd01656cff13", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562115, "uuid": "5d127377-acd2-4564-9b47-6e33964ed167", "comment": "Malware payload (SilentBuilder)", "value": "15eeb66ee6267b7d9fa4334b276affbccead7277fa7ff092094f14d0091fc99b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562115, "uuid": "bc376357-5f0d-4d02-b167-4de5565b5b3d", "comment": "Malware payload (SilentBuilder)", "value": "e0315258ff56c9e21ed015b10b65ef4301baedc5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562115, "uuid": "bbea16e3-e5f2-47f3-b708-81f525317728", "comment": "Malware payload (SilentBuilder)", "value": "4589fbb74dac15026fc9335c1508a8d73ccc339777d405a4ef87c2457416abdb8556f642841aa316dfa712b61abdef27", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562115, "uuid": "73160dcc-fce5-4976-bdc8-1e09ca240b1a", "value": "T153735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562115, "uuid": "867de993-8323-4dc1-aca5-44b0ffb9fb14", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562115, "uuid": "b6981df5-dcf2-44b0-9b48-05f1c4633fa3", "value": 77331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562115, "uuid": "1323097b-7d40-436f-94f4-0d31c9fe9dbb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562115, "uuid": "56c333f3-56ad-4476-8df6-49f807139a95", "value": "2022-1-27-a04fbdbbb37d6677e074dd01656cff13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03355708-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561979, "uuid": "5e5d2384-7785-4b0c-9fa7-50c5a8abaa21", "comment": "Malware payload (SilentBuilder)", "value": "9a65716248f045a68f2ba5e98f62eb26", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561979, "uuid": "881afd90-70bb-4601-aff0-493f4d0566cf", "comment": "Malware payload (SilentBuilder)", "value": "165541a04eb26ea8f64e9c8e9773a217b655d5a1fd61a335a3f63026f0cf19ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561979, "uuid": "0afe25a7-6baa-4e44-9a45-bc678e773d0c", "comment": "Malware payload (SilentBuilder)", "value": "1ab9e776057cb60fbb654924059ec86271db996b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561979, "uuid": "af82f6cc-4f75-4502-b9b3-080d6997c9d3", "comment": "Malware payload (SilentBuilder)", "value": "074bf0d0b77f866e994693350992f93f3d94a8c6556d52bd556e54159ad1cc7b5dd1bcd550a5057ecaea4d179121de88", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561979, "uuid": "845efc08-3d88-491f-ae67-15e31a0ea5a2", "value": "T1AAF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561979, "uuid": "4df26e41-fc71-471c-8672-639cc8c0203e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561979, "uuid": "8cc68437-88e5-4c92-adea-397435872584", "value": 158209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561979, "uuid": "ca684436-0a53-4330-b1a6-d736c16f3de6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561979, "uuid": "0c0470b7-a7b3-4405-b3a6-913ba7c800f5", "value": "2022-1-27-9a65716248f045a68f2ba5e98f62eb26.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f59889f-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571932, "uuid": "d0a8ecf0-3b79-4f78-8e76-41874b34f9b1", "comment": "Malware payload (SilentBuilder)", "value": "dbefb15d290cf46f3c399d1d71ab1d76", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571932, "uuid": "ed06d54a-6b97-47a5-934e-ad58f16ebff8", "comment": "Malware payload (SilentBuilder)", "value": "16af49a75379af7aa952fe50c3fc1c0c56daa202b444e80aeb50704f84cf15a9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571932, "uuid": "ae836a7c-2652-4f21-aade-b071659f3a57", "comment": "Malware payload (SilentBuilder)", "value": "dbb36b7abc74f478c0705adcadb462ce87ae31c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571932, "uuid": "37426e4f-e592-454c-b343-dff718bc155a", "comment": "Malware payload (SilentBuilder)", "value": "056666f5c6c2b180e4f274c4f39c0076d57cbacbf89a9bf267dfcffb430082ed35f2e7be890c1c94e078447f34fcb9ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571932, "uuid": "cf837beb-f394-4dc1-9c8e-76621b43c94d", "value": "T19B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571932, "uuid": "1fea57c4-16e6-45a5-8d47-c2f1dc197cfc", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571932, "uuid": "42219ee7-ad2f-4635-8c14-0c6df9c52830", "value": 47951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571932, "uuid": "665db8ab-8042-42a4-b877-53cf292237b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571932, "uuid": "03ca4483-f7e2-4b5b-964e-10aa5e5be411", "value": "2022-1-28-dbefb15d290cf46f3c399d1d71ab1d76.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaa1614-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563898, "uuid": "5b7068b2-85fa-4a6c-ba1f-022ce057d5bc", "comment": "Malware payload (SilentBuilder)", "value": "d6e6ca451c8e56c11fb9b02b918916b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563898, "uuid": "da61351f-77e6-4ab5-a9be-8db12c475e36", "comment": "Malware payload (SilentBuilder)", "value": "16b4b4adb7969b8d3d2370499706c063e9046c64bbb4e7a68f065dec43eeebd0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563898, "uuid": "83d39448-083a-432f-ac0f-52a67a0c84b5", "comment": "Malware payload (SilentBuilder)", "value": "d5a55554d3a9f70eaa32c6a5153276e2dcb8c7b3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563898, "uuid": "a2f15ec8-f3c2-4757-8b54-12d2cafeaa81", "comment": "Malware payload (SilentBuilder)", "value": "47cae105b6e75a58bd094e5f4951cf2c054e77278a890fe74fc3c4d72498196159b76974359996587a95e85777bd0260", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563898, "uuid": "69d1d522-fbfd-496d-803d-a44cd22651eb", "value": "T1C2C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563898, "uuid": "1eb4e369-7cd5-4058-88c5-ea02cf0d828d", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563898, "uuid": "fb81a5c0-5ae2-44ba-896d-fa60eb1d1bae", "value": 118923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563898, "uuid": "1e1207ee-c8b4-4813-8ce6-eb175d3e9539", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563898, "uuid": "d661dd1a-003a-48e2-88fe-777ff41eb4fc", "value": "2022-1-27-d6e6ca451c8e56c11fb9b02b918916b3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacb331c-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559737, "uuid": "f4f8d7e5-771d-4814-979a-f927c4c637b6", "comment": "Malware payload (SilentBuilder)", "value": "50865cabbebb276af475170adcb7f89a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559737, "uuid": "92277f3b-dcf7-4ea9-b3c1-9ecbc5c781c3", "comment": "Malware payload (SilentBuilder)", "value": "16ca805a7f74a1fb1caec29f246a41d06399ffa5a6d2247a81bc02780f1324ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559737, "uuid": "8d23dd5b-1d5d-4735-b504-24c304ceeb91", "comment": "Malware payload (SilentBuilder)", "value": "c1a895f8324a6509df81acf6bf1225b268577658", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559737, "uuid": "637d37a6-fa78-4a0c-bfe8-623d00ccbc14", "comment": "Malware payload (SilentBuilder)", "value": "b6796cd86a42b1fb665c0310ce7119788ae4e7e2293b19b5afb4a5236a7453ae8c6ea39350ece7fe8fc4b5215b22dd39", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559737, "uuid": "e7636f29-d9e3-4d37-9874-41ab10fe6f02", "value": "T184C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559737, "uuid": "abc86323-c82c-417d-8bba-3dee6b13bad5", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559737, "uuid": "159bb15a-2145-4745-b0bd-882cb3a1328a", "value": 118351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559737, "uuid": "2241bf96-918f-414a-966c-ee19a8c9b34a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559737, "uuid": "446d6020-090c-43bf-9d6d-1558000d494d", "value": "2022-1-27-50865cabbebb276af475170adcb7f89a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1e2317-8203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643571368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571368, "uuid": "1d2122e9-146a-422c-9954-a83982004367", "comment": "Malware payload", "value": "cddf34bf8621accfa63772d9218f67f5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571368, "uuid": "b9433835-48a0-4d5e-834c-6f1483d42165", "comment": "Malware payload", "value": "16e14977a9be1d254b050ee075971ab9389c7321c0189fd5188404baf67a485b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571368, "uuid": "3712b722-5ba3-4610-bc51-5c0756451a80", "comment": "Malware payload", "value": "9a9327247c8596f0d722f59b1dcf5aa7afdd43e3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571368, "uuid": "2c5e7717-afde-4871-81d3-6cdc3e069562", "comment": "Malware payload", "value": "e1add585ff6735b7ddff8d320519930bd1e9d878cf46ebc6858ee589ce964a5d9ae89a95d4674a9bc6cf00e48c7f6dbd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571368, "uuid": "10a507d6-01de-4a8c-a9e0-5683755b0760", "value": "T11F233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571368, "uuid": "31ad2704-c3c1-43da-adb9-7507c18ec259", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571368, "uuid": "fa109b62-b772-4365-b345-540c15a675bf", "value": 48709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571368, "uuid": "b1b19ac0-f5eb-45a6-8144-925798f98e52", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571368, "uuid": "e1625d48-d760-41bf-a389-bd835e36def7", "value": "2022-1-28-cddf34bf8621accfa63772d9218f67f5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818384c0-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562621, "uuid": "cf954e87-8039-47ec-bba5-50fe7a0b3669", "comment": "Malware payload (SilentBuilder)", "value": "ad4c65136727cae585c1e7c7ff98613b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562621, "uuid": "5fe525cc-ce8c-4d55-be8c-af7eba24b1c7", "comment": "Malware payload (SilentBuilder)", "value": "16ebb7680d22ab76c482b73e0c6e8a946f876ad8c0251d2f95fc3c87d836ea3b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562621, "uuid": "3fdd23da-f6bc-416e-8c83-dafdd651631a", "comment": "Malware payload (SilentBuilder)", "value": "6ec89fa669bf5812656088f7525a57bf5ce50660", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562621, "uuid": "eb58cd05-da5b-434a-bbfa-8de46eac263d", "comment": "Malware payload (SilentBuilder)", "value": "5f180086abbaedc2b701a2ae573a20caf457c3ab33de984be81511d33ff583a98b60cad07a9491b255bd734ea7069fb2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562621, "uuid": "13fb9143-3cbf-4e95-ae5f-1e4a6f5df912", "value": "T12D735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562621, "uuid": "9cefc6e1-0c93-4611-9c24-f582441b75fe", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562621, "uuid": "bb7bbe73-4289-414e-9d46-99308a71ab88", "value": 77736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562621, "uuid": "9588b4c6-263e-4618-b733-8519697be568", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562621, "uuid": "7c838846-bb53-4875-9a7f-62983c833143", "value": "2022-1-27-ad4c65136727cae585c1e7c7ff98613b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0620a67c-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573151, "uuid": "bb4389c4-1c8d-4c45-95af-447fe522dd80", "comment": "Malware payload (SilentBuilder)", "value": "0157f3219dca1309cf02630e73f5c46f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573151, "uuid": "63a19b33-5e23-4faf-accd-aee8b6389217", "comment": "Malware payload (SilentBuilder)", "value": "170458e4fd96e4e62de75c3f3e515bc6689e1cb007df735845873aaa1fa49e88", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573151, "uuid": "947c6a10-2a5d-4c10-8a29-244cc3e46bc8", "comment": "Malware payload (SilentBuilder)", "value": "7136286768d0dd651c6a3c64a90aabb3bf2a676a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573151, "uuid": "0b0aff86-062d-4514-8b76-31c49bcf2693", "comment": "Malware payload (SilentBuilder)", "value": "e34828b6e8144d34b968507518d78e66147e1d12ea8767c7f02c5651a01967b044bd409a7163044c88f73af53c646267", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573151, "uuid": "7596ecd6-102d-4515-9799-0e451da78860", "value": "T182934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573151, "uuid": "103a8081-e8e8-41fa-b194-394a4852373f", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573151, "uuid": "7224fc6c-de68-4239-a3f0-424747dfb475", "value": 92711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573151, "uuid": "79b7a82d-a827-4af3-9d71-b247c2c0be37", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573151, "uuid": "6274fa59-5683-4763-b7fb-95fdea5fe73a", "value": "2022-1-29-0157f3219dca1309cf02630e73f5c46f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c698532b-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569609, "uuid": "a00f132d-00fa-4732-91f1-064ae0c37b25", "comment": "Malware payload (SilentBuilder)", "value": "930664edc30bc72297e26a179adaac78", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569609, "uuid": "dcf02cd5-7614-482d-a579-cd6bd5c61a67", "comment": "Malware payload (SilentBuilder)", "value": "170703bf2d71008a16bf54ff8e3f62f3d681f0b268c18494314660d502391dfe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569609, "uuid": "e4358d6c-b996-4135-9890-7ae843ddd5f4", "comment": "Malware payload (SilentBuilder)", "value": "ab8641c16c43d6cb568b2e6009a2f7b4272b56cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569609, "uuid": "56c3bc7c-be16-4f60-878d-9077f707dfef", "comment": "Malware payload (SilentBuilder)", "value": "8bc11bd206c8f4629323b09bc5e0c9a8f8372041f710efc99be5b8c7f2b39c75ae35bc7f2e2426b96fd1a60847a79256", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569609, "uuid": "3fa3ef21-eccb-49d8-a5b3-685883010d11", "value": "T141233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569609, "uuid": "7f539ded-f650-4ff6-9c84-e1bb2bf1e6fe", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569609, "uuid": "adc118c2-20ab-4d3f-9d36-139e43c8ae24", "value": 47739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569609, "uuid": "ff8284a6-4dd4-4e65-8316-7fd20f0bad1c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569609, "uuid": "a76966a1-b54e-4d36-8661-3c1c37a60f5b", "value": "2022-1-28-930664edc30bc72297e26a179adaac78.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b6fa86-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557960, "uuid": "af11911c-3d53-4317-8952-ee7c469188a2", "comment": "Malware payload (SilentBuilder)", "value": "1810819137dd9a0cd47ddc47d47aea8f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557960, "uuid": "6c54f8c0-9368-48e6-8f94-f10827933658", "comment": "Malware payload (SilentBuilder)", "value": "17474f300dbfbb0c6572daca5f0208850d5d423d32f6c7f5d33df201e4bad56b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557960, "uuid": "a2b9291b-ed42-46a6-9fa4-ab16eb8a3d4f", "comment": "Malware payload (SilentBuilder)", "value": "b78aa281caa5a5761c68318d8b04b9c4e8c98e66", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557960, "uuid": "de8e13c8-70ed-4807-9e5c-ccc82db6f5ba", "comment": "Malware payload (SilentBuilder)", "value": "577ba1b31a77953ece73f96d4bdc04ea7646b6d0e234241fabc33132eee844ea8171375ebbd2aa14d47a3f2fc2bfb869", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557960, "uuid": "a2afe7f5-a06e-43ae-864a-48e7e5c6cef6", "value": "T1FC735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557960, "uuid": "5ecafd6a-8ff3-410a-9ae8-87850fd1b902", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557960, "uuid": "b2607769-beda-4622-8281-b6adc825b457", "value": 77612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557960, "uuid": "529abbc5-2294-4e82-9b81-35b78d03d75f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557960, "uuid": "b768103f-b8d5-4d7d-973f-9da52aba3ef0", "value": "2022-1-27-1810819137dd9a0cd47ddc47d47aea8f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d9c057-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643560264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560264, "uuid": "d512bff1-2e7d-41e2-b354-27bdcb35d702", "comment": "Malware payload (Heodo)", "value": "9bf70734e65acdd4519531277788f43a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560264, "uuid": "d74c123a-c51b-4e9f-9cce-e621fa04d0f5", "comment": "Malware payload (Heodo)", "value": "174a5d14ad92a48002d27e9920a8e089709ef7d6546e2e0141b37aa0e5b29c66", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560264, "uuid": "b21f3d29-71f3-4be2-932e-d9ca25e6ca3f", "comment": "Malware payload (Heodo)", "value": "e618967123e990051d86db333d701dd437ae3a84", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560264, "uuid": "10024457-a1d2-49d2-bee1-b05a12840456", "comment": "Malware payload (Heodo)", "value": "97b3511fff494d6ac77a2be025855312fd879fa278756fdcbbe5e44ee850680cf933bdfabb8b9c97cc0610f733540b59", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560264, "uuid": "b9562591-ee18-4cde-8d6d-f67632902cf6", "value": "T16AF3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560264, "uuid": "eb17072c-0521-4123-9877-e0ff58e19099", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560264, "uuid": "1d5a4411-08e1-4daf-b3eb-0c970a9692ef", "value": 158750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560264, "uuid": "41dab158-47ba-4841-a844-c6eaf05ab024", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560264, "uuid": "9d3036dd-2991-4b56-80a3-6add01440219", "value": "2022-1-28-9bf70734e65acdd4519531277788f43a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4e1cfe-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559686, "uuid": "7490b12e-6a4b-4605-910c-7b4a577fab51", "comment": "Malware payload (SilentBuilder)", "value": "4e92f9f74eab08ae5e1a37c202f66cfb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559686, "uuid": "f69e60b9-2f3e-430d-bc60-c031a38bf42a", "comment": "Malware payload (SilentBuilder)", "value": "1754cf50ec4213c63789e700cbddf386c267ef1bc67e3b39e1a6482772dbdab3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559686, "uuid": "dd13ae19-ebad-439c-b2e3-072064e0cbee", "comment": "Malware payload (SilentBuilder)", "value": "9ab93d378726c609fcef17dbf0fb9041a91fee87", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559686, "uuid": "9c68c448-deb2-495b-9f85-e5cf6492ebfd", "comment": "Malware payload (SilentBuilder)", "value": "fbba8389a4113de78ff6f393e2732dc1e15574dd4c03033f188284c896c612e4acf976ea6be856de7489fa7cf9a246f9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559686, "uuid": "9dd88ae3-684f-4172-8e17-00ec8ab7b855", "value": "T144C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559686, "uuid": "478f55eb-7452-4e8a-91ff-24edc64bf16b", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559686, "uuid": "6715f238-d927-4fee-a5e4-cf8f2db3a78f", "value": 119078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559686, "uuid": "f793b958-870f-4112-ace5-1a71f22e70b6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559686, "uuid": "d0be982e-ee1e-4555-b71c-0722edd06042", "value": "2022-1-27-4e92f9f74eab08ae5e1a37c202f66cfb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4848a6fc-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569397, "uuid": "ce8b7618-e094-4108-8e7d-d8746fe21687", "comment": "Malware payload (SilentBuilder)", "value": "8958d5d8841335ae5f5ae88606b8465b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569397, "uuid": "fce5adf9-143a-4da9-a45f-e4959c073abe", "comment": "Malware payload (SilentBuilder)", "value": "1767bdb59dde6fffedfe970c7c1c2827b42a4a10a930d2948ada6b019f964aa6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569397, "uuid": "1eac1e7d-3a00-4a09-b17c-79d5d6858328", "comment": "Malware payload (SilentBuilder)", "value": "a1090a7887f62f189717be9bcb2b04920b91350a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569397, "uuid": "820ba908-ac38-4a57-b11d-707a000e4573", "comment": "Malware payload (SilentBuilder)", "value": "b64954722669986dbae6452e375df53122f73cb9a1f636a163bc8a15cdd26c992d4596403bf4bc28305fd62924d40ab1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569397, "uuid": "75b559e0-ecfa-4eb6-91e6-251d7b8a9cda", "value": "T161233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569397, "uuid": "fd0732e5-6fc5-4b4c-b752-c4a9cc7462c6", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569397, "uuid": "2e811a88-ca00-4c2f-b920-78738120e7d7", "value": 47792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569397, "uuid": "002f38d0-a94f-4bcf-849a-32ef92cbeb8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569397, "uuid": "ff403f3e-1a0f-488e-9ff5-0017bd31cfc0", "value": "2022-1-28-8958d5d8841335ae5f5ae88606b8465b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac49bd8b-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563981, "uuid": "f9e179dc-d2f6-495c-a409-c5f76ce251c8", "comment": "Malware payload (SilentBuilder)", "value": "d82eb8d4efe8ec92f33ae45974d52aac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563981, "uuid": "ada9894e-d120-454c-b609-fa6c5a3ebf0c", "comment": "Malware payload (SilentBuilder)", "value": "176f936b2aee68a3188ee114c4d54b335cdb84b96a046213d89e8f3862fab3f2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563981, "uuid": "08494bfb-baea-435f-bbb9-e37523ec6b04", "comment": "Malware payload (SilentBuilder)", "value": "92adb8b0040c279420d6e3fc699c83e0a641c81c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563981, "uuid": "b89052a0-aaed-4688-a765-69fa1f68e945", "comment": "Malware payload (SilentBuilder)", "value": "b5c3d4d93e974753e428cbec94dc09518369d27dcca005d1719a5036aae6abb5d88e27d7100da7ad6c6319f164653dcf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563981, "uuid": "d0e08378-b28a-4ce0-94f2-053caeb851e4", "value": "T137735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563981, "uuid": "332343de-46f9-450e-95cf-b0ac8fdd4f69", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563981, "uuid": "76df72a3-f840-46a3-afe8-8f2d3135faf8", "value": 77834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563981, "uuid": "672a830d-0285-4ad9-ba8d-e403ecd26feb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563981, "uuid": "fdf191bf-1d91-470f-8993-31401c457a68", "value": "2022-1-27-d82eb8d4efe8ec92f33ae45974d52aac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82219496-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643573359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573359, "uuid": "e705410c-81ad-4f85-a71d-897da7db5f46", "comment": "Malware payload (Heodo)", "value": "0e106000b2ef3603477cb460f2fc1751", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573359, "uuid": "a7941c99-e9ee-43c5-ae92-f323824fbda7", "comment": "Malware payload (Heodo)", "value": "178ceab4ea6816fb9d09c729b2a0d6a06bb786452d4178d49bd0a0dee3f98359", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573359, "uuid": "02d87bed-1a2e-4777-8556-b084b6d2e1da", "comment": "Malware payload (Heodo)", "value": "7c0bd61a7069cc04d4a0ab02b96d9c4003be0f6d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573359, "uuid": "ed882f1b-7732-4846-9863-2658977540d6", "comment": "Malware payload (Heodo)", "value": "3cd7fc3fedf04ce8ae4c6ae421831878769497e15bce1482b31983f43304a5b837bc7d04732b6abbe4d855c575758eee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573359, "uuid": "a4b59703-ba60-450f-9999-49638602b8ce", "value": "T160934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573359, "uuid": "ec3c0d51-0e15-4cca-940c-b18b0cfa2a9a", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573359, "uuid": "939ff296-8b28-44db-8164-6222ea4592a0", "value": 92776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573359, "uuid": "b277eff9-3eba-4a14-8cfa-7c39f95744ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573359, "uuid": "6f235dec-ab65-423c-a197-441aa4f63e62", "value": "2022-1-29-0e106000b2ef3603477cb460f2fc1751.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ed9235-81de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643555457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555457, "uuid": "42c5efcf-5cf1-46ba-a861-9d66174e6a20", "comment": "Malware payload (Heodo)", "value": "0bed9faae4f40530bd4ff409489cfc65", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555457, "uuid": "eaaf7e8b-cc8b-49bf-8bfd-dfc68834f6e0", "comment": "Malware payload (Heodo)", "value": "178e263a0c2ca8789e428d39cb64723eb7474cdb59d175ebfdeb926747288d97", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555457, "uuid": "4a70c8d0-38f4-4e2f-9545-d24914606335", "comment": "Malware payload (Heodo)", "value": "71490e303dbee3e383cf67acbdde35cc19244459", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555457, "uuid": "6af40709-58df-42c9-8144-a44541431520", "comment": "Malware payload (Heodo)", "value": "704a7eefcd7404f57dadfc32edad3af103b3baafe6a4cfca3b139e684d6776a00fb46335d64ff6e6ece922a78eecdeaa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555457, "uuid": "7f84e465-85a6-467b-ac46-2372b74062fa", "value": "T13FE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555457, "uuid": "39470ea8-c161-47b1-9f72-bc5506f66516", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643555457, "uuid": "b73d3da2-16cc-4d80-abe5-bdb61676fa63", "value": 147098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643555457, "uuid": "2ed5db47-d368-4739-abca-5f94b27355ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555457, "uuid": "63bd31e2-28b6-4cc5-ada4-76f4a3e8e22e", "value": "2022-1-26-0bed9faae4f40530bd4ff409489cfc65.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daee6f02-8203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643571361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571361, "uuid": "4b0d142a-b307-45df-b9cf-847de289f4bb", "comment": "Malware payload", "value": "cda63a9c93bf7403ce09518af0c35803", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571361, "uuid": "d0147f32-5dda-408f-981b-be9257b3ed99", "comment": "Malware payload", "value": "17ba5272aaaa9fadb6f5ff7d21dc73ac18ac050da14556ca601a534e4c9c9e1c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571361, "uuid": "66a1df76-d857-4a3f-a63e-869d62d340c6", "comment": "Malware payload", "value": "909e970933b2719b9bd3add498356c69903d1450", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571361, "uuid": "0b420c34-5928-4e5a-a576-ba921983158b", "comment": "Malware payload", "value": "f8dcfb13a6af6f33044d2f0c3a455f341fffde52ea4c665550150760666d5e2187d4bab4d8d4f934943239e5b1b12f1d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571361, "uuid": "0cafac12-d98f-464c-a67c-b7ee4678c298", "value": "T114F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571361, "uuid": "5b957dbc-0b7a-4f78-8800-ca8be5839b5b", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571361, "uuid": "bf86f5ac-2e72-4bce-aa32-4c337518cbef", "value": 158787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571361, "uuid": "be573198-92e0-4817-adbf-d3ab9c9ccf3b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571361, "uuid": "eb829574-a53a-4d80-ba6f-cfb4102f125d", "value": "2022-1-28-cda63a9c93bf7403ce09518af0c35803.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed463a8d-81e2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557218, "uuid": "9402f15f-b16d-4020-acac-15b7b33d32ef", "comment": "Malware payload (SilentBuilder)", "value": "63e2fc74675a893f1fd56833921b90ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557218, "uuid": "a621d445-aa70-4a6e-92c5-76bb62aefa1f", "comment": "Malware payload (SilentBuilder)", "value": "17e10455cfccf042305c2eacca48516ab35134ab0b1140bb761e7d8813427c56", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557218, "uuid": "08179c0d-75f9-4016-a9d4-8a2a5bc2cbf3", "comment": "Malware payload (SilentBuilder)", "value": "5c8e8743a38c354771cd458dfb7dadeeabcdc561", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557218, "uuid": "90388c47-5168-4078-ad52-d1c2f59013a0", "comment": "Malware payload (SilentBuilder)", "value": "455dc11eda378daa9c92a4cf4efc8295db30090d60f108d576078e42780e3c18f330a3035981876f359757132b446b0d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557218, "uuid": "a682750e-54d4-459d-86c7-80a5b00d1ec1", "value": "T1BAE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557218, "uuid": "876f5af6-190e-4a06-beee-e29772a5711c", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557218, "uuid": "cccfcb1c-7a58-40a2-bda4-efb5e03d6ca7", "value": 146358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557218, "uuid": "a7033225-ecee-4c6c-aa04-3aa3869d8b23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557218, "uuid": "725a2fed-0fe7-4f75-bd2c-3a58595d024c", "value": "2022-1-26-63e2fc74675a893f1fd56833921b90ef.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28dfd74-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559777, "uuid": "3d27a5b8-7f64-451e-9ec3-acb88e0ffe1c", "comment": "Malware payload (SilentBuilder)", "value": "5fbd785658e40229c7a7d6ef1914fb57", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559777, "uuid": "c0037c2d-a835-400c-aa59-6f0c3f0fac87", "comment": "Malware payload (SilentBuilder)", "value": "181fea1115865504f669e1a89f00a03e4db0447b9b3e98c279b4a54a1d644025", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559777, "uuid": "9af539c9-fd7f-4067-96b0-080d838ebea3", "comment": "Malware payload (SilentBuilder)", "value": "3d11dda8bff5e29d01c2d5c08c4c49ee2ffa47b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559777, "uuid": "9254583e-21e2-4086-a865-be179406c1f0", "comment": "Malware payload (SilentBuilder)", "value": "f857a5ea1be4b8ff60f64191c830afbdf8599af980c77505fd7d2196ca5c43d7947977bedfc751891bc567606f9872b7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559777, "uuid": "5878d9f3-cf27-48e4-b99c-9dc7a6c1c894", "value": "T1FFF3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559777, "uuid": "88489b1b-2d64-42e9-b49d-79d6ecf691f7", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559777, "uuid": "b8ae8946-df04-4f90-b6da-4386ce818088", "value": 158908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559777, "uuid": "fec65aab-15cb-40de-881a-debf995a7e33", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559777, "uuid": "f6f1bc19-b8c8-40f8-b2cf-f85855b8b34a", "value": "2022-1-28-5fbd785658e40229c7a7d6ef1914fb57.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f8067f-820b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643574790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574790, "uuid": "05d4e944-d409-46d4-ba47-451b57bae4b5", "comment": "Malware payload (Heodo)", "value": "7ff04d7111953cb7295bf7f7c9fdbbf8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574790, "uuid": "1734dcab-1ce6-4214-8df8-4b6338f78e4c", "comment": "Malware payload (Heodo)", "value": "182803dfe11736cf2c116544763515359dd27d3faf4098ee3ed9e916d5275b1f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574790, "uuid": "c6679070-2321-46a4-919b-f131c360f3f9", "comment": "Malware payload (Heodo)", "value": "e921a199ce4f9e59dcb65a7ddc394bc1b7126631", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574790, "uuid": "de556faa-3add-4b63-a82f-09a3eb72d5f5", "comment": "Malware payload (Heodo)", "value": "fe4bafb6d798614b3a0bc6a0960e1b74ae4b565786847f307401208a6b8e73640e173ea1c747aa8f0fa6944729188df0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574790, "uuid": "ada405c4-c3df-424b-ab97-1c4a28220f4f", "value": "T1D3934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574790, "uuid": "3344aea4-4b94-4080-83e7-fdd7430ad10f", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574790, "uuid": "a4cbee9e-7c9a-4b4d-91dc-0b8e361f8291", "value": 92309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574790, "uuid": "a019387d-f800-4c11-b028-2c5172dbf923", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574790, "uuid": "06b54bf2-c6a1-4791-b9a7-4876ed679ded", "value": "2022-1-29-7ff04d7111953cb7295bf7f7c9fdbbf8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c2536f-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643570595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570595, "uuid": "2e284104-c13a-445a-9793-dba4d134d291", "comment": "Malware payload (Heodo)", "value": "b2f19b67f2d29194f5447a08f77e5ec8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570595, "uuid": "01e3ecec-6e81-4b57-b08c-eb23ac398f61", "comment": "Malware payload (Heodo)", "value": "18486b33d5cac2a2dce431152a9ca893005d0bb2a5810b961bc6246e0264f4bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570595, "uuid": "448d50a6-7b41-4a78-ac58-a30900b2e78c", "comment": "Malware payload (Heodo)", "value": "1c99fba35e433852ae50674644065d9abcc3f09e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570595, "uuid": "f25e425a-c192-4b7c-b3ad-fc82776b7b95", "comment": "Malware payload (Heodo)", "value": "c7b368f540ebc177d9a5d968736f1eb528641b29383e8179a689377ea0af6d031abade50367a885ed7556d4568aec341", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570595, "uuid": "2a8fe56a-2022-4488-82fc-7484524cf60b", "value": "T1D3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570595, "uuid": "5c3f1e4d-5fda-4370-b285-eabcdefc3e0d", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570595, "uuid": "19dbaa5c-d7b9-484d-b871-311363aa23d4", "value": 159217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570595, "uuid": "ea6bd64b-d8dc-43b2-8681-3bd80d94e199", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570595, "uuid": "a3c6573e-b091-43b7-b80a-d99d6e6c782f", "value": "2022-1-28-b2f19b67f2d29194f5447a08f77e5ec8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbf4444-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568624, "uuid": "a1c4a00b-e13f-4164-82d7-f93b7f3680b0", "comment": "Malware payload", "value": "6ec40a2f74d22e5bc76b06e4f80c379d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568624, "uuid": "2f86bfd9-c744-4455-bce0-bba62cdd98ab", "comment": "Malware payload", "value": "184e8be727cff871e01b09d9751caaede3e050f9172b4bc1f561fb7e5de1b333", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568624, "uuid": "acb4c443-3a23-4c4c-aafa-6979298e9823", "comment": "Malware payload", "value": "a05aed973a29dc966dc9291a60d9a29267cc01d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568624, "uuid": "f7a888a7-3956-4c6c-bf08-055f58904c0a", "comment": "Malware payload", "value": "a4948d0b4311bab80d68ba0b3c0badcf28756345dae9d557f1a63caa04369b9330b30ba2a06d58230e7c91a54292dee8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568624, "uuid": "1a02f1f0-172f-442f-9fc8-0c393842555f", "value": "T1D0839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568624, "uuid": "087e8174-7d48-4b18-9e5e-e08d1eb267b6", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568624, "uuid": "572deb08-1dd2-4409-ad28-dc87038b1191", "value": 87593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568624, "uuid": "e7dbe8ad-6fc8-4498-b68c-3285bc7ff21d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568624, "uuid": "4f25ad63-4f80-49f2-a1cc-167e2b6bcb8e", "value": "2022-1-28-6ec40a2f74d22e5bc76b06e4f80c379d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b0f3a8-81fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567803, "uuid": "6a6454d5-7eb7-4178-b475-9ba2c8280aa3", "comment": "Malware payload (SilentBuilder)", "value": "518af71379fcee3c0a7993417a755030", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567803, "uuid": "d309f43a-7f6b-4a6d-899f-20bc2749b819", "comment": "Malware payload (SilentBuilder)", "value": "1852a705d50b649bd0eec456ea788b07c4ea942b4f524940a643be700bd241df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567803, "uuid": "6f4d202b-02e3-44b5-9d85-ed3b28f1182b", "comment": "Malware payload (SilentBuilder)", "value": "2c8e71bc0968abdee1f5fa17566deb46a7edcfab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567803, "uuid": "105d14bd-8755-4d29-8ba1-0227eb447086", "comment": "Malware payload (SilentBuilder)", "value": "28a1c294d4640294a31868e2fb68d5b9f2d120a754ccda8e74d8acf66889fa19b52df437687c22b5732b17bbb036ef88", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567803, "uuid": "fb703082-b109-4552-88e2-464edc333ec8", "value": "T1DC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567803, "uuid": "8492797b-d0b8-4d76-a790-400d75e5b403", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567803, "uuid": "61e24ccd-a1d9-4449-a967-3a32703d7457", "value": 48325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567803, "uuid": "0e66d266-673f-4ebd-9456-5941967c9b4c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567803, "uuid": "3348c8d0-9fe4-48a5-b971-bfc2bf2f377a", "value": "2022-1-28-518af71379fcee3c0a7993417a755030.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdd3c1f-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572008, "uuid": "65949f4a-fa73-4c0b-af96-0b7541e4ce25", "comment": "Malware payload (SilentBuilder)", "value": "e023295bf142ecbe89a5e70a92479bf6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572008, "uuid": "a05777fb-847c-419c-a71a-64a755d3fe6b", "comment": "Malware payload (SilentBuilder)", "value": "18570590017219d42fdfe278b8985dd2fc496d1855b4305399e767c5c91656b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572008, "uuid": "906c4065-62a8-4833-8c9b-b3dea9a30d3b", "comment": "Malware payload (SilentBuilder)", "value": "9d747ed89df7e15aa2c52e2f716d1406472676e2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572008, "uuid": "0a654ac0-528c-4138-a429-3ba3c389ab46", "comment": "Malware payload (SilentBuilder)", "value": "9a9f47608ee8e24c25c8ac8be923e7ab608e523f8a743c5eafb55fa0010737440642a6dfe2ef42cee7d97454c49684d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572008, "uuid": "26e82360-fe4b-4c53-ad2a-063df1a76031", "value": "T16C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572008, "uuid": "81435e82-ac30-40b8-ac86-5dd843d2bb9a", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572008, "uuid": "4ba536a7-1d70-4a4a-bd6e-9318e4e7e8d1", "value": 47879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572008, "uuid": "f4cddaee-0737-4188-8e56-6c7508bc3ff2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572008, "uuid": "d07c8f64-6d24-4b46-848a-9a244e834cc7", "value": "2022-1-28-e023295bf142ecbe89a5e70a92479bf6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70077ac-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569126, "uuid": "19a38598-a5fa-4717-b473-18ff2e767e78", "comment": "Malware payload (SilentBuilder)", "value": "7e904b79a721a6879681141d8b3fff3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569126, "uuid": "85ca1d96-ec2e-49a4-b033-a44cf5afe41e", "comment": "Malware payload (SilentBuilder)", "value": "18675d370342734bf75c7be7066e9d8d52e0e781fb9e40d824f6300c22ca2583", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569126, "uuid": "ac4e3b3a-a03c-443b-8eef-5ab742995a3f", "comment": "Malware payload (SilentBuilder)", "value": "c09dcb5fb7c62bb1749aff8bd342180a7abbb1b2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569126, "uuid": "ce211047-e5aa-4160-ad8f-61639fb56dfb", "comment": "Malware payload (SilentBuilder)", "value": "42c064026a9f804d3913864d89fb0d955565e11b074005b2d431da764c530a97a4b7c8dc6edebbe6204d50fcb86fe26d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569126, "uuid": "a4903bbc-36eb-417b-921a-5a144c273e77", "value": "T18E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569126, "uuid": "80e4bb57-9d0b-4284-875e-aea927130995", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569126, "uuid": "422b30a1-3d90-4743-b6f6-9e303a63fac3", "value": 86695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569126, "uuid": "944ada7f-9de6-49f5-bbe6-5bc745dd103c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569126, "uuid": "3df22cdb-da66-4f9c-a545-646c1f2c8226", "value": "2022-1-28-7e904b79a721a6879681141d8b3fff3c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba81217-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563067, "uuid": "096efb25-3001-4390-990a-26a23435f069", "comment": "Malware payload (SilentBuilder)", "value": "bf5979f5fe8297ed09150b6c3bec44fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563067, "uuid": "05a1db9b-7366-4f8a-a392-dae7652561cc", "comment": "Malware payload (SilentBuilder)", "value": "187959c80f85b27af86026a2b2e3d15836dd5e9405efb3d79407143be082fb73", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563067, "uuid": "074e4824-3ed7-4c8f-b568-c3bc372e092f", "comment": "Malware payload (SilentBuilder)", "value": "f4ef1a21812875e10dec9dc3dd9181da8a47839a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563067, "uuid": "e384ae99-af99-4f2c-bdac-57a611a2bbec", "comment": "Malware payload (SilentBuilder)", "value": "e5c928e3b2c7694d4c201b8800266579e90c9fc1d8bfcac2cc1f9543bb424d23fd72c861a3c7e1445e6eda4bf7cf8924", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563067, "uuid": "66ff4b00-b19f-48b0-9a04-d9a4d8b44d44", "value": "T1F0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563067, "uuid": "6149600c-b113-4ec3-ac20-3bd4b9f3f1a6", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563067, "uuid": "5fef412f-891e-43f6-bd71-844d9139e913", "value": 78130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563067, "uuid": "2184ca8c-2c54-41c1-a8d5-0d6277ea556d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563067, "uuid": "ab54c1b4-f3d9-47e3-a82f-8e1f078d9302", "value": "2022-1-27-bf5979f5fe8297ed09150b6c3bec44fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9686850a-820a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643574252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574252, "uuid": "2fe11b4d-2af2-44ae-aaeb-bcc4d5e43c8f", "comment": "Malware payload", "value": "5bff5ce4810d39d6d257cb7feb109712", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574252, "uuid": "3a811391-8297-4dfb-ba17-a952e15c1fbb", "comment": "Malware payload", "value": "18bc2f5bc28c41b844fe8f04ab742dd6c6ef29f17cdff869bc0add973ea13b80", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574252, "uuid": "34fc13b5-cb34-4fe5-ba1a-56dd00894a2f", "comment": "Malware payload", "value": "9445f17a7b544beebf7c012a257f31933105bacf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574252, "uuid": "30ed89a1-638d-441b-9c3c-c732b7ee7bee", "comment": "Malware payload", "value": "ed256c964a58780838dfceca3f1b800825cfab87e41dd58d68b6e4bcc647790a464e5f85e867920439abb76f13f0599e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574252, "uuid": "1df0ffdc-ebde-418a-a349-0aa58fada348", "value": "T12E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574252, "uuid": "18289d70-c48e-4f8a-8560-ecdae0b8f74e", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574252, "uuid": "701374c8-3c80-4bff-9e14-2444459ad1bb", "value": 87409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574252, "uuid": "fdd4ba51-c8a1-4fb3-a82a-499cde3dcc95", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574252, "uuid": "a0a542b6-ded3-4fb2-b40b-febebecbbfc8", "value": "2022-1-29-5bff5ce4810d39d6d257cb7feb109712.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0633727-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1643561089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561089, "uuid": "7bba8786-7fbb-40b8-86d5-aa8ecf8cbdad", "comment": "Malware payload (Gafgyt)", "value": "dc84138ed6c6b59aced0acd6a78adef1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561089, "uuid": "c43ab8fc-15b3-48d4-a572-3f9dfc7073ba", "comment": "Malware payload (Gafgyt)", "value": "18c6b16489f4e8495f68c0fb223633ceb9a33ea56fafd50f7f0f59b4205d7b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561089, "uuid": "7ac6b32c-8c73-4030-9d74-81010b7bbeb9", "comment": "Malware payload (Gafgyt)", "value": "52ca7b9f80b734b846d5598cb86fe7256c3186ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561089, "uuid": "bbadc2b9-4896-4d79-a016-ff03e5a0cfa3", "comment": "Malware payload (Gafgyt)", "value": "7bd7d98ae1c430fa3ec17c0b4517b68852deed504e8f71c02a29e71dca35808b8637752e7f08ba59446635a48809c440", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561089, "uuid": "b907b392-4827-41d4-9637-5a42384db058", "value": "T109632B42AA42CAB3C8930AB502EB9A261631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561089, "uuid": "77cb1e41-34e2-4971-b666-374ce8a0f64e", "value": "1536:5w8bIEmDIdV5LTepgWncXy9olDmF+l2OZ/fufYEZ:tbIEmDI1LeNcIYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561089, "uuid": "1a4dd390-5697-4584-a7aa-633f0fcc88a8", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561089, "uuid": "d2cd0f58-38e3-4e19-ab39-4c40a9e021c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561089, "uuid": "0acb1434-9411-4eff-8468-a2663e8401dc", "value": "Demon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da2ad7d-820c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643575016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575016, "uuid": "9d6a4e0d-3bde-4c83-9661-6e2190a1fca8", "comment": "Malware payload", "value": "86d2658475cc34f14449ca86d6742bae", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575016, "uuid": "eab5fe30-329b-4f5d-863c-9095739bebbe", "comment": "Malware payload", "value": "18d7add6de378b89c7f3a403f190020a4f8cc173f2ada834202b116c1e0b8e68", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575016, "uuid": "2dd694b7-12cf-45b6-9983-a2855b1edd44", "comment": "Malware payload", "value": "8c59838d19e4a1fef127386d3e223d5deb1ecf83", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575016, "uuid": "27fad773-ea6f-4d81-a994-b3b3a5ab7f3f", "comment": "Malware payload", "value": "5f157f7a8c6a7cae425744d8e055930d7d68132dba5760c49b582dbd661c20664b962acf038873de5b140bade17780ca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575016, "uuid": "5064eb25-5c3c-4a3c-ae30-7794c87174e4", "value": "T172934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575016, "uuid": "a8710dd1-2553-4755-8f88-ceaa92d4b11c", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575016, "uuid": "094c719f-fd32-4c6a-b94e-294aa9ad79e6", "value": 92592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575016, "uuid": "0d483ebf-6da1-4c7e-abc3-6dea7819b8b5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575016, "uuid": "839ff67f-7d8b-4f5a-9a24-e5ad89728f08", "value": "2022-1-29-86d2658475cc34f14449ca86d6742bae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65ff167-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571407, "uuid": "930dd41a-b76c-4be3-8db9-80b1add86dcc", "comment": "Malware payload (SilentBuilder)", "value": "ce972c20deca6fa848a68f88efa79e2b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571407, "uuid": "cfb96873-3b08-49e2-8087-8aae5c8e93cd", "comment": "Malware payload (SilentBuilder)", "value": "18df49b10e5c6d820996eba33aa41a2c714836ca5c8855b690ac08708ee0adb6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571407, "uuid": "8c1cf23b-ed16-428c-95f6-ead6dad94957", "comment": "Malware payload (SilentBuilder)", "value": "7db1c68cf0fb6d20c6aa1ce6153e53234cad7977", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571407, "uuid": "e5be7b88-51ac-41c9-b8ea-92efbb62af55", "comment": "Malware payload (SilentBuilder)", "value": "ee3943d78bbb92f21d44d299c5fad7a5aee9046c963f218e27bb44599acbbde9f9095b57f037c28fd2c8da4edd8d7899", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571407, "uuid": "635176e8-f648-4453-bc96-c906d9865c8a", "value": "T150839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571407, "uuid": "abd56935-2e4d-4f99-8fc7-ae928346a731", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571407, "uuid": "bb7232c2-dba4-4040-8d97-e22f9c014a88", "value": 87455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571407, "uuid": "e4eb60f4-706b-4771-8cd5-34166bcb66a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571407, "uuid": "87830598-8948-42da-8a4b-f990c4a7d32a", "value": "2022-1-28-ce972c20deca6fa848a68f88efa79e2b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c557aab-8203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643571041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571041, "uuid": "5d3f75da-9d6e-4e85-ad4e-1a37b975b37f", "comment": "Malware payload", "value": "c6d18a7a1a89ea57c1181888e3c7b9c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571041, "uuid": "7df15f10-b649-4f13-9472-5d4c5800c563", "comment": "Malware payload", "value": "18f2347f4d04d401e19185d03b57d3eead771762ee3eedff2cd605901cbf70bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571041, "uuid": "1bdb11f8-51ca-407d-adfe-2b7212e2d580", "comment": "Malware payload", "value": "0698671ba4d92b291951553930566ae8f4ddb7c1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571041, "uuid": "2e2bb7c4-7b4c-4521-86b4-8b01530240ff", "comment": "Malware payload", "value": "ca8fdb73d8b6e571bc80aad0f931a6505246bdd35b1913d344fabd7352322ae52034a9c29f125ff12c0a4e9b42a88de3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571041, "uuid": "671e0707-67cd-41a7-83ff-94caaddc14d2", "value": "T1CBF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571041, "uuid": "4d59058d-10ed-4013-a173-684de04f87dd", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571041, "uuid": "d094f066-20f1-4020-baf3-c1792537fd11", "value": 158361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571041, "uuid": "e06c35f6-b584-4f27-b362-d296028e73e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571041, "uuid": "59ec1fe2-726d-4013-84c4-89e549057095", "value": "2022-1-28-c6d18a7a1a89ea57c1181888e3c7b9c6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ca42e2-81f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643563624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563624, "uuid": "8beca768-57d8-4b4c-8f56-df5e4d358568", "comment": "Malware payload (Heodo)", "value": "d15e576e446ba4485c210065ab5cd66f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563624, "uuid": "842da3a4-cc7a-400d-9a77-be4bcffe6d0c", "comment": "Malware payload (Heodo)", "value": "18f33d53df6d126870a3d3564b56167f3220228eaf826be7e700f2e5cd4c3d7e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563624, "uuid": "fb5c73c0-71a7-421b-986d-2ab4cab4a737", "comment": "Malware payload (Heodo)", "value": "b70bf84342e8663f3abd31a8cc074e1e8aa9de33", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563624, "uuid": "12141ca1-e12a-4685-9e85-a0d8f40a10f5", "comment": "Malware payload (Heodo)", "value": "0a4ebdfb56dfd69707ba6953cbbf3c6d142a0c7bee195d8357e6bc611ab5fe4b140b7fae931e6d071d205672d3696bc1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563624, "uuid": "62dffd07-ea69-4152-9d87-2f05e90c4be2", "value": "T1BF735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563624, "uuid": "6d6c0946-f1c4-41e3-8b4b-fc43397fa791", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563624, "uuid": "193927c2-11a0-464c-bf51-5e2e9cb8ee4e", "value": 77988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563624, "uuid": "6b37cc1a-3d79-4752-bffe-cf350c722479", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563624, "uuid": "b02ce6bf-349b-414d-a6ac-8fd6c4f6c9cc", "value": "2022-1-27-d15e576e446ba4485c210065ab5cd66f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20891007-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643563746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563746, "uuid": "0c79395d-eecd-4b9a-aa9e-10faeca8a4be", "comment": "Malware payload (Heodo)", "value": "d4acbf4a9c684a8bf8ac74da84b6525e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563746, "uuid": "20cb516c-5c44-4e96-bb28-fe02b32a36e4", "comment": "Malware payload (Heodo)", "value": "191d450fcd9f4da8d1c55abaeb876e68b6fb2f7559a1d373b098e5fb9fbb43e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563746, "uuid": "2e4e6ede-f887-4a62-afe1-a6fbfd2c6144", "comment": "Malware payload (Heodo)", "value": "160dfdabcaa1df2223e44fbd31cdeb4251a98b11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563746, "uuid": "58488f7e-b1e0-47be-86c8-952f1ca0ea3e", "comment": "Malware payload (Heodo)", "value": "9a65c7f70a541ba9c2e5f9a595a8f55ac33f5027ceb4befd673558afe5293a4a761b8c644367ee8f5aec827e6fb93d3b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563746, "uuid": "81f773de-3978-447f-8e71-a265d8cbb560", "value": "T11E131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563746, "uuid": "0cacaabe-6820-40f9-bea3-7e5305b02ec1", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563746, "uuid": "1e5f30b2-365e-4739-8024-766e33cb27a6", "value": 45483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563746, "uuid": "12cd370f-0a7c-4900-ac57-9b024402a3a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563746, "uuid": "43ca5c45-45df-44e4-8fa6-28c7c51781bc", "value": "2022-1-27-d4acbf4a9c684a8bf8ac74da84b6525e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a92a33-81e2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557039, "uuid": "52b96120-245e-45e4-a2da-37e8a3e8d794", "comment": "Malware payload (SilentBuilder)", "value": "0867e202329c62929436330f8e8f4a42", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557039, "uuid": "c40fee16-de32-4408-98e7-3d76bcf0b918", "comment": "Malware payload (SilentBuilder)", "value": "1925322925cc719715950be9207f6b90d16ab287bda917d1ab6936a65a4756b3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557039, "uuid": "3f936176-448f-439a-ba67-b8e1720822e2", "comment": "Malware payload (SilentBuilder)", "value": "ef1edc9b51e078ba49aed611d09852a1a35f54ca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557039, "uuid": "cc002e8f-e8d5-474a-93fb-9b66844d31d8", "comment": "Malware payload (SilentBuilder)", "value": "5ff9e7e1289e715eff167b0b01d324208039e8c52628e10708b63a7ef8d04afff7345ccb7589729455d0dbea7b1a3aff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557039, "uuid": "e3b7431d-4c49-4869-b877-663964965047", "value": "T11BF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557039, "uuid": "35df362f-adc2-4aac-869a-441078f2a8ed", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557039, "uuid": "7979f88e-776b-4f84-aee0-b781b3cbf6fa", "value": 159189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557039, "uuid": "0cbe575b-f21f-4e5d-bde0-77f1d50b313c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557039, "uuid": "49df953e-9515-41e0-928d-0cdbf4af58d9", "value": "2022-1-27-0867e202329c62929436330f8e8f4a42.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97da9efe-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562658, "uuid": "b178ed78-6899-4bbb-a330-076c132fe987", "comment": "Malware payload (SilentBuilder)", "value": "ae0c590a87ebe0201fa483ae345dd77b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562658, "uuid": "a3148c91-73aa-4dc5-8c44-6c4cd8783ed7", "comment": "Malware payload (SilentBuilder)", "value": "1985166880b2098586e8829863d61fb17389ddf9ff4711cf6aaef99e0720298e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562658, "uuid": "ede8b568-d9b3-4435-bc4c-b4590b120d6d", "comment": "Malware payload (SilentBuilder)", "value": "8f4c8b198798f081604b45a14592963699bbb805", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562658, "uuid": "58069c35-8603-4063-a3eb-a5ff50db07ea", "comment": "Malware payload (SilentBuilder)", "value": "876722306e5a6f5e0b669e7f97a86a8ff56f8f39e063a03e1b5a52c10e2372bac1db9d276532870c47f0e52d34d66166", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562658, "uuid": "7cb5db5b-3171-4641-a4ee-463f1c67c20a", "value": "T1F0735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562658, "uuid": "ba3da771-df30-4824-9605-46e7d7148924", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562658, "uuid": "39f031b2-cc9e-4364-83d7-3a415b2791f1", "value": 77350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562658, "uuid": "abbeca13-efe6-4c84-84ce-cc29ca8a387b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562658, "uuid": "3174b1a8-fb30-435e-ba0e-fa58163c88f5", "value": "2022-1-27-ae0c590a87ebe0201fa483ae345dd77b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956f9711-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560936, "uuid": "9bbed92e-abeb-456a-9168-ee3cac5aefcf", "comment": "Malware payload (SilentBuilder)", "value": "f525a295f14e30113653989dc6cb334b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560936, "uuid": "6885d865-b14e-4544-a547-e4b73b42a16c", "comment": "Malware payload (SilentBuilder)", "value": "19c339b1b8e09a46c18aa862be280a930cf4a920f962bb2929108ee5d91d355d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560936, "uuid": "b0155219-94f0-45ad-85a7-5681ccccd9a8", "comment": "Malware payload (SilentBuilder)", "value": "5b2c7db8ba2b063f4b060f810e31a7de94ab5ff9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560936, "uuid": "334165c4-dbf4-4cbc-9edb-7125c26e1afb", "comment": "Malware payload (SilentBuilder)", "value": "c12ac6fb3df9201ae7ff81afb7aa624882c58e79983bb6b21a4936adb06bf95787143c1695c34bcf73c8e7bd3af039f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560936, "uuid": "f42f2b81-830b-49e2-bbcb-65ffa2425dd4", "value": "T1B8F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560936, "uuid": "c0eaf117-840b-4517-8f24-574b3c18e41a", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560936, "uuid": "a66d0bc4-61c0-4da5-868e-5884bf40ce12", "value": 158301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560936, "uuid": "e04af4e6-b825-476f-94c1-a7d5ebc8d1a1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560936, "uuid": "f3b977ca-8136-471c-8044-bf1360f9affb", "value": "2022-1-28-f525a295f14e30113653989dc6cb334b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd70d68-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566695, "uuid": "1a25f2ab-bc6d-465b-9c3d-aa2886afa85e", "comment": "Malware payload (SilentBuilder)", "value": "2a394a8c79d07daa2a0f5562d98d3363", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566695, "uuid": "ea7d2f7f-2050-4ffd-aed1-940db2e1fd49", "comment": "Malware payload (SilentBuilder)", "value": "19cf7c786f97cb3f89bb01fdb63cad5900da708904e9f130f86dbda8680a68b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566695, "uuid": "5b532d3a-a8aa-4737-8f4c-33a59b5dd3e5", "comment": "Malware payload (SilentBuilder)", "value": "73c4e2984d0acb79fc85887858857ac1cdb81137", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566695, "uuid": "49608d36-6671-4b25-bc38-b5a446de50ae", "comment": "Malware payload (SilentBuilder)", "value": "4e46765b097009aa82151c945c08cf5c339de3daa0acca2039af986faaa01a4a5b0123cf5ed80c13e7e6449c0df5fe15", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566695, "uuid": "8173f006-a923-4fce-94eb-350ed6e8d788", "value": "T176F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566695, "uuid": "faf674a4-6232-464e-a726-c9284af6248e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566695, "uuid": "9091239a-0400-49e1-a3dc-a9ac9f79eb3c", "value": 159135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566695, "uuid": "8f4d17d9-a853-405f-92b8-2b47804d49cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566695, "uuid": "b4e9d9e2-e8e1-4fd9-80b2-814686516cdc", "value": "2022-1-28-2a394a8c79d07daa2a0f5562d98d3363.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ba3c43-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560881, "uuid": "76d23f72-a8fe-44d0-98fd-f84a6003682d", "comment": "Malware payload (SilentBuilder)", "value": "6fdd2510269245c3db1ed7ad1ed407a1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560881, "uuid": "3eaf8ef2-0bcf-4968-8a13-056136a36990", "comment": "Malware payload (SilentBuilder)", "value": "19ef9646a32b6fd446bb79b5b8901b39367cc2e73dfe0071ab1f537b4ce45dd3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560881, "uuid": "4fec3a02-0b2e-4af9-beb3-b9e95e9e2200", "comment": "Malware payload (SilentBuilder)", "value": "732636b147c1a9ad645d5c7a2b66be1598547ece", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560881, "uuid": "11476e40-c663-4949-8402-1753fa554832", "comment": "Malware payload (SilentBuilder)", "value": "318ab7a33fdef1246f9aebd0720bf47aa33edc8f27e7fc8bdcf3cff62e07b67e2a4929656817bc1748717a44b8a69602", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560881, "uuid": "ed9c71ae-2f72-4b0a-8a51-9fa5671a2188", "value": "T134131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560881, "uuid": "9bc9eae4-ac76-46f4-a365-753e6ff8fddb", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560881, "uuid": "e6232596-ecbb-4048-963a-47d121820f9b", "value": 45329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560881, "uuid": "ca28525e-4dc3-4c31-a7d4-bebd8be7f3ea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560881, "uuid": "833bca8d-ef00-4aa3-82cf-d1737ebfc644", "value": "2022-1-27-6fdd2510269245c3db1ed7ad1ed407a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d74cdc8-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571660, "uuid": "a3b019e4-3ad2-4d86-956d-2d45f4c82cd6", "comment": "Malware payload (SilentBuilder)", "value": "d4d638372240422c6a9a1257013f0b7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571660, "uuid": "58456d17-0094-4494-abb3-79a14a9d3d08", "comment": "Malware payload (SilentBuilder)", "value": "19f50518daa60c9b66e3d4559678b6af58676c9cbcd291a53cb2def82aec0482", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571660, "uuid": "30347272-bacd-48be-9859-87b1e35416a9", "comment": "Malware payload (SilentBuilder)", "value": "0ff94d01c9a24fef2109995471e6b6020eb8f5d5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571660, "uuid": "f03f6898-b4b6-40ae-9348-b30fd8ea9119", "comment": "Malware payload (SilentBuilder)", "value": "68bb26daa6ddb53ce6675fcc214618c86aae223f15cfcbf142f790aa555de6affe20cbe759e2cd56680008daa74c9de2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571660, "uuid": "aaefbf92-5c7b-4b31-8607-42c6f67e0807", "value": "T16E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571660, "uuid": "ded21f9e-bdcf-42f3-a6c0-a99e13df63fd", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571660, "uuid": "2fcd5862-cd5a-4a56-bc90-27a9177fff49", "value": 87246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571660, "uuid": "d8d3f1bb-533d-4551-8ae5-6bee645f141a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571660, "uuid": "bc8eebec-cf6f-4b69-9589-e5dd6e59c6e8", "value": "2022-1-28-d4d638372240422c6a9a1257013f0b7b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4003de-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643571341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571341, "uuid": "c87f80eb-8898-4ada-8749-0c35cabf23f3", "comment": "Malware payload (Heodo)", "value": "cd30776b20beda4907bf99744a3b77e1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571341, "uuid": "9b09acd7-b06d-4e2f-9c98-77cd15477b49", "comment": "Malware payload (Heodo)", "value": "19feb5494a4375c8b868ed3b54d4b5f74d4d3057756703a37de9ba1fbbc69da0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571341, "uuid": "37b5061c-7978-4ab5-a1bc-0b36c22436fe", "comment": "Malware payload (Heodo)", "value": "7d707768a964452f0d45c6276e064d6153bc68e0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571341, "uuid": "7f80b5db-6961-49fd-a05d-1fd21bc6932f", "comment": "Malware payload (Heodo)", "value": "3f8dd059d9e7fafc66aefc637abd38d39b981e1a96aee320c8a992e01dd0007191b6640544b37ce05e70e66982bb0af9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571341, "uuid": "f9ca005a-106b-4d32-88e6-492b404b0ed9", "value": "T149839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571341, "uuid": "2dea8cb9-01cd-45fe-bed6-08432a5efce5", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571341, "uuid": "01b721e7-7244-43dc-967a-0abc88a637ce", "value": 87196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571341, "uuid": "770d95f7-4d07-4936-a69d-4b1cd555a7e2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571341, "uuid": "ebfdd121-2186-4e29-a07c-9ecc2aa118f5", "value": "2022-1-28-cd30776b20beda4907bf99744a3b77e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767429ba-8207-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643572910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572910, "uuid": "dec7c4bc-6c3c-4d98-9ffb-5e75b0e3c1ee", "comment": "Malware payload", "value": "fb1119565490f8788ca5a27f3b888b18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572910, "uuid": "40a37d91-9667-46d9-81ba-171e94ea9963", "comment": "Malware payload", "value": "1a0a6162e318c913f890229338ef1b596c69d44014fddd800623a2fbf202b3a0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572910, "uuid": "37a338b1-f738-4cc3-938b-3b99d64af5b8", "comment": "Malware payload", "value": "3604a5fd72cc2b636d92305347395c9c0cfc3a2d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572910, "uuid": "914be3c7-d533-4cc6-ab32-a83a595423cf", "comment": "Malware payload", "value": "09fff8de7bcb528e5a867a48c1e09cd1cbd4ca84b08470938e4fb830457d31b2f4f4979d40eae2d31b4f816e22d2e90e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572910, "uuid": "7f93a214-f097-498b-878f-e9b303c8b9ee", "value": "T19CF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572910, "uuid": "2da5db37-c2b8-41d5-867c-78b43fd72082", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572910, "uuid": "896e217a-dcc3-493d-b5f5-9009a7d2392e", "value": 158413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572910, "uuid": "e65bee8e-e0de-40a3-a2cf-8689d5c69100", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572910, "uuid": "00b58a5b-86a0-448e-bdf3-d43409305617", "value": "2022-1-28-fb1119565490f8788ca5a27f3b888b18.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dff5c6-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568586, "uuid": "44683549-3af9-4de2-934f-d8c712024124", "comment": "Malware payload (SilentBuilder)", "value": "6dba074f8b81efcc2dff0a656283fced", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568586, "uuid": "b38fa4e3-a51a-4a60-996a-659ec8197d62", "comment": "Malware payload (SilentBuilder)", "value": "1a3ab2a12ca16e533c7dfa54d422e861a958469155a82238bd85fda6a3b8341f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568586, "uuid": "88950938-583d-4e0d-9b6c-91ba5d4aebbb", "comment": "Malware payload (SilentBuilder)", "value": "d004121d892157a932fe696ffa2b56d45be199c1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568586, "uuid": "344e737f-e077-4d44-a5a3-ab1ac3c12a2b", "comment": "Malware payload (SilentBuilder)", "value": "fc4b6404459ac6839cd15d98940a57cb1207d204c0fced2b20ffa6dfd57bdeb18394459b4c2ea06f4b082646fdac86d4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568586, "uuid": "ef6e4ee0-fb9d-4782-af0c-c4d70f60aaa2", "value": "T138233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568586, "uuid": "8a124800-8715-4814-aeed-bc4c5371ccf2", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568586, "uuid": "150b7ce3-cdcb-4fad-989a-b1391e403412", "value": 48613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568586, "uuid": "694011e6-5de1-48d6-a246-2014a2cc0532", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568586, "uuid": "7b0c6fec-da89-41ca-a6a7-09c23e6af082", "value": "2022-1-28-6dba074f8b81efcc2dff0a656283fced.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4bf242-81ca-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1643546747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643546747, "uuid": "990dbffa-9582-42de-b3d8-cbe1433e4362", "comment": "Malware payload (QuasarRAT)", "value": "84749489341fb7f968fc940eb0751d23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643546747, "uuid": "ffa0ae5a-e331-4630-a756-85fe230885dc", "comment": "Malware payload (QuasarRAT)", "value": "1a3c5e1a2a52a3796116eaf838e36a23bc6428b42bd1c5c5a17aa73ab8974e46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643546747, "uuid": "79de2ea4-bedb-488b-b3db-4bc6019332a6", "comment": "Malware payload (QuasarRAT)", "value": "89609f93cdd419af9fa82a9734b1bffc63563068", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643546747, "uuid": "93e553c3-cc44-4be4-96c9-38495cdbd1c4", "comment": "Malware payload (QuasarRAT)", "value": "fed7274ba4bb8c26d9a4a959a3170ccd7cb404629ede1faf39472108bb2b0f1c663eb64666e319a071066ddc350cbcd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643546747, "uuid": "f0af3426-25d1-4e3c-979b-979b67878724", "value": "T125A4F5423BDB8C11E3FF5AFD453287209632BD67D87AC32D37904D5A0929698CE097E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643546747, "uuid": "ef46bf0e-a00b-4a78-9ce2-41ce6831bf33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643546747, "uuid": "d353a444-6030-49b5-a87d-0a2ee44240cf", "value": "6144:TdCg6C+mzrvSRlzby1HehUsJ7/hgUvjUwVfjzby1HehU6wtffzby1HejU:TlrvvSRlKRmthFJVfjKRltffKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643546747, "uuid": "40f709c5-7344-4da1-905e-14581cecc9cc", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643546747, "uuid": "bce6ccd5-25b0-4325-a2f1-222fe3400101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643546747, "uuid": "4afbbdae-e060-4e45-9d97-b9472972947f", "value": "84749489341fb7f968fc940eb0751d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63e20d2-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568266, "uuid": "c1a65acd-53c3-4c17-990d-52f85261d960", "comment": "Malware payload (SilentBuilder)", "value": "634a887a41aae5ad745b14ec2cea7b4b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568266, "uuid": "3e53c806-3a94-4435-aeb6-6cb2214a2ce0", "comment": "Malware payload (SilentBuilder)", "value": "1a912c4db96ebc0a53a340782034b10ebbb40bbbd5fe9118e01455e3ee68a0ae", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568266, "uuid": "67838055-121d-40e1-ade4-e1f75765cff5", "comment": "Malware payload (SilentBuilder)", "value": "ffc4bb16faa4697d1275631108786b1b1404331d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568266, "uuid": "411f20e8-e8f4-4516-b262-fb92b67fedd1", "comment": "Malware payload (SilentBuilder)", "value": "c80cad58a23104af75ccd44656718fc22f5572688e57ba6669d311cff2d3e19179f27a534f14210e56ef9221cb6de110", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568266, "uuid": "aeacf6de-eed9-4f38-9876-ff25b8e9310d", "value": "T147233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568266, "uuid": "426bb16b-b17b-4f0d-bbc8-365036ba6355", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568266, "uuid": "3f913126-2fe9-4895-8c24-cc9e5274a12c", "value": 47841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568266, "uuid": "c37067df-9f7b-4408-b203-3041a98cfd54", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568266, "uuid": "1341cbce-a575-40f0-93dd-e231997f16e8", "value": "2022-1-28-634a887a41aae5ad745b14ec2cea7b4b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4199cbd-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558437, "uuid": "7e150342-c1f1-44db-aa5e-18489d1a7fa6", "comment": "Malware payload (Heodo)", "value": "273acc9fcad353527ec5bcd1bb519239", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558437, "uuid": "80595fdc-2c6e-49e4-a720-8e51cb2aeccc", "comment": "Malware payload (Heodo)", "value": "1a971e5dd08b0e4a13c831fa71facc9561b1c3a18d8a9c7ca0f0f5ad71e157a8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558437, "uuid": "4282ed99-f279-4243-9fca-6a73ab273109", "comment": "Malware payload (Heodo)", "value": "972628ab2feb1cb29a4f3b3df313b81859474bb4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558437, "uuid": "2f4712f8-2d06-47ce-8135-b7cf9c7ebf96", "comment": "Malware payload (Heodo)", "value": "5626d8fab5ed30c9fa55e4a52c70b6c5a1b7668ac2a909fc6b086cef54087b7444eac81873dd7908176ec6d174945339", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558437, "uuid": "263766e1-11fd-450b-a499-a103ecd3f953", "value": "T19B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558437, "uuid": "8d8662d5-4ff9-4f0b-bbe5-9810fb9cf36c", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558437, "uuid": "f3d7f865-a0be-4778-abbe-3365f7513741", "value": 77586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558437, "uuid": "9a621d12-3636-4cd0-bf2b-7471c1cfd714", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558437, "uuid": "3da2e411-1719-4ac8-bb93-8d52be01e7a3", "value": "2022-1-27-273acc9fcad353527ec5bcd1bb519239.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cc82a2-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572808, "uuid": "dbe92ccf-4a37-4df3-a5d5-e0278a11caea", "comment": "Malware payload (SilentBuilder)", "value": "f8063c142c3d91dc16cf1bd78700ae5e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572808, "uuid": "82984b06-e4ed-4050-9046-26076fedba71", "comment": "Malware payload (SilentBuilder)", "value": "1ad85fab44a6528aeb2ca4d57cdea134495edac6c2dc0f75b76155101f71f23b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572808, "uuid": "1cbf0c49-f579-46df-88b5-031103407f0c", "comment": "Malware payload (SilentBuilder)", "value": "5939ba95d9d1182e757f9110a0c1da67de3b0697", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572808, "uuid": "52183053-8ee5-4e4d-a467-e85d84f2b83f", "comment": "Malware payload (SilentBuilder)", "value": "b6594c771a2b06dcfea71c56fa1669aecc4f9b1e4dff6015128c2907d427a89358f33d4fb92827fee94a2dc03611c174", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572808, "uuid": "49cb00cc-8e9f-4a21-879b-9b30cea39d89", "value": "T1FB233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572808, "uuid": "ae7d9d39-d342-4440-ba47-50a3e09ea78c", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572808, "uuid": "7b9fab5e-8358-43d6-b0c1-eaf860a7c6b8", "value": 48663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572808, "uuid": "5c03676b-de86-47bf-9432-8f6b06d4c579", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572808, "uuid": "53427641-44b1-406e-8d84-86efaa98f473", "value": "2022-1-28-f8063c142c3d91dc16cf1bd78700ae5e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1f80aa-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643570475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570475, "uuid": "835c7e9b-4fae-4618-9e3b-3751d6f138f3", "comment": "Malware payload (Heodo)", "value": "aee973ebb9a044668aed8faad1ec1ef3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570475, "uuid": "df3d010e-875d-4800-b774-3ca4ed7e9aba", "comment": "Malware payload (Heodo)", "value": "1ae8b21e093ab7d1ef0d104eadac51d16467341f8a07dc3257e2bef84234f544", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570475, "uuid": "68a588fe-7534-4811-873d-e37b3e292d76", "comment": "Malware payload (Heodo)", "value": "54d41f9e29599109b802340e2f590e537271be8e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570475, "uuid": "fd4ba93c-735f-4845-806c-3ebb852efa88", "comment": "Malware payload (Heodo)", "value": "2aae86a1be0248b38df702ccdebfaf545fb69a84e2d0dbf03f44ff71882d251e22287c9779bca40221e0a42c25a8df4d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570475, "uuid": "fec39795-d166-45e5-bf6f-12b11951c9f3", "value": "T174839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570475, "uuid": "a8c5732d-9d3e-418c-9c19-fb7eca862d7f", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570475, "uuid": "52303f96-d766-4fae-b057-a71be0fbd0d0", "value": 87402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570475, "uuid": "0bc4a9f3-8dad-4921-9445-251b67c9b95b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570475, "uuid": "c18f0d36-967d-4c71-b411-67d2b12e9603", "value": "2022-1-28-aee973ebb9a044668aed8faad1ec1ef3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c55dd23-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558317, "uuid": "34cdf542-95a5-4b5a-b920-3e9d76017896", "comment": "Malware payload (SilentBuilder)", "value": "23b69b9ca691a0349624d63cd191da31", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558317, "uuid": "135b81f3-98e4-4853-91d2-db20f0cf5166", "comment": "Malware payload (SilentBuilder)", "value": "1af08d670a7c07a872c732723497e606e9993828c7d05afd1a8ecb2494b01291", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558317, "uuid": "0b09cfc4-5e95-4d04-856e-985eaeebfff8", "comment": "Malware payload (SilentBuilder)", "value": "026e8bc30b62d809752fd8883ae7e58da202f541", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558317, "uuid": "bbbd5845-a420-40d6-a1ef-a9260d6a1126", "comment": "Malware payload (SilentBuilder)", "value": "df00e98dd8d56c1125395bd62f6fad4ef2914448c372efb94056cacf2b4210198994135c68444a42f859b09a6a06a56d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558317, "uuid": "1ebf148e-3a48-490a-adfe-e5cc3d59e1ec", "value": "T12C735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558317, "uuid": "2923beee-3468-4ceb-a041-3c7b88b8be05", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558317, "uuid": "af738b38-ca52-4b59-869d-a91467eca4de", "value": 77382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558317, "uuid": "010c55e3-58bd-450a-b2ac-0cd7c6d6335b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558317, "uuid": "cb849cf3-2895-4baf-83b7-eb44b8f1dca1", "value": "2022-1-27-23b69b9ca691a0349624d63cd191da31.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc53d92d-81f6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643565833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565833, "uuid": "e81f8560-0ad9-4a24-8bd3-a74533d58884", "comment": "Malware payload", "value": "0fde40187b1bc61943e258dafdc7776c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565833, "uuid": "6e855e7c-597f-40c4-875b-59ed6a70c45a", "comment": "Malware payload", "value": "1b0e7b3ddd65c0d74f0ebf601be05a3b8caed6d579f52953a9a438f34d3938c3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565833, "uuid": "37d95fd2-590a-400b-8323-d7478ee6a22a", "comment": "Malware payload", "value": "175e4851e934bddda837ba5900ce1aa43269f707", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565833, "uuid": "e58131ee-4f5e-4a27-9c55-4d4e4ed90880", "comment": "Malware payload", "value": "91e8dfa4ed713f6301e625d6be971d180ad7ff373b5118bb62ec5ba367c18909da3353445b8df0fec0a40e3605deae8e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565833, "uuid": "0edb23ed-573f-4e7c-a18f-57504ec74803", "value": "T128F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565833, "uuid": "a8c8ae7d-ea7e-4071-9e4e-2c72174f5cbf", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565833, "uuid": "84570927-e77a-4344-a839-7ba2724d37f5", "value": 158698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565833, "uuid": "e232725b-d016-4b07-9790-2c3ec6091709", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565833, "uuid": "9fe5ecec-61b1-4a8a-8000-799e36c4b59c", "value": "2022-1-28-0fde40187b1bc61943e258dafdc7776c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf9da0b-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570611, "uuid": "cb7daf4e-73de-43c6-8cd8-9cecc3bd427f", "comment": "Malware payload (SilentBuilder)", "value": "b329cfaf1fe1958e7e72b0edcb8abd15", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570611, "uuid": "3381249d-3efd-4340-9f96-67fda40c0c28", "comment": "Malware payload (SilentBuilder)", "value": "1b1700d9726e84f7e0d356cf07ab6651056a100cee8963672d59344fd08e8740", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570611, "uuid": "22bcd03d-8db8-4b9d-aff6-1a840f1ef347", "comment": "Malware payload (SilentBuilder)", "value": "e3555b6b4e1fa8e4c84872942b6e66760912c9af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570611, "uuid": "76b2cc05-6a13-4e19-ae43-b9fcb2513bff", "comment": "Malware payload (SilentBuilder)", "value": "5da0732ed544537c74449b717c8097215c890c3f05af84725de8b80ecdb71219589ee79951b4ef74a88c3e5d23c123de", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570611, "uuid": "316f5989-ebd4-4ae1-9b09-b4a715eaa147", "value": "T1E8839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570611, "uuid": "fef3f863-1eef-48f4-8aa5-0ad21421f005", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570611, "uuid": "b3a8b2c7-0f39-4fde-9a8c-a3c88ce310c1", "value": 86906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570611, "uuid": "d9c47e1d-6ab3-482e-a0ea-adeaa3d891dd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570611, "uuid": "94c9b95a-bed7-47cb-8f73-960c3320f906", "value": "2022-1-28-b329cfaf1fe1958e7e72b0edcb8abd15.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2ef0e2-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561726, "uuid": "a1b8ae53-f6f9-409a-92e6-e174b62e5172", "comment": "Malware payload (SilentBuilder)", "value": "8fc5b812afaa37304e65b2e8b50ab1b7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561726, "uuid": "a0763a34-86b7-4b39-8ed5-8cb0c878d782", "comment": "Malware payload (SilentBuilder)", "value": "1b2fb54ab9593743aafa97eecdaa06acb264b866a8ffff13a3ead39c04cf7c69", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561726, "uuid": "0e5445e2-cc63-446b-9b3c-ce6d4d51d736", "comment": "Malware payload (SilentBuilder)", "value": "5038338d15b8e7a2f00294e9d29a645b013b3e49", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561726, "uuid": "4e730e29-d93e-430d-ade3-82fbeef24d46", "comment": "Malware payload (SilentBuilder)", "value": "f75544981b882ef14a898e3bf1b6374dfc3abb904a1cbb4f5ff574ee4da71a17c907311e5995a458f87b165cfc1478eb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561726, "uuid": "5f681342-0733-4195-869f-49b930e08b1c", "value": "T1A8131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561726, "uuid": "00c4d499-1b7e-4988-8139-8364b733250f", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561726, "uuid": "d2056d74-875d-4933-a3c9-3c3a2111a23c", "value": 44822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561726, "uuid": "b0968d21-48c6-419e-aa03-aa6ada67a3fb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561726, "uuid": "0265b458-0c99-4188-b4a2-19c2cab26df7", "value": "2022-1-27-8fc5b812afaa37304e65b2e8b50ab1b7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ee83b7-81d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643552933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552933, "uuid": "e0bd2472-a469-4dca-be48-e2ddf8002b1f", "comment": "Malware payload", "value": "455a7e8a42d5b2ecf7b664bb9b838caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552933, "uuid": "4796bb95-bcec-4110-b538-3b2a76220673", "comment": "Malware payload", "value": "1b41428d0d5d0caa351f1a8658eede72e583ec2d0766f5fc288e5a4bedb781d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552933, "uuid": "788b7069-abc1-44a1-94b2-c2508bcd6df2", "comment": "Malware payload", "value": "f3b206c1d0399280b7a3c32e957962fc90b62fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552933, "uuid": "62da7f09-0c44-47be-a70f-84a95dd963d3", "comment": "Malware payload", "value": "edf4b3c86ffc8e7827e3b8d08c2edcb044bdcf864c544d76b8099888dd66490aec6e3fb06891a43b8ed00dd76579bb6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552933, "uuid": "5fd70278-b84b-4a8b-ada9-2faeea762923", "value": "T1C022BF05B0BC4E33E8A2ABB484351447A5A2FE9D3DCF0F124F30394C249B8D0A52AFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552933, "uuid": "e5119b97-fa9b-438a-a772-4f7ab3b4f54a", "value": "192:G6z22htooM+x6P8ZG0/WDeLbh4zl5UKVyHRluUqYIMCH:c277lRGTDeLWzTUKVyxlVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552933, "uuid": "5dc52ec4-f0c8-4551-8d79-8df80d120376", "value": 10652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552933, "uuid": "4e574766-c541-429d-b8d6-92ef0801f8a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552933, "uuid": "f3575f14-75f3-400f-aa1e-7e9e4914e035", "value": "Yofukashi.x86_64.root", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ea1378-81de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643555377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555377, "uuid": "ade60bb8-5b64-4a3d-a623-456b6adbd952", "comment": "Malware payload (Heodo)", "value": "077a1e129e7c2c250c4832f60e2f10fa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555377, "uuid": "9bd8420f-b06d-4eec-8f48-51c210e45ef7", "comment": "Malware payload (Heodo)", "value": "1b792eac386e26dcdfd800f9a5941fe04a5a86917bf6f1085f53be5b0deff161", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555377, "uuid": "1e58eb25-260b-4cea-a30a-e6a8c39f3d2c", "comment": "Malware payload (Heodo)", "value": "3410c6f3d9f1b7a4746d835e100d8de466eaefa1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555377, "uuid": "a68ab8ce-fd9e-473b-ab70-a9adb498a8f4", "comment": "Malware payload (Heodo)", "value": "1a9d27bf4b057b31b967d220b8f6c8edffcb857c95f0a9a5075b6011edbde13c104200c91d01812966a39005461ea132", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555377, "uuid": "f34300c8-06e4-4bd6-a299-a1fec7976ffa", "value": "T1DFE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555377, "uuid": "f2fbf92d-5157-4c8d-a191-e3bf49d7d73f", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643555377, "uuid": "8f9d5680-0397-43df-bcaf-40ec10e84a3b", "value": 146941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643555377, "uuid": "d6d013fa-683e-46d8-9f41-647c834938ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555377, "uuid": "f17d910c-8528-4dbe-90a1-af8d263d792d", "value": "2022-1-26-077a1e129e7c2c250c4832f60e2f10fa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e425648-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563018, "uuid": "6f91279a-37ef-4d6e-ad00-180794cabe59", "comment": "Malware payload (SilentBuilder)", "value": "bc0db4d0e9a2447ae1ff9bf9aab9add8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563018, "uuid": "1a924fa0-a6ab-4ca0-a44a-0e666e4a9fa7", "comment": "Malware payload (SilentBuilder)", "value": "1b87eba3a1f994595b71c0eecbbb34c17462a40e1e9c9fa4014edfc8677a65dc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563018, "uuid": "b5f70330-dab4-4d48-8d7e-ddc89a52ae97", "comment": "Malware payload (SilentBuilder)", "value": "cd865375272f4d9ef9f8e3e6a24569c755299134", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563018, "uuid": "bb38adba-efe4-4707-b426-6e2d32746f12", "comment": "Malware payload (SilentBuilder)", "value": "ca297993cebdf17129d9cc34da8d92a182536c4ce1930d415ecf658b26186c5a428751d5ebda8c1671e442f4877deef5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563018, "uuid": "f2c58623-733b-46be-9e0e-8b592edf4883", "value": "T17A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563018, "uuid": "935820c8-480f-444f-a367-d546fbfa341d", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563018, "uuid": "53f5e38d-d1b9-4252-b4d5-70746fcf20b7", "value": 77425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563018, "uuid": "2118cec9-345a-449f-a128-5c1cf842abc3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563018, "uuid": "af963d85-2263-4b3f-a72f-a44c6611be17", "value": "2022-1-27-bc0db4d0e9a2447ae1ff9bf9aab9add8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377735d8-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562926, "uuid": "4bd77ed9-b73d-4dc2-a050-59177acce52b", "comment": "Malware payload (SilentBuilder)", "value": "b9a7204d37dd4edd3dc005a83183e44e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562926, "uuid": "4711f27c-de9e-48b2-a34c-a237782fc516", "comment": "Malware payload (SilentBuilder)", "value": "1ba1d2a72943ad7493e83c7a055f6e00abe0b300f41e9fe9802d14f1e7aeeb1f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562926, "uuid": "9d9e5af9-8037-48e5-a8aa-9fb9c44ca45e", "comment": "Malware payload (SilentBuilder)", "value": "dfedf8d0ea6aa7c3d187f33873c14e753a914086", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562926, "uuid": "b647ce14-dd56-4739-9fac-2051277f5235", "comment": "Malware payload (SilentBuilder)", "value": "e50095741c340db45b5a0330dbc7a7d6bbb8d4661cd722c5c835abb4859035318fad5622715c5f678dc69545d57a6ce5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562926, "uuid": "4ed4360e-8abe-4ecd-9591-7ad6bf871390", "value": "T197735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562926, "uuid": "ceaf5297-8240-4fa8-b495-fdefdefb07af", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562926, "uuid": "3b639bad-5e74-4604-9807-4b475bb8fb0a", "value": 78031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562926, "uuid": "eda10f5e-2e9b-4b4a-8291-7c8fe31a58ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562926, "uuid": "341a4142-6fd4-4419-9702-6246b6788df6", "value": "2022-1-27-b9a7204d37dd4edd3dc005a83183e44e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d13cc00-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561674, "uuid": "bbdf95eb-c1c4-45d5-86c5-93afcc4ac8be", "comment": "Malware payload (SilentBuilder)", "value": "8d92eee3de709e5ee5802abb581aef9a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561674, "uuid": "a0b7278e-6949-43c0-93d3-ffd3d4fbe071", "comment": "Malware payload (SilentBuilder)", "value": "1bad5f13640f8ffc3ea4495847fd835decbbaab5a0d1f5e6cea4ec62560f01f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561674, "uuid": "5fed4592-0619-4858-9d60-9589e3aa9bfe", "comment": "Malware payload (SilentBuilder)", "value": "5d3bd334499c9f0cfb2d5a281068fe1740dfe48a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561674, "uuid": "7ef59709-d8d4-4351-9350-2a2eaf3ffc38", "comment": "Malware payload (SilentBuilder)", "value": "168bfb31a19d86cf57c2bf38b8583989cd697b23c4d9b23f0cff4f04ee81d28aa46b0e9624945ead20b1d41f078f8692", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561674, "uuid": "68ccac93-1b02-440b-8b96-b8ef57f96345", "value": "T1E4735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561674, "uuid": "54779fb2-186c-4173-bf8f-92aaf796034f", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561674, "uuid": "abb8041a-2ac7-47a1-81d0-2c37c3ae172b", "value": 78002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561674, "uuid": "ff842da9-5325-4e79-a3f2-f785f6515eed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561674, "uuid": "4632426c-3a9a-407d-a99b-9bfafaf4aa15", "value": "2022-1-27-8d92eee3de709e5ee5802abb581aef9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4624fd0-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570491, "uuid": "021282bb-b1d4-4fc6-ab0a-af8be7a00e35", "comment": "Malware payload (SilentBuilder)", "value": "af1fbcc4437fe1ffc5b2099dd6533ee3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570491, "uuid": "257126bf-c333-42dd-a6e2-1fc39a759869", "comment": "Malware payload (SilentBuilder)", "value": "1bb393a2fc46e1e0caa0c2b8734842dcd6906b500c08d58a2b3fe9ca637e8437", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570491, "uuid": "484d558e-3ffa-4e37-885a-ce1a4c9ff0b6", "comment": "Malware payload (SilentBuilder)", "value": "94d631ec1676c5055d2d5c50703327ff5d12165d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570491, "uuid": "ff139eeb-a474-4818-9623-e8e5ece034de", "comment": "Malware payload (SilentBuilder)", "value": "98c0d31d5d48b5ed47636bcfd210e6ed443038856421bf75388acb4d4eff1ea123e766ccc5f7afd7299a8cfdc74958c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570491, "uuid": "9fa4345b-9be4-4fe1-a754-de20d10fe741", "value": "T19B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570491, "uuid": "4b9f543a-110d-4b0d-b307-cc2f587de0b4", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570491, "uuid": "b16e1f9f-6104-4258-9fce-a937d1ced021", "value": 48131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570491, "uuid": "6f87cda1-91bc-4c46-b73c-1d1744cb1d40", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570491, "uuid": "345478b4-9634-4e8f-a9b6-81e9049699c5", "value": "2022-1-28-af1fbcc4437fe1ffc5b2099dd6533ee3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cc65d0-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558489, "uuid": "64bbea75-4a0f-40d5-847c-4fe226a65ace", "comment": "Malware payload (Heodo)", "value": "d388e42ff5581f5e477b3885a6e2b9f1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558489, "uuid": "26f5f275-d886-47aa-a85b-2885af519854", "comment": "Malware payload (Heodo)", "value": "1bc3a7079f725ef5ddae70de2b5e68aa57cb30c204aa9908584859f10ed0974e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558489, "uuid": "430e4970-49a0-498b-b6ec-39a27275ddc2", "comment": "Malware payload (Heodo)", "value": "f627c460152adee33f075d8309272eb63d172564", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558489, "uuid": "d98f8e3d-0301-4c38-bb8d-cf3c2bb20abb", "comment": "Malware payload (Heodo)", "value": "abaf47baeae5ed25ecfab9d642188539d696e698b09b3066c410f21d83f9aa2bb366bc87457284210b9c8c00a0a3c77b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558489, "uuid": "298ac31e-9815-4dc9-a707-cf168a5ce033", "value": "T1A8E35A6576B5C9F6D60403B10AD2CAFA2327FC739E5603E33199B31E1FB91509AC26C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558489, "uuid": "96e656cd-1ca3-4ef0-b6c6-83418dae97e0", "value": "3072:T7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIKGx3:/cKoSsxzNDZLDZjlbR868O8K0c03D388", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558489, "uuid": "49387867-55e7-4470-acbc-af82495d8719", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558489, "uuid": "cfa6feb0-0d62-4471-88f0-4b5bfb628ff8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558489, "uuid": "a3ca658d-d470-458f-bc76-aea06943039b", "value": "2022-1-26-d388e42ff5581f5e477b3885a6e2b9f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f483f2c4-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572692, "uuid": "f65d32ff-5db1-4afa-951f-e739562439ad", "comment": "Malware payload (SilentBuilder)", "value": "f4fa18ef1e163798fb1c1a276294ee88", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572692, "uuid": "f919fcdc-ad8f-4476-8a23-7faa3a3f9827", "comment": "Malware payload (SilentBuilder)", "value": "1bc5a2bbaf4e8c8d2ca046dfe0fb499b5b0ad203546f0d56f3e9a4a9c56a4b87", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572692, "uuid": "d1894e8e-1d8a-4e71-8534-7575520ce89c", "comment": "Malware payload (SilentBuilder)", "value": "5633260ca59a5d18dc71bc03b1409dbfd7d1b69a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572692, "uuid": "a10031ed-2a6e-4c26-91b8-db32e1029b49", "comment": "Malware payload (SilentBuilder)", "value": "5b6811b54edc98fb654be4b95ac2b2a0874cef01ba1f3762f8dc08ef24526cf1db0cc0d5f68d7321bf710d712969d695", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572692, "uuid": "9a931b76-6207-4c10-a419-543729425761", "value": "T1B6839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572692, "uuid": "93f54357-ad56-4677-bd94-faaed1f6b073", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572692, "uuid": "13c2a43e-d261-4172-a90d-23133d24854f", "value": 87097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572692, "uuid": "168f8f22-3172-45a1-999d-b3665d99f83f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572692, "uuid": "3e0511e4-efd9-459b-a1ab-aa93ed2b95de", "value": "2022-1-28-f4fa18ef1e163798fb1c1a276294ee88.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebaa95ca-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572677, "uuid": "66dc2243-9c43-4c1a-994f-c0cdad52dae4", "comment": "Malware payload (SilentBuilder)", "value": "f3d197c0579236d94decb0af7de08f3d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572677, "uuid": "4be23bb8-72cd-4091-8f17-53c86be71c8a", "comment": "Malware payload (SilentBuilder)", "value": "1c12a653dd7eea136fc613f37655963704f5f4d757183cf6463256f116fd4f97", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572677, "uuid": "3f8482dd-9180-4495-b1bc-95e957d9eac7", "comment": "Malware payload (SilentBuilder)", "value": "c2c3b665019de5aba0962053c6c811e272d041fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572677, "uuid": "0d6e4346-1224-45e9-b4d4-b7b1e2e2c0c2", "comment": "Malware payload (SilentBuilder)", "value": "a1ea97fa0634236fb907b561c47b4ab5b1a41b96ab3374eb8cd677daf3b442d35cfb4ef739376bf3a6a3d5d13256d33a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572677, "uuid": "5693e3a1-5cc4-42be-877f-4bb4c22fc14a", "value": "T1A1233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572677, "uuid": "d2b7d702-969b-453b-b325-1d456d8c3be6", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572677, "uuid": "251e5069-e7ae-47b8-ae4c-7f78c5548352", "value": 48602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572677, "uuid": "29c8cad6-2080-4351-ba7b-4e55e0ea4aa5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572677, "uuid": "331d6110-ba5d-4a4a-b51a-2ac7c33d4587", "value": "2022-1-28-f3d197c0579236d94decb0af7de08f3d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9854ca5-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561077, "uuid": "3a3cb701-581f-4403-8f28-d4fd8557f009", "comment": "Malware payload (SilentBuilder)", "value": "5a307716913ae0fc30dd8f029249f49c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561077, "uuid": "11366759-5de7-4540-84a0-3a510ec41940", "comment": "Malware payload (SilentBuilder)", "value": "1c4ba0c3bb1b6d1223724b53d10b31aa3bba3e44e4237dd9a3c73aa9dee3e75f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561077, "uuid": "418f6eb3-b82d-44f9-a23a-dbef63243260", "comment": "Malware payload (SilentBuilder)", "value": "80a3de8fbc046f20f7ef0d7a1d99e79535c4d837", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561077, "uuid": "e1b167e7-e2fb-42e0-ac11-40634f54a82b", "comment": "Malware payload (SilentBuilder)", "value": "1e88118c732df51448d584ba032e695850bc7259c7d7afeec443c3c64e55b00d2d94e45c1d5d97dcfb27d3f82dc8f1e9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561077, "uuid": "336c1c2d-e023-4048-81f6-8be5eb3add9d", "value": "T10B934B1BA98648C5E66D47F4E0625AE9BE63EF45FA433ED321107FC63AB41434C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561077, "uuid": "21419fff-3f12-481a-9e11-5921f2f8a0d5", "value": "1536:8xIk3hbdlylKsgqopeJBWhZFGkE+cL2NdA/6yH5Eb7EdrpFkkGX/sGC6ORQQDBh+:8Sk3hbdlylKsgqopeJBWhZFGkE+cL2Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561077, "uuid": "26e52eaf-788f-4bf4-a9a3-e528ff8b1c1a", "value": 91918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561077, "uuid": "c7779f83-e28c-49f1-a0ee-1101a999e29b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561077, "uuid": "799ab9d2-561f-4bc7-b88a-0268125cca09", "value": "2022-1-29-5a307716913ae0fc30dd8f029249f49c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fa5dd1-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571961, "uuid": "ef2707de-f39d-4b78-bfcd-53caa1e94e5e", "comment": "Malware payload (SilentBuilder)", "value": "dd3e9e827857c8fd7d80addbef85beda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571961, "uuid": "195cbf4f-bec6-41a4-ba77-5b60414dcb40", "comment": "Malware payload (SilentBuilder)", "value": "1c528bd0ec23902d829228bac773dda0b845e5eeaf1ad694c3d21d58867f7439", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571961, "uuid": "45162d3b-79a4-425a-baf0-7e6dfe4ba6f1", "comment": "Malware payload (SilentBuilder)", "value": "07fe19f82f121918fb6b8ce85ef9605ddbbed264", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571961, "uuid": "1de328d9-aef6-4acc-8bea-563e269284f8", "comment": "Malware payload (SilentBuilder)", "value": "3b174d78859ac6bbafdb66968adfe91e09244aacfbaeb4a73051069221e3cd7e3942d0929542cfa23f33af2b59c9bc2a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571961, "uuid": "fb53d107-7160-4fab-bd2c-b5bb00fce095", "value": "T1DF839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571961, "uuid": "49307912-c16e-491c-839b-51965e6fd3de", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571961, "uuid": "1a9f52a1-5b20-4ba8-8080-a01b03a67927", "value": 86739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571961, "uuid": "54e85baf-2bf4-42d2-80e2-2b4956a5a0d4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571961, "uuid": "e9b2b520-a6f7-4b4f-937e-a7e928bc02ce", "value": "2022-1-28-dd3e9e827857c8fd7d80addbef85beda.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef74785-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568092, "uuid": "8b875f8f-ee56-4d0c-b89e-7f43b49201ce", "comment": "Malware payload (SilentBuilder)", "value": "5be7754feca7857b3a7652c303a1ef9a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568092, "uuid": "d6c4bd58-4b36-47a4-9e5d-19ccb2a126af", "comment": "Malware payload (SilentBuilder)", "value": "1c7769f7756b40f89666e846a479b0a2270023e52b1504d9b7a6d1c7c707c9b4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568092, "uuid": "b50b0db8-422b-48ad-a2f2-893d3711ece6", "comment": "Malware payload (SilentBuilder)", "value": "70e7213ec640a9e9c128f535272f1bf0d992554e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568092, "uuid": "7403ca21-fa08-4758-b296-8e9b27fd448f", "comment": "Malware payload (SilentBuilder)", "value": "15e9b10c26281c6a20ecbcea71091d233513af24d9d0f9dcd7ea01e8472c6bdbfe749755127fc997f80acefa9810344a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568092, "uuid": "44b49361-2524-48f2-bf47-7f4139def6f1", "value": "T1A8F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568092, "uuid": "e1c6ebcd-3850-4142-8196-8bafcfa35d6c", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568092, "uuid": "2165b621-043e-456a-b4c1-296bc7a13e1b", "value": 158725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568092, "uuid": "6ceb3cef-d694-4ad4-862f-eeba4b3fbb73", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568092, "uuid": "a4537a28-25b4-4c93-abfd-68b9bb1e50f0", "value": "2022-1-28-5be7754feca7857b3a7652c303a1ef9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1969f6d-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566594, "uuid": "61e82ebc-32ba-4f7e-b3ee-a1d159530e26", "comment": "Malware payload (Heodo)", "value": "272494e0d06ea53c819d21cebd983bc3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566594, "uuid": "f6191feb-2bcf-428d-ade4-21f6bd391bb1", "comment": "Malware payload (Heodo)", "value": "1c99304fd053c8c87a0ab1801a14d66d248c551bda4b7345db7dd5e6ee091aee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566594, "uuid": "4a990ac2-88ad-4a50-b1c4-a3c17a8648a7", "comment": "Malware payload (Heodo)", "value": "646ff081a5726a13121d1203babfb3a867489997", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566594, "uuid": "187843b0-0e5d-4a74-873b-ae3dfbc09dd2", "comment": "Malware payload (Heodo)", "value": "98e5e7c7ee0a5a5902937580d8304cfc4f7101e378423c921b41ebfd0391c9c6fe262fefca03a1e2a2bca75916deba2b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566594, "uuid": "f58bc7a2-dd07-40fe-bfe8-a75207a0a0e2", "value": "T1C5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566594, "uuid": "cdbd5004-9056-4359-af7f-af6f06e1e42f", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566594, "uuid": "8bb9eb3e-1db4-4dc3-a03a-9f51f92e8d91", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566594, "uuid": "b9e1a856-f91e-4341-9b9a-d35e08e4fe5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566594, "uuid": "591f17c1-6c37-417b-9523-d2ee0a00936b", "value": "2022-1-28-272494e0d06ea53c819d21cebd983bc3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed77eca-81e3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557462, "uuid": "03362949-2f8c-4705-bde6-5e9adcf98902", "comment": "Malware payload (SilentBuilder)", "value": "7cfc185912c00146e5d8f4b41d66e291", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557462, "uuid": "a08e0878-c3a7-4b1e-b632-64430fc19618", "comment": "Malware payload (SilentBuilder)", "value": "1c9dd97ac8ddd3def19560ad3fa953158d527262e683884207108ac53b0789fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557462, "uuid": "67f4f1d1-76b5-478b-ba6f-43b80c45fed0", "comment": "Malware payload (SilentBuilder)", "value": "e7825c3420e31952637a22fb24542644d0924994", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557462, "uuid": "fd61e83b-96ed-49b2-8bdc-fdc0096c9c16", "comment": "Malware payload (SilentBuilder)", "value": "677e5aa0dbcc360e85b371deed590e9bbe47a931595101995304ab81d5cd1c9b3e6b1a1b45c381c7b44cb7f476c92904", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557462, "uuid": "64104f8b-c8b6-4140-9be9-1c5ef845c38c", "value": "T192E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557462, "uuid": "ad4c68e3-28cd-428f-be7b-4348c2418889", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557462, "uuid": "1999db28-aedd-4319-a0ca-3b39ad56fb19", "value": 145511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557462, "uuid": "c05d28d0-6b2c-4198-9c54-25ee5f43c77f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557462, "uuid": "ac783afb-7187-45de-afda-f96551511298", "value": "2022-1-26-7cfc185912c00146e5d8f4b41d66e291.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21be288b-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569761, "uuid": "77f995b7-e303-4deb-aace-7ae25387d871", "comment": "Malware payload (SilentBuilder)", "value": "98b8230c306de7759508117fb10113fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569761, "uuid": "66f5ad12-5f62-4f64-84ff-63d377260320", "comment": "Malware payload (SilentBuilder)", "value": "1ca1328bdfa9ff5c8a503060991009b5e07eea953cbd22681d553aa0d8901e56", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569761, "uuid": "971f5912-3746-4c10-8265-5c5be5a3ed0e", "comment": "Malware payload (SilentBuilder)", "value": "979150ffd946cd68b620dca84afc15d5ac88f2ca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569761, "uuid": "3947d67f-1ad6-4ff3-ad70-0403d707af17", "comment": "Malware payload (SilentBuilder)", "value": "fa9f179aa67323b8b3e2eb91d3752ff1725959061adc956976eab2556d141fa627e2c7083083da1ba82c551742952ab3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569761, "uuid": "e7efae8d-c7a7-46e6-abed-459463a3995c", "value": "T168F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569761, "uuid": "5b6e50de-6925-4ea8-b780-4861c7b8ec2a", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569761, "uuid": "96f83e62-0910-4e61-a3f5-d347a08d0269", "value": 158238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569761, "uuid": "0093c521-23c4-4e01-a15e-0a615aa65c1b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569761, "uuid": "1057e941-8819-4bd1-ab73-2db4dbeba11d", "value": "2022-1-28-98b8230c306de7759508117fb10113fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08e9d62-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573437, "uuid": "08cba4d0-59be-4d24-81fd-9f1b9a3b5be1", "comment": "Malware payload (SilentBuilder)", "value": "139162dc053f85edd860503b056dc9ff", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573437, "uuid": "dcb6d9b2-ce5c-4b1a-bffe-d0a179c9d804", "comment": "Malware payload (SilentBuilder)", "value": "1cdb09749f5a241c844d1cbf19b0cbfd9172993598ed8d068d6ecac5fe96a49c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573437, "uuid": "5589dd5b-5424-47a2-84b2-3d224e18b1d0", "comment": "Malware payload (SilentBuilder)", "value": "89ab2005435c5b322ef0a78ead6bb6b7fbb86780", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573437, "uuid": "9e83707a-13c6-4813-ad84-3d506fe5bc00", "comment": "Malware payload (SilentBuilder)", "value": "907358412f2182c0e675520c844f3f617dd06e6a1288c5c0ba508531d339b273a20355ebffa5a9889f381bf572e4bb0a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573437, "uuid": "b7cfc0e7-f415-4a23-af45-422502e3bbc4", "value": "T13F934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573437, "uuid": "592f02cc-845f-43d6-b2a6-a1629e61c93e", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573437, "uuid": "fe31e291-0b17-4f9a-acb7-2b9cf2941edc", "value": 92656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573437, "uuid": "5a359baa-fcff-441c-864f-dcf0a4dea6c7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573437, "uuid": "c6fd5de3-54a0-470e-90d6-8cc1d44326d9", "value": "2022-1-29-139162dc053f85edd860503b056dc9ff.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030e6a58-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572716, "uuid": "4e9263f5-c178-4fa3-b93a-d1fbe8a52e43", "comment": "Malware payload (SilentBuilder)", "value": "f5ac49b60701d587a135f94705b3ff64", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572716, "uuid": "f7c396cd-f24d-4d9a-8747-f988fd2026ab", "comment": "Malware payload (SilentBuilder)", "value": "1d033dc4d9d7ee10b847db576c117685e14e49fb0d37c60c199ce42699dc7afe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572716, "uuid": "803a8ef5-2765-450a-a852-97ae952b3a89", "comment": "Malware payload (SilentBuilder)", "value": "4939b16e6a7c746d905d2dc8d7022474b7c5318b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572716, "uuid": "cdd392a6-42a1-46ab-9b8e-aa4701d4896f", "comment": "Malware payload (SilentBuilder)", "value": "213465abe32d30a13185e0c131cab828c90f83a29aa59f4598dc6332262cd3a059b43b1ff21f0693b72d08348fa316c6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572716, "uuid": "a86033cb-e894-4852-89a1-a8820e0874ca", "value": "T13CF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572716, "uuid": "60e28dbe-47e2-4007-bb2e-4e3dd14c2e5e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572716, "uuid": "e87d3aaf-019c-4776-92cd-56699027674b", "value": 158341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572716, "uuid": "feaeb456-cb18-49dd-9f66-409bd7fdc2b4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572716, "uuid": "e0a3aaa4-5d42-45d4-a112-b599f9a32f1d", "value": "2022-1-28-f5ac49b60701d587a135f94705b3ff64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91866723-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575962, "uuid": "0e3ab903-10ba-457c-874c-12726ac77c3b", "comment": "Malware payload (SilentBuilder)", "value": "d626f596df4ac799a66a886fa0e38d42", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575962, "uuid": "dce97256-20f2-4996-aa9c-1a1f2c273b95", "comment": "Malware payload (SilentBuilder)", "value": "1d083ab426fc7b3b8b12824a16d78ae2e625822b783fcc82b43cc7e7b271ed14", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575962, "uuid": "7eb928cd-4a41-41ea-b907-6f73cc494951", "comment": "Malware payload (SilentBuilder)", "value": "3ed29fc0a2848b5f7426b4ac6298a450f2de1d5e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575962, "uuid": "5cd6df5d-1dda-4e0b-9d6e-7c3d0a8d1107", "comment": "Malware payload (SilentBuilder)", "value": "5f0af980a42d9714567de7a40211fba59c4c6235224898109c57b643c7c6f2212958b4d501eee674d482dca16fe9d1e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575962, "uuid": "eafa74f0-914b-4843-ac9e-cec33c16d307", "value": "T1CB934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575962, "uuid": "4692d74f-9bf6-4d79-89e7-764b3e5182b6", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575962, "uuid": "54fd297e-929a-4dc5-8366-606425e1ec8c", "value": 92850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575962, "uuid": "d8f3de56-ad4c-4787-94fa-d1e6770840e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575962, "uuid": "d48ad341-6b85-4520-bf50-498d85650af8", "value": "2022-1-29-d626f596df4ac799a66a886fa0e38d42.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed12bc5-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569918, "uuid": "25058830-f232-411a-9c0e-7c3c19fb539d", "comment": "Malware payload (SilentBuilder)", "value": "9d340ab1301ff7594abb84e13778413e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569918, "uuid": "535dfe14-ea17-41a6-ab7c-5697735c2018", "comment": "Malware payload (SilentBuilder)", "value": "1d12326d21df4e7b784185432aa23bedadf9693701d634d111d52c35d8f3b890", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569918, "uuid": "c13f4466-75ab-4ebf-a703-8b382197d16c", "comment": "Malware payload (SilentBuilder)", "value": "4aa68d4ab4be370704b61e77d8fc089654197d73", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569918, "uuid": "27f964b2-3893-4f6e-80db-1dc8a4de87fb", "comment": "Malware payload (SilentBuilder)", "value": "29b3e8ab81545676a6a8a05ef72d9d8d6d60fb5a25fad8506897e211dc166574c432a4b758f117313443ca277750e530", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569918, "uuid": "793c002a-30e5-410c-b3b1-f4dc91cd96dd", "value": "T10E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569918, "uuid": "f79b2875-96e6-48a0-a572-c97e2f120104", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569918, "uuid": "994262d7-8f6b-4d6a-966c-fb6f030f8ec5", "value": 87355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569918, "uuid": "3a8e1fed-181c-4e4e-a91c-da94ae658483", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569918, "uuid": "0031ab76-1ed5-4d09-816d-290c6d7fa4fa", "value": "2022-1-28-9d340ab1301ff7594abb84e13778413e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408cadf6-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562512, "uuid": "3b78faaf-710f-42e6-947c-fd87c75be1bc", "comment": "Malware payload (SilentBuilder)", "value": "aa0c7bf7d45c6d57994de0361b16a2b7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562512, "uuid": "a5e07813-a8c3-4e00-b63d-b58061b50440", "comment": "Malware payload (SilentBuilder)", "value": "1d1982577f1910e3e41024f344fb0ac486336774916640d1c59dc23f1e2389ea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562512, "uuid": "19400212-9360-4fc4-9326-2c5105c4b308", "comment": "Malware payload (SilentBuilder)", "value": "c2fee8c226a311c3fba5c5ef0f380b9970e3ab03", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562512, "uuid": "fa002e09-84ed-445a-ad61-7fa7f5948ecf", "comment": "Malware payload (SilentBuilder)", "value": "75382297576e94baf2ee0aa8cb85a7d1deed75804fb58798774c8b8e864382ef6b295bec9e065de16c4fe9ce46318f73", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562512, "uuid": "03e40644-4243-489c-86f0-0a81c643ef23", "value": "T110231953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562512, "uuid": "e32a18c7-21d0-420b-b6a2-9b0c94f95a24", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562512, "uuid": "b281302d-5f4c-4397-af2f-88d8c67f23a7", "value": 45582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562512, "uuid": "99801a8e-1b0f-4495-8283-353a5fdb9e3d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562512, "uuid": "35d1b9b6-4893-4974-887c-623b0d1d82eb", "value": "2022-1-27-aa0c7bf7d45c6d57994de0361b16a2b7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68012f2-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560213, "uuid": "1080a54e-09bf-4671-b1d6-d3677641ad4e", "comment": "Malware payload (SilentBuilder)", "value": "5db7400e68d02a4793bff77f7f6f982e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560213, "uuid": "98b83fef-21fe-419c-a41f-d6e931a7e49f", "comment": "Malware payload (SilentBuilder)", "value": "1dad62dc048c893e3120ce8ff42deda28e82e5743710dbbdc264dbb1ca92dc78", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560213, "uuid": "85d402d2-f1f7-42d9-a8c8-145dd387bec2", "comment": "Malware payload (SilentBuilder)", "value": "653483da7aeb2752f1c4c0fdacb96cdcd5a6feb2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560213, "uuid": "25bd3854-8ced-4a6f-8cc7-914ee1bb67a5", "comment": "Malware payload (SilentBuilder)", "value": "4dc659ae79c79fe404f91046fbc77bce8a8dbcc8d546b4a129040f8520e92511a6bebb09a64e188e6533a104956b491e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560213, "uuid": "29f516aa-b055-4d9d-bc33-099e9854c319", "value": "T188735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560213, "uuid": "0b527d94-cff0-461e-91d1-7bcebfe140ea", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560213, "uuid": "0623e64f-1ab6-44ef-9129-6dde4471fa63", "value": 77699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560213, "uuid": "94085ace-6be0-4508-b2cb-1a83d2dad885", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560213, "uuid": "595b1c23-e282-4b7e-a089-61ee80871d81", "value": "2022-1-27-5db7400e68d02a4793bff77f7f6f982e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f330116-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564335, "uuid": "01c6986a-a019-45dc-acd9-2fb5303cb3e3", "comment": "Malware payload (SilentBuilder)", "value": "e1ba445d83feea5e3eefb6ab18cda832", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564335, "uuid": "b8819bba-b056-4b1e-a6da-199243283be9", "comment": "Malware payload (SilentBuilder)", "value": "1dada2283353dc863abbbd6af9fd647cbb3cd6da1b0cf44ea6feefeda3126fce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564335, "uuid": "d957cafe-8db4-44da-9300-9c994bb466d7", "comment": "Malware payload (SilentBuilder)", "value": "2a2bcf42415cb4b5b4bce3ce8b2a8e548e8f604b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564335, "uuid": "3b69e575-322f-410e-a506-cef29ad98f1c", "comment": "Malware payload (SilentBuilder)", "value": "3ad68e3dbfa16e3c22bd68c6901972de1d748549c636688927470ce5451b4b6b4663acfcca0f7c068a1a93daea3494bf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564335, "uuid": "9958a1ad-e2ec-481f-a685-1d307c95e053", "value": "T1A5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564335, "uuid": "9fef3942-4d18-4221-99ae-286aff311174", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564335, "uuid": "43b70924-6033-4cee-af6b-1b81fc5cdbd2", "value": 78340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564335, "uuid": "b6d54f0f-0e02-4a86-87cb-9e2670c30470", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564335, "uuid": "3fefdef8-52c2-4676-ae7a-babc0f8a28fe", "value": "2022-1-27-e1ba445d83feea5e3eefb6ab18cda832.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88383f0a-81ab-11ec-9275-42010a9c0029", "comment": "Malware payload (BillGates)", "timestamp": 1643533426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533426, "uuid": "251341f4-3cc5-44fa-9817-3c15bacee973", "comment": "Malware payload (BillGates)", "value": "f8f4194c0c324168556e255690a4bad3", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Setag", "colour": "#D64623", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533426, "uuid": "8dc7cb62-0f26-4dce-a753-fe7340f5a92d", "comment": "Malware payload (BillGates)", "value": "1dbb236b77ac51eee70e27ffa0daa5c65e9e8c6d9f05e39c2160829e70045926", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Setag", "colour": "#D64623", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533426, "uuid": "e217033f-d4a4-423b-b366-e33f14d52140", "comment": "Malware payload (BillGates)", "value": "d911c0d9fad98fe243e29e2c012e058c1500820b", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Setag", "colour": "#D64623", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533426, "uuid": "a8ed7cc9-e204-46a5-addb-aaec1a5a5700", "comment": "Malware payload (BillGates)", "value": "deefda50b2f9fb1a00a19ae7bd2c25952e7d44e609368899e52e9e4e976da8bf99c9314491affc66839d61544bec99f1", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Setag", "colour": "#D64623", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533426, "uuid": "56b719eb-46a7-4b62-983d-fb6e20a669ff", "value": "T1ED456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533426, "uuid": "3d0e6f4d-6a98-483f-b331-3de94b03b3f7", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4L2y1q2rJp0:745vRVJKGtSA0VWeo6u9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643533426, "uuid": "3018730e-c2a7-40c8-a09d-802489176d35", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643533426, "uuid": "8c2b44b0-b839-4ccf-afa5-81cd839be478", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533426, "uuid": "3fa2d1d1-e120-4c58-8114-b51234ca7e26", "value": "Linux-syn25000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2400a64b-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643573201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573201, "uuid": "2c00bb3c-5dbe-4210-8890-4038f6b1b7ff", "comment": "Malware payload (Mirai)", "value": "d26d0dbc2c89abafd0f7a7f37371cc00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573201, "uuid": "77c1da9c-5b1f-4ad5-9776-fcc5911fa862", "comment": "Malware payload (Mirai)", "value": "1dbb2d5f16a92ddbf3ba0624e767ed7318dcd715c8725955a5fd741bb8a29f2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573201, "uuid": "1660600b-3fe7-45bc-9b45-f8db7de61604", "comment": "Malware payload (Mirai)", "value": "57026c0db737c5ec4641b447f5b69408a44dfe33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573201, "uuid": "9fe2765a-9bcc-4f3b-8788-783760761bc2", "comment": "Malware payload (Mirai)", "value": "4f7e727359e8956df3d87c2b0fa04ddc5297bf402a7969c32668f579125f86ef4d260d48b95a08fc72e27cf8c2c8d178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573201, "uuid": "f3c27444-ff78-43b3-b8f4-df3ff754f78e", "value": "T1E7D2E1EDD144E8FAE97FC87913C503031A2823A589876C5B11B66683CF695B1B8831F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573201, "uuid": "45431292-21ce-489b-8917-b88af781fa56", "value": "768:lZI8JvLN/MnqFFvj6lc6YBNolvRLPeatJgGlzDpbuR1Jc:lO8JvR/IqFFurYBNofe0VJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573201, "uuid": "8d74428d-4699-4beb-b2f2-fa6a172736d8", "value": 28532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573201, "uuid": "3e7eb1cb-ce57-423a-8a01-f71f750af894", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573201, "uuid": "c8129869-0583-4c8b-b9fd-cdc15663bb90", "value": "d26d0dbc2c89abafd0f7a7f37371cc00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac797c9-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566663, "uuid": "ae24bcb6-45de-45ac-872a-f4a79f25b78f", "comment": "Malware payload (Heodo)", "value": "28679b502659637f953767eb90f3b362", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566663, "uuid": "1209834d-d43b-455b-9d2e-9835443d6771", "comment": "Malware payload (Heodo)", "value": "1dbe459b2c4cc2cdc472f8f9f42516531aa63933e70c3cc7dce39bf622557532", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566663, "uuid": "60603f2a-6703-4555-a877-6f09bd77ea01", "comment": "Malware payload (Heodo)", "value": "97b710b862dc2b30d0192787747c973e43c93480", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566663, "uuid": "29bd69b4-8a32-4170-be69-743b7821276d", "comment": "Malware payload (Heodo)", "value": "7df473d1d1b592484bb948719973f1b27cfbe3babed556d58ce6346d082b2c9d0257e2d7d276c9f20638dab62fd0c243", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566663, "uuid": "7bed41ac-8d93-4d78-bfcc-146e8588d92f", "value": "T1CE839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566663, "uuid": "d0cb5e4f-3dec-4533-9c4b-a1eea45c0d60", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566663, "uuid": "f191ae1d-6144-4306-a599-f105965c0033", "value": 86904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566663, "uuid": "e9232219-1b5e-4886-b895-4f41c97e0b9c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566663, "uuid": "f9221953-af2f-4d4c-b66f-497a9c0ccb89", "value": "2022-1-28-28679b502659637f953767eb90f3b362.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f684ef-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565363, "uuid": "997d2917-ad13-45b5-8146-369898ffd853", "comment": "Malware payload (SilentBuilder)", "value": "0347112a10889c4503677cbf80deb3d8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565363, "uuid": "4216853f-9f5f-4c04-8014-f5de71608df0", "comment": "Malware payload (SilentBuilder)", "value": "1dc0b45771f29170cfb75e8e938ea4c7e173ab8718d0c14048d91da713c82a2e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565363, "uuid": "bf465f6b-0e99-41e1-8a61-937644f90b3c", "comment": "Malware payload (SilentBuilder)", "value": "296da0d9bf9eaf6a9780c1be74c7e6e54d21732e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565363, "uuid": "3e978028-fae7-4c75-ba65-c57bfaccd469", "comment": "Malware payload (SilentBuilder)", "value": "adcdc8a032ac338a13907517f22f0194ce41b39d99305bd0c0340df871304585c360765bec2f8f8165ae106be0ef82bf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565363, "uuid": "766d7e74-4966-46f9-a08e-9c484d1f0e28", "value": "T110839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565363, "uuid": "23d61e50-cef5-45fa-8c2b-8ce05e8d39ee", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565363, "uuid": "67940756-8adb-4b27-b6e4-dca64090928a", "value": 86817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565363, "uuid": "6d593105-99ce-425e-a370-5824385c12c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565363, "uuid": "2906061b-f5e4-4979-a96d-4f2c4c206648", "value": "2022-1-28-0347112a10889c4503677cbf80deb3d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46b45a9-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562733, "uuid": "6defc02f-e281-4540-aa6a-54261d28e1a6", "comment": "Malware payload (SilentBuilder)", "value": "b286841d06f5ef2fc4714428cc3e9661", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562733, "uuid": "e4aa77f0-8a47-448d-b5a1-a77139a857c9", "comment": "Malware payload (SilentBuilder)", "value": "1dca0a81eef620d779edfac572ffbcbae0fd03f1e4ec7a6b72e11f7250ed7211", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562733, "uuid": "2b7cd960-88e4-42ad-b250-340142468925", "comment": "Malware payload (SilentBuilder)", "value": "d6f4190c9674416367dc0e878294cf072eff3f3b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562733, "uuid": "ab29c1b5-5641-4d2f-ae87-57cc4099080e", "comment": "Malware payload (SilentBuilder)", "value": "4a22802e57353392cce7352583d459a45a40ab427b38d89998891a5a9ab5fe34c2eec22f56f0d370aaaa11003872cc0d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562733, "uuid": "9759579e-f9b7-4fcf-a4c5-008cd818bcab", "value": "T171735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562733, "uuid": "5ff22f04-9a59-437d-bae6-13fcea00b728", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562733, "uuid": "e8feadad-62b2-4747-af0c-61070ed6764e", "value": 78353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562733, "uuid": "e6396f2d-1834-46a0-9749-288b3f65aa17", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562733, "uuid": "325dfa7c-7fec-45f1-80eb-9c1d66726e1f", "value": "2022-1-27-b286841d06f5ef2fc4714428cc3e9661.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e2d658-81e3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557452, "uuid": "e158f39d-dced-4587-8d5e-25a129e7f0ab", "comment": "Malware payload (SilentBuilder)", "value": "10f6ebc0021a8accbe6a700d216899b7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557452, "uuid": "f0d7e634-0b2c-4969-8c5a-7718ee1e4899", "comment": "Malware payload (SilentBuilder)", "value": "1deecaee9dab6fb611c802439a84d3811f415643cc997415400ca3911c1a5bfc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557452, "uuid": "36182702-2b83-4533-a2db-2071469e467d", "comment": "Malware payload (SilentBuilder)", "value": "6e1b2029c2af5cee511fbd8deeeb8032f39c2d88", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557452, "uuid": "7ae2c5b1-da11-4a68-b2aa-77d6aa0a306d", "comment": "Malware payload (SilentBuilder)", "value": "328aa49c4726a1f95d5676f5889d2e6d6b0e7e80d84b92d745ca492548d65e3e0edabbb97b7ff9cdd471143f7ea31f91", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557452, "uuid": "27d1199d-832b-4b62-833e-474fd5b362f1", "value": "T1E5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557452, "uuid": "adf4c5ed-525c-4ded-ac28-6db183f60df7", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557452, "uuid": "fb21fcc9-c090-4f03-b440-539573814d4d", "value": 78410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557452, "uuid": "22c4718e-ec8d-4243-acb8-ee987260ee56", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557452, "uuid": "4554044e-522f-4cb8-94f6-65f262a5d4e2", "value": "2022-1-27-10f6ebc0021a8accbe6a700d216899b7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478d6c1b-8198-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643525157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525157, "uuid": "9a1decf4-2b8e-45af-9751-6b4e399e5d60", "comment": "Malware payload (njrat)", "value": "ecfe447d1895357ce925bbe0a3619b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525157, "uuid": "dfd854e1-c72c-43ff-9ae0-0f6a20e7df38", "comment": "Malware payload (njrat)", "value": "1e55c31399aacc9290f92d5f269897a82c8674c3a5f2cdd67068cf54b4179269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525157, "uuid": "fc8bd805-e101-4f16-9105-be6c97d6e066", "comment": "Malware payload (njrat)", "value": "ac53f2f3394bc8be288cffb257481fd8357000a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525157, "uuid": "f23a0c92-1e28-4e57-bb51-8e112623564b", "comment": "Malware payload (njrat)", "value": "a237dac35ff762c5ed4c3899feedef291b2b3d078be9a39ea71cceb49c185a7a8daa3d17f454ba9311d308f79ae1c413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525157, "uuid": "e78792fe-9151-4d4f-9003-ebd50340b875", "value": "T18893F84977E82424E5BF56F39871B2404F34B5471602E79E48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525157, "uuid": "35de0c90-9f90-41e9-b9c2-e41b6909d902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525157, "uuid": "f98dcd83-bd94-49e5-a3de-b893c43b38d5", "value": "1536:ygv78lZc+/2HK1j+1zdljEwzGi1dD3DfgS:ygvoc+/2HK1WzdSi1d/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643525157, "uuid": "06c89569-7169-4bb0-8066-2a39800294db", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643525157, "uuid": "c12088c7-ffb5-4f41-bc1c-2e51c14d3a71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525157, "uuid": "9c99f931-c1f1-48c0-be55-d55740ef8d8a", "value": "1E55C31399AACC9290F92D5F269897A82C8674C3A5F2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1cad10-8209-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573913, "uuid": "ef6168e4-b84c-49a0-833e-613d42c5a0e8", "comment": "Malware payload (SilentBuilder)", "value": "371cde58696e31d84641d33c2720f54c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573913, "uuid": "79df0e80-b241-4ac5-9de2-177758601496", "comment": "Malware payload (SilentBuilder)", "value": "1e7027f8a0224e9229de6c53947d9ac278298a8cc31ceccdb21a4a5998898a27", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573913, "uuid": "2f84b843-399b-4438-95f5-a71d49a93299", "comment": "Malware payload (SilentBuilder)", "value": "9320892e3479a2a160130b434de95fd47cbb79db", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573913, "uuid": "cc6b419b-c52d-41ae-a0b9-be9b4afc1e8b", "comment": "Malware payload (SilentBuilder)", "value": "df4f3d61d5ace35b965ff4205494bb033881bb5aaf2f54bf13b76387280f67fd66e047a7c17ce794ae6d7331f836cad2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573913, "uuid": "21703f5b-9135-4d29-9624-f602314b8ce1", "value": "T120934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573913, "uuid": "7eaf70f7-27b1-42cd-810b-1a6955c5c25d", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573913, "uuid": "ef9b3eec-85d0-446e-80fa-d93b0abf03e7", "value": 92976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573913, "uuid": "721375fd-dbf7-4d11-825e-57beb7141f30", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573913, "uuid": "c313dd5d-5294-4b2f-b938-60a930793667", "value": "2022-1-29-371cde58696e31d84641d33c2720f54c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990e8d56-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558795, "uuid": "91d4eb5b-4d47-47dd-bc9f-8ec2b52a78dc", "comment": "Malware payload (Heodo)", "value": "f1e9d0ae1673f499318060f8dd9b1fa8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558795, "uuid": "74f603a7-e110-4fd3-8f1b-30082927c8ad", "comment": "Malware payload (Heodo)", "value": "1e772cf172997a0354cb86d07d61cdf8f42698b44516ae22b85f66c141039813", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558795, "uuid": "838bd622-8de1-4a1c-888e-1836a36a9e6c", "comment": "Malware payload (Heodo)", "value": "242e297efe0ec567879c94b327716d015b049b78", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558795, "uuid": "ecfe1525-b8d4-4eb8-a3df-385a273bdf80", "comment": "Malware payload (Heodo)", "value": "01ecfde6140747bb68333bf85fb1890212832c336eff56016e55c17e8b64ffeff8f04adb51ac1dcc2ec4ad930aeb564f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558795, "uuid": "e55c80ae-53a8-4357-bdae-71fc606173b9", "value": "T1E8E3596576B5C9F6D60403B10AD2CAFA2327FC739E5603E33198B31E1FB91509AC26C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558795, "uuid": "63158763-4f86-4c66-9b3f-2321be02187a", "value": "3072:f7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIKGxZ:jcKoSsxzNDZLDZjlbR868O8K0c03D38W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558795, "uuid": "90283412-ad4c-47f3-a5c2-2e3ce38f41c2", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558795, "uuid": "973da94f-4090-49c4-8fb7-04fc09f30a5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558795, "uuid": "24eabab9-bff1-4a08-b285-26500b81eefb", "value": "2022-1-26-f1e9d0ae1673f499318060f8dd9b1fa8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a53cf61-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1643560810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560810, "uuid": "5f853d25-56ad-400a-b6e6-36f973c7fb18", "comment": "Malware payload (Gafgyt)", "value": "b012dd4bbc206a7494bec8dd13434a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560810, "uuid": "074f017b-ed0a-44d5-b92d-b2a4d81e88b2", "comment": "Malware payload (Gafgyt)", "value": "1e7ee453c3f0149856da913525d7cbbf1fbe0e497898e6aeafbb9386ed38f8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560810, "uuid": "e22eb50e-34a0-4495-b396-d1e7d41ab8e5", "comment": "Malware payload (Gafgyt)", "value": "533e8f4a6a7b85a7cb7a6ba040b859bb497245eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560810, "uuid": "f14b57ef-6d98-4a8f-985f-43e89c10bdcb", "comment": "Malware payload (Gafgyt)", "value": "105ced77859b4476897572ea6ac258bdec7404397dd49c3dd3aa2258d8af8759c8de0c232f127968282ca7e309f7f5f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560810, "uuid": "badeb7cb-c5d8-43b9-ba42-acf2bcd5eaab", "value": "T178632A026741CAB3D0831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560810, "uuid": "c655b10c-4b95-4389-919a-aa1d0d24fc36", "value": "1536:RRVYPCNH1jUdOn4JymPWBSgSh1MtNkr/NbHBDSDmd+l2OZ/fufYEZ:RRUCNH1gdikrEHM1IirVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560810, "uuid": "a7a922b9-cfbb-4455-b25e-6388bbb26293", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560810, "uuid": "578f26fb-2ca4-4368-a909-ac90849e0157", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560810, "uuid": "b47c954c-af15-493a-8b5c-b40315d78d4f", "value": "Demon.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8985d44-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560109, "uuid": "2262adc9-127f-4232-8308-1b71e31b287b", "comment": "Malware payload (SilentBuilder)", "value": "8739757f9a12b4a3a8a461c185c96fd8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560109, "uuid": "552089e4-4f39-4fe6-b748-62a9338b3f8e", "comment": "Malware payload (SilentBuilder)", "value": "1ebe5100e49b1c5cad51fa15ecfe9711c5e6421e4e53c07ad9f4ef3e4ce9cbb5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560109, "uuid": "74d354ae-6054-4180-b305-20d25ee634cd", "comment": "Malware payload (SilentBuilder)", "value": "baf799b81d50807adb05eff8a619a1dda2e4563e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560109, "uuid": "1aaa4bec-7895-48f3-9d62-c299d3636748", "comment": "Malware payload (SilentBuilder)", "value": "d8f860a6d02df9d514c24eef0621d76d93b47aff135a9a9276a35b02b52ae9d4688605f1e5fdc106aadd311fafab9744", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560109, "uuid": "4fddcd42-831d-4476-8337-b00f0f436974", "value": "T1B8F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560109, "uuid": "389e43bb-ce29-4840-bf83-c6586f4203b6", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560109, "uuid": "6f6871d6-881b-482e-9d8f-110cf4ce0c9e", "value": 158809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560109, "uuid": "ae86127d-32e3-426c-be21-c690f2c60a7c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560109, "uuid": "5f173098-ab57-433e-80a8-1586702c7b6f", "value": "2022-1-28-8739757f9a12b4a3a8a461c185c96fd8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b94a184-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572758, "uuid": "e46f2349-61c0-4e04-8322-2abdc1dffda0", "comment": "Malware payload (SilentBuilder)", "value": "f6ab863c048c22322acb25a77558e344", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572758, "uuid": "fc67714d-b675-4aa5-887d-7e644d432e50", "comment": "Malware payload (SilentBuilder)", "value": "1ec3dfd98e20f54dfbfd95853a70e67cb2b505e706345eceb8281810e9f2835a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572758, "uuid": "677d6c91-24fc-43b5-a12c-7a1afdd03c13", "comment": "Malware payload (SilentBuilder)", "value": "417ab1a98014cf80c398607d4f73a92fdaa3f2ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572758, "uuid": "05de9782-74cb-4b2d-9629-82981739389e", "comment": "Malware payload (SilentBuilder)", "value": "27857077d8e156a945d96f346c93c43701e3218892047988d04088d38217e2fb5b46b33c80f8d05af0ea37c40ea70b10", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572758, "uuid": "88805cb7-7df0-448e-811e-fcd7646daff8", "value": "T1D5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572758, "uuid": "8c00cb09-0b52-4bfc-9caa-c81459e2e7e6", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572758, "uuid": "3d0af0a5-efc5-482e-bae1-4e4541b6667e", "value": 48417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572758, "uuid": "4f9ac2bf-51b7-45df-8666-ce8faad67d24", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572758, "uuid": "206b0d72-c4a0-4116-9897-215e16f1b16f", "value": "2022-1-28-f6ab863c048c22322acb25a77558e344.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f97ddc-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559271, "uuid": "da52614d-2b8d-4eef-9348-a815e98a029e", "comment": "Malware payload (SilentBuilder)", "value": "4402d1f90aa009e7d519672a8d2edb51", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559271, "uuid": "ba3a3f88-bc2d-496c-beae-757846fea0a4", "comment": "Malware payload (SilentBuilder)", "value": "1effbf14fde0089a76191676c3055f933a55062930126f74d59d922e4c5a2f0a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559271, "uuid": "d4e7f000-bc3e-4479-a207-4548a05f316d", "comment": "Malware payload (SilentBuilder)", "value": "8394baa3d846d968471a30e5559253afe558ef50", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559271, "uuid": "61e5cbbf-571f-4ad2-8e2b-d303e41fe3d3", "comment": "Malware payload (SilentBuilder)", "value": "d8a802f6cb43f9aa5e9f8b530f710325c60eb8be52506299b1171969da09ab37fedee4bffe8a432948752e766e16dd49", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559271, "uuid": "3318edf9-e9ea-4664-bf3c-4c9ec098013d", "value": "T147735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559271, "uuid": "b0a261c6-7f2a-40eb-a15a-8c8a55a688af", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559271, "uuid": "6fedf4c2-fb5e-461b-89cc-9327dfdecedd", "value": 77476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559271, "uuid": "b5a34a9c-4b48-4852-92c8-2d1a586adced", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559271, "uuid": "8e9be18e-8c47-41a0-987a-41798f5fc2b9", "value": "2022-1-27-4402d1f90aa009e7d519672a8d2edb51.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ecb3d7-817f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643514605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643514605, "uuid": "eaf32c43-26b2-4a7a-b77b-42d2d7e71e19", "comment": "Malware payload (Mirai)", "value": "1c59fbdb333fa9261351bb75f0028666", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643514605, "uuid": "988f4fa9-e78f-4585-9a44-27bb77ebb149", "comment": "Malware payload (Mirai)", "value": "1f0e528d919d09f290e89e56920960c67a17a6a57ad82a058d1fce45a7247934", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643514605, "uuid": "424c3d09-f06b-4256-a04b-33b0b941fcf7", "comment": "Malware payload (Mirai)", "value": "cf782018279952789ebedcdf4941834ee70e2253", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643514605, "uuid": "823412d5-679f-42d3-8a0a-909a3684ff6c", "comment": "Malware payload (Mirai)", "value": "e2b331b4df9ff8b452f2f668b17fbd47831dd68213967d2597469792a2bf2f7fa6e3d15fe7d1c99b484d1d55c345516c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643514605, "uuid": "9cf9ad70-d655-46ca-94b2-56128d9807f5", "value": "T17433F1518A0DB8D7CE300FB5E83994D87F8F67F8C9BF243247E427A5109931526B5689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643514605, "uuid": "495e93fe-29c0-4be3-906a-98bd43c55c57", "value": "1536:1wJuVXWgnH0PnL5x5SPgaM0zLVvWKO4U7BBSiFSW4c:OJuWuinLhwM0zLTO4U7HSNfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643514605, "uuid": "6f2c0643-bb4f-4468-abf5-31f0e639ce21", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643514605, "uuid": "a4a81363-15c4-49a6-8633-7e005b8ecbb5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643514605, "uuid": "a3afb4e4-4279-4bc4-8385-5f7a9591c4e3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cde35f1-81f1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563499, "uuid": "8cc08262-1d07-487b-85a8-76b552e92501", "comment": "Malware payload (SilentBuilder)", "value": "ccbf403b5466f5c1703107fbef37a6a5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563499, "uuid": "280503f0-6349-4223-939a-ba3dd7565832", "comment": "Malware payload (SilentBuilder)", "value": "1f0f73465483bf21c39613f43fe280fdf58b44cd2b446ed831df8a9b1b23e8ec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563499, "uuid": "fcc392fa-8789-4be5-b208-5fdbe6fc6ea9", "comment": "Malware payload (SilentBuilder)", "value": "910e26bf27c6765dab5b7c53fc4e5ccfbf958077", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563499, "uuid": "4cdb4034-a806-4ac4-b7d2-5d582a941992", "comment": "Malware payload (SilentBuilder)", "value": "cdec152edfe94a42005cd5e8d34e39d858219ddd068a56b056a490cdda031974d94c18e15bd3af514c548be482be5bf1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563499, "uuid": "598035a6-aed2-47e2-957e-f16b85106e02", "value": "T1B2735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563499, "uuid": "41dcea61-56f1-4bd1-9cbe-71daa21caac0", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563499, "uuid": "1cc4ac77-f1ef-4381-b93a-faf46154274c", "value": 78245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563499, "uuid": "88890363-5545-474d-909c-7d0a7b1cb423", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563499, "uuid": "61341260-c9ce-483a-aae3-60365888b639", "value": "2022-1-27-ccbf403b5466f5c1703107fbef37a6a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c3a93d-8209-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573936, "uuid": "24d7d6ce-acc6-4245-9562-8ae54b609171", "comment": "Malware payload (SilentBuilder)", "value": "3803ad2b124c3d3e8cfb9a3073cc5f2c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573936, "uuid": "eb0b1695-d907-405f-b78b-d8e66e139940", "comment": "Malware payload (SilentBuilder)", "value": "1f0ff744e05569398668ab360829cac774417466bf71a7bfbb3dee9813b3afac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573936, "uuid": "a053fa54-e113-4354-8e50-68454099441d", "comment": "Malware payload (SilentBuilder)", "value": "86cb87fb38efb13b7d482ee39ab77e7017880d2f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573936, "uuid": "368f53d0-d3eb-4036-8356-db28e8cc5f82", "comment": "Malware payload (SilentBuilder)", "value": "5047c7394653c81977d5e111665a60d33e94d4fbf03e63dd291cd5988f515b153cb2cf6fda3de68694dcd64ae7e0d22e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573936, "uuid": "b7111c42-86fb-4d4c-bfc2-6621e470ba8f", "value": "T123934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573936, "uuid": "4b8ae7a9-882c-4ff9-993e-47c98dc782af", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573936, "uuid": "c03eb9e8-c9e0-40b7-8bc7-3ce11cea1965", "value": 93021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573936, "uuid": "502a31e7-f8ae-421c-b555-4d5dd3dc821d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573936, "uuid": "6b5057d3-54d6-48ce-85b4-5783919424f3", "value": "2022-1-29-3803ad2b124c3d3e8cfb9a3073cc5f2c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a30585-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574034, "uuid": "32470e48-86ec-4d14-8739-e24adc25f65e", "comment": "Malware payload (SilentBuilder)", "value": "47efb01194904403fc6b8b547c90abfb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574034, "uuid": "22a9ac81-86f6-4429-9bd4-627e37fd55e2", "comment": "Malware payload (SilentBuilder)", "value": "1f9330f2a53c001916c75063b5b6e2f4c46cd803c135aded9b876b0a4b602fec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574034, "uuid": "681e5df5-2ba9-40fc-b14f-ea92678c7ad7", "comment": "Malware payload (SilentBuilder)", "value": "27d0c865f2d966b0df730a7ac526df9be1ee8816", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574034, "uuid": "4e5785e7-13ba-4e33-8fd1-d06e0f6d8baa", "comment": "Malware payload (SilentBuilder)", "value": "4d828343ba6c548f4fff54a2dfbd794294172ce17943683af5756687f3f94b79d4c2033de187bcecf10492e3e65fed2d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574034, "uuid": "838d9880-4c53-4f6f-b0fd-55a5e2371c99", "value": "T1AE934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574034, "uuid": "4040c77f-26ed-4276-a7dc-277c4bfa0575", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574034, "uuid": "7f33db9d-34c4-439a-923b-3cd74dda3b99", "value": 92807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574034, "uuid": "0db808a2-aca1-40cc-ab6d-8a7fc02e4ef4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574034, "uuid": "6552f730-dfcc-4a17-8e84-fb71fe18e805", "value": "2022-1-29-47efb01194904403fc6b8b547c90abfb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c276a6d5-820c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643575185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575185, "uuid": "53ae7614-1fe9-4469-b5c8-e17c0e18bbb0", "comment": "Malware payload", "value": "9c6719268cd450a3e0048c2c4f8bcdf0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575185, "uuid": "ed087a07-fcdf-460e-9347-76883fe5a762", "comment": "Malware payload", "value": "1fa9acdd1426113d7bd9bee6c8bab8845b58553c34a8cbd639700dbb962c316d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575185, "uuid": "1303c034-4444-4e6f-a7dc-80fa92aaadd9", "comment": "Malware payload", "value": "a32b34e4e4a6b18195b5a56cc7084658f8189ff4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575185, "uuid": "86dfffff-12a2-4afb-afce-ba43d922ffa4", "comment": "Malware payload", "value": "7643f60d8faed5adc7005c9726e3c963c6c7bb0849d93ed3bdba0f3abfb56e3b0712df42236d25e7ed776acd5014b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575185, "uuid": "7b2b1123-2293-459e-82a2-490007865745", "value": "T15E934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575185, "uuid": "2166b28b-8928-4871-be45-cc59207e5b28", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575185, "uuid": "409db489-391c-4747-ae5a-42204bc13b92", "value": 93251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575185, "uuid": "47bc52b4-7396-4334-aa6c-7aa142c4dc22", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575185, "uuid": "d18beb08-9367-4964-a42a-af7d5f3be1eb", "value": "2022-1-29-9c6719268cd450a3e0048c2c4f8bcdf0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4463c6a3-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643556076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556076, "uuid": "49fad374-3731-4a00-92c5-0e9c007e0a86", "comment": "Malware payload (Heodo)", "value": "15b4a489f4f6bc5e48c7899401f21683", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556076, "uuid": "29644680-68d2-41ac-b338-b27db2ad7587", "comment": "Malware payload (Heodo)", "value": "1fdb97705302ed871764287760bb02e5037c4cd63bf7bd80bd77fc261c55fdb8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556076, "uuid": "a5eb71b4-8006-443d-a18b-3540d6ea2fa8", "comment": "Malware payload (Heodo)", "value": "517e84d350241c4a6ed3d4993a1376cb6a082776", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556076, "uuid": "0524f778-599c-4eb7-9f17-5438b679ef9a", "comment": "Malware payload (Heodo)", "value": "d9158d9cb51d3f45746b29a1329cb249cdc669506d70301645cccd4d8494ac401ca50ab3f9134cccf22eaedee183711b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556076, "uuid": "8e63b2d0-6adf-44ee-9869-29bd87543c22", "value": "T125E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556076, "uuid": "eb02b413-905a-4928-98b6-809a7ceee758", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556076, "uuid": "1614b7d1-4334-4a0c-905f-2ad4a749684d", "value": 145760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556076, "uuid": "a8704807-a722-41fe-acf3-2efdf7313ba9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556076, "uuid": "4f7b2743-81f6-4755-ba07-743bd4f108b9", "value": "2022-1-26-15b4a489f4f6bc5e48c7899401f21683.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111be4a9-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643569304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569304, "uuid": "ec609424-e7f5-49f2-8f3f-9637db4098c7", "comment": "Malware payload", "value": "84926bfcb974dec17d6d2d88508e64c1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569304, "uuid": "cad75de1-1e07-4697-92e9-69b9cad6e0ee", "comment": "Malware payload", "value": "1fed0f162277cfeccd9c2e634700bc9befd67d88ae3fa952562ccdd63171b7be", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569304, "uuid": "21d1b0e8-93e5-4989-8633-f027494b67f6", "comment": "Malware payload", "value": "59568e11853d33ee7355cc06a447383029c9f417", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569304, "uuid": "e5ad7abf-9f39-4206-a539-ce5d02133d1f", "comment": "Malware payload", "value": "0bcf4b1cad5749a853ea5d084dcea813f8ddb2c31473ad3579ab56ef6063aded6fb78b35b082e6f952965d9adbb36ac8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569304, "uuid": "86553c7d-ca39-4833-9e30-0b7d770e61ff", "value": "T18C839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569304, "uuid": "bcd2b8a2-fd8c-4500-a151-3951724e26ac", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569304, "uuid": "a9e58ee6-8b68-4aea-9103-40443ea4d914", "value": 87041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569304, "uuid": "f14ea8d6-783f-487a-94a4-bc0dbbd87d7e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569304, "uuid": "28eb0e2b-a478-4746-abcd-41e8a5bc26e0", "value": "2022-1-28-84926bfcb974dec17d6d2d88508e64c1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa84bc10-815f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643500842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500842, "uuid": "e70b4750-1b85-4748-92a3-40bcbd03805a", "comment": "Malware payload (Heodo)", "value": "abb4ecd3f954660748b4bbf17d0d2241", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500842, "uuid": "495ee46b-df9f-4deb-b5e6-6dbf31f64157", "comment": "Malware payload (Heodo)", "value": "1fef1f9f5b2506677f7410b0b3d74394dc59b29993deb3dad1f2429031157548", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500842, "uuid": "75cb538f-8fcd-40e5-bdc9-f06dd5d35c39", "comment": "Malware payload (Heodo)", "value": "e6365d345e672bbb884b2d4f90e5f90dd5666f08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643500842, "uuid": "ac6c4be2-f9c6-418d-9704-620e1f9b6b67", "comment": "Malware payload (Heodo)", "value": "7fd58b7a982519377fcf5ad051af1d6ef5bd355cc1707136dadc270540db9e0beee1cc0295ebce3ff25fdc029cc6a377", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500842, "uuid": "c8bb8bd5-7819-4552-a7f0-dc31d301775e", "value": "T189C49E3D72A0A435C27A34F535F9A3B785AFBC524B29429BE7FC212B1E3D5414A3460B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500842, "uuid": "8c37df7f-9675-4e8b-8060-c7a0db686ce2", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500842, "uuid": "a420f574-ee5e-439f-a93e-ce210c54805d", "value": "12288:G5Yfb6SGkFIPbKq1r263Q6DraMA0ZaC87:GK21kFIPT26DD2MD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643500842, "uuid": "2a143c53-b7ec-48fe-87e4-43ec1bb068ff", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643500842, "uuid": "73af0b95-7d5a-4caa-88ac-b3fdf55b6455", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643500842, "uuid": "8bb38a39-7dd2-460e-a304-08f735d116a6", "value": "emotet_exe_e5_1fef1f9f5b2506677f7410b0b3d74394dc59b29993deb3dad1f2429031157548_2022-01-30__000035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1465c84-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643561385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561385, "uuid": "d5a77d7a-89bd-453c-aa2d-f50d0e20a604", "comment": "Malware payload (Heodo)", "value": "80f0d938086317a4519ce4e25101df8f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561385, "uuid": "aa79c5da-8cd0-4209-bce1-88cac4c8a00c", "comment": "Malware payload (Heodo)", "value": "200e1235cb1176470caa731ef16f04a4394df648f51fd523a97ceb6f6d375998", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561385, "uuid": "dfc88434-10f7-4386-bc1e-dde3cfd56bf0", "comment": "Malware payload (Heodo)", "value": "49345818942dcc049325c8fe0d3f301c51803e05", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561385, "uuid": "53bbae74-45ea-4a88-b8dd-cbe27735b16d", "comment": "Malware payload (Heodo)", "value": "33eacdb9555f0be82102a58b1b8bac1f247eb3d308cba00d33f20389d7db4d4f42977c0773442be7a71b5b009fe675ca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561385, "uuid": "85944d6c-3f66-4a28-8481-75a397b3273b", "value": "T147735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561385, "uuid": "ecd430ec-ac2c-401a-b6c6-19f6a4d64f5a", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561385, "uuid": "58d3dfc5-9723-44af-a067-94dcc5d22f71", "value": 77896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561385, "uuid": "814bfd2e-33be-4a25-a98f-7a00aab4fdd5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561385, "uuid": "b2f049d5-4326-43b8-b496-c91abe8f9933", "value": "2022-1-27-80f0d938086317a4519ce4e25101df8f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4948ae-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569730, "uuid": "031cf2c6-c745-46eb-868c-c9a171e2924b", "comment": "Malware payload (SilentBuilder)", "value": "977d196c4bbe339e8b43d71427532d2f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569730, "uuid": "8f3cb2e1-3182-497d-918e-955c11b37a9d", "comment": "Malware payload (SilentBuilder)", "value": "20192b3448e1d7af4e55696aeebc21d8d68046a129b0d2f4c777fba67ba9b78c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569730, "uuid": "a8c08f45-9693-46d2-b9cf-be946c9d4eae", "comment": "Malware payload (SilentBuilder)", "value": "003bc4340d0eb0d18b67df8c40bd89888d5a832d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569730, "uuid": "8dbabe96-051a-4cf4-83f1-68b68b4d24f2", "comment": "Malware payload (SilentBuilder)", "value": "67450c909deb29a122a76c7f3ff74a9fe23c4a4a2f861c6dc0da597e15d2c5b8e4e97cea1f464faf479c626d5068fbe4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569730, "uuid": "f930d97c-0942-4d5f-8b90-23266bf372d0", "value": "T170F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569730, "uuid": "43b68096-8bad-4a48-8e2a-46bfe6d6d31d", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569730, "uuid": "b19dcc1f-2b90-4623-9e70-b8d8f12411c1", "value": 158608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569730, "uuid": "5c4de70f-c57e-46a1-9668-7d760573ab4d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569730, "uuid": "0b729d04-02cd-4cec-a097-4c852136763d", "value": "2022-1-28-977d196c4bbe339e8b43d71427532d2f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e625d0-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568966, "uuid": "ca0abbfc-74ca-40c3-9411-df40dbb3dbb4", "comment": "Malware payload (SilentBuilder)", "value": "7a0743fd0384a8f6dc017a88e90c8840", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568966, "uuid": "bd095056-846d-4543-a28b-565dd464ec53", "comment": "Malware payload (SilentBuilder)", "value": "203d114cc2ce10aa8e253aa7bae1af145037a6aed50583d9027ca863cbdbdd75", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568966, "uuid": "3acaf247-1040-4678-898b-29f7597b7b6a", "comment": "Malware payload (SilentBuilder)", "value": "fccc67231f25f727405f87d28d1f4384fb851cf0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568966, "uuid": "3abefb2e-f42a-4f9b-9141-9b4023159f48", "comment": "Malware payload (SilentBuilder)", "value": "4814891c9350c3084f5da6c1705c7c34478b165cb34530d69e911a661a27820922f4558f2264230dc583ca7ec8510852", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568966, "uuid": "3093dac6-9586-4c60-8209-5979cb9e7e8c", "value": "T12B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568966, "uuid": "1d2a224b-b1f0-4bf2-8bfa-d23c590ed9ac", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568966, "uuid": "efdfbf53-073b-4851-b8d8-e8814a81ce39", "value": 48120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568966, "uuid": "bcba1008-9a9a-4bea-adea-eb32e09abdcc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568966, "uuid": "58aac8a9-e12a-4b08-bf38-a1c93dd6f6d2", "value": "2022-1-28-7a0743fd0384a8f6dc017a88e90c8840.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb414848-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561026, "uuid": "029b86a1-1fee-47eb-bbe7-37fccea4832d", "comment": "Malware payload (SilentBuilder)", "value": "760e613d898bcb697f634c0186fb59be", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561026, "uuid": "d0a57e2d-d1a3-4091-97c0-f9c06159384f", "comment": "Malware payload (SilentBuilder)", "value": "204d9ac99e89bb18ad031fcd06c27e631db055b6f6d249a9984335aa8793cf16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561026, "uuid": "f775499d-aca5-4c5a-a9a9-329301f54835", "comment": "Malware payload (SilentBuilder)", "value": "ec39984ffbaa7239f12f24283b92a14083e14eb1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561026, "uuid": "c50aaa8d-bc36-4620-b1ee-ef1c366be659", "comment": "Malware payload (SilentBuilder)", "value": "6c495bc40d9bac7639704551fb9df01a2c826d81acd481d0b1e9b69f1f7ea297a1f1c4f7ac2d876957ef2ddd5dec1f0d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561026, "uuid": "9723aefe-c1e0-490f-8105-fdc73db7205f", "value": "T17A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561026, "uuid": "ae1af233-6e1d-4eab-a604-7eb3b8da6d33", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561026, "uuid": "7a668ae4-c84a-4d1b-8c7a-65235d41f0ce", "value": 78025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561026, "uuid": "bc9b7033-f008-4c92-a762-7409a3dc1c5c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561026, "uuid": "d6fbc612-e45e-4598-950a-fe3855fe741e", "value": "2022-1-27-760e613d898bcb697f634c0186fb59be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315ca937-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575801, "uuid": "d24381c8-1b80-4d8d-9692-dd4c05f16048", "comment": "Malware payload (SilentBuilder)", "value": "cc5a37c84e8942a6e617b254b5057ad0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575801, "uuid": "76eb70e5-5316-4b52-8cf4-5984359b24a2", "comment": "Malware payload (SilentBuilder)", "value": "2076e909086aaeab6287a2be8b21e8e6bbaafd533c0daa221908c44184368766", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575801, "uuid": "40b4e093-5c84-449c-ab17-c494cf2c484a", "comment": "Malware payload (SilentBuilder)", "value": "86bb6c9a385cc37d3b6a32a67621cbb5b253cbfb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575801, "uuid": "c5c42b28-027a-468a-a39f-caf6ea05cd3d", "comment": "Malware payload (SilentBuilder)", "value": "c572779f4842a7fc7fefa21967dc4287c6b2ffc0667b559075fb52f5cc3212800a5066b20e7d10306c96788a91361040", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575801, "uuid": "d547e44d-81ec-4360-bf36-beb81d7e32d4", "value": "T196839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575801, "uuid": "284e1e6d-f829-4570-ac44-71b07f24a377", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575801, "uuid": "eaac2541-a61f-41b3-ace6-c163285961e9", "value": 87479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575801, "uuid": "c465cb62-9f2e-47f2-81f5-e43e571e680f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575801, "uuid": "3b5a3bdc-a596-4eb0-9776-49cddf497a93", "value": "2022-1-29-cc5a37c84e8942a6e617b254b5057ad0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ad533b-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643561552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561552, "uuid": "e2c914c8-c0a3-4f4f-8fa0-1821df98def6", "comment": "Malware payload (Heodo)", "value": "88e0080ec1c7b825cd4345d3cd9d9e52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561552, "uuid": "bd816d4b-d101-4c60-aca3-79db3f2b282a", "comment": "Malware payload (Heodo)", "value": "2082cd46e93843ef79301d84b78e2fa674030a715dec9e337400008eb2f9e153", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561552, "uuid": "32367e0e-d683-4598-afb4-9775d27e9a83", "comment": "Malware payload (Heodo)", "value": "288dbb05b2ed0a3e573a116f6e04551e52cb02a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561552, "uuid": "2a14bd45-a211-45c6-b69f-a7ac83bde843", "comment": "Malware payload (Heodo)", "value": "f7705f446b90af385fbc69b4f92514e5ad31bc608641149bd201375994f8f84244d50ced56f0f9aa87c61d42e7995ccc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561552, "uuid": "c2bab0f5-a5bf-478c-ba46-8f2091c27e4d", "value": "T10B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561552, "uuid": "bd4102c9-dea6-4298-a6b4-7ad919c8fe0b", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561552, "uuid": "94d8066e-7a99-47a2-823a-fc6fd4487118", "value": 78121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561552, "uuid": "cd2497b8-13b1-4290-94fb-5abb9b8ae897", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561552, "uuid": "229e4397-ae36-4dc7-85b4-6ab349266e3e", "value": "2022-1-27-88e0080ec1c7b825cd4345d3cd9d9e52.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51e9bcc-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575995, "uuid": "65322495-6d9f-4138-8adf-34f20672087b", "comment": "Malware payload (SilentBuilder)", "value": "d95f073ee33d3760e7ab272576fca197", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575995, "uuid": "feb42eb1-6236-4f93-90b3-59a5d4851c85", "comment": "Malware payload (SilentBuilder)", "value": "2094b6f638d13158119b43475f1010c08dfda3741b4dfd312f9e153e96d1281f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575995, "uuid": "8defa5ba-fa70-4f8b-a353-f1e112a1f1ef", "comment": "Malware payload (SilentBuilder)", "value": "123b94a24c032e946a3033433a89b7f95b0b406e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575995, "uuid": "e27c1e7b-f3b4-41e6-a88e-f664aa66ea2e", "comment": "Malware payload (SilentBuilder)", "value": "d44a1b23035e1a0c8a23da4a68fa55d04e603bc8ccc4f7add58b356c67d24996a7fd4bb69a647097a30636ee61cedd47", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575995, "uuid": "9ecf5efe-219c-4526-aa8d-7d776ae95b99", "value": "T1D9839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575995, "uuid": "18964834-3bf0-46f3-9a92-8bf5a762dd56", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575995, "uuid": "2d8407b7-a549-442a-b4db-782ab047f03b", "value": 87107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575995, "uuid": "58d568f2-f592-43f8-8eb8-bc169e9562ed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575995, "uuid": "bfc83304-ca54-42b7-982d-5e712a9b69ee", "value": "2022-1-29-d95f073ee33d3760e7ab272576fca197.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586ba023-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559116, "uuid": "dd21df7c-1d7a-4d27-b291-5806d37f4f0f", "comment": "Malware payload (SilentBuilder)", "value": "3f6d03b45246aa287bd8041c394b0e7e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559116, "uuid": "8771bb76-6744-409b-a94d-c83ae05d73b2", "comment": "Malware payload (SilentBuilder)", "value": "209a39656f13f212f35b05527310d01078b472f61a1b8c5e8d6416cc7816d485", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559116, "uuid": "4d6683d3-0d5a-48a7-8c33-b6358685623f", "comment": "Malware payload (SilentBuilder)", "value": "e4a49f41f230bc8a545e6cec353ee2ba7dd82d8f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559116, "uuid": "769eb4a6-d9f6-4bf4-a681-503a9b4b9211", "comment": "Malware payload (SilentBuilder)", "value": "b2dee44cc1d0c84b16a8253924c792e261af9eedb490fc13c348078aa58d55f743b11d2734bcb914d43a99af5226b68d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559116, "uuid": "f2324187-a894-4e23-9c2b-8d84f6a6a779", "value": "T1E5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559116, "uuid": "22562967-da7b-4f7b-be87-44374a9ca34d", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559116, "uuid": "178c9ef2-dfd4-48c5-9699-3091ea5958fc", "value": 78290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559116, "uuid": "0059541c-c5d9-4069-9fea-0b010c665a12", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559116, "uuid": "77758669-95a6-44a4-a9a5-0b093d039b3b", "value": "2022-1-27-3f6d03b45246aa287bd8041c394b0e7e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deda4cca-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570508, "uuid": "09466aa8-f1b6-4301-92d4-394a89e73e34", "comment": "Malware payload (SilentBuilder)", "value": "afc6b1c5486365c5d5f065e565758d51", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570508, "uuid": "377de2c5-71f0-4ef9-8008-491e9a7c4408", "comment": "Malware payload (SilentBuilder)", "value": "20a240a8f76bb30db5ffc5823338e7e07cef874ee70224808aac4023b9e1ba08", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570508, "uuid": "448430a3-b238-47f4-9a20-023e9ea948b2", "comment": "Malware payload (SilentBuilder)", "value": "fab77ba5016670e56fd0ca199b55eae81d8beaad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570508, "uuid": "3edea96f-6a66-411d-8b9d-353b96353819", "comment": "Malware payload (SilentBuilder)", "value": "96101e1811dd1920c870261ef2b1dc1e9cc1b7a6a7a37ed484515f969a29da2c8847a2c586d98e9c5d14859b02f40256", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570508, "uuid": "201dc25d-4f61-4ab8-87b7-6c7aa7e69841", "value": "T120F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570508, "uuid": "f241d544-7e2a-4dea-91f0-faeb47da10b4", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570508, "uuid": "52738e5c-ed6e-4d53-9986-26e664799a27", "value": 158741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570508, "uuid": "21593d79-07a3-4f0b-87dc-4baa18926998", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570508, "uuid": "13d6346c-3dff-4f97-ad6f-65638c619c62", "value": "2022-1-28-afc6b1c5486365c5d5f065e565758d51.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6602f8-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561805, "uuid": "30addd60-8f7d-4221-9562-be147980f4cc", "comment": "Malware payload (SilentBuilder)", "value": "927e4de8c28c86366c7de9292ec6cd0b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561805, "uuid": "860ef267-a034-4896-b78f-dd19ca44830d", "comment": "Malware payload (SilentBuilder)", "value": "20b6b1cb8e0a72f199167a1e8a1285e79fdf0ec94aad33f8d67ca5633e2c88ea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561805, "uuid": "09baf567-4aab-4c0b-9c14-c87bae6eedcb", "comment": "Malware payload (SilentBuilder)", "value": "9fc2b2ebe876aafc78d4b473a687a9071a152d65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561805, "uuid": "dd4f8479-41a1-4700-a6cb-6b9053103a16", "comment": "Malware payload (SilentBuilder)", "value": "7242bcb584852066f5df182313e65742e5eb7414525f2a8812aadea6a75111722f15fcc3527374304612d32663dc9c86", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561805, "uuid": "d3595023-cc6f-46ae-8b4b-e483f031bf5b", "value": "T17C735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561805, "uuid": "e5a8372f-d2c8-461c-a575-ddc349b380b8", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561805, "uuid": "e552bce1-2145-45f2-8ce2-4ebd7cf36c00", "value": 77940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561805, "uuid": "3a53dac6-8d92-483d-a76a-844fbc630413", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561805, "uuid": "5998c0a2-83dc-4f9b-96d2-00497205bf13", "value": "2022-1-27-927e4de8c28c86366c7de9292ec6cd0b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99c8c46-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643571734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571734, "uuid": "a788e7ca-7911-46f5-a386-ed783b70e3e9", "comment": "Malware payload (Heodo)", "value": "d639280c6f28848f99a256e0ff7dfc9b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571734, "uuid": "88d198a8-961c-499f-9f2a-067c9abdc218", "comment": "Malware payload (Heodo)", "value": "20be7b7387a9681a624754dc43a6f05c4184c957df5975fab8ae83bac591dfb4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571734, "uuid": "6794c437-4364-4756-a8c4-8045e040b8be", "comment": "Malware payload (Heodo)", "value": "fc473d0cab40d31245275e298f7e9d894c7d8db7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571734, "uuid": "0823ade7-7d83-481e-aa39-ce4deed19337", "comment": "Malware payload (Heodo)", "value": "f6ba4de1a26e8d1f3af8bb355936a82021658ec476d3683e769235034f5792a2693b8487457e106d2eba217c954c75eb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571734, "uuid": "fba597de-a7aa-4d6c-812b-91004b5b6948", "value": "T1B8F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571734, "uuid": "00f364d7-a985-482c-9881-fa5038e72992", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571734, "uuid": "87c65e92-bacf-47fd-aac1-1c0b17cbc6ed", "value": 158664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571734, "uuid": "a02f47d8-4091-470c-8db0-5198da2529cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571734, "uuid": "70530f4f-4b47-4abd-8bc7-777c3b1b780f", "value": "2022-1-28-d639280c6f28848f99a256e0ff7dfc9b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d36837-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560002, "uuid": "cee431a6-387d-4353-8fd9-813f83c817b9", "comment": "Malware payload (SilentBuilder)", "value": "571c81fc6502cc153b7c61306ecab5a8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560002, "uuid": "0df0f17e-33bc-4c62-a9fc-782f13bdf12c", "comment": "Malware payload (SilentBuilder)", "value": "20d59b193da973c39c114e376c1c05a68ac255737c7c3c9e636ff11e0d1a6914", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560002, "uuid": "c8f585d6-a489-4386-ac9c-51da56ad1958", "comment": "Malware payload (SilentBuilder)", "value": "37cf226358c32f962b52798cf229a57d5830a298", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560002, "uuid": "b5b2f4cc-71f7-4d3d-9d55-1c466f2b9151", "comment": "Malware payload (SilentBuilder)", "value": "9501b216cfb0d565b2ee970c67daa8acb231c1a1f389e112ff2ba32ecf42260b36b8b8e7d6b3764adb0a81fb8554e026", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560002, "uuid": "e575e566-23de-4877-b2d6-0f32b7fd5323", "value": "T108735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560002, "uuid": "0d6f15df-5355-4dcf-b4c3-329b77c15fed", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560002, "uuid": "73ca01cb-2395-42fe-95e7-c832594d122b", "value": 77426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560002, "uuid": "f2c684a6-06c1-4df4-a851-dee58ad9ef02", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560002, "uuid": "ac5bd7cd-9d3b-4d6e-a4ee-d78a3f682d5e", "value": "2022-1-27-571c81fc6502cc153b7c61306ecab5a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fefea2f-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556149, "uuid": "c0615b5e-e6fa-4d07-aaa7-6a9e4c3156b3", "comment": "Malware payload (SilentBuilder)", "value": "1db2b998c366b7dc3004536a21e42e72", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556149, "uuid": "90da9258-1f02-4ff1-b041-3e7cb3e9c7eb", "comment": "Malware payload (SilentBuilder)", "value": "20e5b252acc854e60911e58b1fec652ad3c68b82465dc2fce7a4151c85b8cab0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556149, "uuid": "a361af26-3dfb-470d-b655-6577ebb76232", "comment": "Malware payload (SilentBuilder)", "value": "08dd624ef22ceebd44db5463aab069b90b60e7e2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556149, "uuid": "ea592673-5f14-489f-a5cc-e64fe7d470f5", "comment": "Malware payload (SilentBuilder)", "value": "ee1b1a2ccc2ca592529d10e0608b63c7b2cf096c03d0de18a9fdfb96539396f5b6f6cee4b710b2881ddab1d3bd8422a0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556149, "uuid": "9d6d4dd1-47cf-48c7-b068-340ea4f360bc", "value": "T1C9E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556149, "uuid": "fbdd892c-3087-4136-afb3-b19e8e654150", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556149, "uuid": "28c3a562-49b5-4b3c-a98d-1aa9821b47a5", "value": 145446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556149, "uuid": "def285eb-cc46-482c-9148-f7ffad0e2fe9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556149, "uuid": "445cbd4f-1d83-4a33-8d5b-f3e37aba1aa6", "value": "2022-1-26-1db2b998c366b7dc3004536a21e42e72.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4794c0c-820d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643575645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575645, "uuid": "39978229-3aa7-4430-9480-7b2c8c977383", "comment": "Malware payload", "value": "beea5f9f7a876ab00722fbc179356ba8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575645, "uuid": "35b30aa1-3026-45a1-8f4c-3c1b8fc065c3", "comment": "Malware payload", "value": "215fbb1c9c303b9fdec558d8a02c26f134136704cf659bdc77aaf7297e7e0247", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575645, "uuid": "ac01662f-ad81-4ebc-9454-7e0575a9001a", "comment": "Malware payload", "value": "014b293cf7185d2e7e73071ccfd1a4e84192151d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575645, "uuid": "7531ad2e-cb93-4508-9f10-3893401be9cd", "comment": "Malware payload", "value": "912f4c38d1a92d891c017b961f0961ae77bc545ef3cf093f6d8a0b91b41b7bdbcce30e7c53d30a4f7e25cddb0c518afa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575645, "uuid": "da73db77-721c-4331-aee3-c54c73eecef3", "value": "T159934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575645, "uuid": "09285523-4684-4eae-858c-60150789a020", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575645, "uuid": "d8925309-999a-45ba-b8b0-205d5818b16d", "value": 92246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575645, "uuid": "e1181ede-cc78-4964-85fb-316c0a28e6ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575645, "uuid": "2e7f0f81-644f-4f7b-904d-4f23df88222c", "value": "2022-1-29-beea5f9f7a876ab00722fbc179356ba8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289c12e9-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574068, "uuid": "13be3a5e-2a8d-4b62-b078-86f2b94d5a2e", "comment": "Malware payload (SilentBuilder)", "value": "4aa4e733283091e0b5e4f54492764ea1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574068, "uuid": "ce6ed379-6de7-44bd-ac61-254e9b1ab6ee", "comment": "Malware payload (SilentBuilder)", "value": "21936bf6ef81df0400ddd59d5c920e4e7137de947b73e317ed5b877bdf4e5e84", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574068, "uuid": "c6e68150-42f5-4980-938e-ad871d6431c1", "comment": "Malware payload (SilentBuilder)", "value": "fdd48f755fc14e046e4b127e66f889a161408a01", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574068, "uuid": "6a692020-b641-4420-82c0-d533b46f6218", "comment": "Malware payload (SilentBuilder)", "value": "307a4defdd8019caf8e787325e9485b783a714215241356c1a4fb2fc516a44ecd64bd7d51e6fba23cec5cb0a5b4d07d0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574068, "uuid": "9714a3bd-31ac-4a15-b886-d6ce1519ae62", "value": "T1D3839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574068, "uuid": "4fc5d4a7-0f95-4d40-92bb-6b183f927b0d", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574068, "uuid": "53847b95-1ef2-4a5e-bb04-92c00d140cb2", "value": 86803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574068, "uuid": "d7776e0d-2d15-4b55-95ae-5b2592e9f25e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574068, "uuid": "2a29c9d3-3eec-4d38-b9eb-b5e1c9066227", "value": "2022-1-29-4aa4e733283091e0b5e4f54492764ea1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a340908e-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572126, "uuid": "02d1bea0-f78e-445e-9688-1fc9cbf6a4e0", "comment": "Malware payload (SilentBuilder)", "value": "e3b6016f7d5347394534af6a8e900474", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572126, "uuid": "ff2c22e7-941b-47a5-a2e5-9381cf0e6221", "comment": "Malware payload (SilentBuilder)", "value": "219a9709298a66ab708ff6200599221eb32bd9de1ed0c12a8b21fd615450e5bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572126, "uuid": "dad3afcd-1fe1-4fa9-9c8a-03cb36ab5459", "comment": "Malware payload (SilentBuilder)", "value": "71f8dc672fbb01f9d25c017d4856937eb5dd8ea4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572126, "uuid": "69aa1d74-0cf4-4eda-a319-6c8f35c7a84b", "comment": "Malware payload (SilentBuilder)", "value": "309c0299321f9d25849d0830f6b879b6af30f51baa538b09481405a9f7e35f7e632e25170c9db3a94c9830778c3defc2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572126, "uuid": "970a9782-c22b-4942-9a40-d2faf1d0e9d2", "value": "T1F0233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572126, "uuid": "4f32807f-4267-4352-b127-4690c0380b8e", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572126, "uuid": "0ec610ea-3db3-4b84-bd42-1d3689d4d9b7", "value": 48615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572126, "uuid": "ac7c969a-910c-4768-b102-618a03b31e43", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572126, "uuid": "44e24513-210d-4fbe-ba06-aa4edf6ac507", "value": "2022-1-28-e3b6016f7d5347394534af6a8e900474.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101fa512-8209-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573597, "uuid": "53c0ef24-97f8-4ca8-b290-2bcf2b1770ff", "comment": "Malware payload (SilentBuilder)", "value": "1b46ec8d62fb1068c66625e2dfe13292", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573597, "uuid": "311198c8-c9fc-4b49-a78f-3bc2fdba816a", "comment": "Malware payload (SilentBuilder)", "value": "21a95d96ad920f23bb05b317fe3ad6705df1e61d816fffc5b22f89d82637d4f6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573597, "uuid": "e89311ac-8d2a-4545-913e-7feb088902ff", "comment": "Malware payload (SilentBuilder)", "value": "8acacc78be403d0ffc14c910242e3335fce42f34", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573597, "uuid": "21bc818b-f3dd-4357-8216-3d9ef94a9592", "comment": "Malware payload (SilentBuilder)", "value": "3643e4aa5b00a8a389886aa6f1a63d84cb279ec36a3ec81aeae38e4f53379e6b3cd10e6502ca83c5791e98c9b8c4d349", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573597, "uuid": "d2284b61-302e-4e05-ae3b-ce9234daa033", "value": "T16B934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573597, "uuid": "5a6da57d-995b-4f98-8313-0b407f2daf44", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573597, "uuid": "6cf3e7f0-0c24-4cb4-aedb-1ce1e305d328", "value": 92290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573597, "uuid": "24a35877-853a-4c91-b492-e71a2d33ab29", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573597, "uuid": "786cfc05-d4d2-4576-8b4c-a87fa258d241", "value": "2022-1-29-1b46ec8d62fb1068c66625e2dfe13292.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c88514-8206-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643572593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572593, "uuid": "446c2420-71f7-4e45-8d9e-fd25d02a0950", "comment": "Malware payload", "value": "f1e6e3e0a58b85b3898c31d1073b0951", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572593, "uuid": "1044342a-0878-42bf-9b78-ce56c352f0fa", "comment": "Malware payload", "value": "21cc98bc3dcc7b3d9d7a472e92998e77d1fa0a52e62e6ea106bd5b37231831d1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572593, "uuid": "539d0cbe-3e20-4e2c-a2e1-16481ab55c21", "comment": "Malware payload", "value": "8658662e5694ee4fcc22ea788d9feeac6dac5a16", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572593, "uuid": "4b14819a-8562-46a7-ba5b-bf9e80f439bc", "comment": "Malware payload", "value": "5f4b8b8ce7b5ff25c2485c4576b7cf7c1e7c8b59996474aa3ead1bc9bd69ece26b15a05298b3e5cc54748db3cdaa8765", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572593, "uuid": "9784faae-e09e-4143-8ffd-0e89ad94df24", "value": "T196839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572593, "uuid": "6f3d8896-3d69-4afe-b3bd-46e4ecc6f81f", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572593, "uuid": "c77f2ec2-1aec-427a-8b54-d7e974b18fab", "value": 87098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572593, "uuid": "a2b62944-d61b-48f7-993b-54bb6925aa52", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572593, "uuid": "bf52bd4a-23b9-41ca-ae4c-2b1d8711eec7", "value": "2022-1-28-f1e6e3e0a58b85b3898c31d1073b0951.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6038382b-8200-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643569866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569866, "uuid": "754e129b-e8eb-4375-b2b1-62a0fcd014a2", "comment": "Malware payload", "value": "9b7fe11b34ead8191352711f287a05d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569866, "uuid": "935f9c9f-c404-4235-a934-80e610e0a97f", "comment": "Malware payload", "value": "21e876a20144fde1fbdcc07ca045311215abf75c5c0c32e3f7a39094a130dae8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569866, "uuid": "91250b8d-ad23-492a-b9ee-b268dbfd3852", "comment": "Malware payload", "value": "f9caa09fc63bdcd2102dd85342dabd4949eea755", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569866, "uuid": "d4e16165-ca53-481d-ad36-c80c9f47257c", "comment": "Malware payload", "value": "581416d016d14a2c382a0805f7d348c5a4a3cb6204f9b06cb21e70a43ac52c6f6219da0a2010f450b3ca32c398620351", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569866, "uuid": "c4d7b10a-ba2a-4c42-a069-72f6b26708c5", "value": "T165839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569866, "uuid": "a25f97c5-3950-49bf-b352-b7629435002d", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569866, "uuid": "e6407700-7a62-4043-a830-1d60e6424867", "value": 87625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569866, "uuid": "1afbf469-0c43-4cb5-b066-ff76b0d883da", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569866, "uuid": "178343b1-a5ed-483a-892f-ef41ed3dc2be", "value": "2022-1-28-9b7fe11b34ead8191352711f287a05d5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3490a6d1-81e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643556479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556479, "uuid": "61fbc595-5e9b-4d9c-8865-f97ed9fbbdec", "comment": "Malware payload (Heodo)", "value": "3d581debcefcca581ec25fdabb4d0b74", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556479, "uuid": "dc11ed79-9070-4a98-bf2b-1caf597a38fe", "comment": "Malware payload (Heodo)", "value": "21ff6d208b8707a2e84236e0388570226f22250d30cd1a4689817c56432649fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556479, "uuid": "0ebfa477-5256-4329-bea4-3f9e9cf8e862", "comment": "Malware payload (Heodo)", "value": "b45fe4801829725c76ad2f8b3b235bc21dddff30", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556479, "uuid": "65da9eac-6c9b-41ce-b2a0-54b086a3ed3b", "comment": "Malware payload (Heodo)", "value": "c5a422074d3a99d889171770591d7263559840277fdf82d36f964da37d054e4afd3c5e7e91d2e0796d22878ea611a5a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556479, "uuid": "1eef1da9-2620-4d27-8139-6bccf95d33da", "value": "T14CE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556479, "uuid": "01e5198f-552b-4d74-baa1-2fbe9cefcd65", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556479, "uuid": "339439f7-406d-4509-9993-e2aeb4214572", "value": 146392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556479, "uuid": "b566e5e5-29c9-4083-b947-01d3e6118ce7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556479, "uuid": "be457f87-e013-4815-8be6-ba277361b1ed", "value": "2022-1-26-3d581debcefcca581ec25fdabb4d0b74.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7eb6b5-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575306, "uuid": "c6726e5a-d9f0-4a9b-920d-32ac07ddf26a", "comment": "Malware payload (SilentBuilder)", "value": "a667002700b271193ff840f58b7d5f9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575306, "uuid": "b5d96fed-91fa-4577-a6b4-903b80539ea3", "comment": "Malware payload (SilentBuilder)", "value": "2216432c6e2d12ddfe47bcad1508c5b576c56bd7556d593d18c2d28c111767af", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575306, "uuid": "cad6b523-d45c-48fb-aa8c-8fc940854e48", "comment": "Malware payload (SilentBuilder)", "value": "1152dc3a60f45c8bc515ed717dd13b195712cff6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575306, "uuid": "dac52bcc-7f65-4a26-b50f-9bc210dd1ab0", "comment": "Malware payload (SilentBuilder)", "value": "6176faa0b52a26a5d2d4306b613cb40c633fa408f09f4dd5dc7bce38fb7c28b288d689d637b1cd6e8e1d1dcb7498d60a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575306, "uuid": "f0831c3d-2a6e-45ac-a8cf-e8fcc1039bea", "value": "T1ED934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575306, "uuid": "4090bc94-dcba-4652-a6dd-20e646805b22", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575306, "uuid": "5d0a2fd0-66cb-46f4-8dd1-54b8a40a17d4", "value": 92538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575306, "uuid": "a291f4cf-6bd4-4748-b6ce-ff9bf40d1ce7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575306, "uuid": "c52cf600-2726-4682-ad6c-63addba16852", "value": "2022-1-29-a667002700b271193ff840f58b7d5f9c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cb8657-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570012, "uuid": "2996f641-c857-40d5-b25c-adc97fe8b0fa", "comment": "Malware payload (SilentBuilder)", "value": "a11f8f3f32ccdb84cb1fc372b4de3740", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570012, "uuid": "f4136d47-a034-4fb9-b754-37c2138d6d2b", "comment": "Malware payload (SilentBuilder)", "value": "228115fc5fde3e5adcc52481982892c39f6c007dd2ccee3047b15fb1f1c75619", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570012, "uuid": "3d8cf7f9-f5c4-40b2-b884-b573de65cb36", "comment": "Malware payload (SilentBuilder)", "value": "a9331383a6bd208be0d2195382aa8ad74c39d2d4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570012, "uuid": "753cea2c-cbae-4b53-984d-bf9f900a4432", "comment": "Malware payload (SilentBuilder)", "value": "cf43e7170cb01a8f3553b7cb2da3f2b258cb46b7fa85c923a0edb1a9e91b56dc85b58c56cece441c9a015a0aa4bf1cbf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570012, "uuid": "d3a0cfd0-cf75-4998-84e0-9d47ae19277c", "value": "T10B233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570012, "uuid": "51a9b4a3-511c-4bc8-bf68-7c2c0567f561", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570012, "uuid": "89ac1425-4c9c-41a8-bd59-27fb92b854ab", "value": 48306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570012, "uuid": "f9ba51cf-20c4-43cc-a0c6-7a807ac572f3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570012, "uuid": "d00292db-3671-491c-a586-e53204015493", "value": "2022-1-28-a11f8f3f32ccdb84cb1fc372b4de3740.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb19e1c-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570483, "uuid": "c225ba45-651b-4a5b-8e86-11771c2af1f8", "comment": "Malware payload (SilentBuilder)", "value": "af17eb50af0ca8e4ec4c26c85ddf13b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570483, "uuid": "6d16bfd3-f139-4728-8267-ac0381ec169d", "comment": "Malware payload (SilentBuilder)", "value": "228676f807b4865dab3a8f9378a443cab50d2dae04650acd24b46d156cd2b029", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570483, "uuid": "749a385b-9107-4b20-a2d6-bf9367caebd9", "comment": "Malware payload (SilentBuilder)", "value": "8f53f6fb8e1e181d4a8f72b33ed3c509242f9654", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570483, "uuid": "ba3fc2fe-abc6-45dd-b820-efa4e684ab3d", "comment": "Malware payload (SilentBuilder)", "value": "0dde1152078b2683b19377c2858cf8dc9f5a62539ed64e9ae1ce58d367eba71abc4326facf238244aaf09763580a94e2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570483, "uuid": "c986c5b2-64d7-4c71-a0b4-07f27d04990f", "value": "T193F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570483, "uuid": "27beea47-3067-4ad6-a63d-90840d1f0a5e", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570483, "uuid": "f1c771ad-422a-41d1-bffd-15d3c64e597c", "value": 158757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570483, "uuid": "f4416ed0-0ec6-48f9-b3cb-c7c9840127f4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570483, "uuid": "84e73075-a2bc-4688-8c05-704e51cde9f6", "value": "2022-1-28-af17eb50af0ca8e4ec4c26c85ddf13b3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d943138-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564574, "uuid": "22180abd-d315-4b4d-82a2-dc62e66ee8d2", "comment": "Malware payload (SilentBuilder)", "value": "ea38f254209488a385c78810674f285d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564574, "uuid": "3862c0b4-d1c9-463b-93bb-897e8db6d13e", "comment": "Malware payload (SilentBuilder)", "value": "22d81364f7c7536a0e16e4cd40fba5fc473e3a3eb48d24eca105be138db5e213", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564574, "uuid": "2daa97d2-e8e4-4d98-8465-58a73c4cbd10", "comment": "Malware payload (SilentBuilder)", "value": "2794cc64abffad5b997961f3728dfc7cd6513490", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564574, "uuid": "6fc874da-8e85-46c8-97ec-48143b86fc95", "comment": "Malware payload (SilentBuilder)", "value": "b9356ee5ab1343fa150f390acb989bd33e4310dd1254ad1dc654d82e758bf13b9851c60b3272e0628fc7a05acd015e07", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564574, "uuid": "de254907-d10b-446e-be00-5603c7b83ec9", "value": "T1F0C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564574, "uuid": "e4e09100-3798-468d-acd9-79f90c3130d8", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564574, "uuid": "6accc26b-0353-4f4f-8fc9-9a2db5f0581b", "value": 118792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564574, "uuid": "9c89b1ff-2e05-4a8a-9a78-6fa2e191e8ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564574, "uuid": "f6a838fc-c1bd-4e14-a23e-d0e6fc6b46f3", "value": "2022-1-27-ea38f254209488a385c78810674f285d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e860e8a7-81cb-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1643547331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643547331, "uuid": "bfb4d783-04c9-49d3-94f4-8936979d4c46", "comment": "Malware payload (CoinMiner)", "value": "c39ae15ffb7c520b5f612cfc43a60241", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643547331, "uuid": "14f5cfc2-1807-4c73-9c5c-7848e2e17e00", "comment": "Malware payload (CoinMiner)", "value": "22e83b1f2a1d5a6e73e51efc8a3169810070bc333fa40ba34786321210d3b670", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643547331, "uuid": "e1eeb2da-bde6-463d-8fa7-9a6bdb72c551", "comment": "Malware payload (CoinMiner)", "value": "71de8c994ee9635016084ebc0eb51aaa911c712b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643547331, "uuid": "f822ca55-6ef8-4387-a3fa-9adf848f691d", "comment": "Malware payload (CoinMiner)", "value": "ec49a67962f8a2ac0b249e67d4c506d8ed63f3241d9e181c9601fdaaf8ce671ecf1e860fb4bdb3ffc5aa0560baecd31a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643547331, "uuid": "07cf93fb-f3a3-4ddf-b391-e94551b71986", "value": "T1794633105EBABD6ECBEC523571EF5F094A300F82C459E6E712E068DB089FF9146B7918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643547331, "uuid": "4bc40c35-378e-4204-a4bc-5ebf1cdeaf9e", "value": "9bfd2dac39af50555ae9789117b36b66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643547331, "uuid": "bfc21b62-35e8-481f-95c0-1387022d0d95", "value": "49152:VJskjrIwTiCnlsIU7Az9TOxTxPrr8L4Kj8E0KGCx4Um/GAD/eTfvlKZ4abkI+D8B:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643547331, "uuid": "63d42362-6068-4698-ad7b-61251498ed2b", "value": 5628416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643547331, "uuid": "9eec9587-5082-40d7-8bc8-2343f4f1d8dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643547331, "uuid": "623aee6d-83b2-4954-be8c-6e01ff14b85f", "value": "c39ae15ffb7c520b5f612cfc43a60241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5953741-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570895, "uuid": "9265d8a8-ac06-45a8-b7f0-a2809314e4d8", "comment": "Malware payload (SilentBuilder)", "value": "bdfc17cf3cc450600e60800925f40b5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570895, "uuid": "bfa83e27-0ba5-4d4d-9e8a-ed57008d116c", "comment": "Malware payload (SilentBuilder)", "value": "230bb1d4a64971668dac25be900f18134b1d57c93a7163d35c16a04788520325", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570895, "uuid": "01e3cdf3-0075-47a6-a160-c476f0299a91", "comment": "Malware payload (SilentBuilder)", "value": "c7c7ad184e94e95aeb7536c2ebaca90f2be34659", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570895, "uuid": "15a0c6cd-c0fa-48e1-9f0f-6644d2c8654a", "comment": "Malware payload (SilentBuilder)", "value": "3817bc13e2de80ecd182a634edf1b1baede8f89d3a25093c9f04bc681c0bfc77e3e19c108b3d7a370ed167ceb635057b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570895, "uuid": "481eed58-762e-40ea-b644-56bd1e33a152", "value": "T105233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570895, "uuid": "00ad5cc5-97a7-4504-aadd-b4db5e75be66", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570895, "uuid": "5507de48-2cab-4e44-88b0-f2210a0be5da", "value": 48029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570895, "uuid": "08706434-55e9-4f1b-b0a8-da3521717bb9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570895, "uuid": "9c36deff-ab6e-479c-8302-a4d915ec0d76", "value": "2022-1-28-bdfc17cf3cc450600e60800925f40b5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c926c53-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556197, "uuid": "15aea998-e438-4568-b40f-94608998e0b1", "comment": "Malware payload (SilentBuilder)", "value": "7b432cfde754ed7bccdadc6c7a8c9c65", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556197, "uuid": "392a2970-9051-4053-a3f0-12f55e2fd739", "comment": "Malware payload (SilentBuilder)", "value": "2334d92a1acae4ba7919f09275373771d06a30ceb7e1007f043b3505e4eb86c9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556197, "uuid": "7c04c0fb-6bd2-4841-82a0-7386383e5924", "comment": "Malware payload (SilentBuilder)", "value": "3511bedd96f41b705a2c47918a0b74a99110501d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556197, "uuid": "442c70ac-ea10-4b8c-adf8-55238acd04cc", "comment": "Malware payload (SilentBuilder)", "value": "d38298027701d162796beb2874cbb6c768443adce3a225b219315379397d7f69395869e844760725907c97e0eb760528", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556197, "uuid": "68bcf99c-840b-4657-b70a-a590d82aa124", "value": "T15E131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556197, "uuid": "4c014853-e272-4a0e-bf6f-a658e62e3ad2", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556197, "uuid": "632f9eec-7f11-44ec-b87a-248272f6b348", "value": 45240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556197, "uuid": "c7e687aa-189c-4d2d-8fde-710a4aded720", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556197, "uuid": "204d9b3c-af8d-45ef-8080-ff87f6bf1e91", "value": "2022-1-26-7b432cfde754ed7bccdadc6c7a8c9c65.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1378069b-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565872, "uuid": "f870f63d-169c-4bfb-944d-9fbc56702863", "comment": "Malware payload (SilentBuilder)", "value": "1071f162b42afdb6e8ed6bde99ce9e04", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565872, "uuid": "1a4edf62-f7c6-424e-9780-acd4cb0da29e", "comment": "Malware payload (SilentBuilder)", "value": "2357ceb074f4db66ac177de5922c964dba074daf6160b0c6d299df5eb4785841", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565872, "uuid": "e76a3374-58df-4dd6-9fa9-58e9d8add565", "comment": "Malware payload (SilentBuilder)", "value": "7f3f37461eb920a79160070caeb3e50f1e36bfaa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565872, "uuid": "d10e9193-f5a5-47a4-99b1-82577d66ad73", "comment": "Malware payload (SilentBuilder)", "value": "9fa3b87bd1a23838e493e103b572692538eca90322a0ebe58468a382fa6437d06d72670484ed1b15f293cc4b5b966246", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565872, "uuid": "00a5ce1d-0962-41b2-8b61-a0b9fa8f1647", "value": "T1B3233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565872, "uuid": "5618ecda-e2f6-4876-b1b5-bb63e3079329", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565872, "uuid": "72e5c03b-83cf-4252-8951-82661c431361", "value": 47986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565872, "uuid": "464da6ec-65b9-4084-a11a-88252c8b705a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565872, "uuid": "43d7e165-d82e-42d7-9aaa-67cc8e7c08d4", "value": "2022-1-28-1071f162b42afdb6e8ed6bde99ce9e04.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea5c8c1-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561166, "uuid": "b33d864a-1e0d-43fb-b03d-dac24b824ee2", "comment": "Malware payload (SilentBuilder)", "value": "7c53d887bd896d417c83d8b77a84d1d2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561166, "uuid": "2f46ea85-746e-4094-b072-da1d5f02b381", "comment": "Malware payload (SilentBuilder)", "value": "2371f333ec1c6fbf4a8b901436dde4078997dc0a731cbb8f37f2173db4fdfc62", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561166, "uuid": "9b68f819-a58e-479b-b4fd-07b90448ba6a", "comment": "Malware payload (SilentBuilder)", "value": "8bcec0937170297d8a1525c9e4efdc1aef73fae9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561166, "uuid": "e00e4257-4f57-4853-95d3-4ee1923bd4f8", "comment": "Malware payload (SilentBuilder)", "value": "c567d75304f9758b3635cca5fbe48ecbdfb965540a7b9c9786952b2747745d21c13a91bb9bfaf6ee78bb8fcceebb9539", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561166, "uuid": "842642af-0275-415b-a894-72ea2f182fa7", "value": "T12A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561166, "uuid": "f34fa080-5ba6-4510-96fb-7dbd93eac344", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561166, "uuid": "55e8ec2d-c0cd-478d-bc02-a459f8232ed9", "value": 77763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561166, "uuid": "b44e86a3-9458-42eb-bdf9-920fb167e166", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561166, "uuid": "3587f3f4-70b4-44b5-817a-40444056e861", "value": "2022-1-27-7c53d887bd896d417c83d8b77a84d1d2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599fe00b-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565990, "uuid": "8b0db2d0-e61e-415f-ae6b-e265c0d46f49", "comment": "Malware payload (SilentBuilder)", "value": "12fb19a212fe723e887f921b2e15a265", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565990, "uuid": "d41a6500-80b2-46f5-bda0-43d02a19e74a", "comment": "Malware payload (SilentBuilder)", "value": "237fe334c18c58c71ccdd708c0f41fcd8d1ebcca8305324d66a6c33bdededbd6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565990, "uuid": "c0291c99-37d8-4294-b331-fc857467a450", "comment": "Malware payload (SilentBuilder)", "value": "fa4a05d2dd5d743133374c367a9de504efb4a08b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565990, "uuid": "a1499b39-5f7d-4890-ac70-e7c78cd76aed", "comment": "Malware payload (SilentBuilder)", "value": "ce5697e4c04b61dc97bea00e802a55609a9725f13285fac438eac792f55beeb744fa98a9d74f3963301f3a1405965931", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565990, "uuid": "ad8b3c7e-927d-47eb-a40a-c35ef1f91b7c", "value": "T131233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565990, "uuid": "be2e0ba9-1760-49af-bac6-1e8eefbd45f2", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565990, "uuid": "8d9160a5-40b2-4a77-adee-c66166562c69", "value": 48196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565990, "uuid": "de806ab3-130b-464e-87cb-aae3a2378652", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565990, "uuid": "c08173a3-0966-4edd-bdc3-7d16d2777ef1", "value": "2022-1-28-12fb19a212fe723e887f921b2e15a265.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fd77a8-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573142, "uuid": "317694e2-cb79-4194-b1a9-2ac9124327da", "comment": "Malware payload (SilentBuilder)", "value": "01064f37ff14c341465e963e58c916de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573142, "uuid": "b4f69811-f949-4a29-8b80-025f7be98979", "comment": "Malware payload (SilentBuilder)", "value": "23f91e787bcadc2d65d1fdb976895287db6e323b8840b9c4c5dc23308905536d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573142, "uuid": "1d094d04-326a-444a-b55f-c80c5567b02f", "comment": "Malware payload (SilentBuilder)", "value": "7f9a0e6e350250d25ae9211c513edfa82c81a6b9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573142, "uuid": "96789792-dbce-4779-b358-d49177fd30f1", "comment": "Malware payload (SilentBuilder)", "value": "bcd90baea9f83160d340a72e4a73bc73c0420206ef13529c0db282c918ce52a36c0682fec34e4fd13929e1cdca361150", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573142, "uuid": "7666d072-d4ef-4a0a-a135-4b7d1cfa3b8c", "value": "T1BD839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573142, "uuid": "cda5d52c-3f49-4f77-bd14-e48604f822bb", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573142, "uuid": "42c79b29-b8a2-4648-8846-b99a508cb246", "value": 87061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573142, "uuid": "06fdbd1d-de90-4f9e-94d3-4f74f28b9203", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573142, "uuid": "4290fa01-2e90-4386-9a72-7143422ce24b", "value": "2022-1-29-01064f37ff14c341465e963e58c916de.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdd4bbc-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563739, "uuid": "1993b192-343f-4f0c-9c58-f0eae9a58a5c", "comment": "Malware payload (SilentBuilder)", "value": "d4109053d5d63d0df493d4b0bc0b96e2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563739, "uuid": "6a90e161-d4ab-49da-a3f7-e7c6a51a71a6", "comment": "Malware payload (SilentBuilder)", "value": "2443c6bdd69d54a402bf9fb8b6c317957cb6fb979b41cd3bf38a40bb6c13037b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563739, "uuid": "51c4d55f-0440-4d39-9e54-17c7c45e1494", "comment": "Malware payload (SilentBuilder)", "value": "8d7f8dbc36a0e2d0ea7bae4e62caf7ca9330fccc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563739, "uuid": "d6e67fab-4a7d-4fed-b280-1ae73000000e", "comment": "Malware payload (SilentBuilder)", "value": "7c59ecab646ef36195ffca917f5b8cdfe222834af2e178ab5812f6da5bd7d3afddbf0e8b8e85b3609545ca42db50081f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563739, "uuid": "f6194397-add0-4023-9594-ea840ad23ec6", "value": "T175C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563739, "uuid": "35ae755d-59f6-47fb-b7a6-5ea37a0f0098", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563739, "uuid": "6c882b61-f0c3-48ee-aec5-baef425a3c84", "value": 118945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563739, "uuid": "ad8de93d-ede1-47c0-93cd-d120f2d1c18d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563739, "uuid": "5273ffbe-c281-40ad-97d4-d94db2da22e5", "value": "2022-1-27-d4109053d5d63d0df493d4b0bc0b96e2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03224c45-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643559402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559402, "uuid": "2619bf9f-dca9-44e6-a7a3-04aa93f0f4e6", "comment": "Malware payload (Heodo)", "value": "2fc3b7ca8c6ab2158011f857181b617f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559402, "uuid": "847d2435-6ad2-4642-b40a-56d7cdcea777", "comment": "Malware payload (Heodo)", "value": "24488895f8334af4e7de8f5aa32a12778c2faa803cc302a83f6cdf8367edb0cb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559402, "uuid": "9db60afd-b0c3-4a6f-9e8f-eeb29c68c036", "comment": "Malware payload (Heodo)", "value": "685563faf327be3a72079e84f6890fe437115b6a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559402, "uuid": "b49abcd4-55ca-4824-b3e7-ba1f3c5e0d16", "comment": "Malware payload (Heodo)", "value": "a14507308645a4ce51cabae539ba8ce34f5b188224e5eadadbcb210e9f18fef0d4da7ebc9b7ec675af05d8037c245007", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559402, "uuid": "f7714bbb-f395-422e-ba5e-32ccf3ae7bba", "value": "T165F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559402, "uuid": "2f375f88-6357-471e-81f8-a7a5dabe8d67", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559402, "uuid": "06e05d5a-ef8d-48be-b26e-c14d735b8e5f", "value": 158660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559402, "uuid": "1d842967-b19b-46c8-93d3-fd8fd36dbfeb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559402, "uuid": "bbe51c16-f485-4111-9f56-4743ea4e0d9b", "value": "2022-1-28-2fc3b7ca8c6ab2158011f857181b617f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25146af-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568769, "uuid": "6dbafeaf-b81a-4db6-8b89-59082fdada86", "comment": "Malware payload", "value": "74e8832748e6cd38ae67fbf2b750f308", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568769, "uuid": "9b0f00fb-dc70-4b4d-911b-75568f73d0dd", "comment": "Malware payload", "value": "24621be79c165e2e79ae4a5d2fa2a3b4225169bbd3f82aa18169289aa04f855c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568769, "uuid": "fa42e535-c6fc-45c8-9689-83025e7eacbc", "comment": "Malware payload", "value": "be7afbd9f9fb9aab60e0d4fcd5a98f6716e20d2c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568769, "uuid": "18b22fb8-9463-43c5-b0dc-6a68405859f6", "comment": "Malware payload", "value": "310d16a27772f86c37f86f62a682cf170989e740663cf9f8cd0b94e02f54091732529505949e95ae6ccb47abc343f69d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568769, "uuid": "fd765df5-2ed5-4faa-8b3a-715e8939d2cc", "value": "T145839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568769, "uuid": "deca3043-f1fa-4429-b68c-d12f50ab551e", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568769, "uuid": "ac017061-b7fc-420e-9327-13689811b5b7", "value": 87042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568769, "uuid": "77587b94-0779-4242-a686-745ee8a4a711", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568769, "uuid": "e5087f73-dc50-48b8-9176-32461e4e5ce3", "value": "2022-1-28-74e8832748e6cd38ae67fbf2b750f308.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c24695a-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566343, "uuid": "9fe23241-b7f5-4057-9310-26696557b70a", "comment": "Malware payload (SilentBuilder)", "value": "1daabc8557682f39e655ba28faf5f514", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566343, "uuid": "3c1079b6-e2db-4191-9820-2b8067bbf4cd", "comment": "Malware payload (SilentBuilder)", "value": "247d9759a3693326f9eddd1b916d67d9fe1e9d2f3485c2383b200e71a1a0a9ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566343, "uuid": "e9ec5e07-1f53-45a9-9acc-4609be718e10", "comment": "Malware payload (SilentBuilder)", "value": "a37758354433217258c26bebb54d89f1e4769565", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566343, "uuid": "454e2af2-922e-4bdd-a450-87ca3d3d88e0", "comment": "Malware payload (SilentBuilder)", "value": "0d505216e06233d9f92e969a4788e4e456707bfd449b3c009da8f9ee2d2f66ebdee0c239aa3f2bcabab4c1744f3e134d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566343, "uuid": "967912c0-f25c-4a48-aa13-6ff85ef0ee5e", "value": "T141233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566343, "uuid": "20a9ee00-6f79-407a-9ec5-fb5fe428aefa", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566343, "uuid": "2466bd92-7028-427e-85f9-bb89bc6e6cd9", "value": 47919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566343, "uuid": "40837b99-fbf6-44e2-8f2a-2cc0bccf419d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566343, "uuid": "7ff315ec-fb43-4084-8c97-9bf7ceefbb89", "value": "2022-1-28-1daabc8557682f39e655ba28faf5f514.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bced0411-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566586, "uuid": "74a20f73-1e8d-47dd-909f-2341483184c7", "comment": "Malware payload (SilentBuilder)", "value": "26d5c04b809b9606e968e81b2851fd81", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566586, "uuid": "cff2b661-9928-4d74-b283-cf1a2236fa07", "comment": "Malware payload (SilentBuilder)", "value": "24906b2971138d40cc85fbaf1b2a8941d40459c9a278211b2d293c0de4ef76d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566586, "uuid": "67558c76-13ed-43d9-9e7c-3b1b948842de", "comment": "Malware payload (SilentBuilder)", "value": "e5c95bf1e9587f9a05fe87d31ac8a0d9d9cdf60b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566586, "uuid": "a82a4949-84db-4f8a-b6c5-191d3323b519", "comment": "Malware payload (SilentBuilder)", "value": "bb44b9c8b6dbc97ae7b7f6aa0a41934c06efbb7ed281b85e83237422a7d6cb9a393807adb0a60d7ca349889f087415ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566586, "uuid": "228350c8-3b89-4595-b26b-b15bc9b7ac5c", "value": "T138233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566586, "uuid": "6ce77300-ea5d-4f5b-87af-49538767d05e", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566586, "uuid": "f20092e8-edd7-4e71-85df-8c35cf9e6f75", "value": 47713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566586, "uuid": "39f03b01-3f0f-47f9-a0ac-a886e350a22f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566586, "uuid": "81b90802-319b-4810-bda4-6e3bed299e9b", "value": "2022-1-28-26d5c04b809b9606e968e81b2851fd81.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795db072-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575062, "uuid": "f0f09a50-7eab-41ab-ab1d-a26ba7a38283", "comment": "Malware payload (SilentBuilder)", "value": "8ec49e8c39ce1fc8883ad12d4d658d32", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575062, "uuid": "43857885-07f6-40db-aa13-a46e914c2410", "comment": "Malware payload (SilentBuilder)", "value": "24d4c59650d2c60ff5b4f7d736ded9c9c4612cf44a483ba21c76ddb1a9624096", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575062, "uuid": "f89b4c9e-f4dd-4064-9531-92449cc78867", "comment": "Malware payload (SilentBuilder)", "value": "2a6d365b346a40c925fd3e00e5c2fb35b611a5ad", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575062, "uuid": "c2ea44a8-ec93-427a-9a61-f17fc2ff12cd", "comment": "Malware payload (SilentBuilder)", "value": "72cf57218b75e33fc063cac61057d629af6b939d9539357f65049c24d4ff99244115acfe33965bbce71d7fdb2528089f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575062, "uuid": "fb972705-aa8d-4458-849a-d9d898b25694", "value": "T1A0934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575062, "uuid": "8b8cf2eb-f9ed-4b6c-809b-e423e40b2f58", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575062, "uuid": "e14cd9fd-62a1-4140-92de-fb149d9ae384", "value": 93232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575062, "uuid": "70673a50-2ce2-48b9-b172-5f127c91f5a7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575062, "uuid": "f38a8a5f-16df-40d6-b689-be12ebcac1f3", "value": "2022-1-29-8ec49e8c39ce1fc8883ad12d4d658d32.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d321d961-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558463, "uuid": "f649f0d5-53d4-4e2f-af87-9753544162e9", "comment": "Malware payload (SilentBuilder)", "value": "2939145e6c23fbcc949dd4ef1a8e645e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558463, "uuid": "21b35674-bd8e-4db4-acec-2ff3dc631eac", "comment": "Malware payload (SilentBuilder)", "value": "25077f03a79ccf16851609baf2cfa2ca41aeb0bbec9645f870caeeeaf4ab27b9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558463, "uuid": "83e3ac19-be11-43dc-8057-e1c059cc9674", "comment": "Malware payload (SilentBuilder)", "value": "98dab7b2fcab83c17eb6775bf1ae7fb1e6523582", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558463, "uuid": "cfcf1470-e697-42fb-b6ad-6b42c4d4806f", "comment": "Malware payload (SilentBuilder)", "value": "5ed1c97e40051a3138a04280a51833de3ecec7728afbd014365cc6b519c3f898c79bea816a5026fbd640cf9c057b224d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558463, "uuid": "cfad88f6-0e5a-4780-8cbb-22a25444f26a", "value": "T1D5C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558463, "uuid": "2810d82f-4683-413d-b063-f9a7ba38aba1", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558463, "uuid": "283661cd-2736-49bd-85fa-b5f8903e76da", "value": 118354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558463, "uuid": "8771e7e6-23c8-459b-bea3-9e3b55baebdd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558463, "uuid": "c8719c0b-7635-4499-8059-0db26da54e12", "value": "2022-1-27-2939145e6c23fbcc949dd4ef1a8e645e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37234eb0-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556053, "uuid": "2f7dce99-a22a-4eb2-b3e0-df01b7364403", "comment": "Malware payload (SilentBuilder)", "value": "10b1d3d483d27ce9c683de19752e2c17", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556053, "uuid": "d3ac83b5-dc29-49fa-91cd-0ac509e5e6c1", "comment": "Malware payload (SilentBuilder)", "value": "254202a8bfb23c7fc1e453b3fcb283b9e0778025c45743aadb2e83c240a5a5fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556053, "uuid": "0b9c7ef4-bd63-4009-96fd-dc906b40d6d6", "comment": "Malware payload (SilentBuilder)", "value": "afac636645fcfd8dea002db32089de1cc6853efc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556053, "uuid": "ac1da9a4-097b-444f-94ad-5fe625a3dc66", "comment": "Malware payload (SilentBuilder)", "value": "b81b0bd1af73123b673110fd3048980b4377bdc4fa08c8200724277426a8e700fb2fed0d04f6fc8f30ee40a4931187e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556053, "uuid": "883607b1-f649-4078-8415-5dc16697bfeb", "value": "T16BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556053, "uuid": "95411da6-af93-4e47-b8af-46e8d0f3412e", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556053, "uuid": "b1baaf25-b129-40ce-ae4c-259bdfedeaa2", "value": 147367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556053, "uuid": "3e79b2f3-d1a5-4300-b1e4-f126a709ac09", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556053, "uuid": "c00c3e35-0e81-434c-8a3e-2cf3b66e2dbc", "value": "2022-1-26-10b1d3d483d27ce9c683de19752e2c17.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f10b74f-81f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565650, "uuid": "34acb288-f214-44d6-8bd6-c3263547aad1", "comment": "Malware payload (SilentBuilder)", "value": "0ac46a55b3654846181ade9c470adfaf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565650, "uuid": "f8f9b95f-9ce1-4baa-8af8-89cd50fd0293", "comment": "Malware payload (SilentBuilder)", "value": "254f4ba8203f83cf9f8a14d878206940782e9c1cc06c8c9a8e76e98c51ea1d0a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565650, "uuid": "a43b2f04-51e5-4056-ba3d-9b8af07acaf0", "comment": "Malware payload (SilentBuilder)", "value": "8eac0e78bc5d49a6b94c4fe36f4a543eeb959cb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565650, "uuid": "536613f2-54fe-484b-be6b-3f20eaf39f95", "comment": "Malware payload (SilentBuilder)", "value": "c6c6f8d44174806f60baa588439cfbaa03164598859f41394ee7f9fb8b337761c4d07d6e08de6a013f145ce965345741", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565650, "uuid": "1ae358c0-1a42-4767-8376-2b90ee6d0540", "value": "T158F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565650, "uuid": "ff757428-f967-4d42-9525-f26dbafc63a2", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565650, "uuid": "8ae20b47-74dd-4b02-b551-4308d1498dcb", "value": 158733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565650, "uuid": "6028d551-024a-44d8-9449-11e87ae65764", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565650, "uuid": "85ca82c6-ec6e-4219-a2ad-00d1d4d150b7", "value": "2022-1-28-0ac46a55b3654846181ade9c470adfaf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434269b2-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "7f44bf0c-57c1-4c9f-a8b8-e18ab6a96ea0", "comment": "Malware payload (Heodo)", "value": "e23180b9071f7612df6edfeae0d1509a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "470e6e6d-984d-4e9c-b49a-565da04e74c0", "comment": "Malware payload (Heodo)", "value": "255fbc2336016900a3abf4e9b8855fcbfc12381da76ded3e74f31fce9b61b9ef", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "9d319dd0-6d0e-45e2-9cf3-d3f3526a2586", "comment": "Malware payload (Heodo)", "value": "8384385504b637a1e8e3b7f38647bb6129b9c8d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "bb4ed066-8446-4ae1-bc26-4c74c65c2eba", "comment": "Malware payload (Heodo)", "value": "c0765603458c8ebbe666be347755e52c9205404d2ea786bad8d5968a131bffd6d7bf8e64e09d50cd329e6a70f2c22e09", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "22dc9f74-e4b6-4e09-af8f-c96208d866f3", "value": "T125E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "9d8b8d87-7f0d-4779-83ed-cd831625928b", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558651, "uuid": "80cb9a0b-57a2-4ffb-909f-1b393126944c", "value": 147030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558651, "uuid": "8be6e31d-fb6a-45f9-af29-9afb1cfe7a6e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "e135f2ec-4f6a-4407-abfb-84c06237efbb", "value": "2022-1-26-e23180b9071f7612df6edfeae0d1509a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae7e32-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568075, "uuid": "20e38ddb-ee29-4cc9-8d5d-88cf87548865", "comment": "Malware payload (SilentBuilder)", "value": "5b85347fd2d16fb3a3ae6d1ac398f3e8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568075, "uuid": "7f751601-b501-4303-90ae-17f243017ffd", "comment": "Malware payload (SilentBuilder)", "value": "25638f730ecae53cbb28913a97b20885ff8bc3b26966557c0bf6a1360bedefa1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568075, "uuid": "0a991212-2174-472f-ab57-348c6551d1f3", "comment": "Malware payload (SilentBuilder)", "value": "e4443572795bf39871f2ff7218f0f7f7ea01b256", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568075, "uuid": "473747b9-c656-4765-be4c-dd1b3ece8e64", "comment": "Malware payload (SilentBuilder)", "value": "37f9b12d9e0299f29fb3c47a71c70cf57d920f6792fe2f29eb584ab979e53aea36c35bab83fcd91ed4ec3d315d5a4173", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568075, "uuid": "38f6d065-12c7-49f8-9386-61c88fa421e0", "value": "T100839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568075, "uuid": "86f88eaf-b4ae-4912-8009-94a26c83400e", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568075, "uuid": "56834ab8-f2d9-4d89-9fe0-cad6a9a19a46", "value": 87489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568075, "uuid": "e43c17d4-c379-492c-822c-16fb1fc01e81", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568075, "uuid": "13dc2dbb-294d-4cb9-a2ce-da62f82caaab", "value": "2022-1-28-5b85347fd2d16fb3a3ae6d1ac398f3e8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bfa715-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558017, "uuid": "7d2c0e1c-506d-4362-a7ee-24a2b9c545c2", "comment": "Malware payload (SilentBuilder)", "value": "1c318eb8dbf003c5fad21f4f4f46cec6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558017, "uuid": "84642fbc-e2cc-460d-8134-d80c232de510", "comment": "Malware payload (SilentBuilder)", "value": "257eb712d716503660faf568e83213e9f7ef7474e4650470f5947de33d6b769e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558017, "uuid": "54bb8783-39db-4339-9106-87b5a9464142", "comment": "Malware payload (SilentBuilder)", "value": "dec0f0f3c4f552dd4c83788f65ca29eaa61f47f2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558017, "uuid": "8c278abb-109e-41a5-89d7-09436fb401cd", "comment": "Malware payload (SilentBuilder)", "value": "ed1ccf1224ddf0fd540f29ee5cbbc31112a17069dd71852da1a8c9d93a51307de0cb3d09954ae4ddde6024401d4e70e5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558017, "uuid": "87d20e22-15d2-4833-9c59-7e5aa239e35c", "value": "T141735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558017, "uuid": "65f15aa2-bcc0-4aef-b40c-258ae0573fc9", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558017, "uuid": "2f591db9-3a99-498c-9d69-0010475c8278", "value": 77494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558017, "uuid": "f28c51a3-1460-4894-bd93-1321dd7086a6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558017, "uuid": "26b243e3-5600-4f37-8527-5823801e28e8", "value": "2022-1-27-1c318eb8dbf003c5fad21f4f4f46cec6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499543d3-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562097, "uuid": "5f8c9f4c-94d0-4bce-979d-203db294aacc", "comment": "Malware payload (SilentBuilder)", "value": "9fef3fa33e69648659c91fb91d9997cc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562097, "uuid": "3bcaa126-c389-427f-8fe6-eda432cfc341", "comment": "Malware payload (SilentBuilder)", "value": "2587ab7ac28c07f615519e9780d2620f0a9d28a3551ee82c4f57e3c3658b2291", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562097, "uuid": "2de1e6a3-e010-4a01-9474-7748e9c3b5af", "comment": "Malware payload (SilentBuilder)", "value": "9cc95137191f4b68876ace61874ae31dd99e4294", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562097, "uuid": "4299bd1b-d126-4bcb-93c7-31575ceef457", "comment": "Malware payload (SilentBuilder)", "value": "f45a81da7558cc7336826b13449c90d1e7c2eb0606448e02e6ca1851fb3a5a4f3b7709a8397115ff3478c5af58710298", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562097, "uuid": "7b60c588-d928-44c0-b2f9-c335e1e84486", "value": "T11F735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562097, "uuid": "450639ac-8f60-4df8-b388-ca6847ec2b81", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562097, "uuid": "201ada88-a048-4e97-ae7c-ef94eda4b14c", "value": 78224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562097, "uuid": "268f9e15-3c90-434c-a828-de4583d5ef03", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562097, "uuid": "3f2fafb1-950d-4db9-90e6-f80b141c92e4", "value": "2022-1-27-9fef3fa33e69648659c91fb91d9997cc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b723eb-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566463, "uuid": "4badf0df-8ddc-4dd7-9a3b-ad20278e2a79", "comment": "Malware payload (SilentBuilder)", "value": "23454bcc9dad5e906bd5738bf7e17f5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566463, "uuid": "58b0d435-0056-418e-9a68-f9b18a0105d6", "comment": "Malware payload (SilentBuilder)", "value": "25bc5380e662af54b1ef81b3120eca2a94193a6d9097b4e401783ecd71a8e43d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566463, "uuid": "2de6a3ed-637c-4f1a-8057-102585e857e3", "comment": "Malware payload (SilentBuilder)", "value": "1919a19966317fdccace7ab9918bba17f56dc51a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566463, "uuid": "170f5ac1-4a7c-477d-83e4-de6cfa80c2fa", "comment": "Malware payload (SilentBuilder)", "value": "9f7417612f1b1973f893e375665c782af180e49ac38a90b33a3b57b7c5efa1ecfe913eac8ccea85e85ab483bde4e168d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566463, "uuid": "e5f3eb14-5219-4f84-9528-47165c30e1d9", "value": "T11F233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566463, "uuid": "eddd438a-963b-446b-a20b-600082fd8370", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566463, "uuid": "0fe11b29-c1b7-4af1-83a8-002c4ab342c7", "value": 48049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566463, "uuid": "e11792e2-950e-4a73-b972-0d83072e1b62", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566463, "uuid": "6f1f7c71-460a-42c6-9c8e-1bd6dd4b91ac", "value": "2022-1-28-23454bcc9dad5e906bd5738bf7e17f5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf70b210-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559745, "uuid": "5071f33e-bd2b-43d5-be6b-4184d6e794f1", "comment": "Malware payload (SilentBuilder)", "value": "5d78e4d424f14ceb480973acb21eb90d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559745, "uuid": "10085223-ea79-4e92-af88-a8240ea260e1", "comment": "Malware payload (SilentBuilder)", "value": "25f539a15aac317290e9715eaf73287f60fde87a19d79837e4df5499071b72d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559745, "uuid": "25e2ae58-9e8e-460d-b1d4-a554201c95f1", "comment": "Malware payload (SilentBuilder)", "value": "5b8a96fa39c6a4fb53fac2f5eac66c847989534e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559745, "uuid": "74139511-accc-4ff8-b52a-82a66be47d1f", "comment": "Malware payload (SilentBuilder)", "value": "2e2e778f27473593d58ce50105b67d4e380265ffdcbbaf6e139dd1348ee179c6ef2af10139a786b5e4545f1bb8033139", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559745, "uuid": "e9c5e026-8c70-4ebf-b4a7-94258ccf9095", "value": "T187F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559745, "uuid": "74bc37af-717f-4a96-ab55-dbbf07206f95", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559745, "uuid": "16d8e833-42b2-4cb0-9c64-9b2a8fb21451", "value": 37462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559745, "uuid": "918bb372-ba35-467e-8a3b-b36dcabfe865", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559745, "uuid": "0f144c30-4979-4220-b76b-75e75cb08977", "value": "2022-1-28-5d78e4d424f14ceb480973acb21eb90d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70465cd-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571837, "uuid": "151e27ce-d0e2-4b96-8735-60e9d349174d", "comment": "Malware payload (SilentBuilder)", "value": "d90169485edafe0951d20d2c32dd692f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571837, "uuid": "c45213ec-b607-4168-9e58-f57f2b2a14ac", "comment": "Malware payload (SilentBuilder)", "value": "25f9277a0729b5d4257b96be8a16ebed7c0a8a8a1ef8cf70d3263dadac4ad49d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571837, "uuid": "915f6d38-fb1f-4e6b-812b-165e8a67f777", "comment": "Malware payload (SilentBuilder)", "value": "0bd24f267e680262c6f5b68d6a54da41b8850f62", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571837, "uuid": "755f46e9-adfe-41cc-ab79-2460c908e3d3", "comment": "Malware payload (SilentBuilder)", "value": "91a63ef9fcb4f4e5de49a7c6f16d709fedb2ef280f9ca5bd14c137a92c588a5c03814d08a16219a6745b85b1f3ac9010", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571837, "uuid": "44a1bb3b-b769-4da0-bef6-d20b5b4ab1e3", "value": "T171233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571837, "uuid": "5e32fe9e-a4bc-4770-b515-a33ec58389c0", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571837, "uuid": "07a9cc33-3de1-404a-b9cc-dd512813bcda", "value": 47758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571837, "uuid": "107a1501-0d7b-42a5-beec-97b29fd4d13e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571837, "uuid": "bd7b3742-c9c0-4d00-93b4-371b3fcffcd2", "value": "2022-1-28-d90169485edafe0951d20d2c32dd692f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4131d674-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567237, "uuid": "cb8201ea-3f11-43c3-83c0-4e2275627b28", "comment": "Malware payload (SilentBuilder)", "value": "3e02b8f77476b6a3eaf0ab7194680a66", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567237, "uuid": "c1eaa4b8-1786-40ca-921c-f279af9b5116", "comment": "Malware payload (SilentBuilder)", "value": "2610113541d71c24aea21ddcb8760a6f22932858b9c7261d70e9b9d1ca281468", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567237, "uuid": "529ac6a4-c75b-4ab2-9142-51ef6ad0e297", "comment": "Malware payload (SilentBuilder)", "value": "da0beff03a061874feb8e7c6fd93f56be0627230", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567237, "uuid": "1bb0f512-f1cb-4150-b937-deb4b25117f8", "comment": "Malware payload (SilentBuilder)", "value": "cd3b41d532f8fbb7e6d1702b636b07c01242a08eae8f428f05fd2678697f7a662c34b177858344b11a80dc876207d99a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567237, "uuid": "8879ae0e-e97a-4e1d-b8bc-caca534ff8ba", "value": "T10C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567237, "uuid": "4a7d2b35-6ec4-44de-a9f9-2f31bce54218", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567237, "uuid": "6d138ffb-3714-4f8e-b2f4-ef249175dbfb", "value": 48393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567237, "uuid": "a9b019b9-75be-4f07-84bd-1286ad4b9980", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567237, "uuid": "e65b223f-6f03-46ee-b218-2073487c0fca", "value": "2022-1-28-3e02b8f77476b6a3eaf0ab7194680a66.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958b45e3-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569526, "uuid": "f5bfb22c-2038-491f-b87c-f1b2b849acc9", "comment": "Malware payload (SilentBuilder)", "value": "9030d52a1cf27a7fc8d97e3c3d0b9516", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569526, "uuid": "b6fee385-18f3-4910-ad44-58fbabafbdcb", "comment": "Malware payload (SilentBuilder)", "value": "261e19c458d64a0110396d2d79994eeb6d899a07149ad142f7bc7f4a91445756", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569526, "uuid": "fd160d3b-2242-4729-b82b-bccd638fb720", "comment": "Malware payload (SilentBuilder)", "value": "510de04ced651c9329ae19279c6fd2b11e09c84e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569526, "uuid": "847c3f6f-3e6a-492e-b815-fb8417fb4dfb", "comment": "Malware payload (SilentBuilder)", "value": "2386d75aa8ba21d95eb7a065eb1ced469ff0ae4745653890ef39696df6395dfbdf012908284fb30b3366e5895bdadc6d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569526, "uuid": "e4108808-701b-4171-a47d-0304c1ffb5d3", "value": "T1BE839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569526, "uuid": "2d0eb42e-736c-4fd1-8284-b1469bbf9a70", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569526, "uuid": "dcafb5d9-e811-4ab9-abb5-872053e1a680", "value": 87526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569526, "uuid": "a09aad3e-952f-47d8-84a0-8352a4ef8144", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569526, "uuid": "e234e157-7a5b-4124-8e38-30f0dd669668", "value": "2022-1-28-9030d52a1cf27a7fc8d97e3c3d0b9516.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c7ca4e-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566057, "uuid": "48119d8b-65f4-4b94-8b4f-3e58a82a01cf", "comment": "Malware payload (SilentBuilder)", "value": "148e6b0e5a8aa3d1347ee1eacf23d39f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566057, "uuid": "1b37f76d-1b90-4b98-80a9-fa70f9de6e81", "comment": "Malware payload (SilentBuilder)", "value": "262cdcf99f8ff8df571e568e1dbe1601bde6a18e5b83f8ccfadc415016c9a8fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566057, "uuid": "2cc41f49-f2fb-43e3-abec-1129a89cef37", "comment": "Malware payload (SilentBuilder)", "value": "9c633ef62876ca37dc8c381673b6823aef715cf8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566057, "uuid": "ff02424b-56f1-455f-ba91-ee088885e6ed", "comment": "Malware payload (SilentBuilder)", "value": "5ba36581dff22298fd3c7d5da5944713ed434fd88e8e85779173205247a6eae86cd63b10e832defce63fee5f8852e5b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566057, "uuid": "ddf438b6-5ead-4fdb-9cc2-267a0648760e", "value": "T141233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566057, "uuid": "c85cd6ae-1816-4743-bd1c-c48fe267529b", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566057, "uuid": "89295fe0-d53b-4f50-b9a3-f58f5baee667", "value": 47619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566057, "uuid": "e41389ef-30d8-4153-8106-d44532fbcf19", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566057, "uuid": "d7012186-3e6d-4439-97af-cbc45223ba75", "value": "2022-1-28-148e6b0e5a8aa3d1347ee1eacf23d39f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22574ccd-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570192, "uuid": "2fc367a7-0516-4b15-860c-6ada01758dd9", "comment": "Malware payload (SilentBuilder)", "value": "a72623a8078a7213518cbabee063a78f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570192, "uuid": "eb5a402a-b8f9-4cb8-8367-ad8739195a6e", "comment": "Malware payload (SilentBuilder)", "value": "264c3ee5dc5e531545d8ce4daffd0c6578ba54436ca866c467f4abb6e5ee21d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570192, "uuid": "b815943e-2278-4f78-ad55-3638d53374c7", "comment": "Malware payload (SilentBuilder)", "value": "c1e2d3671610f0147dece917a7b1f037560bffc3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570192, "uuid": "ab66f14a-d232-4fd4-a5ed-52183e5bd081", "comment": "Malware payload (SilentBuilder)", "value": "e329f08ddb57f25101a6d0efc6d8395930157e052025199823a1e5cb6679143d521cba00fcfeb35881c9b72bcd5f1e48", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570192, "uuid": "1599f501-7a3b-4064-96e8-76a03ccdc06d", "value": "T149F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570192, "uuid": "238d96b5-8f6c-4eaf-ad43-f8d14a924b83", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570192, "uuid": "96962023-0860-4a7c-9f8a-f1c0a8f4c862", "value": 159102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570192, "uuid": "9206ebd0-4779-415a-b6b6-3f2849ec39aa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570192, "uuid": "ba50d2af-4bb4-4e2c-a6cc-d8222976e80a", "value": "2022-1-28-a72623a8078a7213518cbabee063a78f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763219aa-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560025, "uuid": "1f173595-3faf-4178-babb-200a0b26136a", "comment": "Malware payload (SilentBuilder)", "value": "578f0b2f9de3fe175c8aab2719aef228", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560025, "uuid": "43489d97-a709-46e2-a363-ff75b8334fc4", "comment": "Malware payload (SilentBuilder)", "value": "26ff3ced51de4469fa08e9be792c050a5c69c381c077ae85f502589e06fa4c5c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560025, "uuid": "429b3fee-6a36-4fcb-88cf-2d9832581c7b", "comment": "Malware payload (SilentBuilder)", "value": "9f92b059587fc6e136c8eec9af0cf92009fb68c8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560025, "uuid": "4267a728-7c65-46e3-bf8a-32504b53bbe1", "comment": "Malware payload (SilentBuilder)", "value": "28a4d0e21948f030388f7afa4f2938e2a076786c68a9b7d9a31f5f8725bf87b81986da713c5e63e0210bfbf060935118", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560025, "uuid": "028df668-846e-4e26-b1f2-d34f0b0a7169", "value": "T105C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560025, "uuid": "184c83f8-2f64-4229-b695-429b6ffd578b", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560025, "uuid": "d9c7b493-ce37-477c-9689-a9b697e56499", "value": 119346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560025, "uuid": "0c6ad65e-d544-4cb1-a7a8-a4f7731a2860", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560025, "uuid": "bc72f32d-a75b-4d5e-8426-fb3814b2d6eb", "value": "2022-1-27-578f0b2f9de3fe175c8aab2719aef228.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e15ada3-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568601, "uuid": "4025d1f7-9ef5-4e31-88b0-f6f43d092c40", "comment": "Malware payload (SilentBuilder)", "value": "6de0d7e7cc90a8c178390ecbbe1e9d93", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568601, "uuid": "59104ed7-ae40-4a5e-a0ff-b5a69693ca5f", "comment": "Malware payload (SilentBuilder)", "value": "2722537a240b538fdb0665d5953e0b2eed1a9cefdcc8e576d7f6fa32469d475a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568601, "uuid": "3f09caf1-bad6-48aa-96e3-8d87a7867655", "comment": "Malware payload (SilentBuilder)", "value": "7c44a13069c59bac01f6b1a101c37bb8fbc1a8cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568601, "uuid": "ab41d2b1-2a5c-4a30-bd2b-04c662857825", "comment": "Malware payload (SilentBuilder)", "value": "563d1a8957a6c5b4be3454f83f634dc6fd74c57b0017eba05632309f8b2a19ca4af67ba2108468c08d9ab85422e0e230", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568601, "uuid": "3032a855-7def-4b4b-af3d-9ee30de1ce17", "value": "T14E839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568601, "uuid": "f06ecb62-630f-4a07-a7c7-7b4403b21c92", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568601, "uuid": "2890f631-08d3-4ea8-8e45-3db724915729", "value": 87514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568601, "uuid": "426df1c2-4b98-421b-9169-fcb63e36957b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568601, "uuid": "90b4d0f9-5c25-40cd-a43f-263240b122e5", "value": "2022-1-28-6de0d7e7cc90a8c178390ecbbe1e9d93.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3cb5d5-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643560194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560194, "uuid": "e05a3d2c-90f6-45ed-a89f-63f34f681dd3", "comment": "Malware payload (Heodo)", "value": "5d8ca3cc026f660b20a82f56c8ee1ddd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560194, "uuid": "3704bb5c-4c2f-481b-a67c-73692904517a", "comment": "Malware payload (Heodo)", "value": "273a65c4828d1c6df7c812115c56504d20dc5901775a6f90b6a4ad2552de0881", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560194, "uuid": "9243fc95-2c7a-4873-a25b-975a17c8aab7", "comment": "Malware payload (Heodo)", "value": "2ef38272b5dd1a40d442f0a0441e184bd83b6e74", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560194, "uuid": "6dc864ce-d52b-440c-b2a1-5a560359488b", "comment": "Malware payload (Heodo)", "value": "56a2724856056fc2c396e1bb38b8531ca39abeba1bf2229ca864d81d685af692a14f350506a5689729e813d9ff12c9cc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560194, "uuid": "2f91ba6e-c3eb-4a42-b2b9-47d37b36bae5", "value": "T11F735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560194, "uuid": "089d6f80-e32d-4e67-96ad-09ff1c8463b0", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560194, "uuid": "14966376-5eec-4a3d-ab36-cb43a59f57a9", "value": 77984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560194, "uuid": "0959cb84-1dc1-4651-9601-604ea978c662", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560194, "uuid": "c17c893d-7892-4d47-82a3-c97939c5d2a6", "value": "2022-1-27-5d8ca3cc026f660b20a82f56c8ee1ddd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6029661-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570467, "uuid": "d123c332-449b-4598-b7d1-cd90af53f111", "comment": "Malware payload (SilentBuilder)", "value": "aec800766f2d354a464394fbf43f219d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570467, "uuid": "c70e0abf-57fd-40c4-b943-4c9253a9628d", "comment": "Malware payload (SilentBuilder)", "value": "273f95c033c0b52b075cf47656c8e74f9bcc5a75adcdae8d3cb9d952c7d0c05d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570467, "uuid": "cff32ab1-c1e8-42da-a7fc-0a4fe4583c3a", "comment": "Malware payload (SilentBuilder)", "value": "81af1d0b6cd2e7b3e0bc8b741878a2baf9c00d78", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570467, "uuid": "07c90887-8b19-4209-93dc-6124e339adb7", "comment": "Malware payload (SilentBuilder)", "value": "620037289ca8d5e14cf6849d00ed589ff46f645512d0bca10ffed8f5ac57bf66cf9752fb9f8dfb75a614654e75ea69ec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570467, "uuid": "a5ab90ef-28bd-4419-abfc-2a38e0c3766e", "value": "T168839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570467, "uuid": "64cd124c-252e-4d22-a81f-44d128f0d2a5", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570467, "uuid": "3388f42a-9423-4420-acc7-a694f1448045", "value": 86713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570467, "uuid": "f6942b23-76ca-4e48-8dd0-51576ce2b08f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570467, "uuid": "c21218d5-5a9b-40e2-9e64-14524695d857", "value": "2022-1-28-aec800766f2d354a464394fbf43f219d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e080df-8209-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573842, "uuid": "9f7f47f4-7e18-4953-b34a-052b5e7de619", "comment": "Malware payload (SilentBuilder)", "value": "337d8179909bcd88c17f624ec85ac5b1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573842, "uuid": "b9dafd8b-208f-48d6-ba0e-0b28ab1ab897", "comment": "Malware payload (SilentBuilder)", "value": "274d9f8ced8b2fee3b5208671357d043c16a1f353a73fe3584522393744a1d0c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573842, "uuid": "58ddcbac-76b4-4a24-868c-934edfc65f23", "comment": "Malware payload (SilentBuilder)", "value": "e39577bee7138b57966f4ba99b76727a1e7e22a5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573842, "uuid": "a5570ab0-900a-4468-bb98-cfa1203eef73", "comment": "Malware payload (SilentBuilder)", "value": "4f214aa2a0f17e30d8c832a44d6a4a99a78d6bd4bd9e62a12da3a6b4257fec4e38c6af849331a54b85fc514374fedbdd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573842, "uuid": "4d118d15-8919-4642-9ec1-f9fb382db381", "value": "T191934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573842, "uuid": "e6abd3b4-4a5d-4182-9802-3c2ec24e87b9", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573842, "uuid": "982d3483-66ef-42fc-a8bd-15568b386855", "value": 92530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573842, "uuid": "1f1e9535-941e-4aee-890d-2255eea2a48c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573842, "uuid": "21580261-85d5-4e6d-a575-2231f788c397", "value": "2022-1-29-337d8179909bcd88c17f624ec85ac5b1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8446c71-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556297, "uuid": "989fc4b9-d27c-42d4-b2dc-859249f324a2", "comment": "Malware payload (SilentBuilder)", "value": "289ace6973b25204f62352617a491830", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556297, "uuid": "8fee888b-8efd-4b40-a7d5-f39e885b7b73", "comment": "Malware payload (SilentBuilder)", "value": "278da80be5d5a2e528f04b55386cf99d203697ba451580185d01e38eec48e709", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556297, "uuid": "9f250425-ce52-49a3-a843-f538f10b0ce9", "comment": "Malware payload (SilentBuilder)", "value": "c19627b34950333886856bd809c95ca30e8ad9d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556297, "uuid": "6eebfb4e-ff29-4d28-b334-8aa8e6584999", "comment": "Malware payload (SilentBuilder)", "value": "7a1fe7c3155b0869dc8049341e1329d0bb7cee4cc77822035362d51a091a016e22a144de3109e37a1f36c0e99ffa6061", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556297, "uuid": "b3d67c14-3eee-4ab2-a6d6-2b21d454287b", "value": "T176E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556297, "uuid": "424b340f-64d8-41c9-8f80-8b810cd186fe", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556297, "uuid": "ab014f9c-0d5b-49ed-bd55-e2308a6b8a33", "value": 145907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556297, "uuid": "ac0ebe11-c276-4d08-b1a4-2a069dc0f322", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556297, "uuid": "f6e33db2-6437-441e-b399-0854b2d9febb", "value": "2022-1-26-289ace6973b25204f62352617a491830.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d77737-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563697, "uuid": "b5c2fc3d-0415-491f-93b5-5f9cbd551e17", "comment": "Malware payload (SilentBuilder)", "value": "d357f01b2e4f2d9015b268eae200bb6f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563697, "uuid": "402953e5-c19e-48ec-bd70-6b0d48c57bb1", "comment": "Malware payload (SilentBuilder)", "value": "27ebdff8b8f0f5db8fb0741d069ff244245654334504d4284c959758db5fccac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563697, "uuid": "f2fdf23d-b03d-49a4-93f6-312fc8612ebf", "comment": "Malware payload (SilentBuilder)", "value": "ea4af9ce38a0f910901a2fdeb7b82884d2f0f68a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563697, "uuid": "f63e97a2-561d-4ecb-9361-f3598a8252a1", "comment": "Malware payload (SilentBuilder)", "value": "e86608a0b8cfc9c542e13956b5245b6abd2466966882fb01f135af3b1faed43051c19d8c2dd38a42f222526dc951245c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563697, "uuid": "b5e9f44b-c104-42c9-bf35-b85726e32d9c", "value": "T105735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563697, "uuid": "50fc560a-0353-48cd-9020-a9e868c7ff90", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563697, "uuid": "ed087595-6aea-43e4-a394-0bb006e95b87", "value": 77844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563697, "uuid": "51122829-072f-4c85-bbe5-434bbd01831a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563697, "uuid": "4e4faf08-664c-47ae-a33b-b32e2d10749c", "value": "2022-1-27-d357f01b2e4f2d9015b268eae200bb6f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c3be1d-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565389, "uuid": "fb9295bf-1e75-4e44-9117-2290d10fb8eb", "comment": "Malware payload (SilentBuilder)", "value": "03f61b9d57226fcd7a6ced3200b53e7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565389, "uuid": "f022e6c2-21cb-4087-92ff-23ec81bcd7e1", "comment": "Malware payload (SilentBuilder)", "value": "2806035567f99821d539da17edcd6baa626e53b485f6673cc21ddd61117290b0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565389, "uuid": "8bdab98a-d522-4ce4-909c-904a4ccc1379", "comment": "Malware payload (SilentBuilder)", "value": "1148de7f4e75dd430917b18052c1fff8366b7036", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565389, "uuid": "22cf5ebe-342b-455a-b3f6-ac42101b63f7", "comment": "Malware payload (SilentBuilder)", "value": "df633e87ed5014cdf77ee3785140c4ceaa8337f9a97844381c4cb3a31deb0e9a19bd466606a2a7360f9a0c84b41c4c71", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565389, "uuid": "db16a256-986e-4401-8787-edde33ea5160", "value": "T112233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565389, "uuid": "13633aa2-97bc-4490-ae2c-f0d2a7dd8e36", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565389, "uuid": "d60cab2a-45f0-4ee8-bb59-49dc71714891", "value": 47860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565389, "uuid": "a645ca3e-e51c-4269-a99d-5f2e89818a54", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565389, "uuid": "1fa8b4c2-edd6-4a89-be6b-41799138fc91", "value": "2022-1-28-03f61b9d57226fcd7a6ced3200b53e7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a561b1-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643560801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560801, "uuid": "1eba8c9d-e1c5-4963-ac07-cf5527a65076", "comment": "Malware payload", "value": "b61be6d90a1eaa43497195ef66bc2841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560801, "uuid": "a54df064-a15c-4e20-8c39-90b9954ab9d4", "comment": "Malware payload", "value": "280849244a0fce8ad7ec3c5feccb7decfe5155f4ad587a10f3408037a0b82ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560801, "uuid": "0867ce79-4f0a-48f0-80d1-6473b76ca908", "comment": "Malware payload", "value": "6823f1aeab9c907f6307dcb1aaa5f1de0afa44b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560801, "uuid": "51b95803-13d3-4741-abec-c9049d4fc9af", "comment": "Malware payload", "value": "a92818e6fe00bccb51b877639a82c354b40290fc6537f542daa0884f2153d9c715f198b6eec21dc3faf6e1e8cf779c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560801, "uuid": "a6026fc1-b0d5-4d09-8a81-878ab1b7f102", "value": "T1BFA33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560801, "uuid": "f02b1cd2-feaf-4ecf-8df3-bec5efec9c75", "value": "3072:iHobm0w+aSP+w0sGZmDYgTE+mBQO/IXZFW:iHo6+aG0sGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560801, "uuid": "a5c250d2-5c91-4069-8f64-bcfba6a03388", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560801, "uuid": "29767350-20a6-4f33-91d9-498c674c39e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560801, "uuid": "6ebb8801-143b-400a-9c36-388ad825898b", "value": "Demon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ca0a17-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559598, "uuid": "4c8378fe-3081-4015-84e4-44dfc513cef9", "comment": "Malware payload (SilentBuilder)", "value": "4bd0ffa0325256aa162ea5960772400f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559598, "uuid": "42ecd9b0-1d7e-4df2-b6c0-73502ff99f01", "comment": "Malware payload (SilentBuilder)", "value": "2861dffba9437cffb8cf8fe9cf25bef9088d984a2f2bcd08e7c060c43d4d0b9f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559598, "uuid": "a7deecfe-6c87-4deb-a886-731d8fb7d893", "comment": "Malware payload (SilentBuilder)", "value": "b4128e5c1c5217bfa177ac68c957c8d119deab2e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559598, "uuid": "8b681857-7139-4585-9bc0-7a0a4822b710", "comment": "Malware payload (SilentBuilder)", "value": "249088c33e6ba3859f57789aa43d66681aaf8db467252f42c34169b76ac90706676b63caa5785586b147c235709ce27c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559598, "uuid": "46d76fb7-27d7-45f0-971d-0d0952a7ad26", "value": "T1F5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559598, "uuid": "3c4bf602-cb82-41c4-814f-29c0df673f6d", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559598, "uuid": "78244cda-54f1-4bfe-8734-c7e8084e8a87", "value": 77979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559598, "uuid": "94b261a9-2039-4194-a1d2-646172ef2f0f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559598, "uuid": "5d671d78-00e6-44c2-b39c-34962c42e89e", "value": "2022-1-27-4bd0ffa0325256aa162ea5960772400f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2030865f-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557733, "uuid": "c86f5e43-5a1b-4dfd-94f5-98bac8b0e3a9", "comment": "Malware payload (Heodo)", "value": "13906a68870717641669bac97032dbe6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557733, "uuid": "7d2873be-c3fb-41eb-ac92-1b1628536496", "comment": "Malware payload (Heodo)", "value": "28895b51c9133e5374b3d0a723689995ce10bd811c681a1c604242440254b700", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557733, "uuid": "c98f3c76-16dc-431b-9fd0-37c60e660031", "comment": "Malware payload (Heodo)", "value": "85b9b6b6740fb6355fb3340d3f6c61f8abbad5ca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557733, "uuid": "f79fd1f1-f681-42bc-8623-4b897a7aaff5", "comment": "Malware payload (Heodo)", "value": "5b43d47e3e9f793ac0a19771817bc9acbe1b1548b705d942b493cf6228e8731ed094034d1a3494b736c8a87c45d76c82", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557733, "uuid": "e31afb78-581d-4b34-9c53-0251e2c5497c", "value": "T12B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557733, "uuid": "90c66096-cc12-41d8-9997-b8430b9a37ee", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557733, "uuid": "ec359113-9597-422a-aa4b-a2e75858c7f7", "value": 77515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557733, "uuid": "bc90dfeb-fca9-468e-ae32-98fc8997364a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557733, "uuid": "03a41b8e-82a7-475b-ba4e-75e2ff91075e", "value": "2022-1-27-13906a68870717641669bac97032dbe6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5657e21f-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643561689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561689, "uuid": "d7d5be5b-5fb9-484d-986f-9fdb579ed96e", "comment": "Malware payload (Heodo)", "value": "8e0fd9a6236d60d4426c1a6df4d93fe0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561689, "uuid": "e868ba92-ec36-4447-8606-44183a073307", "comment": "Malware payload (Heodo)", "value": "288fd66d5ce20977bbd5bddc1173c7e17fa9411ed4d411d6496616c1417c17d4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561689, "uuid": "ae4d737f-daa8-4ab2-b512-a9508060c28f", "comment": "Malware payload (Heodo)", "value": "c5aaf11d52ba84b0bb22f25bb6c14c18cebb71d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561689, "uuid": "3d24d2e3-f2fc-4df8-97fc-4163f50ced64", "comment": "Malware payload (Heodo)", "value": "647413cad3c8593b3e6df477c871468822de06247a28c8ec5f7cc776a22f5addcea3091ffde9a9c2e157ab82c06212ad", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561689, "uuid": "3806eef7-5d86-4ec2-bff8-f0275cb8e573", "value": "T197735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561689, "uuid": "e1403492-6b67-4ad2-adb8-c36c084cccfa", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561689, "uuid": "4384795f-0c1c-42cf-b69f-700b14a8d9fe", "value": 77491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561689, "uuid": "5b3bf907-2d4e-44a2-b7aa-da9d28d72889", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561689, "uuid": "6724920c-6015-4738-8a91-c85261c85073", "value": "2022-1-27-8e0fd9a6236d60d4426c1a6df4d93fe0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbcaabc-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568228, "uuid": "68b7f6f6-19f6-4308-ba86-23cf86be850b", "comment": "Malware payload (SilentBuilder)", "value": "613842bee8617be19c84e213f4c6095e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568228, "uuid": "fa55d30c-9fe9-4642-863e-6bc1e3cc4515", "comment": "Malware payload (SilentBuilder)", "value": "28b49fa4d12e7752a16267feed1abe73e8f2f654fc30fbb9b55571eaa9dece86", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568228, "uuid": "4b088ef5-1783-4a7f-ad2b-b40bae5c4e22", "comment": "Malware payload (SilentBuilder)", "value": "740c6fe4c2afa7fa4d4aa3034d4e645f286ee6b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568228, "uuid": "33450f8e-aa6c-4a23-b951-e8bb5bdd4fda", "comment": "Malware payload (SilentBuilder)", "value": "8978f65249323da5ecd5eba8cabf210d711a156131e2aa095b45722cfcb06f4cc6b75a7ddef2c455827c09d32ed80222", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568228, "uuid": "1f6e0178-540e-4571-8e99-78504cf33b27", "value": "T11F233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568228, "uuid": "8debd62c-f26f-4808-850b-d7e2f7ec453f", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568228, "uuid": "69bfc2db-0356-4417-b6bb-bf066d2f4340", "value": 47629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568228, "uuid": "292c384e-8e56-450e-b708-8b65295b429a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568228, "uuid": "467b4f71-8ef7-43b7-b6c4-0ea67aa40ef0", "value": "2022-1-28-613842bee8617be19c84e213f4c6095e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cbb38b-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575102, "uuid": "b9531bc3-11e6-4a3d-8c6e-15ee098060c3", "comment": "Malware payload (SilentBuilder)", "value": "986b14836613662b5c0d0056ec6b66a5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575102, "uuid": "7c8cbb3f-6333-439e-b660-3c066193bdea", "comment": "Malware payload (SilentBuilder)", "value": "291608aa94653bbc7e362cc2657de01d55627e5eed2732b3838fb3c1b3ac459b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575102, "uuid": "d6db94bd-fef2-4670-9532-af1a02bc7d2e", "comment": "Malware payload (SilentBuilder)", "value": "6e7447c0106d88de9d716db79db5a276b1fa53d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575102, "uuid": "7229f0ff-e98c-4252-8eaf-dbd568d62845", "comment": "Malware payload (SilentBuilder)", "value": "60974d9557ce6f167636df73f035c9b8000ea2e9cd4f9bdabe44f7183985a642858fd8358f822278e8f7c2908ae3bb3e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575102, "uuid": "fc469ca7-3fc3-412e-b857-0adb4291e370", "value": "T152934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575102, "uuid": "1b2cc3bd-06e2-4dc4-b0aa-098ea6365f6e", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575102, "uuid": "d8072ed2-50e0-4b36-b1e8-f1eaae191af5", "value": 92415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575102, "uuid": "f8a4462d-abb0-4f61-8213-0929f1d326c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575102, "uuid": "884e3219-3b9b-4dd3-9933-0738cdaf24ae", "value": "2022-1-29-986b14836613662b5c0d0056ec6b66a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670d3df9-8205-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572025, "uuid": "76762c85-6469-4fb1-b4d7-95f28c875dad", "comment": "Malware payload (SilentBuilder)", "value": "e0b30901642de27e846cc54e51b68af4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572025, "uuid": "ac8258c6-2641-439c-8902-ef4835d205e3", "comment": "Malware payload (SilentBuilder)", "value": "2922b25186983a9ada8f4c275ac8395f789b87fe99571a18db87e12a114ff08b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572025, "uuid": "4e5bf725-755a-462f-b0d0-79ee7ae6f4fd", "comment": "Malware payload (SilentBuilder)", "value": "90341c6e53ccfc837492dcbf5b06cce84e3bbb2a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572025, "uuid": "fc96b25b-06c9-4a4d-b196-eaca6ed45022", "comment": "Malware payload (SilentBuilder)", "value": "0bacb8ae9eb1976a04b61fd1fe326034a65fd244f085874e95dbdc1b0c410309ce4d8f3b6a18fc0d836619080473f278", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572025, "uuid": "0ab6611b-81c8-49b6-a9d1-f13699aa8150", "value": "T1C1F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572025, "uuid": "afa3d282-97f8-4286-8649-a4c243b8a96a", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572025, "uuid": "6df48d9e-1455-4104-908d-447df47c5545", "value": 158780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572025, "uuid": "989b4cff-df0d-48ba-b789-c7074b6f6a8f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572025, "uuid": "5c894a4f-f305-4288-afbe-15ba9ac06225", "value": "2022-1-28-e0b30901642de27e846cc54e51b68af4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4997f895-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565963, "uuid": "2a1b9c9f-1a51-43e8-ac3b-abd13b6d3719", "comment": "Malware payload (SilentBuilder)", "value": "127baaf6086b3e6f7c40ab89e330f1c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565963, "uuid": "04c71c62-49ca-45b0-8142-578a43b045b0", "comment": "Malware payload (SilentBuilder)", "value": "2931e81cfc64c3114c5f3850dc07e4eadb673300620b78061d9de76954f179b4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565963, "uuid": "d99973a5-c7fd-4ec8-930f-445c2fc087f0", "comment": "Malware payload (SilentBuilder)", "value": "acf5c4c220dceb2b13d0327f07c6c4d77ae993ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565963, "uuid": "e5cbbbee-d6dc-4923-aea6-7cf844c57d29", "comment": "Malware payload (SilentBuilder)", "value": "4dcc7019978ddbbfd38f15f1d7f2cceca7f571a5b68c0a81b56fcae9a87a26b3a9e6bb63eeddbc075c963affbc1faf2c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565963, "uuid": "82dc10bf-5270-4aa1-8874-76be8073583f", "value": "T1DC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565963, "uuid": "31e25969-4e68-4277-ab5c-f2449dd79c21", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565963, "uuid": "6b796e16-a514-4af2-b911-a94a0a9e94d7", "value": 48265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565963, "uuid": "351b1c41-2f73-4cdc-b0c3-fbd7f1155b99", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565963, "uuid": "5dcaf31b-08ad-474f-b060-e168fc2aecdc", "value": "2022-1-28-127baaf6086b3e6f7c40ab89e330f1c6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb01b60-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560786, "uuid": "aefbfd20-3719-4d23-835d-17eb01e143e0", "comment": "Malware payload (SilentBuilder)", "value": "de53961278081bbb114b4778ace09b85", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560786, "uuid": "b5835b33-9b87-48c7-9949-0662adad0e12", "comment": "Malware payload (SilentBuilder)", "value": "2942b4b221cd184e91352c3f096678a7bfd3b220ffe57984d7dffda8f4e73d2f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560786, "uuid": "1c1137db-90b7-425e-b02b-d583428376f2", "comment": "Malware payload (SilentBuilder)", "value": "42762e2d696bc481b223f4a90325512bbc502af0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560786, "uuid": "9fd5edc5-bb1c-4585-9c02-0903b057988a", "comment": "Malware payload (SilentBuilder)", "value": "31ce80f19f06cd702a0aaac330a4c6fc4a64d88e3b6e7364a25060aafcae93eedce74a4af82e42900c93bc38fad39122", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560786, "uuid": "5dd8be2d-ef5a-4c7d-a497-bfa6e37260a8", "value": "T166F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560786, "uuid": "f179025a-5e27-4193-8811-09ea2cb8e9dc", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560786, "uuid": "6bab3fb6-b0c6-488a-a5c5-6f77c40f2709", "value": 37298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560786, "uuid": "32dd2b99-1e0f-4119-9a47-e996ce4e1ec1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560786, "uuid": "43b94144-85cc-40b9-8644-8ffcbaa91063", "value": "2022-1-28-de53961278081bbb114b4778ace09b85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832d444b-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643569495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569495, "uuid": "0ebc74fa-fbda-4d15-9e7f-7084d2a876b2", "comment": "Malware payload", "value": "8f87cccb3194c5b72515ea7d409de3d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569495, "uuid": "667079bf-5d93-4c66-bc69-84923947304a", "comment": "Malware payload", "value": "29665d728945205215fd327ffb75a3fc373dcafddbf29ac56e3fd4e363aaa2bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569495, "uuid": "d157cfc2-cb6a-4bb6-a4a5-8ba221d1c101", "comment": "Malware payload", "value": "5e4940705f283f0563641413b597beaa80541ca5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569495, "uuid": "c9e18a68-c855-4cc1-9f74-d57824961606", "comment": "Malware payload", "value": "6a1b4bc82e58db81293b508ab9aadccbfb8c4a62b3e9613dd8a565e45c7e0797d927ab4ba7d923868975147bea6810df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569495, "uuid": "ffd838c1-174c-43be-987f-8cd145f041a3", "value": "T17C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569495, "uuid": "ef6eb6bd-c8a1-4edb-9ed3-19e696b62264", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569495, "uuid": "00bb7b65-30da-4dcf-98ef-4f77a115052c", "value": 48545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569495, "uuid": "bc84ac9c-81bd-45c6-9e8c-f2b13ed3cd45", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569495, "uuid": "48b76b12-d279-4637-a0ce-a1c1924fd89c", "value": "2022-1-28-8f87cccb3194c5b72515ea7d409de3d3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa38893-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570125, "uuid": "e06441a6-35b2-4059-bdd0-3d69b7e86a97", "comment": "Malware payload (SilentBuilder)", "value": "a5f98062e1e518f161afe8231fbdf148", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570125, "uuid": "2c99065f-52cb-46cc-b8fa-b91cc3cb511d", "comment": "Malware payload (SilentBuilder)", "value": "2966820444b104382f8e29ab51afda93d641b690ca5128c6dafe4690d05ec4ab", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570125, "uuid": "853858f8-36db-41b6-9e2c-3bce4d288a16", "comment": "Malware payload (SilentBuilder)", "value": "4a4b1171dabead354c8c903d55fabeaf30437acb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570125, "uuid": "258260db-bbc6-467c-825e-1665142252d9", "comment": "Malware payload (SilentBuilder)", "value": "508f101d7be8096fe6e76ea1ac1e9c1b09a11819690cfb82cfc93c4f82030767ae558c2cd699b9f9024abfff0d925d14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570125, "uuid": "7f5c631a-e4e8-4b64-a6a7-1ebaa7bb7f44", "value": "T1B3233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570125, "uuid": "8b6133c8-086e-4ae2-a563-150ee0b01e99", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570125, "uuid": "39cc6521-1b10-439d-8fc1-d103c38c2f8b", "value": 48646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570125, "uuid": "d6e25b0a-a032-449d-a1cd-499b63a73527", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570125, "uuid": "5a3dbf93-668d-4365-94c5-f85bfe06ee65", "value": "2022-1-28-a5f98062e1e518f161afe8231fbdf148.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34ea811-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575133, "uuid": "e2aa7836-c21d-4c32-9f89-e66181730d4a", "comment": "Malware payload (SilentBuilder)", "value": "990e077d210428adfd0dc90663d6d679", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575133, "uuid": "e87d5727-8e65-4475-b66c-73635db6c1f6", "comment": "Malware payload (SilentBuilder)", "value": "2982c725349640408aa77f15a54a2dea5c8d399756026e64ff0bb63957f0f4e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575133, "uuid": "f2ad3b3f-27da-4958-8571-9f1933bdfcfe", "comment": "Malware payload (SilentBuilder)", "value": "0c471cbb68a13df9c4debe520591be7a2e12a7ff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575133, "uuid": "f4982d58-f1d1-435d-9328-d6ab6799b3f7", "comment": "Malware payload (SilentBuilder)", "value": "cad9d4b924f2262c14e179c08cb7590f7c096c5dbfc634b21ddbaafbb0a3fa0b1c22ad0b4b5092899c1fff55b2141a53", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575133, "uuid": "1ca49032-cb1f-4b64-b106-96875b09c7b1", "value": "T193934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575133, "uuid": "7c62a698-2e52-4d40-b397-a532fabb0b1f", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575133, "uuid": "1bcfd7b4-f327-4876-b275-48a9f47b85f7", "value": 92611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575133, "uuid": "dc8a4a0c-5c0d-451b-839b-f488e697263d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575133, "uuid": "8d78c327-321f-403d-b120-bb75b9c1ffd4", "value": "2022-1-29-990e077d210428adfd0dc90663d6d679.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e821bbf7-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560645, "uuid": "04b95aa1-4209-4515-a89c-8e9466afbf21", "comment": "Malware payload (SilentBuilder)", "value": "cba8b9f60577d8788df4a738354b23a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560645, "uuid": "89c41755-5e70-4f83-b611-e88c029a08ea", "comment": "Malware payload (SilentBuilder)", "value": "29aa7bbcf25df4be906d92a3f5865fc6c859542de7fcdfc66d2f9791bf18c3d6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560645, "uuid": "83b9c297-545f-4d53-b7ff-7707bc7a4500", "comment": "Malware payload (SilentBuilder)", "value": "97ef47ed05dae5e0f537b0e39ed689b9e381dee0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560645, "uuid": "9ffaf82c-6fd0-4d60-86c4-ee416aaee941", "comment": "Malware payload (SilentBuilder)", "value": "5b6a01d4396872ccd948c66fe0f71519c18c5df0f024f418ff2d29cb829c4149f67acc26ebc747828e54e2e54e49e399", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560645, "uuid": "3dfd3b5d-a91e-4618-aaae-867b9382bafb", "value": "T11FF2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560645, "uuid": "d0c1ff69-aa63-4126-bd93-86f12ead3086", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560645, "uuid": "afd04ab4-ded2-4b8f-b059-fe66dfac17f5", "value": 36464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560645, "uuid": "5e512b08-b2e1-4183-ab31-7a36c1a39378", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560645, "uuid": "34b20726-fb1f-4380-9210-d920fb09c296", "value": "2022-1-28-cba8b9f60577d8788df4a738354b23a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba553414-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560139, "uuid": "b9775b43-eec7-4e44-963a-44988f6f6907", "comment": "Malware payload (SilentBuilder)", "value": "8b4fbd160c518ba9af2df23192a3d237", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560139, "uuid": "a98e247d-19fb-448a-98d0-a98d72c3f2ea", "comment": "Malware payload (SilentBuilder)", "value": "29ad73c9a4ded0142825063dc2fdcc732e8f0b5dd94ce7c4e80f00fa2665044e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560139, "uuid": "220efe04-b3c7-4c61-9684-f53fe5927791", "comment": "Malware payload (SilentBuilder)", "value": "a4ab9ed78fa3e85cda32e0115797bde64dca56e6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560139, "uuid": "59cfd727-82ee-4678-8803-ea040c384068", "comment": "Malware payload (SilentBuilder)", "value": "f7bbc5e051a872d6b18b57d192c50057984142a55013e237078e6602a5e05ba347b6c6fa4a10d97242fce0cf310cfe11", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560139, "uuid": "1e4a79d8-93e1-447e-9a7b-b1297f1b325b", "value": "T1BCF2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560139, "uuid": "2c6577bc-2d58-4a42-8c1e-1f073e89d829", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560139, "uuid": "10a9cb45-fa2e-41c7-aa89-d085844701d6", "value": 37230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560139, "uuid": "6bf252d4-3aeb-49f5-a576-bb88e1f685c2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560139, "uuid": "d65bddf2-f8b6-4e83-9925-fa18ac3dd3d6", "value": "2022-1-28-8b4fbd160c518ba9af2df23192a3d237.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0e9b70-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562160, "uuid": "c3785890-0e02-4873-82f8-65b919fa076f", "comment": "Malware payload (SilentBuilder)", "value": "a116f547c2633181ac10aaba87818b02", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562160, "uuid": "080fe5cb-f96e-46a1-a098-be59346ee264", "comment": "Malware payload (SilentBuilder)", "value": "2a0446e5fc69fc325355f9ae7b8fb3e9cb08f8f0549bb52acc3cc371b1f29d8c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562160, "uuid": "dd6e08f0-93ef-4290-88d7-d984968c6777", "comment": "Malware payload (SilentBuilder)", "value": "2c278db28ee55d1e2bf67d5f152355ebaec6c8e1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562160, "uuid": "21bba4f1-9637-4979-ac55-fd608fe46622", "comment": "Malware payload (SilentBuilder)", "value": "5a9dbafde52afd00db4c718ab0e705f1101de771c9224653ecec5a1010fd986879b2ecf39024bcd9c20bb8086219941e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562160, "uuid": "7209864a-705e-4785-8d8b-1a355faba3a0", "value": "T17B131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562160, "uuid": "984c9543-c734-4113-aad1-d1225ead2883", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562160, "uuid": "48f4fdd0-66ea-4605-b796-91cbea96c704", "value": 44685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562160, "uuid": "d9177983-92c2-4322-ab78-8df6d088e786", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562160, "uuid": "b8ce473c-2d10-4112-929a-34f881b71b58", "value": "2022-1-27-a116f547c2633181ac10aaba87818b02.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16b791c-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559346, "uuid": "50bbb913-99d8-4b0e-b320-078c119b4acb", "comment": "Malware payload (SilentBuilder)", "value": "45c579ac8d332d147152b3f4a3f9fdc7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559346, "uuid": "6f8cb08d-f601-449e-803b-4aa594d26247", "comment": "Malware payload (SilentBuilder)", "value": "2a0a1ed58053a41980969ed62af5b0bf11269ee3efc761d983b0e3cc29cd3905", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559346, "uuid": "0bbbc888-92ba-4e3a-bb43-2cfce8fa00d3", "comment": "Malware payload (SilentBuilder)", "value": "b414c3a395925c2e9a733474ffe2c06cc195c74c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559346, "uuid": "3c45ae1a-b67d-4525-b45c-df7ca02ed70b", "comment": "Malware payload (SilentBuilder)", "value": "0cc148f478d56959351ad42c57ca65864e37be428889df36b2ad71fdb66c85645a6ef0ec1f2840dec69c0bc0ff97b059", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559346, "uuid": "ee2b0219-7798-49ad-aca9-aa5671647464", "value": "T1A1C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559346, "uuid": "6d9e042d-1432-4a2e-ba56-d44533814de8", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559346, "uuid": "3a7be2c5-c7ee-4d41-b03b-377a83b089c3", "value": 119259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559346, "uuid": "bdd9c250-1d8e-4c75-9fbe-a67e5a222cb7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559346, "uuid": "0965a50e-a712-4192-afe3-02d8dfeebf29", "value": "2022-1-27-45c579ac8d332d147152b3f4a3f9fdc7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fec7983-8200-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569893, "uuid": "a5a1e1b3-78d3-4799-85b3-297a5f082c02", "comment": "Malware payload (SilentBuilder)", "value": "9c2f775c417b7a02de04e5bfc37e1ea5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569893, "uuid": "d9f77c92-7cc2-4f5e-828a-04aff0000d44", "comment": "Malware payload (SilentBuilder)", "value": "2a26b1ac1abd1e73ab097d3c7a6ee87f3b559548f73046cd92e11853d0d97c8a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569893, "uuid": "0f87dd7a-b1b9-42a3-8474-06767f500497", "comment": "Malware payload (SilentBuilder)", "value": "9760bc58edf300003619721f53b1140a8068430d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569893, "uuid": "d2f2c5d6-111d-4511-b658-284dff55faca", "comment": "Malware payload (SilentBuilder)", "value": "e0c421fb659220788c32748381ca1b50c43e48c570a0520e10f42a6f7d74fdc1e92652d9cc876cdb4bb5ff19a80b869b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569893, "uuid": "fc055a30-ede9-4165-909a-303bed7af73c", "value": "T1C1839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569893, "uuid": "ecaadba9-0926-47c9-9fa8-d354c1e43353", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569893, "uuid": "73f85c6e-bc57-4e15-b44e-3f12f7ef10e6", "value": 87509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569893, "uuid": "d8b75cf0-f0e1-451c-aba0-034e381f357f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569893, "uuid": "f50acac9-fb5c-4152-9f47-c89e102c7eeb", "value": "2022-1-28-9c2f775c417b7a02de04e5bfc37e1ea5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbfd8ae-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568570, "uuid": "97328120-57a7-4a4e-8944-473be1328b9e", "comment": "Malware payload (SilentBuilder)", "value": "6cee73800f173833545b95ec7dc58b90", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568570, "uuid": "794215f5-0bd9-4eeb-bbe2-6295695d36cd", "comment": "Malware payload (SilentBuilder)", "value": "2a39cded6937e9cfe2119efedce50feeee58ee4f0f07180b21812cc8d8506f66", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568570, "uuid": "61c8427d-4da0-45ed-be35-1b7ec6deeff3", "comment": "Malware payload (SilentBuilder)", "value": "dca0dd902ac68300da67dfdf5bc657a22f76c41c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568570, "uuid": "ec7627b9-97ee-4f33-b0b6-9954daa927bd", "comment": "Malware payload (SilentBuilder)", "value": "6d56986fc551397cb3d4bc10dbca75c6cdfc8f393ad315e3c056a38186a73e9ac589530239fff7d95b3422b9868f582d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568570, "uuid": "cc7e676e-611f-4fa0-ad70-c77a6c847d87", "value": "T1E3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568570, "uuid": "54145977-d200-478b-8ff2-474164d431b3", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568570, "uuid": "2bb8886d-9102-4313-b39b-19e7a8d6670c", "value": 158813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568570, "uuid": "e2c4b194-1633-4444-9853-5c60de484016", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568570, "uuid": "b6e885ca-7548-42de-943a-fd23b023a055", "value": "2022-1-28-6cee73800f173833545b95ec7dc58b90.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f0d9bf-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566519, "uuid": "e881a954-f83c-4ac0-903c-e7e4c5115376", "comment": "Malware payload (Heodo)", "value": "2510dc50784a97787d85f1e37c0ec475", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566519, "uuid": "5139f664-f724-4fa4-9770-adba16cd5ba0", "comment": "Malware payload (Heodo)", "value": "2a44e245ac795527f4aac9758d8f92b9282d1ffced0d14ef835031b9d439bcee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566519, "uuid": "d0fc9b9d-fc09-44b7-9bb8-153c68b9c3de", "comment": "Malware payload (Heodo)", "value": "9513dbc2af40004f4ccf2cc794144e83e594336e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566519, "uuid": "64153542-d08a-4b00-b332-b425b729abc9", "comment": "Malware payload (Heodo)", "value": "41d81245fea25c0d1cf8dc2eb610fd55cf5573f1e797e39988b29eebebb01b8bf900850441cf60592326ddad772e4835", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566519, "uuid": "24a662e4-777f-4fd9-8070-45a762aeea0a", "value": "T1A5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566519, "uuid": "ff06efd3-b325-4e76-9613-c8594dfa3a18", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566519, "uuid": "bcb7acf1-3070-4ce6-8def-6abce728b372", "value": 48045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566519, "uuid": "409a402d-3486-462b-b0bb-31cfb2671b4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566519, "uuid": "83fbb9d6-0768-474c-a90d-02b347c3fcaa", "value": "2022-1-28-2510dc50784a97787d85f1e37c0ec475.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d25819-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562942, "uuid": "9ee2936d-9562-464f-b5b5-c8f75606abec", "comment": "Malware payload (SilentBuilder)", "value": "ba1a0b690011241ae28e737b38cab52b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562942, "uuid": "7be2c907-c2b8-4039-a6ad-5d1e1f4c2789", "comment": "Malware payload (SilentBuilder)", "value": "2a452e85a4b89806df4d5c18ac82df29240b05b0fcf2f32d08c3d19be26b91c3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562942, "uuid": "345667a7-ed24-4681-88fe-03105b374cfe", "comment": "Malware payload (SilentBuilder)", "value": "8be473c5a8eb751a532d1ad4f89760fecc537462", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562942, "uuid": "e342bdf1-05f0-47ca-b201-03226792c2c7", "comment": "Malware payload (SilentBuilder)", "value": "4b4eb9fef7ec867ef72f116f8f56a1a0560b8e7af963abde8f8ca25dd687c50d75189a8ca5ab756dac52c67a10273e65", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562942, "uuid": "d641d1ae-194c-423a-9261-ce6099672d66", "value": "T1BD131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562942, "uuid": "ce0453ad-1c0b-4614-8d63-bdd63940bb65", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562942, "uuid": "cb29ce8d-70fe-43ef-a76c-556a64105ebb", "value": 44683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562942, "uuid": "479869ea-4f68-42c7-8fb8-304d7e8ec1a6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562942, "uuid": "4837ced8-0d21-427b-807d-b63c6b061a11", "value": "2022-1-27-ba1a0b690011241ae28e737b38cab52b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6454a8ae-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568155, "uuid": "d7a5b629-a61d-46a1-8f71-2230b6060fbb", "comment": "Malware payload (SilentBuilder)", "value": "5d998d532a8d0214212e175ce6d19748", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568155, "uuid": "31f7db61-fd00-4cb2-abd2-4adfd9228f99", "comment": "Malware payload (SilentBuilder)", "value": "2a5cebaa4489a6fcbaa7b51639db57b3240a8cba5d5d729272be080f87882aea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568155, "uuid": "d050fd37-40fd-4967-b4b3-d17e0bae493c", "comment": "Malware payload (SilentBuilder)", "value": "6785e212fe7b3b67b5b4007a2958f7632c55c3a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568155, "uuid": "17ea1caf-4286-4e74-9ed8-0fe3d6f3288e", "comment": "Malware payload (SilentBuilder)", "value": "89aa5cda517d5bb4637189bf90b878d376f79ab7aa3ccf3aa22a55922bd26da0cd2dc5992f1aff46e33d0479adb10252", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568155, "uuid": "72f54c89-f08c-4db2-a7c7-2ade05df420b", "value": "T1E8839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568155, "uuid": "4b490c69-8d1a-4435-9ea6-78fb48357d71", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568155, "uuid": "deadded5-9d34-43af-92cb-4af6e6856af0", "value": 86652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568155, "uuid": "ad6abf43-fa9d-41cd-b98c-bc6860995c59", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568155, "uuid": "058c6afd-a5cf-4cd1-af40-f151de2c6c4f", "value": "2022-1-28-5d998d532a8d0214212e175ce6d19748.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9202bb39-81f1-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563507, "uuid": "71d442c1-91c4-464f-9160-7ace2d725bc9", "comment": "Malware payload (SilentBuilder)", "value": "cd1875e50b1be761cbee64b6ff6e27e1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563507, "uuid": "f79a72e8-63db-4eac-b9f8-383804920440", "comment": "Malware payload (SilentBuilder)", "value": "2a5ddcb49766dc9173c721eacdfe37abb0ba5980d43366d8b4f05e0ce3382c1d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563507, "uuid": "a8329625-35dc-484e-b930-020cec6c23d5", "comment": "Malware payload (SilentBuilder)", "value": "0a88f31688d9b4b1d71b1e3a49cb0a92178d21e3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563507, "uuid": "635f5a6d-86df-45f7-a1dd-17322c3c37cd", "comment": "Malware payload (SilentBuilder)", "value": "ea2eb3824c29ee88011801f7528b2b00e3062ea9acf85373221908b63273477a8ee4659f39354e2a21ceaf1d16efc359", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563507, "uuid": "752a6d3c-2833-4331-bb15-e86437277305", "value": "T10B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563507, "uuid": "d1df7a7f-2e39-438b-8a12-03bc1db4fc96", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563507, "uuid": "57884970-c7c6-426c-a14a-40d4574badd9", "value": 77341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563507, "uuid": "5d508f8e-0b16-4d1d-9ad1-080b9f190b97", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563507, "uuid": "a0f7e4ae-0b50-4d18-864a-5c75c6b64b75", "value": "2022-1-27-cd1875e50b1be761cbee64b6ff6e27e1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2867103-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575668, "uuid": "1e102a4e-c0ca-4447-af91-b57bda776cc2", "comment": "Malware payload (SilentBuilder)", "value": "c0667bfaa26d1c4afa372b7d193d6d34", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575668, "uuid": "74ac188b-557e-45b2-be6b-0b89b724fad9", "comment": "Malware payload (SilentBuilder)", "value": "2a5e268c1423d996c773fcf9ec8e83d6e94b2b01467abf4515b224d88af34f7f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575668, "uuid": "bf0507c1-3ec4-4d72-bd98-f5d644ddecae", "comment": "Malware payload (SilentBuilder)", "value": "536bb36452a67b111f88382c2fabd99f0c4246c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575668, "uuid": "ef3d8acb-17d2-4a79-9c67-776d7f330249", "comment": "Malware payload (SilentBuilder)", "value": "350242a9d29f453e443eb28f1b42610b1a8e7bf9b7eba5423237e314d78af99dfa025e826b12e1d703360c44014e019d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575668, "uuid": "91e6a7da-de99-45be-9c11-464cd9a37dc8", "value": "T1F4934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575668, "uuid": "5bf2e178-80e2-4ebf-b3ea-1dc9a5a9ff0d", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575668, "uuid": "384608fd-071f-49cf-86f1-9f9bbd8248a1", "value": 92228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575668, "uuid": "8e9f9efa-fb11-45f0-b4a2-e9ce740b2b9f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575668, "uuid": "e9e48a53-20cd-4a57-89a9-148d502d2dd2", "value": "2022-1-29-c0667bfaa26d1c4afa372b7d193d6d34.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34058d17-8204-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571510, "uuid": "148efb6d-8438-4b34-9ff4-ff98c737c357", "comment": "Malware payload (SilentBuilder)", "value": "d158c0a008583c2c32adad33fcbb5f68", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571510, "uuid": "3622eb2f-d28b-459e-9d85-3232255860f9", "comment": "Malware payload (SilentBuilder)", "value": "2a765e18e5faefeb2fd211c7b9a5f62c66381c4e1a8a81edc7e723763054c52e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571510, "uuid": "50fc0230-97dc-4330-898b-bf7b68b50bb4", "comment": "Malware payload (SilentBuilder)", "value": "5975840a9b24ac6168e071cbb04814e137fc48d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571510, "uuid": "96aaac22-e351-48f7-b948-6dad6f7ec09a", "comment": "Malware payload (SilentBuilder)", "value": "af15b9329b7d5543db0a1e9e8f12dbccbb4702f8d1b6f7de6938f037364ba2c7d9f334bf56a48ce9cf9b9bdbc18a0215", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571510, "uuid": "fa3a5ba7-c3eb-4aa6-91c2-7c4ce68b1d07", "value": "T1B3233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571510, "uuid": "80e131b3-abc7-474a-b1b0-8500f09b0fa4", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571510, "uuid": "e43d3434-909e-4917-8ea3-6165fba59bc2", "value": 48466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571510, "uuid": "6599dac6-9300-41bc-9ba6-95e5327f1d0b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571510, "uuid": "0a26bcc7-16e6-4ea1-9a51-00995b788cbd", "value": "2022-1-28-d158c0a008583c2c32adad33fcbb5f68.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204fb76b-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562028, "uuid": "2f318422-16f9-4609-95b7-7e3b50dfa91f", "comment": "Malware payload (SilentBuilder)", "value": "9c729275f24304b6cd61d5795ff97939", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562028, "uuid": "927d8085-7df6-4cec-b244-27bac78dcb3b", "comment": "Malware payload (SilentBuilder)", "value": "2a7cd7ce70d016763b68eaa70034e53e679ce1640482e364dc6fb453b759df8a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562028, "uuid": "35d72b29-19f7-44ff-8b63-cf99f321d18c", "comment": "Malware payload (SilentBuilder)", "value": "37b5bb68fc2ded8404e6245c94d5846c2bd6173b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562028, "uuid": "71ac5aaa-d766-47a6-beb1-9b68aacf1674", "comment": "Malware payload (SilentBuilder)", "value": "c6efe5d3fd679428949639a40be968204c77a79de5a91e18b0b11adf9618136e492288c1f396d17fbe5d5dc58affdcb4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562028, "uuid": "eefd3f06-3ede-4b59-86da-ba30345af5d3", "value": "T1F5735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562028, "uuid": "097ed3ce-7edc-4cb0-912d-b36a1a8a9d63", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562028, "uuid": "fd704aa3-8c92-4a61-8712-ddb5ca4e4cae", "value": 77379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562028, "uuid": "2b81baef-ca88-4077-98d9-57d376c3f867", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562028, "uuid": "f9988be7-b089-4841-8d11-70115d0ba8f4", "value": "2022-1-27-9c729275f24304b6cd61d5795ff97939.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bd59fa-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562044, "uuid": "2e062629-115f-4120-aef0-22bea77768a1", "comment": "Malware payload (SilentBuilder)", "value": "9d10de4148841cec5ce594e4428ecf64", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562044, "uuid": "2222e781-e61f-4ed2-9203-ce701eeca264", "comment": "Malware payload (SilentBuilder)", "value": "2a9dfd9466e6fa2bce3d032ffe9ff4e7e4a3f7ec65850b39ec0d1beeb8e6fa5c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562044, "uuid": "9171d97c-b825-4af6-94af-5c59b29bff3a", "comment": "Malware payload (SilentBuilder)", "value": "6a203e9b3773cc16b413abdfbb314b776ea62b69", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562044, "uuid": "4582a242-7968-4eb3-ae02-d87282d5e4ea", "comment": "Malware payload (SilentBuilder)", "value": "87ef33ae65144d99c04e012d5f44f3ccba49ebe169051b63c446182ac8723b8b5bc92ee4b90b34b3102b449c9033203a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562044, "uuid": "c01b189b-521f-4f83-acaf-729ecc499ee7", "value": "T153735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562044, "uuid": "2afad1ca-ab25-49b5-b38b-0dd92d3d6e4e", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562044, "uuid": "00728a93-eb9a-4803-bdb8-20c3c24d803c", "value": 77571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562044, "uuid": "e259433e-13b4-4e71-8f00-f3ad8f86c063", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562044, "uuid": "d7f42ba5-c962-4fcc-9456-f596431abc5f", "value": "2022-1-27-9d10de4148841cec5ce594e4428ecf64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d54506-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575437, "uuid": "ec27c162-b70d-4426-8903-87b57e4765cd", "comment": "Malware payload (SilentBuilder)", "value": "b0c465ddb1472ea31071088db9b1e505", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575437, "uuid": "6e78ec45-0e9e-4f60-983b-28f1764bd165", "comment": "Malware payload (SilentBuilder)", "value": "2aa53a0e037a030feadc846c5da88a5fa59e2e378c88dcabea80a29cd2aa5c6a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575437, "uuid": "98c632e7-6e08-4ed6-9a94-f5b9fe8950cd", "comment": "Malware payload (SilentBuilder)", "value": "528b2eca57a74ee02995cbc5fc366247cf009f79", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575437, "uuid": "0d02ada0-f3ba-44e5-8dd4-b0f2f0811e18", "comment": "Malware payload (SilentBuilder)", "value": "47dbe7b8fa059f5049036219ad51443b815ed0ca6267570dd46e1512794fac38c8fd5a5cb74ef774139b8d39f44962c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575437, "uuid": "19d6ab5b-743e-4585-8176-e3b540eb4380", "value": "T13C934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575437, "uuid": "6b55431c-ff89-4e08-bc02-63bc6f93b532", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575437, "uuid": "213efb7e-b57a-4569-87ee-5c09ff735919", "value": 92957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575437, "uuid": "91499b90-e153-4b56-9dac-2f213439d370", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575437, "uuid": "8ab219dc-b511-4a9c-98c1-a7fad3a06e1b", "value": "2022-1-29-b0c465ddb1472ea31071088db9b1e505.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8bb259-8207-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643572734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572734, "uuid": "6a93bf9e-4207-4e2c-85fc-622c5183eef9", "comment": "Malware payload", "value": "f62c33ed3984675f9dc231a70faf964c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572734, "uuid": "012e18c4-da54-46fc-a8c4-55071b642184", "comment": "Malware payload", "value": "2ab519cf42e1100a5c60299f0664700de24549060e929838d13e98f8663695cd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572734, "uuid": "128e120e-4109-4084-8e28-35d97430e618", "comment": "Malware payload", "value": "252b7c8b80a23998c1f6a1c96d6650626c4e18ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572734, "uuid": "23789dd0-2c6f-4314-a9e3-5458959ce289", "comment": "Malware payload", "value": "0b5ccf73ffbce8ece3e5693f5d9553967009c943b78cfe5f17d39fa0c81d4a37facf329a2ad2311b90631eae6ddac914", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572734, "uuid": "331e7bf4-e0d4-483b-bee0-9da096c35707", "value": "T12EF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572734, "uuid": "b244e395-b7f2-4b0d-8034-3941b73a3ca8", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572734, "uuid": "43677125-b90e-42e4-80c7-14537de8198c", "value": 158680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572734, "uuid": "7fcec9f6-8b27-4412-accd-500c38f266f0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572734, "uuid": "43a4d1cf-433b-4ed9-89f5-cc81acbe555f", "value": "2022-1-28-f62c33ed3984675f9dc231a70faf964c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d420c9-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643559623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559623, "uuid": "a2884143-4ddf-485f-a88a-918021f6091d", "comment": "Malware payload (Heodo)", "value": "4d2e8d79c6c8e53237e41523397ce6a1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559623, "uuid": "aafe8bd2-a013-4196-9e8c-cfca63943ffc", "comment": "Malware payload (Heodo)", "value": "2aebdc0952549497f9cb11c7ba432fc272e818c6ee0882fe2bb547178a7ba766", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559623, "uuid": "1251c332-8c02-42f9-b5c5-961a16129db7", "comment": "Malware payload (Heodo)", "value": "b1f70017bb549c8303647cd38883a545f9961263", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559623, "uuid": "aeb81875-fc3f-43bb-9734-2ce8028f3aa9", "comment": "Malware payload (Heodo)", "value": "b961f2e53b03b86df9b04c02c1ae1d5efac02e299543defa7a6280bb6eaa41a1d97b199fe430e29f3133333a4cc75dd9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559623, "uuid": "989fae07-4cf7-4745-abb6-95ff63d0d023", "value": "T1CE131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559623, "uuid": "0c89e0a8-b629-4cf2-8f96-9d0ddef13c33", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559623, "uuid": "03e95996-e1a7-4dac-91ee-254525f6baf5", "value": 45034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559623, "uuid": "2f25cfef-75de-4654-be66-fa7ad6163988", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559623, "uuid": "b4479422-27b9-4db5-bb15-535b41d4c32e", "value": "2022-1-27-4d2e8d79c6c8e53237e41523397ce6a1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e689bbb9-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570951, "uuid": "b560c190-f680-41dc-a3e9-9cb7578dc629", "comment": "Malware payload (SilentBuilder)", "value": "c1d1bac474a4a668c46a8a176ff4c54c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570951, "uuid": "7f8b3aef-28ce-4b5f-8526-757659cf905e", "comment": "Malware payload (SilentBuilder)", "value": "2b01ef511079064759b8cffab8a3ede2e82cb6e124dd5a9099af67c824267780", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570951, "uuid": "4764e388-29e5-4ac1-ab7e-cf94f73f7355", "comment": "Malware payload (SilentBuilder)", "value": "79e7544c69d84e4d4f713b4dfda5674ebc72b55a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570951, "uuid": "137b5457-98e1-430b-95a6-1425214f8ecb", "comment": "Malware payload (SilentBuilder)", "value": "6937b769e7bc277a9cb845f138a93953ed0e71eed834718ff4bdeac52e3f2005aa7791028befdf05c9eebffbcd3c902e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570951, "uuid": "8247c746-934d-4fb5-b912-8b21f1571e65", "value": "T194233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570951, "uuid": "c3c4fb77-58cd-4658-8cbf-8fa29097f14d", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570951, "uuid": "3bfb5e8f-5996-4e67-af0a-e56e24f99fa4", "value": 47932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570951, "uuid": "5198982a-92b2-4de9-a3e6-0ef85adbc0d8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570951, "uuid": "c201d4f5-51f3-440b-adf6-1d1ba6a23bfb", "value": "2022-1-28-c1d1bac474a4a668c46a8a176ff4c54c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643c3f2d-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560854, "uuid": "74897982-15a4-4e17-9d8a-9112970c0b6b", "comment": "Malware payload (SilentBuilder)", "value": "6f54899ce4735a8d833922c884c1dd0c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560854, "uuid": "b6826bab-385f-470c-a1fe-13b7c9c4906e", "comment": "Malware payload (SilentBuilder)", "value": "2b0adf04374e38930efdf84407df30040688917b99a4d157eb3f436b7a298501", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560854, "uuid": "40725812-3b95-4e85-b99c-a156d46ebf5a", "comment": "Malware payload (SilentBuilder)", "value": "405057c6f43f4e2d34ed80e1638f7e37389ca15d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560854, "uuid": "8dc55d3d-74bc-4fcb-81c1-d1e144ee706a", "comment": "Malware payload (SilentBuilder)", "value": "bb9db6dbea4bf7f67ea7501786ecbf8ed65d30e1bc1dbe5b18ee889bc52d0d49071ca5567fe8f8cb5ba0d567850f3a4e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560854, "uuid": "b53ace46-531b-4d55-bd8f-5ce391ffaca1", "value": "T125F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560854, "uuid": "ac3a046d-ee85-4225-9866-f625732ede8d", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560854, "uuid": "d87574b6-80c6-4142-8dfd-8a684dba989f", "value": 158607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560854, "uuid": "4f42a0bc-5dfb-4110-86f1-719bf6ed51a9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560854, "uuid": "5cf344f5-2196-418c-b976-cfa14334c0ab", "value": "2022-1-27-6f54899ce4735a8d833922c884c1dd0c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9729bdcb-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566093, "uuid": "73e89832-fdd1-43f6-84e0-923d50ecddf8", "comment": "Malware payload (Heodo)", "value": "12a987b65d6526cf0323c84df28d02b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566093, "uuid": "466e1a1f-1a6e-4510-a269-6aa79956e6f1", "comment": "Malware payload (Heodo)", "value": "2b47e67fddd9a978a24d3abe5fa14efee5fd68913ee34873249f404a9cdeb9ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566093, "uuid": "488daf05-e459-43f3-a76d-d5cf26571923", "comment": "Malware payload (Heodo)", "value": "05baaeb4b03244512fb9c5a4493bbc667317459d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566093, "uuid": "84bd224a-bb96-4e66-8a1e-05a38f89f815", "comment": "Malware payload (Heodo)", "value": "f6438d07b1b7ef811de4428f137f0679e02a99cae9da21777b64c85f928cd0ee2c164d7b8894496c38701688aba9d973", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566093, "uuid": "4a2e8432-24c7-4fd4-bdc6-749d969ae435", "value": "T1D6E4BF12BB82C076C26E31B0459BD7B966F99E704F3496C7BBD12F3E1E741D14A3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566093, "uuid": "f8c434c7-98c5-4340-9c33-c3e49032eabc", "value": "d986dd84d593c1266f1531c47644f308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566093, "uuid": "ba757ea9-865d-45f0-b954-e6eceb4643f4", "value": "12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkpldzR6TqKCKDN:tviEdX3Y7GTCRhukkpwqUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566093, "uuid": "cf84672a-2c4a-483c-9f47-4b3fc4a62750", "value": 679965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566093, "uuid": "2ec6ad7c-bdd1-4fcf-9a62-1d4ee3641eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566093, "uuid": "8d5d6d82-c9c5-4a02-8393-1b8ace3199fc", "value": "emotet_exe_e4_2b47e67fddd9a978a24d3abe5fa14efee5fd68913ee34873249f404a9cdeb9ff_2022-01-30__180807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d39e8b-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566472, "uuid": "2a9ab970-0901-4f47-af2b-167c0a50efb0", "comment": "Malware payload (SilentBuilder)", "value": "23de9ee0383c49b2be5fff48ca9d42d2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566472, "uuid": "c66be31e-298c-4bd1-a316-c6de518040ff", "comment": "Malware payload (SilentBuilder)", "value": "2b710e3ac9cc71b6146b3282ccd1d2162de5d93809ef6d1075d777da37e76e59", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566472, "uuid": "a5923217-b780-43a2-beef-3afea23395c0", "comment": "Malware payload (SilentBuilder)", "value": "2eb41b366c0f834e11a036c0156b367d49a99b9a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566472, "uuid": "c8e9ec2e-6604-4f8d-bab3-f43b2e5082e2", "comment": "Malware payload (SilentBuilder)", "value": "9719bc87942ac5bb86a58c1d03aaf02250425e5d35eaa377ecb055dc2c1b39db9a58039fde4d22bdd2573ec0382dcdaa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566472, "uuid": "e1a6ba58-511d-405c-a8b6-323fb88c9766", "value": "T1AC839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566472, "uuid": "a9d53b23-d600-4d73-bddf-cc7a36ad249d", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566472, "uuid": "cc0f4f63-a462-40ca-baee-b961ae751b7d", "value": 86617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566472, "uuid": "e9f7b2cb-4c94-4570-a8bd-acde733f42c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566472, "uuid": "a5b72b7c-b4ab-4a67-b198-f8ab5dc3069f", "value": "2022-1-28-23de9ee0383c49b2be5fff48ca9d42d2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd871008-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643572707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572707, "uuid": "cc1dc354-31e7-4e7e-a240-d5ac54080142", "comment": "Malware payload (Heodo)", "value": "f553b3e0c08df3fd8e2080784a6c863d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572707, "uuid": "bfb446ad-8692-41a5-bc9f-d112663f01b4", "comment": "Malware payload (Heodo)", "value": "2bf9669411ae74c4c93e03680c58e0086f3f615ff93cd36fd75f85fd92a6a530", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572707, "uuid": "e7f6cbcd-0674-4946-b8d3-486a60a7b42b", "comment": "Malware payload (Heodo)", "value": "1868ac339d34563d12323034833dcf8d33b9ade5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572707, "uuid": "f6d054e2-95c8-40b2-a250-24a0ba4a7c2b", "comment": "Malware payload (Heodo)", "value": "bf8f3d5a09bfeec695120fa966ffb32f8db4109dc73eca5337a41e1bf9485f3d10431098342fb5de5bb7b1bb3d0219e0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572707, "uuid": "6f64624a-1717-404b-9c13-b075a4c830b9", "value": "T1FDF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572707, "uuid": "4c8cf67a-01b5-463c-93de-2e271c6119b9", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572707, "uuid": "32e13b82-d9da-4481-a57e-929043522cd0", "value": 159063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572707, "uuid": "c659426b-2537-4630-ab95-44e4ad78b47e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572707, "uuid": "2d3ecde9-a3cc-4533-9476-ec730810d860", "value": "2022-1-28-f553b3e0c08df3fd8e2080784a6c863d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06f2188-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561814, "uuid": "8f2cf317-50de-4786-839e-445ff1164b3e", "comment": "Malware payload (SilentBuilder)", "value": "b23611dcf9683e03d5313c3727a06aab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561814, "uuid": "c58ebe9e-aac2-4822-aebc-5b9d777e78a6", "comment": "Malware payload (SilentBuilder)", "value": "2c1b69fb2c79fcc454029a08721e9ccf3a84aa29578846aec04c15799258caef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561814, "uuid": "4aabdf27-430f-476c-947b-4cce7b028661", "comment": "Malware payload (SilentBuilder)", "value": "2170d8ace1c5beb79f02532c9545808c09ca9742", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561814, "uuid": "7107bde2-f81e-44ab-b55a-4094b8f84762", "comment": "Malware payload (SilentBuilder)", "value": "e1828348139dbed89dfa4ce5773947abbbd0ad9c465f714080fbffe46b152c3ce351c4d53c8ea7f36c354f395299b897", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561814, "uuid": "d92f95e0-2176-462f-aa4d-4715beb49ad8", "value": "T197934B1BA98648C5E66D47F4E0625AE9BE63EF45FA433ED321107FC63AB41434C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561814, "uuid": "f198f26a-1dd7-49a6-bd15-41f9a7399030", "value": "1536:8xIk3hbdlylKsgqopeJBWhZFGkE+cL2NdA/6yH5Eb7EdrpFkkGX/sGC6ORQQDBh+:8Sk3hbdlylKsgqopeJBWhZFGkE+cL2Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561814, "uuid": "28caba3e-8c42-43b9-90c0-965f96016386", "value": 92548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561814, "uuid": "3494c668-8e42-42ab-adac-dc606326ddbc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561814, "uuid": "629b861d-b59e-4a5d-b889-4bb047f40555", "value": "report_2801.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fc1f55-8203-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643571218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571218, "uuid": "d64e8193-066b-4465-a839-3b73d225ec0f", "comment": "Malware payload (SilentBuilder)", "value": "cb89b72fe97a4cd29188f9c566a4ce85", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571218, "uuid": "2d5ad529-b3ab-4397-a27d-9b0fa400ffcb", "comment": "Malware payload (SilentBuilder)", "value": "2c1d1137d6d33775834fbc49ea2f216a10f252cb3c427a630acac690dcc9bb44", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571218, "uuid": "6a76bb0b-5b7e-435f-9c99-28b1889016b8", "comment": "Malware payload (SilentBuilder)", "value": "9a487940694bf7bf29aa5890eaf8b7c14a8b124a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643571218, "uuid": "abf6592b-13bc-4bae-a815-222686e86ee7", "comment": "Malware payload (SilentBuilder)", "value": "e1169827288b7348cff07ceff8eb555ead00adf98f0f0201dd81df472bf9c9300d08604831659b85ef5ab2cfc41ffd97", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571218, "uuid": "2187d856-a76c-4a91-b4b7-7c7e4a919bd6", "value": "T19F233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571218, "uuid": "93220ebc-bc8e-4cb3-8f65-ad65945c45cd", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643571218, "uuid": "ac46a918-16e9-4b17-b1a8-a4f6a2cba7d5", "value": 48578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643571218, "uuid": "538ce5b5-4832-42db-aff3-7c9df9dcdd1e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643571218, "uuid": "b75ee5dc-0c5a-4bc3-b894-035814cdec8a", "value": "2022-1-28-cb89b72fe97a4cd29188f9c566a4ce85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e3146e-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560185, "uuid": "10503c94-aa11-4a28-b8b2-d9b5b060c00c", "comment": "Malware payload (SilentBuilder)", "value": "8e75048ef8a1a145e4aef77d154b6e63", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560185, "uuid": "610edead-857c-49d0-954f-321a77938b06", "comment": "Malware payload (SilentBuilder)", "value": "2c29ae14a43f15858732351d9e0599f0b15f4cd031beff427ad1613fa3889586", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560185, "uuid": "b0730331-20d8-4c66-8164-5dd488f58579", "comment": "Malware payload (SilentBuilder)", "value": "be0347332b59847e2406243ea61848c04a641669", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560185, "uuid": "1da62f45-446e-4cfc-b9fe-89f55ca55094", "comment": "Malware payload (SilentBuilder)", "value": "0dba77328730266284ec3b53e07f2a5a89219f9f925e513f04a823039230ad342f6f89faa7b1a56e814bcd59f0435a88", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560185, "uuid": "121b377a-5433-4bb1-853f-e2de95bc9ef6", "value": "T1A3F3CFE663E6C884DF15433E4CF2071A3767ACA25BE74747A305732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560185, "uuid": "e525768a-76a2-452d-b0de-3601b714f087", "value": "3072:a4+HymsLk3hbdlylKsgqopeJBWhZFGkE+cMLxAAI74UgCEqM5mheHRAjNKnlGIz/:/+HymsLk3hbdlylKsgqopeJBWhZFVE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560185, "uuid": "6ee25922-12ae-4bd2-8423-cfc935895a00", "value": 158681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560185, "uuid": "33a204f7-a7a5-469a-be65-0e52e2e9bd72", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560185, "uuid": "e075d638-b2ee-4faa-a7fb-daa357e39256", "value": "2022-1-28-8e75048ef8a1a145e4aef77d154b6e63.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fe48b9-81ec-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561335, "uuid": "e560481e-c601-4d6a-ba7f-72ffed03eb03", "comment": "Malware payload (SilentBuilder)", "value": "7fd349ba6f4b5d028440647fdd72479c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561335, "uuid": "9a2f75f0-1419-45b2-9b9c-cc8595bbf760", "comment": "Malware payload (SilentBuilder)", "value": "2c5487f274baf485cc018774a07bd212e762485c49b92caec8b9b75cca3857b0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561335, "uuid": "fe85caa2-b859-4d12-b2db-24ead80438d2", "comment": "Malware payload (SilentBuilder)", "value": "2a317db32073760839f632abcf7a564a876e108b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561335, "uuid": "e177bdfd-c2f1-4e1f-9fe1-dccd2f9a88ca", "comment": "Malware payload (SilentBuilder)", "value": "5670c7c18b4c294469283c60cc98a7c7331b74cda8f6f153ffe131a564ba87e527743f9c007ed41e164c4f7b860acca8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561335, "uuid": "e4f3918e-861e-4b1e-b080-df31cd7702ca", "value": "T1C2735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561335, "uuid": "c5df629d-0b45-4be5-b0fd-53d5eab483da", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561335, "uuid": "860a4053-3afc-4d27-a4d9-edd4f1acd941", "value": 77961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561335, "uuid": "144830bf-3964-44e3-ae83-b1a92c6d7986", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561335, "uuid": "e36083f2-50ac-401c-85c8-aab9289b4016", "value": "2022-1-27-7fd349ba6f4b5d028440647fdd72479c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7bc11c-81e2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557057, "uuid": "2b21162c-2eab-461d-a324-18ec1257124d", "comment": "Malware payload (SilentBuilder)", "value": "094dd5eef5482f556215b743e1d0a5f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557057, "uuid": "84729548-0a94-4ec1-ac5a-e6876f56d071", "comment": "Malware payload (SilentBuilder)", "value": "2c55dc970552a8c9c1a7429e4704e611517f176e49fc411e388bf18bd6668251", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557057, "uuid": "2f77708e-932f-4bdd-8aa2-27f9e96d209c", "comment": "Malware payload (SilentBuilder)", "value": "cdeaad9d28bfb9c7df761a21052e4cc1967b1822", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557057, "uuid": "7f77821d-bdf9-4581-ba84-4f7ae9ac3c6a", "comment": "Malware payload (SilentBuilder)", "value": "30c27d3c949589df6db87738f30b0b66d6f7331bbdfd7a3ddb2774993349f0983491db676fe0056eff858b9104ae5108", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557057, "uuid": "685b1f68-0c5e-484a-a960-efb89c5ece12", "value": "T161C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557057, "uuid": "85bb7e7a-8262-46e1-94df-4269d56c08c0", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557057, "uuid": "3d9046b5-5783-46c9-8d17-6d00c1655b11", "value": 119109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557057, "uuid": "6282bdb3-26b9-4e3c-8490-6b6ed9ef5ad7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557057, "uuid": "68a0a1df-dc17-45cd-afd9-a012de3404f2", "value": "2022-1-27-094dd5eef5482f556215b743e1d0a5f3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827de2df-81fa-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567347, "uuid": "2c5451af-7b0d-4f6d-8e58-57d5065e2dfd", "comment": "Malware payload (SilentBuilder)", "value": "4395ed395041df6530ef571fa2d5e890", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567347, "uuid": "85b12296-ddb5-41f3-84e9-49e083d168ca", "comment": "Malware payload (SilentBuilder)", "value": "2c581eba36148672715c506dd407841d613040e10d073e1bbee8002a7f69dd51", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567347, "uuid": "8a7c6642-27aa-4ed0-9650-044b74450b7e", "comment": "Malware payload (SilentBuilder)", "value": "08a0e6373ac92a44d4725cb3b7ac29b15efbb6c9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567347, "uuid": "ccbe1dfc-3f84-4e27-9cf0-c0efaf66a1b4", "comment": "Malware payload (SilentBuilder)", "value": "774e92e7104c79e60e03e96161adefbfc3089622a258c6c0af5213df6bf00f9aa3e14a49c662e33bd9aa960e8977bcbd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567347, "uuid": "16ca8ed3-7e5e-4999-8454-c846525f4516", "value": "T1BD839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567347, "uuid": "d82cb8e9-07d0-499d-b03a-c4d3ee2a7188", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567347, "uuid": "d66a30ac-ae53-434d-a849-7ab67a8a9070", "value": 86807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567347, "uuid": "8fec133f-1b2f-4e2a-be50-19b9ad1e028d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567347, "uuid": "fb8e2708-1797-4741-b3cb-0250ad4fd851", "value": "2022-1-28-4395ed395041df6530ef571fa2d5e890.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2993e9f6-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558608, "uuid": "0cc42928-427c-4bed-86f9-650011d8ad0c", "comment": "Malware payload (SilentBuilder)", "value": "2d6cc86e016599256027d27216fa570c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558608, "uuid": "543fda14-a2ac-4348-8804-60a26778d5ad", "comment": "Malware payload (SilentBuilder)", "value": "2c9b1b744810484899fff02950b68c9b3ddfa2a42dd62f868f3b26312d513677", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558608, "uuid": "7fac3f1b-652d-497f-acc8-10a9d3a86055", "comment": "Malware payload (SilentBuilder)", "value": "2fa9dcc7238a38938da1c28226d9b0ae4472df80", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558608, "uuid": "350134bd-62e2-44b1-944a-d660c4e1691a", "comment": "Malware payload (SilentBuilder)", "value": "a43c9b2912342d3488c9c6a15719bbbf6a8ab8117bf19e9330fc90bd1e19dedb406237704436ebb8d06168f26a1ea2e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558608, "uuid": "18b669c9-1fd9-45d2-beca-2038b37ab2ec", "value": "T1A2131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558608, "uuid": "5c100656-bffa-43bc-acaf-68b0f06b8711", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558608, "uuid": "757d9d21-109a-42c4-9196-44b376f5b5f8", "value": 45459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558608, "uuid": "15361ce9-1c69-41de-a197-8230d052a128", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558608, "uuid": "a072bad4-e8b7-44fb-ab7f-b551f189fefb", "value": "2022-1-27-2d6cc86e016599256027d27216fa570c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a36aff6-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561696, "uuid": "f6dcad8f-dfdf-4266-9052-854dee8edadf", "comment": "Malware payload (SilentBuilder)", "value": "8e102657daedc05be0bacae880b71323", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561696, "uuid": "a1f338bc-cf0d-4374-ae29-3f8ebb83f053", "comment": "Malware payload (SilentBuilder)", "value": "2cab9c888e52a30915633fce9b123d7921cd724accacf7c7ad7dc8c0c92f5d45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561696, "uuid": "34e269a0-a232-4805-80a7-78e8e8117b7e", "comment": "Malware payload (SilentBuilder)", "value": "01ba503f37a7f4ddfdce266a8a0d4d75bcb32851", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561696, "uuid": "3f3633a6-c11a-4d39-adfa-451a8d801091", "comment": "Malware payload (SilentBuilder)", "value": "8e972d3b08bb22f4c9a6a46c02f9ce25b012d3afffb300d875257cad81aafc1189fca7b7abf2d62551b37753812b8825", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561696, "uuid": "ad1ddb28-4b02-49d3-8e1a-2600dd36dd08", "value": "T1CA131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561696, "uuid": "20e67219-a5db-45fb-a518-35543f73fea3", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561696, "uuid": "c03649af-f173-4e45-9fce-6bd025fd36e7", "value": 45190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561696, "uuid": "40d9099c-919e-4884-9461-e3558ec87466", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561696, "uuid": "a166c5ca-b43c-4773-8b57-3f4cef33896a", "value": "2022-1-27-8e102657daedc05be0bacae880b71323.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98df26c-81fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643567922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567922, "uuid": "f25de423-d85c-4f7f-8504-7ad7c0922969", "comment": "Malware payload (Heodo)", "value": "575e660692d95457592b7e23aa542fd1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567922, "uuid": "10e04ee6-e2ec-419e-bd50-803b6d3484cc", "comment": "Malware payload (Heodo)", "value": "2ccc41afc91431c5ae7aadfef979e7e95171d9a183be5f5655b6716135dcf8ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567922, "uuid": "802f5aeb-083e-4aa5-b21d-05a51dd96413", "comment": "Malware payload (Heodo)", "value": "c810fc2e555148659e82c522ff8034f81961b248", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567922, "uuid": "fd055625-4a65-46fc-a868-950517858ad6", "comment": "Malware payload (Heodo)", "value": "bf85ec814428adcfdf0f577172317e407fdbd7b903527f47eaef3f67d2642c3e6ce977e683ecc1cb48b8aec399fb13ea", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567922, "uuid": "b724405a-98de-4fb5-a947-16681bf63918", "value": "T117839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567922, "uuid": "3fe7a1ad-cc45-4d6c-bf5a-14b678870677", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567922, "uuid": "6d17dfb2-5a58-41f7-b8c2-f87c371b854b", "value": 87088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567922, "uuid": "028a1c23-9a77-4a53-a8e4-aeb23891db2f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567922, "uuid": "bc492445-d5f8-4edf-995c-d0125af82abb", "value": "2022-1-28-575e660692d95457592b7e23aa542fd1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5556b631-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568989, "uuid": "84836fb6-36fd-4ccc-89fe-d1e75d33c720", "comment": "Malware payload", "value": "7ac5c8d60b830609b359a59f963f1a70", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568989, "uuid": "6f7f685c-e882-4d8f-8e0e-b20121f9e67d", "comment": "Malware payload", "value": "2ce1961a3bfc47c050b257fa3b1debba7d30c5177a5a662378eae215a4ba674d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568989, "uuid": "9be26419-9444-46b8-b64c-e5b8f717fa28", "comment": "Malware payload", "value": "c478798609933f6e2fcdfee891725ae5cc43d7cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568989, "uuid": "93aa5c5f-ff3d-4504-9455-5a849f08d151", "comment": "Malware payload", "value": "7f85d098a7d6c68059450b373c324ef0541938f2587271e6e633b6b562a5933dc7f422a707e296ec27498828cef178d5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568989, "uuid": "d90aac9b-e59e-44b2-94b2-33b26c39af3c", "value": "T187233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568989, "uuid": "f4653e0e-aa94-48f5-af98-21e35e6d2e3b", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568989, "uuid": "9ae8b591-353c-4d28-84ad-2cd5dab2e8ac", "value": 48087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568989, "uuid": "4ab17645-8aba-4003-9bac-7c1b0e487f8a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568989, "uuid": "6a3494d7-e30f-4e87-bf73-3bb75ac5275d", "value": "2022-1-28-7ac5c8d60b830609b359a59f963f1a70.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40be981-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565256, "uuid": "303c903e-fcce-45da-bf7e-dfe93dc9d0c6", "comment": "Malware payload (SilentBuilder)", "value": "006e74aad35e0c8643186ff5c28deeec", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565256, "uuid": "3a4b7f99-9649-4f5a-8ff2-4182369ba9a5", "comment": "Malware payload (SilentBuilder)", "value": "2ce7c4541d7b637c76f7bf8d1bd36bb10ea8e4a9efe51d748102529a84dc0382", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565256, "uuid": "e71967bf-7d71-462b-9b2b-7097242a9c57", "comment": "Malware payload (SilentBuilder)", "value": "aa30c24e57377603d484c2994c2bf14b7898b5c1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565256, "uuid": "ec13a8b4-8e52-466d-a27e-c2272cae5987", "comment": "Malware payload (SilentBuilder)", "value": "3a23a13f335f83bc468ec0dedb3e3e7bc0e8bce0d21c44c106ddace6e0ac68faa6079cc5ccfc397fb8d7d175e098d926", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565256, "uuid": "d14bd896-10a5-4437-a715-b2773c305bfa", "value": "T1AEF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565256, "uuid": "0baf9622-783d-43f4-ba38-94d4c4d93706", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565256, "uuid": "98825d2e-2ef2-400e-8cd0-3408cabf97e6", "value": 158953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565256, "uuid": "b163b065-67ab-4c8e-8733-07bb8e27044b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565256, "uuid": "bd948a40-efe6-46fb-b3bb-a41f8e07b0c8", "value": "2022-1-28-006e74aad35e0c8643186ff5c28deeec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84eeeb66-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561767, "uuid": "67a757b4-aef7-43a9-8f0d-88b177d8fcb6", "comment": "Malware payload (SilentBuilder)", "value": "9083199437466b9d0db6d95b866b04c4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561767, "uuid": "278a2ddb-e978-4ece-b302-b15573a15652", "comment": "Malware payload (SilentBuilder)", "value": "2cf75140b8bb7bdfbfa133668a6bcaa244aea7f89647ac2486ef62bfd2587dc3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561767, "uuid": "4cf373d5-7261-4a3e-a812-9cde98c1b4e9", "comment": "Malware payload (SilentBuilder)", "value": "aaefd1647cae3f3fe799e3fcf88abf89c5127074", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561767, "uuid": "c3cf198a-366f-4375-b0a8-c8bdb3ed2b66", "comment": "Malware payload (SilentBuilder)", "value": "08980609413eb7edd10f674b6cb20bdb956927720ae78c638c61f4290c14f825093bcd915a185d2a588409778c988f11", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561767, "uuid": "a6463e5b-06a4-43dc-83f4-8d451e0aa1da", "value": "T19B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561767, "uuid": "7e896daa-64fd-4461-980a-78f97fc0c7af", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561767, "uuid": "6d61e12d-9778-42c7-98ef-c93e9ce16922", "value": 77946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561767, "uuid": "ea14b067-4ac3-4743-85e5-e1d4a645ea0f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561767, "uuid": "68a4c4ed-1445-4ff2-9ee2-855d69f49fd4", "value": "2022-1-27-9083199437466b9d0db6d95b866b04c4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a56e4f-8208-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573184, "uuid": "dfa59e88-f385-4276-9fb7-77b4fe7c9bec", "comment": "Malware payload (SilentBuilder)", "value": "029de3c2bb423310487691a3dc2f8e7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573184, "uuid": "b7c81724-93e7-407b-8254-fbb5bb7e1901", "comment": "Malware payload (SilentBuilder)", "value": "2d1e1834e2f7e4557c5bb93b6d6759fa2af4f6188e8c6e311e7f666b1580ef0b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573184, "uuid": "afea4298-cc0a-45b2-a56f-bed70df91d21", "comment": "Malware payload (SilentBuilder)", "value": "f86c91c209dd412580d7ca41b32a3d0d77f62c6c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573184, "uuid": "a6816d71-1f7b-4baf-9467-62eab661be32", "comment": "Malware payload (SilentBuilder)", "value": "41f9384afa2df6508702c4f36a3ec7181b9aa1a42555debd9aeba041e3d43df21cbe8635582f8f876f8decf202d9c37b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573184, "uuid": "abc45478-eb0e-4606-80ea-d2af0951128b", "value": "T156934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573184, "uuid": "14f95193-d372-439c-b4f1-38877a5c00bd", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573184, "uuid": "e2299578-7572-4dfe-854a-96028a7f774d", "value": 92173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573184, "uuid": "e857433c-a161-4e50-bf75-ca62970385b6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573184, "uuid": "fe90b150-2edf-4a96-9fb9-90a764c2146e", "value": "2022-1-29-029de3c2bb423310487691a3dc2f8e7b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8b2b70-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562639, "uuid": "eb64902d-ae8d-469e-bc5f-e328143bbb81", "comment": "Malware payload (SilentBuilder)", "value": "adc82f5d832fb517293211aca29f93e6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562639, "uuid": "cc7534af-1c9e-4b77-a943-0eeb2077b35e", "comment": "Malware payload (SilentBuilder)", "value": "2d4d465e26ec482974041f698bc5b5c32ff19552010ded0f56e109d481a1d89b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562639, "uuid": "e592a326-a76e-4acb-8986-96dbbaf9f546", "comment": "Malware payload (SilentBuilder)", "value": "16b7903bbe62464074fac885a5253a8d34255586", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562639, "uuid": "765733bd-598a-4920-a186-11856b5daa2a", "comment": "Malware payload (SilentBuilder)", "value": "3fd16960608c6336739c7c5387393b40762edb04678629cc8f3f03b52c38a375dfa3ee1168a4806173c01daa192b4975", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562639, "uuid": "36f73b8a-dbad-4556-a987-4e16a9dd7a1d", "value": "T1A5C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562639, "uuid": "0accb12b-0fd0-401a-8692-6c6fdea0115e", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562639, "uuid": "cf1315f8-2c46-41b7-b050-7d93174ea369", "value": 119302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562639, "uuid": "f5a0731b-5b5d-4145-a137-990c11dde1ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562639, "uuid": "9e4984dd-706c-4ff4-b397-21aaf5d15ec9", "value": "2022-1-27-adc82f5d832fb517293211aca29f93e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bc9b22-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564376, "uuid": "1115a205-61c2-4225-8ec1-374c5f910719", "comment": "Malware payload (SilentBuilder)", "value": "e2d90587a5473fb5a19d81a4e0e3b7e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564376, "uuid": "20e26c80-68fe-4a18-b398-19b41f03c221", "comment": "Malware payload (SilentBuilder)", "value": "2d750ca1df15a933de081583177a1f209dbb0c7127c6ba5ec33be68415dd7ed7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564376, "uuid": "751e8c5f-553f-47c1-b8a5-01d4a13b10c4", "comment": "Malware payload (SilentBuilder)", "value": "c1be2ecae7d5beed78374092823816fd897e028e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564376, "uuid": "7d5bb573-c135-4c5e-a888-4be48664c244", "comment": "Malware payload (SilentBuilder)", "value": "b08923ad88e2fc9c2e49d1b94efc3b670fefd4b1091b92623da8999f2138c64842721aa204f7d7f98d50a0912050edc1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564376, "uuid": "63dc933e-b882-4e3a-8be0-95736bc6e196", "value": "T12C735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564376, "uuid": "544544b9-287b-458b-bbdc-ab540d8709c7", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564376, "uuid": "28328613-c266-4d70-b515-68f4052f9325", "value": 77862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564376, "uuid": "cb1e47fc-376b-4f36-ac7d-6deec3fd921f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564376, "uuid": "006b78c0-aa33-41ee-b1f7-4074cdc4e923", "value": "2022-1-27-e2d90587a5473fb5a19d81a4e0e3b7e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ac487f-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560995, "uuid": "69e2ae18-3a29-4ee5-8ac0-910100fe1498", "comment": "Malware payload (SilentBuilder)", "value": "7435a5ad2560e719129a62e71f279a5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560995, "uuid": "c71c045c-0f85-4f7b-bc49-586f5fa0839b", "comment": "Malware payload (SilentBuilder)", "value": "2d7887784440edc28a7492bbf7b3bdabaf2307739a7be7648205b75f2292e19e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560995, "uuid": "aa124d6f-d1a9-4b46-994b-af1fd35e6aa4", "comment": "Malware payload (SilentBuilder)", "value": "b5895382d27393bdc10cd9f250bcdd2610b94fc3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560995, "uuid": "66673a78-ea80-488c-8d9f-bff8de11c8fd", "comment": "Malware payload (SilentBuilder)", "value": "24f7b97d1cca1c0856db5d7918435a06ad74f347a859a9cafdfdb0d622bc5efce7bbaed4b69fa9c33c8021b85025cbd3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560995, "uuid": "e8fab5fe-dc4c-440e-aa47-9dfa67207c17", "value": "T16C735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560995, "uuid": "7f2ad36e-9685-4def-a01b-d773bee12014", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560995, "uuid": "ec1f007a-f05b-4e1d-93ed-e4643a3803ba", "value": 77874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560995, "uuid": "7bad934f-0b08-4d04-aee1-81778cea1197", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560995, "uuid": "5c8c6c59-11f1-47a3-98d6-7c6b7ae9a714", "value": "2022-1-27-7435a5ad2560e719129a62e71f279a5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28484eca-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569343, "uuid": "5cd54090-110e-4357-85e6-aec882689eb9", "comment": "Malware payload (SilentBuilder)", "value": "861a968ce352828b6ba44510082abebd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569343, "uuid": "1c9232a6-7e05-4954-ae77-cfb29d6b10e7", "comment": "Malware payload (SilentBuilder)", "value": "2d84260a3e0359442945a4503cb2b214cb4f3b2a6a493a1d43f4812a8c5bc1c8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569343, "uuid": "8d3b2fa1-56de-4f7e-96c1-6fe45cbce41d", "comment": "Malware payload (SilentBuilder)", "value": "be0d28f158455d98507d23da0956428d9d77141f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569343, "uuid": "3facc5d7-4feb-489e-9f50-101c0173d489", "comment": "Malware payload (SilentBuilder)", "value": "40a19a4b7fe5e224a7072d2ccfeed29919205861226c9305e36d3e64077b03f3d125e589a06d052250ce064798dbb5ee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569343, "uuid": "167768ec-edf9-403b-b96e-6ba2b4e4b6a3", "value": "T1A2839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569343, "uuid": "a0f985ec-7a8c-4d94-98e1-fb6f98a2aaa9", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569343, "uuid": "8f7adee6-44f2-400e-9c8a-b0a8907c092e", "value": 86567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569343, "uuid": "14d404ae-9105-4f0c-b4fc-b424a295d2f9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569343, "uuid": "8001bc62-a577-40a9-907b-2ccc3e70cb6d", "value": "2022-1-28-861a968ce352828b6ba44510082abebd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bc90fc-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643569419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569419, "uuid": "dbddb0b7-8586-43b4-b593-5429f726ddc0", "comment": "Malware payload (Heodo)", "value": "89dbd16cc50884676e94fe6636f671da", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569419, "uuid": "61f651cf-fe8a-4a8a-a4ac-2d5422a41716", "comment": "Malware payload (Heodo)", "value": "2d9ad614b1730288daf11d2d0b66e7c65440f330b9e6aba1bc1ada13dee04784", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569419, "uuid": "2df58806-7655-4707-96cf-44c4240582df", "comment": "Malware payload (Heodo)", "value": "d6af91286ac43a54e37bcb60e536e5533892d895", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569419, "uuid": "6b87c29d-496f-45e6-a175-893791fb1a53", "comment": "Malware payload (Heodo)", "value": "1e39ff2b7a48264eccd6b51d458a69726d28c5375c992a01543a2d50c86f869a7f9ac6938f6bcb4626d7601d171c1442", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569419, "uuid": "d2347539-b401-4a82-b74e-9f65b1997622", "value": "T1B7839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569419, "uuid": "95305094-99a3-452c-aa85-6d7ca59d2664", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569419, "uuid": "ebeeca9f-dee3-407b-bd77-6176e6f2783a", "value": 86839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569419, "uuid": "3581e107-ae7d-4ff9-804c-fc245009a0e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569419, "uuid": "e603396d-12d8-47dd-b355-e864b5539e33", "value": "2022-1-28-89dbd16cc50884676e94fe6636f671da.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33829b88-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575375, "uuid": "afe2ffc3-7d38-49a6-9cb7-a8467dbfd9a3", "comment": "Malware payload (SilentBuilder)", "value": "aef47138179981230eca450239ed20d5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575375, "uuid": "473d562c-b07c-4825-81b6-fb4d5044e83c", "comment": "Malware payload (SilentBuilder)", "value": "2de9b6381af2b1e3ef3d2160cea6456837a173cff5ce2f0d65b9a132390e73d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575375, "uuid": "7f8da654-5aed-45ca-89ef-02315d1a92d8", "comment": "Malware payload (SilentBuilder)", "value": "6c599bad1ebde9bab304c8e67b12eebb9bd28740", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575375, "uuid": "5d047a45-c404-42f4-bfd5-9498cfb9b01b", "comment": "Malware payload (SilentBuilder)", "value": "8ae694f32d46ca77c61a4248158766d7eda13af01a2e86c647885a37c75343b419e7c8ff9a5b08e197059d26d3990ae3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575375, "uuid": "2d150aad-506b-40b6-a67a-32b204c21ce0", "value": "T16B934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575375, "uuid": "fc7c03a5-93bc-4bc6-8997-aaa74ff53610", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575375, "uuid": "af55f835-ccea-4a2b-a558-935df9b11607", "value": 92925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575375, "uuid": "7fd63242-312a-47eb-a2e4-b738cc2b8cb5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575375, "uuid": "e37cf9b9-9bc5-433b-be65-1d695d883b98", "value": "2022-1-29-aef47138179981230eca450239ed20d5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b2d693-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558621, "uuid": "319f3bb8-b883-46c1-8e2b-3d29c592c97d", "comment": "Malware payload (Heodo)", "value": "df4aed9d302b16535cc9dad024aab7b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558621, "uuid": "6922e3da-5da4-4d05-b0f3-dddcbe35d676", "comment": "Malware payload (Heodo)", "value": "2e04a924b41631e2af65e44ddcc989494f9849e63c675f34e9eabc319d5b81e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558621, "uuid": "53845455-ab19-49e9-afcd-c6096e9521ef", "comment": "Malware payload (Heodo)", "value": "8c6cebbab80c70c3f477a0d0069a9989fe386aa4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558621, "uuid": "d1932080-6c26-4f26-8948-a0b573d88bef", "comment": "Malware payload (Heodo)", "value": "68eb32b32d00c9f67a09c1938f8b5297a372c8aea88323cbd795529a48fa50536de278332510f364ea11b75468d79a44", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558621, "uuid": "81f55bcf-088a-4746-8db4-837e81355e26", "value": "T1D3E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558621, "uuid": "a15ec7ae-be7e-4514-84e8-b9def90e233e", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558621, "uuid": "b51db8c4-1033-4829-a473-e2cd6571f93b", "value": 145989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558621, "uuid": "e557adea-8764-4e09-8649-00eb72ea9ce2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558621, "uuid": "5aed66f0-826f-46eb-b546-78e32e3da1f6", "value": "2022-1-26-df4aed9d302b16535cc9dad024aab7b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bec1bc-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558727, "uuid": "9d86e334-1608-4b99-b8e1-f340d64a79b4", "comment": "Malware payload (Heodo)", "value": "ebcf56a4943e0782760759086e11363c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558727, "uuid": "e018990e-245e-46a5-bd93-f7952d769b7e", "comment": "Malware payload (Heodo)", "value": "2e33c680f6d3c0e65076556f12895df30c971eb9c3a2a1eb9e935be1110c2127", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558727, "uuid": "490d1596-cff2-43ae-9273-cf9f9e8581a5", "comment": "Malware payload (Heodo)", "value": "edee7f31c13ffb12c83cafd81f9fa7c3088b2589", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558727, "uuid": "04fc6aae-8d6b-4b7a-a591-2e58c4c14dab", "comment": "Malware payload (Heodo)", "value": "11f86f76bc9e77526412cbfb76d0d70e40682913115aaf7975995fdeab1fad74b5366d0ec187c6f2c233909e72bf3aae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558727, "uuid": "e7389a6b-9f02-42ea-bbd4-7a557a28e9ab", "value": "T102E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558727, "uuid": "7908c942-d1f1-4829-a884-5beb72936515", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558727, "uuid": "01d75dc6-6f2b-45fb-b53b-b9edffdac1a7", "value": 147388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558727, "uuid": "c9228967-9968-42c2-834c-89e619425dad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558727, "uuid": "007a2969-971a-4447-adbd-33cb24c20b57", "value": "2022-1-26-ebcf56a4943e0782760759086e11363c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d363d03-8202-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643570586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570586, "uuid": "f30353b9-ed1f-4c5f-8e35-6ea53cf82a02", "comment": "Malware payload", "value": "b2e5c4ac4a1adc58d33fbf144a77bf0c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570586, "uuid": "cfc59cf8-941e-4c8f-99b0-db2436e9e8e1", "comment": "Malware payload", "value": "2e39dd39d02a2b85e39b0b84b1ef9205348ecc1de419e271742986966a91c31e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570586, "uuid": "9981b6a8-db73-4dce-9b21-aed47e456b98", "comment": "Malware payload", "value": "622c830ef9297112869cd45cbb27773a61ef2e2a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570586, "uuid": "846d96c8-f54b-4746-a924-e14c2979a159", "comment": "Malware payload", "value": "4820d7d07ac64b36bf7933538932ecacad7a13e3ef57e05c4fb29c53f5334c03b3aa1c60d59c8ad2a01970a5db64af53", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570586, "uuid": "1be43da6-aa92-4339-aeb7-3a7e0df6cf0a", "value": "T194233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570586, "uuid": "6b8a231f-4d47-4fb5-8908-b474501d0083", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570586, "uuid": "36856d2a-62b5-4918-93c0-80ca4f4b6370", "value": 48712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570586, "uuid": "4141e5d0-291c-49a9-96c6-990abd088e2a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570586, "uuid": "56802c82-2b10-45f5-b9e3-6fe76d8ba27d", "value": "2022-1-28-b2e5c4ac4a1adc58d33fbf144a77bf0c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6896e5ba-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568162, "uuid": "cdcc3f94-a503-4f85-b18b-58d678a02f70", "comment": "Malware payload (SilentBuilder)", "value": "5daa4150903477197795bac753706c96", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568162, "uuid": "4800df4b-050b-41b5-84e7-246c0a8e13d9", "comment": "Malware payload (SilentBuilder)", "value": "2e44f19d43f227f85ece55f2881ea22952209b04d19117347a2d6181ca3cfdee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568162, "uuid": "80125c59-877f-4bb6-8cd8-ea29e9151774", "comment": "Malware payload (SilentBuilder)", "value": "f0d2b837158bda6879934600c85fb7892d322da0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568162, "uuid": "35acbb69-c7a1-42cb-b329-eae732f0b777", "comment": "Malware payload (SilentBuilder)", "value": "0190b501f5826952cf934cec2cbefe4d17e8adac226742fab099583c78e2c03a0ad09ed201643fe541d3643bb32da603", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568162, "uuid": "bcfe97bb-af66-4c66-9a39-4990f38a6fd2", "value": "T1BC233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568162, "uuid": "e3e2dba3-60e2-4874-89ed-5966bc15e3be", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568162, "uuid": "77507a7a-adec-44a0-b17e-8653277c3b38", "value": 48395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568162, "uuid": "b665a998-c205-4646-9d39-d396c87d6e4c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568162, "uuid": "c0ff3da1-6441-48c6-94da-1f3d5a5207f2", "value": "2022-1-28-5daa4150903477197795bac753706c96.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8747bd8a-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570361, "uuid": "19682df4-23f3-4833-b15c-860af7ca0acf", "comment": "Malware payload (SilentBuilder)", "value": "ac72e58ff40f92ed2d0aadf2e1379813", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570361, "uuid": "07267f69-be9c-4003-9dbd-91f2b11b175e", "comment": "Malware payload (SilentBuilder)", "value": "2e5fad521eadd8b640334b96378f38049b0e307838b2e19a4e33f10aaa03b573", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570361, "uuid": "ec20ae33-cada-4672-80a6-956916068373", "comment": "Malware payload (SilentBuilder)", "value": "2163f120a979a7c55faaa8b082fc4d3a4edc1409", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570361, "uuid": "16f76c40-4f8b-49a6-bec2-8837ac3193c5", "comment": "Malware payload (SilentBuilder)", "value": "9dfd79972e53287c68f26622c73d50f379fad133220de7c648797b92e5ffb40898bfbce1ef1a03afe3d5b5c9ada03880", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570361, "uuid": "872fd006-b2c6-4593-9c76-b66954547fac", "value": "T179839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570361, "uuid": "3437dd48-9099-42dc-b9c5-11919599e190", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570361, "uuid": "efc8deb7-a1c8-4c08-a239-65ae402b4467", "value": 87431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570361, "uuid": "b8d712f9-1cc2-442f-9c45-09c2e92fab7f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570361, "uuid": "72b6530e-4c90-40aa-bbce-509a37930aa0", "value": "2022-1-28-ac72e58ff40f92ed2d0aadf2e1379813.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5705a1-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558939, "uuid": "ec2fc375-9ed6-4904-9828-74978ac3d4f0", "comment": "Malware payload (SilentBuilder)", "value": "376666dec235c5ba8a43915b11112b4d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558939, "uuid": "1b05b22b-d3ca-41a2-9d96-2682dae0d6a6", "comment": "Malware payload (SilentBuilder)", "value": "2e76ae900794b23148beb7d77c22fce4ce9ea0e2fd7307330f3d2cfee5550fc9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558939, "uuid": "4d4989dd-a8a9-4eb4-a673-21d021ca58d5", "comment": "Malware payload (SilentBuilder)", "value": "a987d302501686c06f5cf686795eb0e54c9ef97e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558939, "uuid": "da5790f2-4354-489f-9b0e-700a343de570", "comment": "Malware payload (SilentBuilder)", "value": "63b4911ae23f1014604a20011a808647aac998cb31c94a5ae85279a19a9f819e7661d3b1c08d1cf819f9df194626eb05", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558939, "uuid": "159fc101-cca5-4b64-9c86-81863a6431a2", "value": "T1DC735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558939, "uuid": "e32198e5-f62c-4960-bb79-2b4288f6fdfa", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558939, "uuid": "315b1908-2a91-4f0d-bdcf-634d5696fa99", "value": 78320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558939, "uuid": "c492b48d-2471-4374-a58a-53a833243a76", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558939, "uuid": "9807f0d6-9428-42e2-aefa-c075cef35d36", "value": "2022-1-27-376666dec235c5ba8a43915b11112b4d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c376ae-81ea-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560376, "uuid": "15cb76a8-7441-4d45-aca7-f67330103be7", "comment": "Malware payload (SilentBuilder)", "value": "627e681ca580083bd02de989298412af", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560376, "uuid": "cada0fad-f277-4e2e-94d2-bb953cb226b6", "comment": "Malware payload (SilentBuilder)", "value": "2e8d3571eabf014b009f316283ea3b7ab7a6562dfb2f9ddda5039bb6655d29fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560376, "uuid": "4d73c1ce-01bb-4937-b7a8-4ecd28f46d3d", "comment": "Malware payload (SilentBuilder)", "value": "870feb5de09a8a5985dc67e0578506b17b298ad7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560376, "uuid": "05191eed-272e-4244-be84-4cd3408146ea", "comment": "Malware payload (SilentBuilder)", "value": "55bbfe7644c74a201c5b9ac388cdfe10981c5c391f97bc898d9d9296daa2bd95890d833af04eb29b11a4518099082067", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560376, "uuid": "3820f7db-1d97-46d7-a43a-9224ccc28b0e", "value": "T183735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560376, "uuid": "0f6081dd-7062-42b0-935b-6fd44fcb210d", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560376, "uuid": "9a68a6ee-30cd-4207-873d-05aebfbb44b8", "value": 78064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560376, "uuid": "fca98d1d-87bb-4409-9347-c03e48671815", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560376, "uuid": "d1b9b449-f290-431c-b893-e39b5ad5c74a", "value": "2022-1-27-627e681ca580083bd02de989298412af.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19722bf2-81d7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643552138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552138, "uuid": "eee11553-ac13-4daa-a632-bffb8cf6a4d6", "comment": "Malware payload (RedLineStealer)", "value": "ad732321beb6f0821005d3c301dccdc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552138, "uuid": "1e7b3e6a-10b3-4fdc-b3bb-beb2a3793091", "comment": "Malware payload (RedLineStealer)", "value": "2e8e2f3b627ec21bc24a14b5ae253a4c18f7f1e6a4e77ddde108620296b03000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552138, "uuid": "fca0744f-49c3-4ec8-9a8e-903bf64d426d", "comment": "Malware payload (RedLineStealer)", "value": "563db43fcd83d0498806d0c0c070bae533a2223a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552138, "uuid": "5d7b2d57-6ae3-4066-995e-2098a3ee7cef", "comment": "Malware payload (RedLineStealer)", "value": "2ec054616e82f40023550c9a0fd3c218eaa6fca05d72c643324313ae91a6acff390ac23e3d58d0f5f58d03e6438c227e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552138, "uuid": "090e553a-dcd1-4004-9fd9-3e3738ab2056", "value": "T1A506334367CD578EC10FB9B41EB58E1A53E1E76321C6C2AAF40B83D93B2D0B1965C6B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552138, "uuid": "a09789ff-068c-46d7-815e-aa8de7564d7b", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552138, "uuid": "15641a2b-cc7d-4908-9f8c-de89cac9eebf", "value": "98304:XcHDUeb0sxrrKjKncWZR2a0E8Os+v0AEFSga:EDUbgGmZR2VE8OFySga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552138, "uuid": "d336c202-d13d-4426-85a0-61f9233e7212", "value": 3665920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552138, "uuid": "41f45d98-4808-4c43-ba97-229539eee985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552138, "uuid": "33208f14-4828-4fdf-aef7-230bcdd4f4e5", "value": "ad732321beb6f0821005d3c301dccdc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea5a325-8198-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643525169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525169, "uuid": "fbd577f1-20cb-4f84-ae39-b7cd3861d9f2", "comment": "Malware payload (RedLineStealer)", "value": "18fc06d7b1b067c74b2c09e9d6ea9460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525169, "uuid": "caa2b8fd-ebc9-4a62-b20e-a9f87e68e812", "comment": "Malware payload (RedLineStealer)", "value": "2e94c2b33a93e5b61497fbf1c3bdac637fa76b318dc8dc7f1ddb0af92193100c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525169, "uuid": "03b61240-dc37-455c-96be-cbb0a7ac185f", "comment": "Malware payload (RedLineStealer)", "value": "bf358ec8e0e0567cf33513c94e83fd6e33d99860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643525169, "uuid": "ed6e6001-149b-4f5e-ace1-a18609564fec", "comment": "Malware payload (RedLineStealer)", "value": "bfbcebc02126d1917d9909419196dedb2052b54070f18317711bc8206c1424d14fe32c47eb4c72245d624480dc13a1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525169, "uuid": "75bfb45b-7e41-403f-8031-b0f988af4260", "value": "T106041841AE80D731C6AC273785AB85001332DDDD56EED70F7A59F6386C7339A2A9221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525169, "uuid": "d6c635da-8b77-4903-9f2d-7be88ba143b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525169, "uuid": "e017cd36-855d-4b01-91e1-ac0b01aaedc3", "value": "3072:HtP7y5MblfNnr5ROH2Uzfd0RjlpW1B1oym:HtPxb9ROHxd+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643525169, "uuid": "dbd71292-9455-4d11-99fa-8a538ef479d2", "value": 180032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643525169, "uuid": "1103527d-582b-4d29-ba14-5e7b7f4ad8ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643525169, "uuid": "c28fe3d6-a44d-422b-ad00-fac5a1d8d0bf", "value": "18fc06d7b1b067c74b2c09e9d6ea9460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8710d9-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566750, "uuid": "d9f8d090-79c3-4975-a66f-8ec147d53148", "comment": "Malware payload (SilentBuilder)", "value": "2b70e0973f2c4441fa9f62bfd30996e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566750, "uuid": "98e27ac4-149e-4277-93f4-57528dd57883", "comment": "Malware payload (SilentBuilder)", "value": "2ec3bfb8b46e3a191d57df998bb6dfc6a1d6ac60c57f08700b52f946e63df3d5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566750, "uuid": "f98476d8-4b6e-478b-8c1b-49285e539a7a", "comment": "Malware payload (SilentBuilder)", "value": "2855b5841d6290717e9352a520fa7aec50300e7c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566750, "uuid": "e0fab24b-2265-4562-8819-fd7c9bf94c47", "comment": "Malware payload (SilentBuilder)", "value": "99b20fdb18b61bab41acfecfef906cc0fac2ef24b9b7e72c38aa8274cb76268fbf54c2ba3973f7b7f1941747a0643ac7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566750, "uuid": "fcf9278b-5d3c-48c4-b19f-512c3924aca4", "value": "T149839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566750, "uuid": "cdb85837-3e62-4284-901a-56875dbd71c6", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566750, "uuid": "f180387b-6aa4-4932-bb2a-3d6614d61ec2", "value": 86561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566750, "uuid": "304ec0ad-e2a5-4b1e-b8cc-0d2f834a3716", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566750, "uuid": "42d3609c-268d-47bf-82a7-4195bfc764ee", "value": "2022-1-28-2b70e0973f2c4441fa9f62bfd30996e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250b04b9-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568908, "uuid": "7de3a0e3-0434-4098-a3f0-eda38de824a1", "comment": "Malware payload", "value": "787bd84ac6e9099d3d2809a14eab5b0e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568908, "uuid": "d5857c03-dd22-48c0-bf65-8f5fd2439f6a", "comment": "Malware payload", "value": "2ecf23206a33b8c3e6e70cd708ba5e3fef31442d474dad8d0b9e8a8adc72e3ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568908, "uuid": "47e1a230-6624-47d6-bc9d-0ebbf9b5d183", "comment": "Malware payload", "value": "901c5d8c7429c9b3b371f2662650416c58c3de14", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568908, "uuid": "0ba37639-4d2e-4874-9a07-a4747f3b7da2", "comment": "Malware payload", "value": "562e9dcd5cdc298b298dc99f4fb013fae0f981fba5011c0242f621a6891f4629fd8e4c1dd6d0135aa32fe8338f1cded2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568908, "uuid": "5dcbc792-12c3-4f9c-bdba-f9ec0dc9d9af", "value": "T1D0839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568908, "uuid": "f010a793-e457-4821-b8b8-f8b9ef59ecd2", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568908, "uuid": "12858d92-5551-4d69-b953-cc94c89920b7", "value": 87466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568908, "uuid": "a92a30bf-4ce1-475a-b70b-5b3041615645", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568908, "uuid": "e8a5a0c8-140a-43e4-828c-14c65730d0b3", "value": "2022-1-28-787bd84ac6e9099d3d2809a14eab5b0e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cde0e75-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575793, "uuid": "94a46d90-bb55-467b-81c6-b1b5844046de", "comment": "Malware payload (SilentBuilder)", "value": "cc28d0195f1a573922086af1d66f1612", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575793, "uuid": "c5f63a87-1be4-42c0-9ae3-9b35e89421f5", "comment": "Malware payload (SilentBuilder)", "value": "2ecf55b8751b09b99340ebda4e762160a1fde8dc32407116916fad1cd4e6892e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575793, "uuid": "1a535b61-e7c3-48b7-9fbf-d4537c8714aa", "comment": "Malware payload (SilentBuilder)", "value": "69b850a7820789e79f422fce07f2c7f6db84a0cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575793, "uuid": "e731f5c1-8ce1-443b-b964-76a415cc784e", "comment": "Malware payload (SilentBuilder)", "value": "bb699b2899cb52119c8edcb11ca61ba6f17bfcc67ce38df763460e24f469839aea963f107ee7190c7d3194bb14ef2f1e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575793, "uuid": "c01b0c0f-ec6c-4d34-b302-36d148b2d868", "value": "T1CE934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575793, "uuid": "de592d64-9c8e-484e-aba4-bc466103b10c", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575793, "uuid": "5837f7ce-0f9e-4e6b-8e51-2bb7ea348d72", "value": 92410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575793, "uuid": "76ca3aff-bc67-405c-adb9-44bc9b4c67c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575793, "uuid": "6d600291-f5ec-4c60-98d4-e3a44944bae6", "value": "2022-1-29-cc28d0195f1a573922086af1d66f1612.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65babfed-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557850, "uuid": "07f812d7-5eae-4190-81f2-185fe5a8d455", "comment": "Malware payload (SilentBuilder)", "value": "1534bf46b001749beeb6c71b01481836", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557850, "uuid": "23595fd6-b7ae-4829-ad8f-823b425bb47c", "comment": "Malware payload (SilentBuilder)", "value": "2f313bdd1f0b1f89af7c8edef079c540d6c7bdbac84a6fa776cd2c64c188b535", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557850, "uuid": "06f7cbf3-290b-47e9-b584-7f4d742b056e", "comment": "Malware payload (SilentBuilder)", "value": "eb5ec84a44a2cf3626d535ab79a9153bae9d4981", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557850, "uuid": "9ef3a0df-14d4-481d-a0e9-18d9b7909d26", "comment": "Malware payload (SilentBuilder)", "value": "f4081e42f0d66ece7d8969e388123601eb8213c3f7602a7d252d4179728c4aa6d7c8a6c877e0aa241e88b5a6ae8e02ed", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557850, "uuid": "6fa191c1-4e04-4dfd-88cf-21d0580f8e7c", "value": "T12A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557850, "uuid": "eaaddf9f-8c52-4f1e-973f-9abea4848092", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557850, "uuid": "fdc397de-1d42-4a1a-b8e7-cab14ec95b2a", "value": 77583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557850, "uuid": "af3623d5-b10c-4712-8727-e436c2f1a54b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557850, "uuid": "04c4c9d7-8e7f-49ba-adec-d54e108e3cdb", "value": "2022-1-27-1534bf46b001749beeb6c71b01481836.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fd888d-8206-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572351, "uuid": "4375d60b-f5c4-4160-ab8f-d65833e0695c", "comment": "Malware payload (SilentBuilder)", "value": "ea944f4f618cbf58ef91e58994527059", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572351, "uuid": "4aa46a19-a393-4add-9194-d101d0ab31f9", "comment": "Malware payload (SilentBuilder)", "value": "2f38e8439566c854c2f0971402f865b9ebe3f6ce8b8e05d8a5fc2a55cfc3b444", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572351, "uuid": "f403a4fe-cb23-4ba4-9034-dc6ba5e6bcff", "comment": "Malware payload (SilentBuilder)", "value": "06d51384e46e2c635ca937b92fecc9c1bd54371d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572351, "uuid": "912b2977-d833-40a6-85a6-62c73a08aa8e", "comment": "Malware payload (SilentBuilder)", "value": "558c70f0b1aa001fc307a44cc310e68fb7471df717217dfb19b2975fe5d1efca8aabd3d5dc7fe290c9ec66a9ec7b90c0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572351, "uuid": "17d6ee94-3812-4eb3-a962-c65701983005", "value": "T1C9F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572351, "uuid": "0db67d75-09fe-4c33-adac-7a10f2085c07", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572351, "uuid": "0288783b-87af-4e57-abcd-3602e9db1503", "value": 158420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572351, "uuid": "c2a09aea-4eed-4c24-a1be-06bdd30be212", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572351, "uuid": "2d6013e8-cb6a-4f30-9680-af154d840986", "value": "2022-1-28-ea944f4f618cbf58ef91e58994527059.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24d57f8-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561951, "uuid": "3d4a17d8-680c-4406-ac01-4e45ba9fbf9a", "comment": "Malware payload (SilentBuilder)", "value": "98a930aa993e5c90b1a8a2e1bf7ef920", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561951, "uuid": "64bb466c-1fd3-42e1-8c72-2302646e893f", "comment": "Malware payload (SilentBuilder)", "value": "2f4386e2292f14f9df4e733331f9e1dda4a5ce200a809e887d35387ede0d5b7e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561951, "uuid": "eab285d1-4d36-43df-b837-98a0532a0d17", "comment": "Malware payload (SilentBuilder)", "value": "6d35ac44bf7da38fc200daec3eee81942829da3b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561951, "uuid": "ae0f301e-b5c9-4d74-8277-440c4704aa4e", "comment": "Malware payload (SilentBuilder)", "value": "5f9a492f3fb4cea6990e3079777b93fcb0fa874495c1bacdea4c73996eb0bba8271616a29482ee45d17fc5ac8cf70db4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561951, "uuid": "f5734a4a-8172-4257-9e6a-6721d42f9456", "value": "T1A0131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561951, "uuid": "90d47763-7267-49b0-b9ce-12409d0c6e00", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561951, "uuid": "0722f8eb-5c4b-4e7f-8958-e31f269182cb", "value": 45221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561951, "uuid": "8c337a93-8d2b-4d3b-8b03-c7f36fe11759", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561951, "uuid": "2950e24d-4c10-4fce-8654-4c8c5236b450", "value": "2022-1-27-98a930aa993e5c90b1a8a2e1bf7ef920.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d413539-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559875, "uuid": "8f457705-91c8-4382-b5be-85a1b305fd49", "comment": "Malware payload (SilentBuilder)", "value": "6b3ccfc801fa2d24bc8decfa7f65a665", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559875, "uuid": "bf9cf7cc-7ba6-4dae-aadc-a873415edd1f", "comment": "Malware payload (SilentBuilder)", "value": "2f6ac87194314879796798ff3f003b042788c6cafbfeb72cd6aa8b7208785be3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559875, "uuid": "18c344bb-35e2-4edc-8170-8e3dd61a15fc", "comment": "Malware payload (SilentBuilder)", "value": "8487ef5a0ff4c75fb477c0f1d6b61816046e0e81", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559875, "uuid": "e5ec7964-0e13-4a8e-9b22-ee8d528ad344", "comment": "Malware payload (SilentBuilder)", "value": "850a18d395dbb9fd246debca1b515b1dfdf326e77f29b464d2ab4f7ae026b2066781785571f043b3d36c634c40bf9ec3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559875, "uuid": "53113813-2577-42fd-9408-0d5e4e5d45d4", "value": "T153F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559875, "uuid": "684f0356-f75a-489b-a09e-cdc15d6af0d2", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559875, "uuid": "8c1d449c-3ee5-40f4-813f-fdfdae89eae1", "value": 37371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559875, "uuid": "f25c4893-544d-49b5-9f29-3146a939588f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559875, "uuid": "0779b3c9-e6e5-4e69-af09-8cd9c2adb0f3", "value": "2022-1-28-6b3ccfc801fa2d24bc8decfa7f65a665.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd09a9f6-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567042, "uuid": "953e2722-806b-4402-a3fb-8cc7c76a42ff", "comment": "Malware payload (SilentBuilder)", "value": "37177ba8a6bbdd74d1d13d3c681e9246", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567042, "uuid": "f7361def-636f-4f3a-bb0e-b04d444ca250", "comment": "Malware payload (SilentBuilder)", "value": "2f89de40bee4be975c46bfff839621f7ce2cfbb7f59696f4f420da29dda58164", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567042, "uuid": "7b72502b-47cd-407e-818a-499df2cec127", "comment": "Malware payload (SilentBuilder)", "value": "e37fd2a4b74b9441941384983824a0e4b89c4ce6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567042, "uuid": "4f4e54dd-ef8a-455c-97df-911a707a0da7", "comment": "Malware payload (SilentBuilder)", "value": "4c162387e8fa834faa908dbb71bdb256e3d29dc8e0875ff050df3e9116705ecdb3907f9a6ac832650e0145bc1bedc882", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567042, "uuid": "8b77dd1d-cf25-4572-8b7f-5d563bad77ee", "value": "T19E233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567042, "uuid": "a7e067ea-786e-46ac-a9b6-d1a1f0db916d", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567042, "uuid": "a6ea9390-5dc5-4935-bdc8-b1c9f6cddfd2", "value": 48137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567042, "uuid": "f19d92c5-5d69-436f-9d81-cedf4096ce0a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567042, "uuid": "678d2acc-557c-4ade-865f-7cde2f41697e", "value": "2022-1-28-37177ba8a6bbdd74d1d13d3c681e9246.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac43f7a9-81fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643568705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568705, "uuid": "e9655a04-f314-4b71-b24d-d126c995c600", "comment": "Malware payload", "value": "71cd92088440ee0ac724582278fddb46", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568705, "uuid": "6a06d15e-ab41-4956-811c-2037f11d5edf", "comment": "Malware payload", "value": "2fca820cd7e2030a03cfbdb929159c1da0cb264cd7c2ea075b5d7ae1a9d8a102", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568705, "uuid": "51cd5e8d-c06d-4806-a5d0-4e660d068553", "comment": "Malware payload", "value": "99a05c437ed6acd7e239f50914cf003df6685617", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568705, "uuid": "319ae988-c9c4-4d2d-9569-27e2853c508f", "comment": "Malware payload", "value": "7d0775b84e63c1ee6718b13e1589135f10b91cf9115fe0f7008842b3c6f22e234961f95c4b7dfae26a7afcbceed91d5b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568705, "uuid": "2855f00f-7403-4006-b6f2-04c3182b15b8", "value": "T1A1233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568705, "uuid": "247ab5d8-107e-4986-b42b-cd8f901e89fb", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568705, "uuid": "2b5a20e8-8f37-4240-9143-3d5ed278e943", "value": 48062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568705, "uuid": "6c45b6e3-f2b7-4f80-95f7-5029246dee53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568705, "uuid": "b3c29599-29d3-4daf-9011-8e81c7bb36dc", "value": "2022-1-28-71cd92088440ee0ac724582278fddb46.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e110b9d3-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643566217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566217, "uuid": "d02ee1ad-2a95-46ec-aad0-1b0bc728586e", "comment": "Malware payload (Heodo)", "value": "190fdbb652d31380af54202a2212c8de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566217, "uuid": "1ac3ce7c-7d80-48e4-906e-61182d7ed1d4", "comment": "Malware payload (Heodo)", "value": "30109c3c06102f8e616793eb841649b9b9ed50cf19f4d0d3ec0d08cd91f292e7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566217, "uuid": "5eb7baff-d071-4845-8c99-a55c3365a5bc", "comment": "Malware payload (Heodo)", "value": "c28252e4e64284a0a6aa63a42012bae0360c0f7e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566217, "uuid": "792f9755-7a34-4066-97aa-91be312d0ec1", "comment": "Malware payload (Heodo)", "value": "875f2482a638b09bee265a7b0ff584c4abb66792fbf32c37c79ff26fddf8ac0f5603331b56b5201d190b0c3bcc741d49", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566217, "uuid": "15646ef7-0236-4c86-82c6-abe102bd0ee0", "value": "T193F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566217, "uuid": "eb390be7-5c75-4c46-b37e-a6d355ae8e40", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566217, "uuid": "895cdc44-c5fd-4415-8f6c-5d5459e12693", "value": 158376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566217, "uuid": "3f14ba5a-13e6-4dee-8b4f-0e05ddc3c011", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566217, "uuid": "5c850855-877b-4c95-870c-45af3a650e82", "value": "2022-1-28-190fdbb652d31380af54202a2212c8de.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3e5b04-81f2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643563951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563951, "uuid": "9aa3e392-0a80-4b5e-9838-2bfc4af33bbd", "comment": "Malware payload (SilentBuilder)", "value": "d7c1ce09508c0237c4fc45e80d83c2b5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563951, "uuid": "004f37b4-251d-404e-b26d-6bb6224ee8bf", "comment": "Malware payload (SilentBuilder)", "value": "30223be0e1f97bb27de607315ba19d9f4ddac5f0848ff8f0e661870ca6cae92d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563951, "uuid": "823e21aa-4de2-46a0-b09c-485ba708bc75", "comment": "Malware payload (SilentBuilder)", "value": "0baa9c78484e3e90689934c2edb28af19ceaaa57", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643563951, "uuid": "49f0133c-6d2f-4f7f-b590-deb5bf777644", "comment": "Malware payload (SilentBuilder)", "value": "93e603aa414e5dc684f4cb6e9186c89f8423aea7c667c245fa0d85e0611bdacfe493f53154d122caee5478bc01034f32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563951, "uuid": "9cb54479-78ab-45ca-ad4e-45b565946aab", "value": "T116C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563951, "uuid": "2b6dbe36-378e-4953-b463-2fd34b3cf17a", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643563951, "uuid": "18b76975-ccae-46f8-b64f-5ffa34dd9d77", "value": 118971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643563951, "uuid": "2b8b6e4d-1b8e-49db-a672-779c19d93ae5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643563951, "uuid": "a38d3854-ea72-4f51-9fda-f89ff78cd8a0", "value": "2022-1-27-d7c1ce09508c0237c4fc45e80d83c2b5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da083cf9-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643573077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573077, "uuid": "5c9e00a5-29e4-47bf-84c0-c2cc9d71dc29", "comment": "Malware payload (SilentBuilder)", "value": "ff1798b2b5948daa9c40e8948d645a18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573077, "uuid": "97b5ea1c-8995-4afc-bd68-68fe16b0ceb2", "comment": "Malware payload (SilentBuilder)", "value": "3041fdca3f26c89aa18f59220ec15de596e4ffc714901cf9fa7ba8f775e5c341", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573077, "uuid": "4e50e29e-305d-45fe-bb0b-220fa02e905e", "comment": "Malware payload (SilentBuilder)", "value": "56cb15b722deaf932fc8354936a596f83ebd625b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573077, "uuid": "7f4fcfa7-6a32-40e3-95d3-d317d2bdde37", "comment": "Malware payload (SilentBuilder)", "value": "df5da2298a4ce8a63b276cec5a6fad274084251a8b1f939f9b8c3428274322427d1365d7445064165e8e3515531fa0ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573077, "uuid": "05607d74-1407-474e-bea5-3e684303b4be", "value": "T194233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573077, "uuid": "671698d4-5794-4d6a-8db9-1b4b91fa7a46", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573077, "uuid": "61675afd-a1b7-491a-8f9f-4b5c57b767cf", "value": 47872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573077, "uuid": "e767ce48-880b-42b7-bd5d-b6fee2560b3a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573077, "uuid": "c1239fca-4d5b-4002-94f1-057543e7507e", "value": "2022-1-28-ff1798b2b5948daa9c40e8948d645a18.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35cab22-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643570918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570918, "uuid": "b6699408-fca9-41f2-8064-4b74f6d1573b", "comment": "Malware payload (Heodo)", "value": "bfac3a270e1a2c2bfc91a858897951e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570918, "uuid": "95de5d23-538e-4b03-945b-d25d484f62de", "comment": "Malware payload (Heodo)", "value": "30481b64f1fb7ff75860a229e9cbbd1d97c3b299a863d30387aed535af79f970", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570918, "uuid": "83bc3849-45e8-495e-8adc-65d9cbd71f1f", "comment": "Malware payload (Heodo)", "value": "d4c078a3b6a5053419b58d2eb502619569361d76", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570918, "uuid": "75c50a17-efd3-4b2f-bdae-8a22e84f4832", "comment": "Malware payload (Heodo)", "value": "7c6723f3450d0ccaa28aabe70d21a5f3d79b1ac05fdc700f2b4f0f3ab5086384fddde43ad94ae32b9be0bdc6377ada1e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570918, "uuid": "08700e9f-b610-469b-8fe0-3276a42f8e63", "value": "T109F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570918, "uuid": "8fcb3803-7919-43d4-b1d1-39d69913ff61", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570918, "uuid": "b6e7090e-954f-42da-8fcd-2ffa86012695", "value": 158662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570918, "uuid": "a3b56112-c08e-41ab-90a3-e4e37c85ab9a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570918, "uuid": "98660816-42a7-4baa-b993-775f69c13b38", "value": "2022-1-28-bfac3a270e1a2c2bfc91a858897951e5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3219c45d-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559481, "uuid": "13cc414c-823f-4959-8a4d-31cee8254bc2", "comment": "Malware payload (SilentBuilder)", "value": "393ae7f052010ed8c78997998af54526", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559481, "uuid": "49198d8a-9fa9-42cd-a160-d188db3e86b6", "comment": "Malware payload (SilentBuilder)", "value": "30627e75c3697ba0ccc76c9a037fc06d9d0e38049ece5b28b6a6b3eec654ce2d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559481, "uuid": "f7c1b4db-11c7-4f60-b200-af1b345afd02", "comment": "Malware payload (SilentBuilder)", "value": "4bb715a9f8a0614524dbe047d38d5f43e6999a61", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559481, "uuid": "a67488bd-e5e3-40b9-8061-a55ada080d66", "comment": "Malware payload (SilentBuilder)", "value": "610d461ea3d45b9a4db96a4b1daa2a581f86001d685f5f629ee3af4d69de159b37b3e1843942e3e403f0d58214e3de24", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559481, "uuid": "e1710d46-bb90-4b11-b0cf-c27a09b5fd7d", "value": "T116F2D7977B8BD999EA45033A4DA34255B713FC159FAB87473204F3261EF89E08D03A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559481, "uuid": "e65f2041-4839-4ae9-bc76-b99f105b0599", "value": "768:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJjj6ehEnmEzk:f1kk3hbdlylKsgqopeJBWhZFGkE+cL2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559481, "uuid": "e895c06a-2ecf-4f99-9071-6a1b44ef10ee", "value": 36969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559481, "uuid": "ae130ff6-575d-494d-b1d4-97610a567e45", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559481, "uuid": "b1c67e7b-fae1-4e15-90b9-b1431301c157", "value": "2022-1-28-393ae7f052010ed8c78997998af54526.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2e0de1-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643576248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576248, "uuid": "54b2a3d9-d68b-4823-ae57-652daa39a88f", "comment": "Malware payload (SilentBuilder)", "value": "ed9cf2809f4cd271cdda405edfaec753", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576248, "uuid": "953987f3-dfb9-45f7-87c4-775bd3310ace", "comment": "Malware payload (SilentBuilder)", "value": "3084bba9fbe6f33ecae50e0770fe9f5f7572d89fb97b3eae8a28c597a26b143d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576248, "uuid": "95b6d46a-1fb8-4936-a5dc-6539929c53c8", "comment": "Malware payload (SilentBuilder)", "value": "33466c970b912b93664be57c3065b13846895ca5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576248, "uuid": "9915f4f8-3259-4da6-a055-e02a0b6d4bb4", "comment": "Malware payload (SilentBuilder)", "value": "5ea7af41c7ea65c8ffa3b46d6e995351a58bb98c39fbb9aa58006e698d9183fae81a6cd9f2521f4e6f8b13167e8ba4d3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576248, "uuid": "403960c2-0303-4f53-a8d2-de5b30f2b216", "value": "T196839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576248, "uuid": "b8daa1a8-0de4-4724-a6cc-61d62c5bc7ae", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576248, "uuid": "4d554964-8d9b-4ddb-93b2-1fc49c83abe3", "value": 87606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576248, "uuid": "2496cb11-35d6-4149-81ac-b8b1c6272eca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576248, "uuid": "725ad112-8967-4e1a-9f3f-a85b61593567", "value": "2022-1-29-ed9cf2809f4cd271cdda405edfaec753.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df400de-8182-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643515773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643515773, "uuid": "39c388ba-2a4a-4938-a71f-0cd91beb8a50", "comment": "Malware payload (Mirai)", "value": "ad63f6bd753ba7cab98a80395fb2a212", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643515773, "uuid": "3160bcf2-3e7e-487c-9aef-47829d3d61ca", "comment": "Malware payload (Mirai)", "value": "308ec0de876e196879219cd6ee7653d55f642509a81145c2f2a5926e219ecdea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643515773, "uuid": "abc66e47-2635-4b74-8bb7-5098fc4b8fe6", "comment": "Malware payload (Mirai)", "value": "ed41a9b66ebae65a6cd763945d4acd446ffdf722", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643515773, "uuid": "65417654-7d75-48d0-82d9-69a6b42a7245", "comment": "Malware payload (Mirai)", "value": "47516e3db21fd9b1b19984c69860e65653664e1c08b981a79f14e65aaf8091109b4fcbb9ad831af1beb868b6c45d2e81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643515773, "uuid": "28ba35f4-92f7-4509-abe0-04d7746d07fd", "value": "T188C2D054E45C38FBEAEEADB6F6C9DDC173B18F8CB5EACC9291A0C70548864327610D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643515773, "uuid": "f0c8ca83-86a1-493f-a4d3-6c1d211b7f2b", "value": "768:9CKgZIzHc4uq6L1VBvbQNrNz/JLMwa4uVcqgw09QO:9CTZIJmL1sNr0z4u+qgw09x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643515773, "uuid": "906df4c2-e610-4815-9193-6d6d4c3b0e31", "value": 26220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643515773, "uuid": "bd6f6bc1-3f19-4c9b-ac38-83600fb0c62f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643515773, "uuid": "4b122e91-1e2b-4aa7-b6af-7f241cf26720", "value": "ad63f6bd753ba7cab98a80395fb2a212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e32ece-81ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569312, "uuid": "66ca89c5-e2cb-4759-a053-722024fd7bdf", "comment": "Malware payload (SilentBuilder)", "value": "84b9a8f12ff328680632a969bd1ba81a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569312, "uuid": "dcb656d6-2e46-4a2e-8815-0dff01467ea6", "comment": "Malware payload (SilentBuilder)", "value": "3099fcfca47fcf95a49d04859c26e82dbc12d6c2f545b8d1b9eb4bdcacbdcaca", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569312, "uuid": "1b59fef6-a656-4348-81e7-fbfb9431a26b", "comment": "Malware payload (SilentBuilder)", "value": "522faefc0468d352b577159f1dff3f80213e616a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569312, "uuid": "9fda74d2-ce23-4073-9bd8-6b7afe99d320", "comment": "Malware payload (SilentBuilder)", "value": "c735e69040374a3f8fc7af3b796b7b28ae5c1d61ad903f7df1598274f990a3912da3516cde8932b89a968eb5e2ca2011", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569312, "uuid": "724aab1b-7f7b-459a-ae65-5abb4320d199", "value": "T17C233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569312, "uuid": "fbeaa1db-147a-421e-9ec1-1af71393bd4d", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569312, "uuid": "97f69cfa-2cd0-4643-92dc-25083995d17c", "value": 48665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569312, "uuid": "ef4e6b84-5181-4b91-9294-32b52ac1f7b9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569312, "uuid": "067cbb5a-2a46-4e5f-a6cc-42770464b5fb", "value": "2022-1-28-84b9a8f12ff328680632a969bd1ba81a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9963cd-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572870, "uuid": "918d191a-652c-42f0-af71-2409df8b187b", "comment": "Malware payload (SilentBuilder)", "value": "f9a07ee67966b99ae93a06c8a7cc7c71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572870, "uuid": "7f155587-4787-4813-bd38-01dfc0df78a6", "comment": "Malware payload (SilentBuilder)", "value": "30ad5eb7a5db85efeee7bff168439bf50a293aa0750a9ca83ad4825649b32263", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572870, "uuid": "e9413517-3991-4eb1-ab53-6118583b11d3", "comment": "Malware payload (SilentBuilder)", "value": "87bf131097ec429c8953b5612234ad00513f5a9c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572870, "uuid": "39111074-fa46-4725-a981-bbba35c6dbd7", "comment": "Malware payload (SilentBuilder)", "value": "f77aa06dbd16fa5ee34e67d6c9116bb80a3b1265738d3a13f98bd318ac8f57074e1995e553eb0abafa61579d9c35224f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572870, "uuid": "6b1dfddc-f4be-45ca-887d-7a60a1c89682", "value": "T1A0F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572870, "uuid": "2fe6b447-67c1-4756-8697-69ac1c0cbda1", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572870, "uuid": "88744bff-fa00-49c2-bb7f-2e27ef5b5a6d", "value": 159124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572870, "uuid": "4e77db2c-f4a9-417e-bd5e-347775c4646b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572870, "uuid": "20d4b0e2-02a3-4917-ad6a-09724dcad931", "value": "2022-1-28-f9a07ee67966b99ae93a06c8a7cc7c71.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc207a6a-81e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643557136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557136, "uuid": "3b4f8e5d-b878-43cc-9627-3b66237ec076", "comment": "Malware payload (Heodo)", "value": "5e18c25fc561fbc7f57d72d9f231af00", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557136, "uuid": "237278a0-e558-49c6-bf67-81bdbe9721c8", "comment": "Malware payload (Heodo)", "value": "30d107ca6cdb50aef3961ee70fc73cda4ba7420488d9a6c05e0eefb37af56c58", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557136, "uuid": "27cf4d91-5c7f-475a-9c67-9ca858aa9204", "comment": "Malware payload (Heodo)", "value": "0aa2f1f1df2c84effa98e59fef5440d201663bdb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557136, "uuid": "1ed8c52e-26e6-45e0-a8c8-23f3ae6e8210", "comment": "Malware payload (Heodo)", "value": "52614925e651ebcc2f01f5cbff3e73bb06f287d6497c5df5dbac08276168334f52c467e79c7bd670eac5fc6ff35e9678", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557136, "uuid": "9916a39f-464b-4777-8b76-33df2c986ac5", "value": "T120E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557136, "uuid": "b8944728-35f5-4999-97ea-30f208c2bce0", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557136, "uuid": "14baafbb-7716-4aa3-a9e3-1680213af09e", "value": 146148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557136, "uuid": "570dac7a-7332-43cb-bc98-a1b906425280", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557136, "uuid": "c49f6435-2b7b-4d79-a5e1-8f9107b42347", "value": "2022-1-26-5e18c25fc561fbc7f57d72d9f231af00.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607ac16b-81f0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562995, "uuid": "1dc374c1-5890-45cc-963d-10f7d57f9fad", "comment": "Malware payload (SilentBuilder)", "value": "bb719669bc5d4c381fc6d68e8bd071e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562995, "uuid": "e0416968-67c1-4cc2-aa6f-e9f911b054ca", "comment": "Malware payload (SilentBuilder)", "value": "30dcde0b6b6e511aaed5290f974d8cf089e48a1081ec3a4cec9a3c62b098ff7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562995, "uuid": "5fab4d7d-4173-4d84-97a3-502c048f8280", "comment": "Malware payload (SilentBuilder)", "value": "bdbbfb46a3648ef3eee3daa6636f39b1cd8c9990", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562995, "uuid": "cd72bf21-5f26-4f80-9034-09d89a7de7a2", "comment": "Malware payload (SilentBuilder)", "value": "946467cd75372fd793c40b65828c1ae4a6ae77fc78b6ac7a8145308157ffa14b01a1cb68d6a332f7be9a4212bcd600a6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562995, "uuid": "0f72882c-99f7-41f1-b2f3-ecf998ea2878", "value": "T127735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562995, "uuid": "6a35addc-c2be-4832-ab5b-69c37b5cf0ee", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562995, "uuid": "c9353a9b-438c-4027-863c-19440dbbb13b", "value": 77446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562995, "uuid": "cea0809d-804e-47de-a3df-abca217c0e27", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562995, "uuid": "27f95c05-662a-4ac8-8bad-8f66650ccda9", "value": "2022-1-27-bb719669bc5d4c381fc6d68e8bd071e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f6be2d-81f5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565396, "uuid": "6996c3bb-8a01-4cbd-97cc-a8cec2dd2e22", "comment": "Malware payload (SilentBuilder)", "value": "04a6e65cadf043dbe578d10b1a2e762b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565396, "uuid": "61b48974-e4d9-4c35-b81c-48781c18baa5", "comment": "Malware payload (SilentBuilder)", "value": "30fe1fcf150ee197506db2526a2794dabfc9fb421d1101fb99ee3f170e66603a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565396, "uuid": "f4c4f3d1-58c0-4149-b048-27c21737ae54", "comment": "Malware payload (SilentBuilder)", "value": "136faebc71d263cdf5442f9a9e20c7ed516bcfd0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565396, "uuid": "4d2dbe49-8590-46ec-a1ec-425cd04cba30", "comment": "Malware payload (SilentBuilder)", "value": "b58ca841c8f383782d9845c0fbf47f57204a5f678e0404d8f5249b12efff936e479f159c6409acc9c4add51aec7f774c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565396, "uuid": "2ff7623f-512d-436a-ba8e-cb7c4d201ac1", "value": "T1A5233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565396, "uuid": "7c9364d3-ecf5-4516-80d5-3a8a6961eeb3", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565396, "uuid": "261f3585-168b-4332-9b45-f91f5d750e7e", "value": 47805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565396, "uuid": "a1217f06-33f6-496c-8a45-b3371c097bed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565396, "uuid": "20999122-eded-4b28-bda8-5932cd7cf5f0", "value": "2022-1-28-04a6e65cadf043dbe578d10b1a2e762b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a05d0f2-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566527, "uuid": "64213bd7-aca4-461d-8b27-7f28017b71d6", "comment": "Malware payload (SilentBuilder)", "value": "253aa86d6d9433c5e40b4bd9bafe704a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566527, "uuid": "e672cbe5-00c9-40e6-bda3-b18dba3ba0d9", "comment": "Malware payload (SilentBuilder)", "value": "311c862eb1e3c56dfbc8c91da5c75785398ce1181f6cca67ff367144bb500c76", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566527, "uuid": "c8aab945-3ce0-4ff1-af90-f6c90593fad9", "comment": "Malware payload (SilentBuilder)", "value": "d51c5308618ca6b161ecfa80800d29b45a5f1707", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566527, "uuid": "9c2318f9-78e0-4aae-a8aa-40588a622562", "comment": "Malware payload (SilentBuilder)", "value": "05352a06edd5caf11b89181b5658fd366688ff3e3acf21abdee929ed0b4d5a3cd70a95b2dcf89217d8cfbcba0b452545", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566527, "uuid": "530b84c5-b11e-42c2-b372-3b124f875d4b", "value": "T198839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566527, "uuid": "ea906adb-d382-4975-b5b2-965a80f51bbc", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566527, "uuid": "3e102083-1f66-4c31-89c7-9ada6f5ae735", "value": 86615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566527, "uuid": "0ea70b87-0428-443b-a1c9-84debc9bd8ba", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566527, "uuid": "8cffea7b-0d31-419b-bd74-444d8db72cee", "value": "2022-1-28-253aa86d6d9433c5e40b4bd9bafe704a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03af473c-8184-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643516453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516453, "uuid": "96ab5c6f-c518-43aa-98f6-c37158154656", "comment": "Malware payload", "value": "118cfee735fbdcf08801ff2c1ca850c2", "object_relation": "md5", "Tag": [ { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516453, "uuid": "7f57cde7-2e34-4f41-8115-af8986a2d8f7", "comment": "Malware payload", "value": "312608192b138d9070f608ca295e8951dc4fce2b35f581dde609c2872519cb69", "object_relation": "sha256", "Tag": [ { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516453, "uuid": "0733d9ad-3027-49d7-a2c7-efcf99644181", "comment": "Malware payload", "value": "e8d92b83a04122d73cb8aabe1c107034b59875a4", "object_relation": "sha1", "Tag": [ { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643516453, "uuid": "01449709-48d3-4f8a-9cb1-f640cf75a783", "comment": "Malware payload", "value": "f4b1cbe9bbcfa28e4a06c9711c4e5fcf590c2e62384ccb0276a24416d9667474bef113d8436155abef1457c46211c5eb", "object_relation": "sha3-384", "Tag": [ { "name": "cve", "colour": "#A81113", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516453, "uuid": "4aacaf3c-44d8-4d9e-a2ff-85e267fe282b", "value": "T1B2829EBBE50EEC1CC04F667E811E05FAB21B8242D685975F2A81F2FC1E81DCF5B16685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516453, "uuid": "ef2c8959-e4ad-42d2-8430-fcdd9f2ed9ae", "value": "192:FsF9p1ORsc7llJwOYHdXSCiq5GCePiuYWojlkcPQjaxKOfaw/rA6pHK0s17kBpbw:U9pPUnWOYDXeQGc6fIrA6pKl2pg8LNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643516453, "uuid": "ac1d8241-0c8d-4319-9613-65330f4a657a", "value": 19120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643516453, "uuid": "b7a1ed53-7499-450c-82f4-4a522f3af0f4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643516453, "uuid": "0cfa1fe2-5cbd-4738-b6db-213aaf17e9d8", "value": "118cfee735fbdcf08801ff2c1ca850c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598e73cb-820f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643576298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576298, "uuid": "1f080b51-a89a-4c85-8dad-59e688eea512", "comment": "Malware payload (Heodo)", "value": "f1635b5af134fbd0f1e834eb5d131438", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576298, "uuid": "045c48e2-5d49-4141-a5a0-81d6c04e03a2", "comment": "Malware payload (Heodo)", "value": "3142b702d78a8e444020d48dfa7be8e93630f3eaf0e4d7a4d673a2318b61cd9f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576298, "uuid": "7649c169-b041-490b-b42d-e39bccbd334c", "comment": "Malware payload (Heodo)", "value": "cd20b8df947fc62c0bf047d3f5f46cf77b6c4129", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643576298, "uuid": "28f8e58e-c3b7-46d9-a831-e4a0505b591e", "comment": "Malware payload (Heodo)", "value": "5c5b7dc8d48bf9684312e5cdeb07c23bd5aff63da5822d0490310208ff33be1f17c28db819ab276f13cb00c675471551", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576298, "uuid": "c3d38610-20de-41ab-ab49-2cf20f7b6722", "value": "T1A7934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576298, "uuid": "e4e55aa8-dfbd-41a6-869c-b2591779b333", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643576298, "uuid": "1197713f-de14-4e5a-b78e-caa996c97ddc", "value": 92384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643576298, "uuid": "d7dca10e-7f7c-4839-97ed-aae63599d8da", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643576298, "uuid": "19e40633-18ff-4e84-94ea-3743755b49a5", "value": "2022-1-29-f1635b5af134fbd0f1e834eb5d131438.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c630fcd3-81e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559729, "uuid": "fc395ece-fa14-444e-8a6e-f3e2ddca2940", "comment": "Malware payload (SilentBuilder)", "value": "50807b61603a9c74dd9e229025ca7375", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559729, "uuid": "abfd006f-1d73-4e03-be7e-d08409f8dab2", "comment": "Malware payload (SilentBuilder)", "value": "3148fb14eaec8549476c7400ef2acd916cc2d30fecf3aacc3fe5d8db1af2313f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559729, "uuid": "0e104344-d708-4286-a726-f769cc4ae117", "comment": "Malware payload (SilentBuilder)", "value": "32899fde4f286a9c4abcfe44d5715a62637be138", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559729, "uuid": "2812cbce-f2b2-477a-a500-d728829e562b", "comment": "Malware payload (SilentBuilder)", "value": "46e3bc2d3a8acd2a8f540441247f678f8e60a5c3da9e3a558963c8a045e44eb6ca39ee085a00a637260a6ce6a9a60ecd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559729, "uuid": "f98b1af8-16af-4eaf-acee-787ee7dbc980", "value": "T15CC37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559729, "uuid": "5566866d-a4d1-484d-90de-a504a53a5771", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559729, "uuid": "29a9b76f-d539-4161-b45c-e7909ccb2b98", "value": 118879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559729, "uuid": "16828511-4e1a-4a52-90c6-e1c6cb1a4926", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559729, "uuid": "c8c62c8c-2e2d-4062-b617-fe530753a3b8", "value": "2022-1-27-50807b61603a9c74dd9e229025ca7375.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f698cad8-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643556375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556375, "uuid": "a584fc64-2589-487c-96a4-6e69fe0ef4c6", "comment": "Malware payload (SilentBuilder)", "value": "2f530e1c72e2695f08f693038eb5b9f7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556375, "uuid": "735a9769-95ab-40e8-9ea2-9d89520146da", "comment": "Malware payload (SilentBuilder)", "value": "3156205b6cbc1e3090e5a962940f6a69ea2cd4d6ab18e2fd3f6380ee1a93bb4a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556375, "uuid": "82c642c2-7440-4d3c-9b86-df1cd66329d6", "comment": "Malware payload (SilentBuilder)", "value": "9c5e28e6f263296f67489d540669d44acdabe283", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556375, "uuid": "1d45751c-c626-4682-b68d-83ca6bfd9a02", "comment": "Malware payload (SilentBuilder)", "value": "7e1cf21b99a9b67ff1f18b6237693d5e9824b776bea0b2bc4dcd1d5285fbc9a9ace3345cee927d725748891a60dbe94a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556375, "uuid": "b4afe784-e792-4bb0-86a3-c16650784505", "value": "T117E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556375, "uuid": "61ec0996-b77f-4fcc-bb02-156b09755bd6", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556375, "uuid": "fa716c06-b4ca-4709-9f3c-10066f432e05", "value": 145639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556375, "uuid": "61e8f12a-69e1-46ff-b04b-1917ffc827e7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556375, "uuid": "28adc19e-a973-426a-a37d-92cfdbafc734", "value": "2022-1-26-2f530e1c72e2695f08f693038eb5b9f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81ab10e-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570443, "uuid": "eb39bdc3-2f11-4790-9a70-6ccefe64b683", "comment": "Malware payload (SilentBuilder)", "value": "ae82d4e63d9e5cd5d647ccfce8fd3543", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570443, "uuid": "08bf422e-27c2-457d-bca4-dc5ceea6ba7d", "comment": "Malware payload (SilentBuilder)", "value": "316dd81b9e90acc8104eeaae7c76f57a4c92caff44d2710ac309f8a006b24f94", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570443, "uuid": "0508222f-6d79-4680-bf9e-690faadc2d6c", "comment": "Malware payload (SilentBuilder)", "value": "777adc49e5a0ccaf84f87a980511e06a4738d1b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570443, "uuid": "19cf71c8-f915-4bad-aeb0-febe83f77aab", "comment": "Malware payload (SilentBuilder)", "value": "5b1eb4bcf02b8b99d687aeb6d152569f8dee727314887ebd0ab2bc8dfaf0f795504ed76792df2508306ab66246df9693", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570443, "uuid": "ef616fd0-85f5-4089-9471-413df5844639", "value": "T14C839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570443, "uuid": "11fa9eda-3338-4b1b-9463-c2b5b5342ea1", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570443, "uuid": "6a05cb37-4067-4150-a0c7-3f55df3253ca", "value": 86952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570443, "uuid": "c348b2cf-4422-4fe8-81cf-668cf54eb14e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570443, "uuid": "3ca6b9da-bbd3-47f9-ae45-619174e73e5f", "value": "2022-1-28-ae82d4e63d9e5cd5d647ccfce8fd3543.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641011ec-820a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643574168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574168, "uuid": "04ad65da-49a6-4edf-8871-cdfd006ee0a9", "comment": "Malware payload (SilentBuilder)", "value": "546567fa6122ee2234e134c132e88610", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574168, "uuid": "48badb67-0024-4e91-8820-21abd6684fc2", "comment": "Malware payload (SilentBuilder)", "value": "320805fdb685b74dbeb2180075ed8d0419e22fa1ebbf57de44188f2f5cae4b1b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574168, "uuid": "a91ad20f-7962-44d6-acb5-cc9c0b775493", "comment": "Malware payload (SilentBuilder)", "value": "c8a7112c7a2dc1dbecbf7f5412d1601b8b2c99cd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574168, "uuid": "97c813cb-2d06-46e1-acfb-59aea26cfac8", "comment": "Malware payload (SilentBuilder)", "value": "602be8593c88ec097f57f0aff799d5a4221c70eb63da2e11d48fcfe5d815a533951f06a1894755ef29054a105da206bb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574168, "uuid": "73471dea-1032-405b-b11b-b87660ffb830", "value": "T1BE934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574168, "uuid": "468f59e1-748a-4519-bcb0-bc0f568b373c", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574168, "uuid": "625e21fe-aa4f-4c85-8444-edd4a5bd9922", "value": 92524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574168, "uuid": "2e8c315a-ee89-4ca2-915a-74df05ec7eec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574168, "uuid": "589f07a9-b6d9-48fb-a419-f5d12307fa1c", "value": "2022-1-29-546567fa6122ee2234e134c132e88610.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e20cf22-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558642, "uuid": "45412e80-451f-4bf1-87e4-1852c4e994d7", "comment": "Malware payload (SilentBuilder)", "value": "2e23c607f92ab5152c1a66fdc8948875", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558642, "uuid": "a809b95e-09c0-4958-8a35-3ff94445ada1", "comment": "Malware payload (SilentBuilder)", "value": "3215a0752a9adeae7944dffa261942fafc9f44fdb5b258d39c1422c7fadb3643", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558642, "uuid": "4e959f65-77f7-44d5-9517-22db1ed0f2c3", "comment": "Malware payload (SilentBuilder)", "value": "cecd0975f298c89e6b979bed6e785ce506b0193f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558642, "uuid": "3d9ea7b2-57c6-4277-8de7-c3ec3158985c", "comment": "Malware payload (SilentBuilder)", "value": "0f65a77cdddcfb58373dfe4a84c08623865ebe41a323421daecffe2ea93fff70f80a25f3d988d29b72ad47cadffcdb63", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558642, "uuid": "db3e4422-051c-4865-8cc4-9d5dd0fb1104", "value": "T119735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558642, "uuid": "eba040a3-413b-4665-8f89-f44e2b0f27b4", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558642, "uuid": "6ef158d3-ebaa-4e08-ab50-653862d465dd", "value": 77477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558642, "uuid": "3c3bdfe4-0d6c-473d-b540-dcfca60c179f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558642, "uuid": "49ec3d2e-b35f-4c22-a6e9-7a7b4b43a9d5", "value": "2022-1-27-2e23c607f92ab5152c1a66fdc8948875.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c54e96-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643564393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564393, "uuid": "82c52035-5050-4cf8-8c98-0eac14612c25", "comment": "Malware payload (Heodo)", "value": "e2f35a24b8e0553d7894b59b54318267", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564393, "uuid": "26dc54a3-7f99-471e-914c-3f5cde9b0750", "comment": "Malware payload (Heodo)", "value": "321cdc7fc00b1e4501036085d9e66a4703716629c140d93c601fe644e2f20cf9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564393, "uuid": "2615c67e-f3df-4e12-8770-ef2a42a19c5d", "comment": "Malware payload (Heodo)", "value": "56a5a505fc78df5459dafd2158950022afa08952", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564393, "uuid": "e79244fe-4566-4132-a754-9d855d7309bf", "comment": "Malware payload (Heodo)", "value": "414822805ad5a35183058dcc371b1d525264153fb93e16803bc4564787f5bac32ff3a493297fe85e9a48ccf0246f1546", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564393, "uuid": "5815e504-aad1-4338-9ca9-52f11133db31", "value": "T17A735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564393, "uuid": "e7471976-f5d3-48eb-bd96-f3af4f4a246f", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564393, "uuid": "791e7b27-d0f8-4158-b145-c5e6f3164cb6", "value": 78325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564393, "uuid": "fac31c83-bcab-4494-89ac-9f6be88aa105", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564393, "uuid": "d7d5913e-91de-4018-94ed-7af82dedeb1d", "value": "2022-1-27-e2f35a24b8e0553d7894b59b54318267.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17b5798-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643559292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559292, "uuid": "f63900df-242e-49b5-9941-c233a4d10bc3", "comment": "Malware payload (SilentBuilder)", "value": "4499fd7f6049bdcfad2adcef411fcbfd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559292, "uuid": "d39f7837-65c4-4598-ab99-23a33ad98707", "comment": "Malware payload (SilentBuilder)", "value": "321e113899cfa2bf884852c905e8797923f9c851f334fec2115baf3784b3a35d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559292, "uuid": "58cb3de2-c5d9-429f-8033-1d4d641886c7", "comment": "Malware payload (SilentBuilder)", "value": "70e5e3e99aff58ab43ffd03fa34628ce984df195", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559292, "uuid": "24157680-d1c4-43a1-843f-589e2e78f4f8", "comment": "Malware payload (SilentBuilder)", "value": "6cc419cea837287610e887e0f9021471408005e8f0eb7a88f9abb6559f5c2af6a0bdeebdb43cf3871fc36917f297631c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559292, "uuid": "41a95c2f-6939-4cfe-9c58-c85f35aee3b3", "value": "T1A1735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559292, "uuid": "2196b76c-6ea2-43e7-ba2d-6a2f218eabf1", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559292, "uuid": "d9c36d17-ab0c-49cd-8806-61bf41aef1fa", "value": 77397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559292, "uuid": "1de544f9-c934-45e5-82d5-09ea2a002770", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559292, "uuid": "38ff4e63-2cc9-4bb4-8c2d-98233e2c05d5", "value": "2022-1-27-4499fd7f6049bdcfad2adcef411fcbfd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7d36c7-81fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643567765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567765, "uuid": "7356a769-be24-4b27-966b-301933e1b8b1", "comment": "Malware payload (SilentBuilder)", "value": "5027b6964df13b9052eb4bc1faaf7a5c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567765, "uuid": "09c4eec1-771a-4511-81e1-70ca7dd96e69", "comment": "Malware payload (SilentBuilder)", "value": "323efcd466e590e3b57fa0c3b2958350a60163d6c6251292b1dd051aa3f2c18e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567765, "uuid": "302c9f44-0d46-46d0-978e-87426924ebdd", "comment": "Malware payload (SilentBuilder)", "value": "5c5baad43f569c471f9717dfa7d9038944ecd8a6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643567765, "uuid": "5cdab510-aac8-4338-a8ae-38cd8b8967f0", "comment": "Malware payload (SilentBuilder)", "value": "fbc4c608829b72ea7969fdf0192cfe1ffc815f0d6b949dfb78803d6a02998a519ca5ddc03edd74662b4d7ebbec3f30cd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567765, "uuid": "a7a93770-019c-4802-a37a-1a45ebbfda7c", "value": "T11C839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567765, "uuid": "18af9b4b-8784-4834-8a5b-3b9d57c93230", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643567765, "uuid": "ad30c83e-bb04-4c91-b071-beab0c94b493", "value": 86618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643567765, "uuid": "47f540d7-249f-4c57-9eef-aba20fc527c7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643567765, "uuid": "cf22372d-0fce-46f6-b317-97528209ea13", "value": "2022-1-28-5027b6964df13b9052eb4bc1faaf7a5c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6034fe6b-8201-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570296, "uuid": "25c26c3e-1476-43c3-9b4c-262d48b36830", "comment": "Malware payload (SilentBuilder)", "value": "aaca3b27382ee07f80f5092cab8c0ac7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570296, "uuid": "97d02307-7c77-40be-ad63-a0a6c2fb4e2e", "comment": "Malware payload (SilentBuilder)", "value": "326b17bb8ca0eaad120e4d8c13210434c91cd2c2a0b39af1c2a85f9e0c638f90", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570296, "uuid": "386ec33d-aece-487c-8a53-037637e0384c", "comment": "Malware payload (SilentBuilder)", "value": "a07fdab180bb229074ffd3e9ffb794480e09af68", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570296, "uuid": "d85bf16e-2f82-4209-b307-343c600d07f5", "comment": "Malware payload (SilentBuilder)", "value": "d0d9060fab1d027e51648166b6702a3ad1c64d517ca473ce147871b66a66f00333ad669101c5caa5ffb3eb875b56a6db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570296, "uuid": "38e8af6c-0ca1-421c-bf49-7f14072769b7", "value": "T150839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570296, "uuid": "3a2684d6-1747-487e-82c4-06f9d7744dee", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570296, "uuid": "99da1060-818d-4eac-a2d7-c688d5c02cd0", "value": 87582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570296, "uuid": "98f63273-8801-496c-9863-6f164dfff624", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570296, "uuid": "c5cf0193-65fc-4a63-979b-fa9045b702ad", "value": "2022-1-28-aaca3b27382ee07f80f5092cab8c0ac7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0725c817-81f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566710, "uuid": "8924e257-3862-4f5d-9524-6371ce208be4", "comment": "Malware payload (SilentBuilder)", "value": "2a5edcba2ee0f783c2e2af6bc1c13cba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566710, "uuid": "11e64e39-997a-4d36-a112-255756eb139f", "comment": "Malware payload (SilentBuilder)", "value": "3284bc5147a4df03866e30d0dd6afca915f56c3ad7648269c113d3746899ac3e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566710, "uuid": "a3c57c00-a66f-40a6-be0e-48c0686c4870", "comment": "Malware payload (SilentBuilder)", "value": "b07aff98484a2a6be11013e881da21703e08f4f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566710, "uuid": "3ffb3a9e-9d85-45c8-9031-c9ff42f33cbc", "comment": "Malware payload (SilentBuilder)", "value": "37a4bae6a55010e1c3f01e808a784b90cd73da748c476b9cb76d8ca8c7ffc07f38834dc20edc1ce97f068b3b10cfc755", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566710, "uuid": "38950ece-cd4c-48d5-b013-e34f99f4e70f", "value": "T141233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566710, "uuid": "4a604171-63b3-45db-9b9d-2aead99d516d", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566710, "uuid": "d5774072-d096-4b77-ad1f-deb7de9614c1", "value": 48399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566710, "uuid": "eb141cae-5424-439a-87e9-d12ed32d298a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566710, "uuid": "e76275a1-be4b-4293-910e-8845e121b0e3", "value": "2022-1-28-2a5edcba2ee0f783c2e2af6bc1c13cba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436f890c-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "9a94ac61-a1f7-4b8a-bff0-e9c4ac9e7ad3", "comment": "Malware payload (SilentBuilder)", "value": "2ebf8cbf11f774949061432eb5273c1d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "d2365a3d-aaf6-4f50-90b3-9e0d7707c335", "comment": "Malware payload (SilentBuilder)", "value": "3296c65d2aa213c6db57b2872368e06d2eff5bd4b7ffd738b98dbd26b337cd70", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "3b39cf0c-d6ca-4998-8dba-d394e4c5d9e0", "comment": "Malware payload (SilentBuilder)", "value": "0d99fe692bc54ececde391508364029341a47925", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558651, "uuid": "db63477f-0963-489e-8778-625c16be5caa", "comment": "Malware payload (SilentBuilder)", "value": "0da70cbb8d824eec3cbb1f415a9ff1585893f50c074f2a586a4b3cf30fbcd6fc3db4ffe60bc59902363b2c6eb741e0ac", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "326851a5-066c-4cdf-959a-92abb1ec1675", "value": "T116735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "a740329f-d258-446d-bc56-e87c8365bb3b", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558651, "uuid": "a2c5372c-2765-4d1b-8eff-8d9c44ae2ff9", "value": 77589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558651, "uuid": "c46b3895-9033-4a89-8e5d-4899a09c7dd8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558651, "uuid": "134153c9-21d1-402f-8391-ff4394fe0afe", "value": "2022-1-27-2ebf8cbf11f774949061432eb5273c1d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1146f4-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575257, "uuid": "3f86dfd3-c5a2-4819-9398-5e95af30b028", "comment": "Malware payload (SilentBuilder)", "value": "a1e8af92aac163421d62dbab3abe9180", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575257, "uuid": "c80b4232-71e5-45f3-ad82-b63b9a1cd82b", "comment": "Malware payload (SilentBuilder)", "value": "32b02c4537bf7dd251525bb8f13a188c0000ead580663eb2cf04efb12908d768", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575257, "uuid": "ba88f2b9-e155-47a9-ab44-27a0bb8e8724", "comment": "Malware payload (SilentBuilder)", "value": "915d6d50b5731de5c14cfbcfba398ac5db8cb2ec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575257, "uuid": "8d12d29d-8396-4438-8da9-03028fc5efcb", "comment": "Malware payload (SilentBuilder)", "value": "e4692f8e4bb9f709a342e6e848812956f3e3fb7f3238c136ad2f1e873415c82ee6b1d95f666b4279899ca696981fb0c8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575257, "uuid": "38376676-1695-4ce6-8062-10a9c9f7c474", "value": "T118934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575257, "uuid": "e1e70ffc-82e8-40b5-83c6-028b9eef8e90", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575257, "uuid": "5a26cbf8-56a0-4d35-8493-ef396d0e66bd", "value": 92356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575257, "uuid": "2475e78d-2b63-49f0-98e8-424711903049", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575257, "uuid": "94a72025-d468-4ef4-999f-a9e9145bf60f", "value": "2022-1-29-a1e8af92aac163421d62dbab3abe9180.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d77387-81aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643533095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533095, "uuid": "bf91de73-ac52-4460-bdd5-2db52f21d02e", "comment": "Malware payload", "value": "cef4fa7fd32846574959ca3b6b0d481b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533095, "uuid": "32652697-d558-45a3-b6fb-ca64bc68b8b9", "comment": "Malware payload", "value": "32b6e058fd83496cef5774cb30f6d3ecbdc98955e2c87fedc733aeb5227c0202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533095, "uuid": "05296350-5f8f-40cf-8715-78fd1fc5b37e", "comment": "Malware payload", "value": "fe903adc951c2cc09185f1a381e0eec4845783a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643533095, "uuid": "2ba24d27-96c1-4e88-b98f-95f79700477d", "comment": "Malware payload", "value": "8822f9d56742ecedc2b995647bfc776b39396fb1f3cabcb27a9fe136d425c1f28a322677bee400ede829894dea8733a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533095, "uuid": "c9ca4cf8-3a24-43ed-b5ac-98f415418238", "value": "T1EDF2E1A06952A9F3C4C15432763F4592A2E346B70EF76B7183742238B8E145387FF9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533095, "uuid": "9afca7db-4580-4625-880a-bc72f25cfe98", "value": "768:COemQK0dWjH2KAVo8Sim+eCVFJIi0ZPNL6vHe5YjX5LeO3U3:neJKQo8SCeCVnIRPwvHe6XFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643533095, "uuid": "2eb2206c-a0d8-43ca-b478-88f9c1fa7c00", "value": 34936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643533095, "uuid": "320be9de-0960-42e8-a376-2d11730488c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643533095, "uuid": "dc778c62-22f4-4061-adda-34788c9df147", "value": "cef4fa7fd32846574959ca3b6b0d481b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9da960-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562181, "uuid": "f810b4b6-f120-4593-8f60-695e6545521e", "comment": "Malware payload (SilentBuilder)", "value": "a18a8c576fde21b83a69ef0fdd0649fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562181, "uuid": "faf931ca-2d27-41b3-a660-0bd9094b343c", "comment": "Malware payload (SilentBuilder)", "value": "32b709711e3eb1628c8b34571b3ef7af86d32c77f5b6ab0bad83819061fc8abe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562181, "uuid": "2b7e5a87-f797-4148-82a1-d3d15d304049", "comment": "Malware payload (SilentBuilder)", "value": "dfa39f693798b8d7d03b01684c7e5ae78cee6405", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562181, "uuid": "8e531952-399c-46a1-a7f7-79ec9f69e773", "comment": "Malware payload (SilentBuilder)", "value": "4de62435bd49c31c71a08ade96f910f8197a4c2601fe1f20c12470e7f4da63e112efdf2d09e4edce4eedc41ee81f3c3e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562181, "uuid": "94638783-f1c8-4024-a471-137d55675801", "value": "T16A131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562181, "uuid": "06a8f8b1-f99a-4739-9af6-8d92e4a8ca90", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562181, "uuid": "9563da04-6cd4-4ad3-8b8c-2f98220a9010", "value": 44829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562181, "uuid": "6c338682-dd80-4d10-b126-345f2332361f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562181, "uuid": "a844e6fe-d304-453b-aa86-4823e9dc302d", "value": "2022-1-27-a18a8c576fde21b83a69ef0fdd0649fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8746b8db-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575945, "uuid": "79097d5b-76ed-4dd0-991d-a659295695db", "comment": "Malware payload (SilentBuilder)", "value": "d5b104f5765f3d5aa74e35fb9dc30708", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575945, "uuid": "3aaa8ca2-0781-4146-8f89-33cfdb238d7f", "comment": "Malware payload (SilentBuilder)", "value": "32bc8bcfc4fcd3b082e4fa31b16ed5bcc4416d78a6c0334f951a585942cb3fc4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575945, "uuid": "309fcea8-2b66-409e-9006-bcfa91796ca5", "comment": "Malware payload (SilentBuilder)", "value": "2be3d5590ad7cae6486b11af1a2f524735de43ba", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575945, "uuid": "26e0e241-ff5e-484d-b788-b47011e64527", "comment": "Malware payload (SilentBuilder)", "value": "caff9abfcaf77d588a06e25cdcba1eb24f8e1747aa7b9aabcdb41f88a57a3ce8ffd207925e0a300f55cbf085b5d7d8cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575945, "uuid": "3af3292c-299b-4cd7-bc40-8bb86dd979b5", "value": "T1CA934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575945, "uuid": "fa7a27c1-3195-42d7-8ab3-e8e81a48ee9b", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575945, "uuid": "ac1380c7-3c1b-480c-ba56-4812eb1c37f1", "value": 92312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575945, "uuid": "da3c47ed-1f22-4fc0-bf26-49c3af5d3882", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575945, "uuid": "504b5b8f-2afc-41fc-93c2-3ce26272e6e8", "value": "2022-1-29-d5b104f5765f3d5aa74e35fb9dc30708.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3896a35-81d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643552880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552880, "uuid": "a841289a-252e-44d9-b660-35fc1e549887", "comment": "Malware payload", "value": "c7c93016885df43bff32fc5352a69e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552880, "uuid": "b9e00d19-799f-448f-a246-ab98effe92f4", "comment": "Malware payload", "value": "32cce1b592b8ce37c3e5f05ad0f0426ef6b357d8059010c949f908f0a929b4dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552880, "uuid": "f998088a-db72-413f-9488-3bba630fc62f", "comment": "Malware payload", "value": "5992f624c9e66cb0ac159e132e70288e2822e475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643552880, "uuid": "60cd904b-7806-4974-b7ea-39e43c503880", "comment": "Malware payload", "value": "0f0bd5017f1c72cb1ac404868fc36eb446fa9cc6aac1c69aa6ea3f4ae3fda19c9bc438a12829575f8ab1234778e70441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552880, "uuid": "29268db9-85df-49ac-9fdd-d3a0fb949a6d", "value": "T15582D132B061B9A387B47D32F2358655A42F2EB471E260E3DF604F54BAB301D9BF5582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552880, "uuid": "6d4e189c-7c1c-4abf-852d-006ced4a1a7a", "value": "384:u11yMP9TXSjxO6fRpvjjlfpgt0qetaBKh05qmdGU5Ybt+7q:k1yMP9kxO6PjxfpArRQwq3UT7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643552880, "uuid": "11a354c3-9603-4515-a9db-bef46e56074a", "value": 17676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643552880, "uuid": "8e1d8caa-65b6-491f-8e4d-3818ccf1ea29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643552880, "uuid": "5fb10904-db28-46f8-a452-6fa528687f89", "value": "Yofukashi.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b89f27d-81ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562127, "uuid": "54582744-5ebc-4df0-b4eb-db7621ea6be8", "comment": "Malware payload (SilentBuilder)", "value": "a070dd167b4711fae95548e6e59aeb56", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562127, "uuid": "f5595d67-d302-407a-8be0-4797aaacd840", "comment": "Malware payload (SilentBuilder)", "value": "32d5b81f5538c56a99bf5ea885bb6cc54fdb86d71b071c4ae7b839b4d3bb10d1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562127, "uuid": "e5cf011c-87ce-480c-9edc-508b8c13662d", "comment": "Malware payload (SilentBuilder)", "value": "b36bc497a62b8dd33672514a85ac03e3a8cfb5a2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562127, "uuid": "427a9ca3-d3e1-4cf7-a577-05277f371f73", "comment": "Malware payload (SilentBuilder)", "value": "fc53ca59d85d20cea8c41fc3e35a5c96aa7d354a74d77292a1afe9bcb405e01a71148396250caa1fa60d75ac832a10b4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562127, "uuid": "fd159268-e3c1-4e00-9fa8-76ec5c86f74a", "value": "T112735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562127, "uuid": "cb8c129f-b8df-46d6-9462-bf6c8746a734", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562127, "uuid": "67e02b1e-ccb6-4c0e-ba81-a94a9fb7c7ef", "value": 77975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562127, "uuid": "0c6d9802-3f3f-441a-a309-2a5e66d70ef4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562127, "uuid": "6bcc9643-9dc4-471e-9ecc-b72118cde67d", "value": "2022-1-27-a070dd167b4711fae95548e6e59aeb56.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850d44c4-820a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643574223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574223, "uuid": "679ad78d-cfac-4dde-80c1-5bcb16a89e20", "comment": "Malware payload", "value": "5a636d3b54f47715662166515097b048", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574223, "uuid": "05549ae3-f6e8-4f8d-84a6-c1e15ce6ecc0", "comment": "Malware payload", "value": "32dd9bc9f049096b0e25e0d9d4f8265a4a1c57f7c7db54431e3d284a4b667255", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574223, "uuid": "381c6e0b-88ff-4527-98c6-f704c1df2529", "comment": "Malware payload", "value": "8dffcdfb4cf166a335926a6b412c4f62063c71ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574223, "uuid": "19686585-11cf-4529-8859-8bdbfb9d55c4", "comment": "Malware payload", "value": "5ac4de61c4d8bb642238ee1406b80d42a78b6801b5169399d9f739c79d534694a82cf337c297bb7c2d0f69c64359708c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574223, "uuid": "c36d730c-e46b-4811-83e5-6a5d73a04080", "value": "T174934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574223, "uuid": "58744b8a-29c7-4962-8082-09f71d1ff544", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574223, "uuid": "c3f33123-d7ec-4103-ab1b-c6ba126cb038", "value": 92654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574223, "uuid": "501483f5-d914-431a-b371-e4cf3cb9c6fa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574223, "uuid": "c432d5ef-1999-4f66-9a68-ebca80a2f4e5", "value": "2022-1-29-5a636d3b54f47715662166515097b048.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1754bf2e-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560725, "uuid": "50c97f3e-3af9-48ca-b1bc-b0750d72faa2", "comment": "Malware payload (SilentBuilder)", "value": "6d36d74033b380fb7bc40a84fe7fb8ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560725, "uuid": "7e863032-7668-4fe0-8c57-79b648e2826f", "comment": "Malware payload (SilentBuilder)", "value": "32e0573b9116e3d959303ed172e794b12809845964cc42d21e321dd02987c9db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560725, "uuid": "744e806f-7e49-4af4-97c8-207c65085a12", "comment": "Malware payload (SilentBuilder)", "value": "e7af2df92e27669e423626af6a1b09d86d429c89", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560725, "uuid": "8d0882d7-ad25-4cd9-a10b-b7da7e715b41", "comment": "Malware payload (SilentBuilder)", "value": "24ad76b77cffed6c9dc30ecd0bf1c856854dd1cb8b2b330a3df34e282297047a7915d3d7ef5d4afb44e68e9395a510e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560725, "uuid": "1197f259-4bb2-4f7b-874c-44e0529324f7", "value": "T197735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560725, "uuid": "0eef3f53-ed58-47a0-ab9e-e30d61c26b43", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560725, "uuid": "2d177a0a-ccb6-410f-8d22-e4613642c6c1", "value": 78391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560725, "uuid": "d2991121-2f9c-4ada-90fb-53e6d61f18d9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560725, "uuid": "f4e9a146-2789-4754-b313-be5c42d69fe6", "value": "2022-1-27-6d36d74033b380fb7bc40a84fe7fb8ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96a9a90-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562795, "uuid": "11644ca9-1288-4c1b-9f90-f2b6a40454b8", "comment": "Malware payload (SilentBuilder)", "value": "b4efaee33a5745c01bd7a97ff46ab062", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562795, "uuid": "76a84169-dedc-4fa4-84aa-7958c721edcf", "comment": "Malware payload (SilentBuilder)", "value": "330ecf4e0a0cf89052bae5979766ee5b77641679b091fcc72b6d6d6c227a68c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562795, "uuid": "f54a18a9-a0e4-4145-bd2c-4f6ee8cafcb4", "comment": "Malware payload (SilentBuilder)", "value": "3e9128d51c10cc16a2eff9f86d704e9b506feb79", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562795, "uuid": "6c5cd567-ab9a-42d1-a47f-d42cd9cc3e0b", "comment": "Malware payload (SilentBuilder)", "value": "bb18fa99053e4e9ed60399714162552ca5a1e69fc6646842d0e72433785d215b5074e6accc037e5cd07436a0e36c0c6f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562795, "uuid": "7bffe8d9-9f2c-4cb3-b2dc-00296e28457b", "value": "T12CC37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562795, "uuid": "f2a1c678-355b-460d-9899-5846606de2c9", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562795, "uuid": "50ed14a6-6efc-4816-b860-2a999c26c714", "value": 119004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562795, "uuid": "020258bf-518d-4f6f-b06e-472bd8ff26d5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562795, "uuid": "9202777a-892a-4104-92b2-7178cf1b2043", "value": "2022-1-27-b4efaee33a5745c01bd7a97ff46ab062.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce53376-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570934, "uuid": "843ce9d2-b5fb-40f4-a02f-f428fc0bea74", "comment": "Malware payload (SilentBuilder)", "value": "c0f34de9a9b8328e58ed8fe9a8c0d5c5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570934, "uuid": "b826bdb4-1481-4083-8928-f023a20897f0", "comment": "Malware payload (SilentBuilder)", "value": "33b82768a52fcbc9349a27dbfda1f4eb58ca6ea8a54dbadc0efb84fff0d3ac2f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570934, "uuid": "0429356f-6c04-4a78-ba55-84b17783ff5b", "comment": "Malware payload (SilentBuilder)", "value": "3b62cd0e9ecac74c008845f524746cac5e411b8e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570934, "uuid": "baf57a11-ecf9-4b3d-bd8f-c2183eccaba4", "comment": "Malware payload (SilentBuilder)", "value": "1c06d11232061c3aef26879971a24b491a64fdb4766cf935e51e2ddbf06a94f527617197e3a136c88b3f0a132f5c8aba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570934, "uuid": "2ec82ead-40df-4cb1-bc6c-902b028d9c40", "value": "T1F3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570934, "uuid": "345dba65-c176-48f7-b701-eb7b6bc0f0e9", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570934, "uuid": "bec5fe51-af29-4049-a91b-d79a53876f11", "value": 158926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570934, "uuid": "22a8f10c-0c7d-436f-bc34-c82592a6682e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570934, "uuid": "3a3111c3-970d-48ac-8318-7d119d4559d4", "value": "2022-1-28-c0f34de9a9b8328e58ed8fe9a8c0d5c5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c2ac85-81e7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643559301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559301, "uuid": "41c397ef-d4d7-4840-b02c-6e384aac37a4", "comment": "Malware payload (Heodo)", "value": "44ae435148894606a1b04ac9b2e8553d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559301, "uuid": "0cd09362-74ff-45fd-8085-b3d058f0d53f", "comment": "Malware payload (Heodo)", "value": "33bdd16820973f9b920bb4ab5985a2498b90fdfa71f888b04a3bd5a5d437a49d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559301, "uuid": "ccd0e6fa-9669-40c2-99e7-ba9d9669bbf5", "comment": "Malware payload (Heodo)", "value": "d5dbbc98cecdc6808f3e22bc77cf6148145938af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643559301, "uuid": "213588db-b0cc-4717-a2e9-9dfced72ed5e", "comment": "Malware payload (Heodo)", "value": "c659b3effee6b2822f53f36f8719ea41e636cf9443224bb0c9c6c91df998a0268896f11b00059086ffd91535be7fcf3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559301, "uuid": "e3e46851-912e-496d-9b3c-08f2e1173e7d", "value": "T13D735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559301, "uuid": "a1ae7c53-2e92-4943-b344-0231a5301404", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643559301, "uuid": "41a22378-0b61-4315-a4f1-70b94ff432c4", "value": 77478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643559301, "uuid": "0a3cfeff-ce36-47c9-a0c7-600e565f7006", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643559301, "uuid": "592d86b9-5cc8-46b1-8fce-f01f1e9792da", "value": "2022-1-27-44ae435148894606a1b04ac9b2e8553d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8baa46b-8209-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643573880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573880, "uuid": "7cb57196-4ca3-40ab-9d69-e3608eda6404", "comment": "Malware payload", "value": "3564c2e97e61e224409f7dda566ebeb3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573880, "uuid": "b453a4d8-1b77-46c9-a3e9-dbdc1d470563", "comment": "Malware payload", "value": "33bf889e7842b760f048737b49445e678cca6eb2d4d18bc1c5ac373cbf3da8f2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573880, "uuid": "c9d64f00-0a5b-4f8d-a004-0f4c273ef4d6", "comment": "Malware payload", "value": "97d5b06718afb17d201795edbef93f2ededc5bb8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643573880, "uuid": "1eff7272-3fb1-43c8-9fdf-26d98b04933e", "comment": "Malware payload", "value": "6783c043a67cac47eaea89f63cd1b417ecbcfb11ca4fc27b6643868b4411914277f8fd6d5a41a2cf7c565637fcd91f18", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573880, "uuid": "779c23b8-b518-4f94-8f27-7b8ac379d55b", "value": "T122839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573880, "uuid": "a741a64a-123e-4f42-be12-51a837f47854", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643573880, "uuid": "72269cbe-49a3-4102-a9ea-2dd6742c8413", "value": 86605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643573880, "uuid": "1b9e832c-5e37-461f-9bab-63f8db9332a8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643573880, "uuid": "36c76d2f-59d6-414e-9a6c-97fb2b523fba", "value": "2022-1-29-3564c2e97e61e224409f7dda566ebeb3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4583f54a-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561661, "uuid": "0aa6c375-bf90-4255-9ee5-28a8f8567726", "comment": "Malware payload (SilentBuilder)", "value": "8d86aa2a00eea3c93cf61961ba8d4c21", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561661, "uuid": "7760a3db-7462-412d-92f9-d1a427cd700c", "comment": "Malware payload (SilentBuilder)", "value": "33e0ba7825f904f51bc23ede0d97b65fcfbc9958d6d2a8f6ff8edb44b58323bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561661, "uuid": "8e4f6765-46a3-4224-af17-f491d4fe6a36", "comment": "Malware payload (SilentBuilder)", "value": "23f038dca9afee71ef58ecc8e0a6b66a0343c843", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561661, "uuid": "6c9485dc-c0f1-4d26-a204-4a072b4f3397", "comment": "Malware payload (SilentBuilder)", "value": "8f86db899e57ccc87cfaf0c76912d7e6e2afa22c99386d58af177942656749dda2a6680bace790f9d0048a06ce4b0d43", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561661, "uuid": "8c670340-a399-4f7b-8c1a-4876de4d03cb", "value": "T145131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561661, "uuid": "a08106a2-e3f2-4c41-98b5-ad56a3a9bad1", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561661, "uuid": "4c3ede33-a498-4740-b5a2-a6c7fbfabde0", "value": 45426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561661, "uuid": "47c7a381-c9bf-42ef-9a15-d1c6a3b3a587", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561661, "uuid": "ad4630ac-89c3-42ee-ac4d-e0192c89f43a", "value": "2022-1-27-8d86aa2a00eea3c93cf61961ba8d4c21.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1072d452-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558566, "uuid": "0b11a428-2bff-4cab-915b-2947ead71f2e", "comment": "Malware payload (SilentBuilder)", "value": "2cd7a22934d50b4c9c686a5f60dd7039", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558566, "uuid": "f2faa2fd-77ee-4d93-b251-4dc06ce284f4", "comment": "Malware payload (SilentBuilder)", "value": "33e599ae288c8d6f1b990410641802f6b89404e15c8dd4120b4cc6df88aab06e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558566, "uuid": "d3f8cefa-7c06-4386-b64c-737293b8a97a", "comment": "Malware payload (SilentBuilder)", "value": "939af25ed1bd59168340ffafc8f2737d1597fb88", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558566, "uuid": "33685946-f4a4-4147-8eec-9daae8aed892", "comment": "Malware payload (SilentBuilder)", "value": "a13c0ddeea4c536606e13d8281e58ee2cb777b33994ab856ab49e9efa7318627cc34ffcbd1ffdd70d458963097b9a9c2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558566, "uuid": "56cf0f85-f2a9-45e8-b685-4c8283912ae1", "value": "T1F3F3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558566, "uuid": "c0eecefa-f7b8-45a3-a902-e899b618cf27", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558566, "uuid": "f364beb7-a25c-45f4-b8f2-f137a80e01c6", "value": 159180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558566, "uuid": "5adcc51b-0109-4c38-8c1e-0a057a9d7c8e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558566, "uuid": "0995c0ab-a6eb-4b94-84b2-dd6be5ec0a47", "value": "2022-1-27-2cd7a22934d50b4c9c686a5f60dd7039.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5a3b1b-81e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643556035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556035, "uuid": "24a5455c-bd27-451c-91da-d49e0f62cde1", "comment": "Malware payload (Heodo)", "value": "0e0bcf994e2bda5d523361030a8add05", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556035, "uuid": "e656122a-83ed-478f-8fa7-23cb2d5cd5eb", "comment": "Malware payload (Heodo)", "value": "33ea1060cbc52a220ee30bafa5255a8641a0ee999f9a004017dc8807d5c2ce3b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556035, "uuid": "701d9142-3b39-45a9-9ab2-ec47f53140d4", "comment": "Malware payload (Heodo)", "value": "bb91f730f70a6915a4f0557187b08cdf893d77eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643556035, "uuid": "58aec792-780b-4c4e-bafa-d7806dd6404b", "comment": "Malware payload (Heodo)", "value": "168dcf961c049047b4eaaf4f8ac75b1639f65ca857d5791afcfe83a7e3e5148a7b43913ee94ec77b28899fcb55506a91", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556035, "uuid": "4f809c4d-79c5-4a6e-9ff9-b647ab02fe72", "value": "T18BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556035, "uuid": "d3d0bb5a-b70e-4c12-8acc-be60a45fb882", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643556035, "uuid": "7be885d5-2018-4e03-9d7b-d4fc47653328", "value": 145990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643556035, "uuid": "f8215289-1006-45a1-b348-140f309024d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643556035, "uuid": "5c08597e-86f5-42b7-b8d5-7645d284d155", "value": "2022-1-26-0e0bcf994e2bda5d523361030a8add05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8b2037-81a3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643529920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643529920, "uuid": "9969d07a-3e97-4aff-a8ee-8972278b099e", "comment": "Malware payload (Mirai)", "value": "5f0606f201daaa9345275b42e78c6987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643529920, "uuid": "03fd7e6b-8dec-4bc4-bacb-1a4714ab223b", "comment": "Malware payload (Mirai)", "value": "33f664b3354d526df22f3b833dcf442748e7fb102c1b0555ae7184dfa521aebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643529920, "uuid": "4eacf540-8a46-4082-941d-d6534afff812", "comment": "Malware payload (Mirai)", "value": "b8ec3be1cfe206ebd7c54c468cb1c53069abdd97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643529920, "uuid": "07851d6c-79eb-4235-ac6a-144f2fde6f42", "comment": "Malware payload (Mirai)", "value": "2edd0f808651fa601dd165409cd2bbfab312b732925471e09741d045b332cd06527bb2f345029f5f59895f1b0eed5199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643529920, "uuid": "d86250aa-98d1-4a4f-a822-dff539e41501", "value": "T1D7833B02E643C6B3CC8307B2029BAE661931BDAA5E2ADF49F31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643529920, "uuid": "e7f3dc62-5b42-4797-bc9f-ad024b017ad4", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8L4GDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0Y0GoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643529920, "uuid": "98e3824f-5b2f-4891-89e8-bfbed54888e0", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643529920, "uuid": "2af6c024-556a-445f-adf5-ded65d54cb62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643529920, "uuid": "01045719-a743-4915-8d50-7fb240ac3154", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8cd098-81eb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561000, "uuid": "63533694-60db-42ea-91b3-867ec897573a", "comment": "Malware payload (SilentBuilder)", "value": "11a58c102f9903402583265078446380", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561000, "uuid": "8982d691-0518-4cf5-9a55-0ecd54c321b0", "comment": "Malware payload (SilentBuilder)", "value": "340c725ca3aeae1b81040a2819f33fb902d867a52c746422aae84fe4d0532f74", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561000, "uuid": "c7704a30-94a0-4643-a548-50ace6f0057c", "comment": "Malware payload (SilentBuilder)", "value": "221e40031675c6262fff4029fc128423e89fb5bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561000, "uuid": "7fb62112-3dc4-4ad6-b0ff-18f9ee9722a6", "comment": "Malware payload (SilentBuilder)", "value": "c99c596886ca9ff3408c53e8d5277bcc424f723139087eeec5eb7720e3c62c93c7a239787b0e9ca29db57933aa8bbae2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561000, "uuid": "2e6b40c5-e8b6-4938-ab55-0cc57f2bd686", "value": "T1B423B6EB77CB4C89EE29037A8DB247186753EC669BE357473205B3169EB0AC08D03917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561000, "uuid": "1e19e097-4e47-478a-8e17-0764e0e78edb", "value": "768:cUFN4Yg+Hyms5k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZcj6ehEnB7qrFBJ:cd+Hyms5k3hbdlylKsgqopeJBWhZFGk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561000, "uuid": "0c54f077-8ee6-44ea-9668-378a390ff79c", "value": 48606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561000, "uuid": "84201699-802b-4fbd-9176-d8c0f14e79fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561000, "uuid": "f173451f-ed85-4067-aba0-8c89b69e05d3", "value": "2022-1-29-11a58c102f9903402583265078446380.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f95e49-81e3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643557602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557602, "uuid": "03276336-e6b7-4959-8903-0b7191d9823b", "comment": "Malware payload (SilentBuilder)", "value": "1339f7ec7951516d0102ade39a4bf498", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557602, "uuid": "5c320aab-7343-4f36-8fd4-43afebf42a6a", "comment": "Malware payload (SilentBuilder)", "value": "340d128e9e4367fee4d4202dd4ab6c1f2fcc0e251979ed44e90a3e9027e23bc5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557602, "uuid": "aaaf21bf-69f9-4348-92dc-3866cf35c455", "comment": "Malware payload (SilentBuilder)", "value": "5234f9e82492805fa507a6bec4e2f98eed48161a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643557602, "uuid": "8cfb9800-0f6b-41fc-8be4-ba4ef4c544e2", "comment": "Malware payload (SilentBuilder)", "value": "b48f453a4b51b1427755c3b27d19d2e48efc1cad7d6d1a2d0b1070f181d169afd8f6cf760be18ef93b5005c21c2f752a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557602, "uuid": "c2668893-8b3a-47d3-87ca-20efdea40dc8", "value": "T137735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557602, "uuid": "05b8f49c-1a7e-4934-b200-bcd0050d3752", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643557602, "uuid": "f53a43e4-0a0b-4e3d-bd82-f16f1358ae36", "value": 77714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643557602, "uuid": "ecc12093-9688-4ad2-9f40-841547ef643a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643557602, "uuid": "e9a79f16-5747-4b69-a641-3ac658d7c6c4", "value": "2022-1-27-1339f7ec7951516d0102ade39a4bf498.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0ee18a-81f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643565675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565675, "uuid": "d28c5ec5-b733-40b0-90e0-5e9fb454c1ca", "comment": "Malware payload (SilentBuilder)", "value": "0bbd5b297a1a045ec0c1cd5faa321e82", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565675, "uuid": "6dae38f7-cc96-43b3-bf58-2eddcb2d9ad9", "comment": "Malware payload (SilentBuilder)", "value": "3412b9038360da67ca4a8450d73da7623489d43b1fd77539c61b2054e30fcc24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565675, "uuid": "855dc32b-e022-4953-a743-96b0519e555e", "comment": "Malware payload (SilentBuilder)", "value": "14f976165afc6484095557ec05351d3740455ca9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643565675, "uuid": "65847b26-10ad-48e8-8c0c-29978094a49e", "comment": "Malware payload (SilentBuilder)", "value": "dbfbd4438c2c1a3ca410f3c3da6109998bcb9b05c3e0175192c9908cd0bd03034d94759c79d7a624afe4eb4a54c3f920", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565675, "uuid": "b76a33bb-5f6e-4640-8e6a-e303ab917b3d", "value": "T169839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565675, "uuid": "907ea3e8-91c6-4077-a03f-8e2a665f43b7", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643565675, "uuid": "5da7444b-0cc9-461b-a1e5-dfc38be9e52f", "value": 87170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643565675, "uuid": "e94922f0-8c67-4db9-89f8-e2be11017ae1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643565675, "uuid": "afa04aa6-582e-4d41-a114-178713c6b483", "value": "2022-1-28-0bbd5b297a1a045ec0c1cd5faa321e82.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535fd41e-820c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643574999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574999, "uuid": "3259735c-4ea3-44b2-bc31-1898080674ce", "comment": "Malware payload (Heodo)", "value": "854aceeee38564fce767fb3fd0bb2072", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574999, "uuid": "6d7a1b3b-137f-4b9c-b165-51af4c81a8e8", "comment": "Malware payload (Heodo)", "value": "342e267add0b210bcc26c023024146d3a87dd2b95684e93ba6f43702d8f728fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574999, "uuid": "145be776-a1d4-4fe5-949c-53d047ac586a", "comment": "Malware payload (Heodo)", "value": "a493fe0d219fb55f6eeb7090171a5f0cf6bdce90", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643574999, "uuid": "45a5666f-41eb-4454-8a76-987d610ece23", "comment": "Malware payload (Heodo)", "value": "ae0dd4d25750610669cc631c799e823460cd2f0548a67d980a70dcd8e6f254668acf709baa7893f51860d2a5bcff8fb6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574999, "uuid": "1ea24840-e70b-4acd-93c0-bfc17dcb0591", "value": "T1F7934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574999, "uuid": "fe12b97c-f7c2-474a-a4c9-ccee4e8e71f1", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643574999, "uuid": "dcb62f4d-f8bf-4510-b1d9-2ae500b74e3d", "value": 92503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643574999, "uuid": "5abc8861-2b84-46c6-9b0e-6b92d4956a52", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643574999, "uuid": "951ca370-ab4d-41cf-8169-6e3aa4336010", "value": "2022-1-29-854aceeee38564fce767fb3fd0bb2072.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8e790a-81ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643561968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561968, "uuid": "20400dd3-5afb-4690-b169-853b16edfaf1", "comment": "Malware payload (SilentBuilder)", "value": "99b8d61cb0b6c38a62f8ae1f4b220a43", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561968, "uuid": "9bc44d73-f86e-47ff-a304-e413f41ca64c", "comment": "Malware payload (SilentBuilder)", "value": "34384020f801437baf2f6947f9d06aca4fc4964282c631493e4239e2f3c7179e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561968, "uuid": "5bbcd1a5-e8e2-4b16-bb78-4849fb66cdf6", "comment": "Malware payload (SilentBuilder)", "value": "5c4322b68184a9a42259ddb059254ee0ba715acd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643561968, "uuid": "4144c48c-fe12-4dd2-9627-fd956a874091", "comment": "Malware payload (SilentBuilder)", "value": "6a8d661947ea12306b96e53d6bdc47273a990ef93a29eb3460c6d4a7cc0767fbdbcc38cb8252ad6c82fc41f2faf4ef32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561968, "uuid": "c914ae72-1032-4b3f-8dc7-8121e3514f8d", "value": "T175735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561968, "uuid": "4ec881be-3da3-4bd5-a9b2-42e6ef0d2c75", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643561968, "uuid": "26a6f1d2-8c5a-4a19-82e2-a2d0dd729dc5", "value": 78163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643561968, "uuid": "79dad7e4-f2ee-40b9-a287-f66375f17d8b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643561968, "uuid": "5d11e4bd-5097-4fd0-8579-3f343d3b4444", "value": "2022-1-27-99b8d61cb0b6c38a62f8ae1f4b220a43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f489b47b-81f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564961, "uuid": "df16646d-d9d7-4e3e-b827-796fcf35c842", "comment": "Malware payload (SilentBuilder)", "value": "f83ed9e0e76b6bb15a05185d779a0510", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564961, "uuid": "e1261e5c-d01c-4282-aeda-a01aed46baed", "comment": "Malware payload (SilentBuilder)", "value": "3441296c922e35460a5650d10f999dd1bc98c52c64249b50699b63bb83eaf2db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564961, "uuid": "c37fecf0-8fab-4414-bac8-2f3e99cd0cc5", "comment": "Malware payload (SilentBuilder)", "value": "c15c3bbc85df3179b551852cec98fcc59d45f47d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564961, "uuid": "7fddf855-98f7-4b29-8cd1-8cdfccf31961", "comment": "Malware payload (SilentBuilder)", "value": "f1da70852dc8ca1e3ca967d4f95c74f1917b0044ecb6d6f9796d2033c2c033e001e86e38205457363c02e08681203597", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564961, "uuid": "6a8e5c1b-1679-40bd-b781-0cda956001d3", "value": "T108735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564961, "uuid": "517b3db7-b553-480b-97e9-ac8a4c4b3e35", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564961, "uuid": "68e8ea85-958c-4d5c-8a72-e03cd62b1599", "value": 78206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564961, "uuid": "0da94433-5d36-4eb0-b112-704ef3f58fec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564961, "uuid": "45f5f801-2be4-4049-aba3-279f1c900474", "value": "2022-1-27-f83ed9e0e76b6bb15a05185d779a0510.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1445df13-81f3-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643564155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564155, "uuid": "a975f8bd-48bb-47a9-b14a-4d051bea4fac", "comment": "Malware payload (SilentBuilder)", "value": "dab316f1d885b3d69e5d190cb0b2d3d7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564155, "uuid": "7c37015a-d3a2-4050-a1e6-8b191936cc43", "comment": "Malware payload (SilentBuilder)", "value": "344282a34c3527d5906e50f975c359b09321e70cc6b3172effe61209e90a2669", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564155, "uuid": "f6e116a8-7eb3-422b-85fa-b6c14d35c5a0", "comment": "Malware payload (SilentBuilder)", "value": "2ba9cbc1a19e3e2009570be845ab5bcca5dca41d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643564155, "uuid": "c3f7883a-3c2a-4429-be64-454c365aa284", "comment": "Malware payload (SilentBuilder)", "value": "2158d5b1a948ec4b3cf362fdb34df1efcf03f398db7dfa8edbb97d57d72978ef6bf283874d5086a889eeb4077ce3bbe3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564155, "uuid": "c3c50206-89a9-4d03-bc17-9eb0e6f37458", "value": "T1E1131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564155, "uuid": "1da07773-758d-4fd6-8f7c-6330cd23fc2d", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643564155, "uuid": "d310202e-3359-4ea5-974e-1121e128cd57", "value": 44674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643564155, "uuid": "8f54e3f6-c482-4554-a8a6-c8ffec70b1c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643564155, "uuid": "0dfdfc5a-bde2-414c-bd16-dd3428212c36", "value": "2022-1-27-dab316f1d885b3d69e5d190cb0b2d3d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e58876d-820e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575742, "uuid": "5835b6a3-cee6-4178-8ae4-ec5e2991ad74", "comment": "Malware payload (SilentBuilder)", "value": "c87a9c7351731b5a7492d1e8231f5cc3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575742, "uuid": "8290aca4-8553-45eb-891e-a119f9afd05c", "comment": "Malware payload (SilentBuilder)", "value": "3445749e043ab104bcffa1b09f3537a9279f0c4d852b9f3d3df1a92d082e0370", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575742, "uuid": "11460890-6a4e-4911-a224-5153c6ef8867", "comment": "Malware payload (SilentBuilder)", "value": "d154b6005a2ce0445bd5af0f587c0efff76b78d0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575742, "uuid": "6f0e9149-0ee8-41e5-b16a-1140b1d01de6", "comment": "Malware payload (SilentBuilder)", "value": "12bbb0427e2bc57df44d44632ea300d12eada221299b69d789d1a139cbb01eefd0266af59cb5f946d1f350d3564dbf15", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575742, "uuid": "58aa6c18-2301-4616-add3-1feba39fc3cf", "value": "T152934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575742, "uuid": "527ae063-fc2c-4ef1-890e-54f6c28ae5e8", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575742, "uuid": "b480f75e-8076-4df2-9204-c6516a2a0d8e", "value": 93050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575742, "uuid": "19aff47e-4b66-49e2-9aae-c3fe77f72ff1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575742, "uuid": "b6010e9c-f5b9-49fd-affd-41c200065683", "value": "2022-1-29-c87a9c7351731b5a7492d1e8231f5cc3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa5f6aa-81fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643568147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568147, "uuid": "626516af-5324-4f5e-9544-5d134a5fe853", "comment": "Malware payload (SilentBuilder)", "value": "5d2e29fde00feee594cb2d5e70f55089", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568147, "uuid": "4b940d72-40c6-4276-b16f-08768d00ab85", "comment": "Malware payload (SilentBuilder)", "value": "34578e8d1d034586dd3f0bb687aa389078fe7538e463e51bb4e03d1f765ef183", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568147, "uuid": "3278c914-434a-4eb6-bf5e-52df33d40570", "comment": "Malware payload (SilentBuilder)", "value": "58d4828ba1e7aa35e1bc3b9912cd16c587357513", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643568147, "uuid": "258fd737-639e-4c29-82ef-47c79f719bad", "comment": "Malware payload (SilentBuilder)", "value": "8d798ccdd0ba82d475b137ad3a1dd2449f7c927c8f025d32cdb3197a35392ee9e270b87355de4369e1e118333490046c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568147, "uuid": "41a5f930-aa5b-46d0-b103-f18cc6f1a88e", "value": "T1BEF3BFE663A6C984DF15433E8CF2071A3767EC625BE71747A304732A6DB1EA48D0352B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568147, "uuid": "cf13415a-f5a8-4c7f-a6ff-73ef7830b38b", "value": "3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643568147, "uuid": "a044a40a-c44d-418f-a1df-ee21b8002880", "value": 158797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643568147, "uuid": "398ae030-8871-489f-8cd2-09bcab206c05", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643568147, "uuid": "5430020b-3e51-4865-8e3e-3eef56055989", "value": "2022-1-28-5d2e29fde00feee594cb2d5e70f55089.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca8bf4d-8202-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643570988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570988, "uuid": "ca6c63a7-49b5-4ddf-8a8b-d683670179f9", "comment": "Malware payload (SilentBuilder)", "value": "c3d006b63614d74cf37f0c57877e2e78", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570988, "uuid": "ddd64c6d-719a-45a5-a407-0e4d9de9467a", "comment": "Malware payload (SilentBuilder)", "value": "3461b3f8365343efde6ef8bc4dd6e7e3a590d5fefc6b7cd3d7c7ecb2db531ca5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570988, "uuid": "9ba649c5-0fed-4c0d-af28-c1dbb9f7f431", "comment": "Malware payload (SilentBuilder)", "value": "88889f1e185a947fd9eb377dbe1c98079b71fdee", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643570988, "uuid": "ae922b8c-3f95-41a1-890a-896afc3c8473", "comment": "Malware payload (SilentBuilder)", "value": "5d3a6b6272a3cbc63131ea4eb6f97a9cdd573e4805ed74b75e04a97b30c0aaf2204a4cf4d293325ae3dfc76e0d549907", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570988, "uuid": "9fb61b5b-d837-48ac-b9a3-403466985f1d", "value": "T1C6839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570988, "uuid": "c1ccf070-adef-4483-b34b-9a1f895b1751", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643570988, "uuid": "44071d72-2f4b-4d6f-84ed-7a4ce82149b1", "value": 87092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643570988, "uuid": "db6e8da7-d59d-4dff-a995-cdb75d682114", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643570988, "uuid": "3c9ed35b-5387-4d3b-a0ad-0d1cb9323983", "value": "2022-1-28-c3d006b63614d74cf37f0c57877e2e78.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082148cc-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558552, "uuid": "3913e1fc-02ba-45c9-a6d2-d475d2b095a2", "comment": "Malware payload (SilentBuilder)", "value": "d9bf593a01a1510542de4086ea97baea", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558552, "uuid": "d4bcaf83-b910-43c7-b986-80c1e5f5e142", "comment": "Malware payload (SilentBuilder)", "value": "3467997c3fe4f1031c72e4b4aecaf0d08cc4000fdc05b2dbdb00f7b426b01ab5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558552, "uuid": "3126225d-cfb4-4083-a69f-8acd0d41da95", "comment": "Malware payload (SilentBuilder)", "value": "de03b5bbadde4275c9aceb550f553921f99e5b9b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558552, "uuid": "9feee300-a876-48f9-80bb-db6a1e306bf4", "comment": "Malware payload (SilentBuilder)", "value": "3fe307055f23b6fd43b9e607638e4eb2b4d4f28e444a5a26da5bb37fb11df40a081e8c1129cc1ff781aad617d15318fb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558552, "uuid": "a3644085-c223-4015-9a17-ff7d54805916", "value": "T16BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558552, "uuid": "a40f8253-ea65-4e8b-8961-858a37302ca4", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558552, "uuid": "73cb1800-2c94-4c11-ba58-b5be00697b00", "value": 145462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558552, "uuid": "0df05cf0-be8c-461e-b76c-723f27b6b366", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558552, "uuid": "b47a0421-1976-4264-be6d-c42da5b10145", "value": "2022-1-26-d9bf593a01a1510542de4086ea97baea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e70e2e0-81f7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566105, "uuid": "4e7a3570-fa69-459d-bfd0-99a7c799a9f1", "comment": "Malware payload (SilentBuilder)", "value": "1680ba5bc9e10c1e17e0f587a08d9ba7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566105, "uuid": "788d8f1c-fde9-4099-a254-cd42c3636c11", "comment": "Malware payload (SilentBuilder)", "value": "349fc308a6ffa3586c9552a92b2c0330e2c34b4590dd3b38c5c0a8e67965b4bd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566105, "uuid": "352b484e-50b9-45b6-9e28-136e64ccc637", "comment": "Malware payload (SilentBuilder)", "value": "9543a05776dcd337465a92d1610c6bddf622615f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566105, "uuid": "e91701a3-8d00-49bd-8b74-9ce488331ae0", "comment": "Malware payload (SilentBuilder)", "value": "68783b92e6397dd0334becedd6f75f583a7de0a90460b4a8b3a45853dd953b4097e60e2cceba1a4aaf892e4952c37046", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566105, "uuid": "ff6a170e-c09f-4181-995a-95b5b7dd085b", "value": "T19F233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566105, "uuid": "5530f32c-c01f-4a81-b823-f4bf440cb606", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566105, "uuid": "56cdaaac-698b-400e-9088-af985fd7b529", "value": 47618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566105, "uuid": "283be7dd-97e2-4481-b0b1-acbcc5a2dd15", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566105, "uuid": "ad936595-823b-49db-afc2-476c3705b643", "value": "2022-1-28-1680ba5bc9e10c1e17e0f587a08d9ba7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb8a999-81d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643551015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643551015, "uuid": "b25c845e-c014-4f39-a6c1-e6aee2142365", "comment": "Malware payload (Heodo)", "value": "69e68aa993ac903011fe40e5b7a20c94", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643551015, "uuid": "3f0445fe-6828-4870-9262-0e51b890410d", "comment": "Malware payload (Heodo)", "value": "34ab0aa6ab20705432011a396b6b2d62f2a5c20f39b083dc77ca3f21999688d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643551015, "uuid": "ef5827ed-9cd1-47a4-b7c6-4c5006f24bea", "comment": "Malware payload (Heodo)", "value": "09c96a286cf13d2ff47042919fa03760c67e6eb0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643551015, "uuid": "4f1750f0-9839-4ae9-bf86-9f61be2d1f1d", "comment": "Malware payload (Heodo)", "value": "aa19c4861dbb8e5d5ab2c95902d6609d5506f6710573ace6e65519ce280a8da16accca0572284eb0c12823b881ca8b38", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643551015, "uuid": "05f8916e-ee7e-4862-9bab-6a0296d5d179", "value": "T135839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643551015, "uuid": "ec9e7f5b-0a7e-41a5-a8ce-6cb93e1cd5d9", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643551015, "uuid": "eb9a6a0f-523b-4950-891e-118288743f58", "value": 87318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643551015, "uuid": "313426f1-cbe2-425d-86b1-48ea2c94fff7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643551015, "uuid": "1a8987f0-2a95-413c-b7bf-bc9b2839a90a", "value": "PO 01282022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ac91d0-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643560079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560079, "uuid": "d8bbc9e8-1f74-4534-b887-250e2e5950ee", "comment": "Malware payload (SilentBuilder)", "value": "5a4cc1a4120f64d87cf0a19594688db2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560079, "uuid": "0fdf4488-1343-4b39-8217-a6890e771071", "comment": "Malware payload (SilentBuilder)", "value": "34f722adbb0175e1361a15b145ebcbdb10aae2226c018e951abd6dacc2eed903", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560079, "uuid": "2b307251-a9f6-4ee3-b8b4-3679968f8170", "comment": "Malware payload (SilentBuilder)", "value": "f27591916717db798150a6e177d1cbe439bb30f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560079, "uuid": "1ad1ee30-d49a-4d9d-91b1-9bf6f7703e2c", "comment": "Malware payload (SilentBuilder)", "value": "20eee737bf18f7ea6a773f6c22b807f8cd5a1f17ff9b3294c3a6c2fbce9de77ea9f9398d56b7ac7eac3f510f9c2d7bda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560079, "uuid": "76c08315-fd95-48be-89b2-26d596d0171a", "value": "T1EB735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560079, "uuid": "d96ddad6-481a-493d-9aaa-991122239f92", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560079, "uuid": "6085272b-0598-416a-a2b8-bfe1367c4eb2", "value": 78225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560079, "uuid": "8e4dca32-1e80-4160-8a30-6f8c0df1468b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560079, "uuid": "e1a64060-19ee-442f-b5d5-1a896008eebc", "value": "2022-1-27-5a4cc1a4120f64d87cf0a19594688db2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db09c669-81e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558476, "uuid": "38732902-64b0-4624-a1fe-774f398efe1d", "comment": "Malware payload (Heodo)", "value": "d31fe3f865ea79ca5a7729a3086200aa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558476, "uuid": "9a7e3a1d-e75b-4fd5-995e-5ddd65127381", "comment": "Malware payload (Heodo)", "value": "34fb1f6ba92f8df593d6636135c9830856d8923744a9d06d9e5609e58b77e533", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558476, "uuid": "df988797-d4ce-4dba-8b7c-378babb45e81", "comment": "Malware payload (Heodo)", "value": "8909420c6cc484ae6c750211168d76b63e746602", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558476, "uuid": "56759434-bb1a-4c2c-a416-f5368daf01f4", "comment": "Malware payload (Heodo)", "value": "5eb208d2951aaacee8f23baa98341c44711d882c90349ae59e2938a184288b973b1b765ac594e8489a9d75de6186e841", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558476, "uuid": "ff8c2429-b40a-4f59-af40-f52c8729c5c3", "value": "T15BE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558476, "uuid": "f72178d7-d7ed-46b1-b844-90a07fe6804b", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558476, "uuid": "3f56800b-ceb0-434a-8465-49252c2b2808", "value": 145692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558476, "uuid": "ce1ecf62-b615-4bba-9425-3be704f6e7e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558476, "uuid": "6c88e369-f799-49fc-826f-80933ecdce8c", "value": "2022-1-26-d31fe3f865ea79ca5a7729a3086200aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d42631-81e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643560153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560153, "uuid": "16e695b5-88a2-45ff-94ed-db92d43c0a07", "comment": "Malware payload (Heodo)", "value": "5c7fbe5ce97f3aabea89d9ea30ebe5e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560153, "uuid": "a666f126-235a-4d70-aca3-e8ea4d63fbf3", "comment": "Malware payload (Heodo)", "value": "350818036a729582675151df0e48a806a301ebdcebdb778f8be7e93fe0d951e3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560153, "uuid": "4e45b789-1c73-479b-9fca-de7a78db756b", "comment": "Malware payload (Heodo)", "value": "d143169e4030f7da076c9e030f29494e8c8e1527", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643560153, "uuid": "455a516f-1037-4e10-bb2b-ee40b62a5d00", "comment": "Malware payload (Heodo)", "value": "0528deca603c126e15b98e8a386e79493d40efe5188743ff42fc7ac03d394949d0c9a7878267d9c4ba1f53b7221fa1dc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560153, "uuid": "b7f6e0ae-2575-4f4f-9ded-aa3fa3613208", "value": "T108C37CBF22866E9BFE5B033D8C520578571BBCF47FDF5203528672016AB49907A26237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560153, "uuid": "9d061ea1-d354-4ab6-995d-4d2caf58fdd0", "value": "3072:mD+HymsSk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIWdb4oifHMVhoSc2vUz3UWD:Q+HymsSk3hbdlylKsgqopeJBWhZFVE+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643560153, "uuid": "93dcc177-5e25-458f-bf3a-0e33b178a583", "value": 118928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643560153, "uuid": "7de52c88-adad-4619-9ac0-7a9becc47ce7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643560153, "uuid": "d61f5d53-0a3b-42c1-896e-bb23a4a29ac0", "value": "2022-1-27-5c7fbe5ce97f3aabea89d9ea30ebe5e0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cede60d-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558694, "uuid": "302d5aa0-0e01-482a-a157-f883fd326159", "comment": "Malware payload (Heodo)", "value": "e37dca4e48082e0a44ac37360b90e97a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558694, "uuid": "0e94a828-aa37-415c-ab67-83ea07e9170d", "comment": "Malware payload (Heodo)", "value": "351d1066fc9ec8e8aa143f3274c2842c12eb2b7db6d46e5b5d3680d254a7986d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558694, "uuid": "7749ec8a-9753-4c20-b730-c287d0931011", "comment": "Malware payload (Heodo)", "value": "31770f0e9d4d1ef471707ee304b2971eeaa5d51c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558694, "uuid": "90c5eb0b-634a-4740-b570-cac0e12214a1", "comment": "Malware payload (Heodo)", "value": "7d7d2766a526b582f05ae7b2b97268aaf1a589884be89623b9c66a430ee05e86e07f857d0a009f5364fea3492400454d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558694, "uuid": "5c060169-c311-437f-a5db-600ba46c7e9a", "value": "T1EDE3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558694, "uuid": "5360fe51-2ef5-4772-8638-8cd72324e535", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558694, "uuid": "23b3ff9c-d20d-4040-b816-7e7cef28e630", "value": 146345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558694, "uuid": "3ede14ae-8f24-4853-8188-bf09843404b4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558694, "uuid": "083e26ad-c147-4c68-9e7f-c48b226e5409", "value": "2022-1-26-e37dca4e48082e0a44ac37360b90e97a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1b90ce-81f8-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643566294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566294, "uuid": "23741889-46f0-40f3-95f8-112493f15373", "comment": "Malware payload (SilentBuilder)", "value": "1bf33ed11b4ea54f6494c82ccb145255", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566294, "uuid": "6f59c2c4-8571-4152-b53b-9120a88d9646", "comment": "Malware payload (SilentBuilder)", "value": "351d4072f0484b273c39083289b3f22af7132ec95d0dc01c1b52c51baad51175", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566294, "uuid": "da0f8a1f-a138-466a-bd09-b33231a83aee", "comment": "Malware payload (SilentBuilder)", "value": "a813fbbb5ea7462d29d061778e3e1d9bb5cf8fb2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643566294, "uuid": "5f886596-2d5f-4082-a8a5-8f39d51dee28", "comment": "Malware payload (SilentBuilder)", "value": "dd5ad1a80ce9c015a40f164da3edfef8ee922802454d54b6d08857ad15885aecceb7eb069a3d6e346fb6ec252be86a32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566294, "uuid": "3cf72488-8f61-4922-a8b3-91d5d04159e1", "value": "T10D839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566294, "uuid": "e381b3c8-133c-4441-b5ed-1c3f87d45dd7", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643566294, "uuid": "ca6682cd-9bb9-4342-a151-be87824ba6f4", "value": 86759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643566294, "uuid": "2bff03d4-6a43-472b-8196-685dcc57c9ee", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643566294, "uuid": "62acae27-d9aa-4402-96c1-4573b85c701c", "value": "2022-1-28-1bf33ed11b4ea54f6494c82ccb145255.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e56082-81e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643558088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558088, "uuid": "3126b466-6422-4a24-809e-68d5029e0615", "comment": "Malware payload (Heodo)", "value": "ae5b6e169c987672e83e47ab6c0c6900", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558088, "uuid": "cdfcf7f0-dc6e-45aa-ba91-fa6b5af48bf2", "comment": "Malware payload (Heodo)", "value": "353ddb1ede17383924fa78ecf533557d2bf9b35db67765f2c52384f07cdb5c76", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558088, "uuid": "4a51cf6a-567e-4e7d-ae4f-a8d28ba78911", "comment": "Malware payload (Heodo)", "value": "199ddebf75b7337da1966f8c133cf0166d162093", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558088, "uuid": "c1266ca2-f83c-4727-aa6b-27b39e741c41", "comment": "Malware payload (Heodo)", "value": "332b9973dddf89a028bf57574dd7b7b730ac2b95e6706c3958722e06889bcdde2497dda573b086e9d7a91407490c621b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558088, "uuid": "d7b8169d-177d-4c8c-83cf-175020be699a", "value": "T1F7E3BFD766C7588ADE25037E8DB636D85653EC718BE393CB1346B3169DB0AC08D03A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558088, "uuid": "ab022f2d-9888-4392-9b11-920290471082", "value": "3072:Yn+HymsUk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIgNIxJ3B7aD15BIjMAVn/9LFK:m+HymsUk3hbdlylKsgqopeJBWhZFVE+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558088, "uuid": "621a72b0-2d7b-466d-9d3e-fab225c158bd", "value": 145548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558088, "uuid": "2dc85228-9325-4fe4-8a19-ffb594b2ab2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558088, "uuid": "81ee20d0-4bce-42c9-bb27-486f30990c79", "value": "2022-1-26-ae5b6e169c987672e83e47ab6c0c6900.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f068a-81fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643569172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569172, "uuid": "365ab36b-d14f-49aa-9c7e-a4b6518b2a45", "comment": "Malware payload (SilentBuilder)", "value": "7fcdee61755a9ae1cb9e5ad939064b7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569172, "uuid": "61dad133-6bb9-4144-90f9-a3bba660ee51", "comment": "Malware payload (SilentBuilder)", "value": "3548b4456fe6299e9a5a082448887b038e5e3f344ae9b51421b56e571b5953ee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569172, "uuid": "c8547515-80a4-49d7-bd43-7ce24e653e1a", "comment": "Malware payload (SilentBuilder)", "value": "2b3148df46442d3e4a81c493ed0bfb0acbe29683", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643569172, "uuid": "e6eace69-9a24-4706-b9c4-769fe635a927", "comment": "Malware payload (SilentBuilder)", "value": "afc2f0330f3389e0d8f004108d95e317b0c46ca653c6e7c7096cf6c3058be30e27df357a58a6cf11339c05cd01e95c50", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569172, "uuid": "bcda0b55-1433-4e63-bff8-f289f65cc896", "value": "T127233AE7B7C79C9ADB21037A49BB82156357FC659BA34A476205F31A1EB0AC04E03727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569172, "uuid": "a813fa0a-5e13-4331-9f5c-ecf14b6a4c85", "value": "768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643569172, "uuid": "8ba839b8-0f42-4166-a246-ec02fbe98e82", "value": 48711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643569172, "uuid": "31f26c74-1784-4328-8ddc-9b0f23a26f0f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643569172, "uuid": "07024231-1829-4171-85b8-89ca6b48b4c9", "value": "2022-1-28-7fcdee61755a9ae1cb9e5ad939064b7a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0692f2-81df-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643555553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555553, "uuid": "fd4dac46-e612-4d9a-b7e3-6984f6c5f18e", "comment": "Malware payload", "value": "9b080578a83b254057b1529b7506a2a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555553, "uuid": "9b5c5a2e-5f93-442c-be43-46cc812c8efe", "comment": "Malware payload", "value": "35599be0e874c1a9ce0c50504c19995c7db3205f4c9d4dd63c594753479f0c1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555553, "uuid": "2753d8cd-58ea-44b6-bcec-eb0d67fb8c18", "comment": "Malware payload", "value": "279dd10c9c930a486101b427c5c55c62fbf8256b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643555553, "uuid": "c719c900-02b9-4b1e-a25e-3a071ae1dcb0", "comment": "Malware payload", "value": "ccf04c73826bb4c3cb4e62cc58e8b1d49ce78bc152d0f135ae85b71a46dbfe9fc554b4c7a456150c54d1cd58f28d0696", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555553, "uuid": "175d6a1e-ce97-4214-910e-4b94824c2406", "value": "T157230856F9815F11D5C211BAFE4E128E73134B6CE3EE73226D24AB2077875B70E3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555553, "uuid": "0a122013-4a39-4407-a640-e9c3dcf4e5ef", "value": "768:ip9nkpd1gA/rwhaxBfBmE/O0aMItZLi0/+t5R1Wdbvq4VFr5bYpQIk:iznU1g4aaxBciI/i0/m5R1ubVr5bYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643555553, "uuid": "445e8cc4-6b92-4001-8645-f03df7e1006d", "value": 47724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643555553, "uuid": "98ab9830-2adb-4793-9267-1b778c7d9a96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643555553, "uuid": "0261d68f-e5fe-43cb-8a5b-b2c35c99319f", "value": "beamer.arm6-20220130-1512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeceabe-8207-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643572944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572944, "uuid": "cbf7b319-5d5b-44d6-9988-35200049639a", "comment": "Malware payload (SilentBuilder)", "value": "fb4ced3aa92eae22378860c41cc3bc6a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572944, "uuid": "ef1d4fb7-39cc-45fa-87e1-a7b948bc4086", "comment": "Malware payload (SilentBuilder)", "value": "35744dd3ef6bb04b7067daa1487428652508d547d2ea0618cdb38583c99d96c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572944, "uuid": "bc1d1375-9e29-433c-988f-107c935dc765", "comment": "Malware payload (SilentBuilder)", "value": "a218dd67b601876dd894db8e274d9ebef2e394bc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643572944, "uuid": "a6b108ca-3ef2-4398-8ecd-252e086d4970", "comment": "Malware payload (SilentBuilder)", "value": "440107b349313344a07bdf2b206150bfbacf24697e03d2d5360d1a979f3770e0b58f0faba6450db4090b15a7a4af3c49", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572944, "uuid": "4e305497-c2ac-4956-afa1-cf1ebd2aa87e", "value": "T198839ED6B2A7D885DE5F837689FB0B522753EC658BE3020796557B0ED938D808D0322F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572944, "uuid": "3480e4de-41e2-445a-a75a-a24099075909", "value": "1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643572944, "uuid": "f1b60a92-f958-4c3f-ba30-3e587548d059", "value": 86742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643572944, "uuid": "8cc798ff-31ae-4e7a-a543-87f8fad2fcc9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643572944, "uuid": "a435ece3-c66a-42f7-928f-1c34fd46a6da", "value": "2022-1-28-fb4ced3aa92eae22378860c41cc3bc6a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14db645-820d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643575613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575613, "uuid": "dc5be2f7-de6f-4bf3-bcd7-9d21c34f4b64", "comment": "Malware payload (SilentBuilder)", "value": "bd41ee2e01accceae4d3f8531163e41e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575613, "uuid": "5fca833c-1122-435a-b5fe-14790ece6aa5", "comment": "Malware payload (SilentBuilder)", "value": "35ce739e4b035735fe28526c972d05721efd0076d41516d2614b6376580ae9f3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575613, "uuid": "02168ee6-6b7c-4e51-8ecd-72b1f898d815", "comment": "Malware payload (SilentBuilder)", "value": "3ce29900e0149de20d0aeef942112de7347f6af3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643575613, "uuid": "0fa3db9a-4c18-400e-8971-bb8a8ca5e044", "comment": "Malware payload (SilentBuilder)", "value": "327691371dffdafa5834163b6c1a7197a39e518d17cbfda1cd297ae9169034115a2da9eea366259c4c35f1e3ef126647", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575613, "uuid": "727400bd-66ba-4a14-aea2-dd5998612a8c", "value": "T11C934B1BA98548C5E66D47F4E0625AE9BE63EF45FB433ED321107F863AB41834C0B17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575613, "uuid": "3c30dbdc-9834-4485-8ec1-702a4c6e0f7b", "value": "1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643575613, "uuid": "3aaecddc-4342-421f-b09b-82198bccbb0d", "value": 93013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643575613, "uuid": "efcf9273-f0f7-4a4e-825e-0673643fee33", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643575613, "uuid": "00502b37-6e21-4dec-ab03-99f8ab84b742", "value": "2022-1-29-bd41ee2e01accceae4d3f8531163e41e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482db7a5-81e6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643558659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558659, "uuid": "662d6a1f-9e9b-4ab5-ac0b-92417a49cef9", "comment": "Malware payload (SilentBuilder)", "value": "2efc34139699ffb9ff7d18e20906136c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558659, "uuid": "0f7c6ba0-cd3b-4c36-a4d1-f04855d508a6", "comment": "Malware payload (SilentBuilder)", "value": "3613ebe4fd6373f1b3436d8a6ea7b22e7b7058b2d56cb05b7b550293b5221771", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558659, "uuid": "06a6e160-2883-4ffb-8868-8ebe3719c334", "comment": "Malware payload (SilentBuilder)", "value": "6a40bb702dd914fe5bac20dfc029d5c8e8e77d8f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643558659, "uuid": "8d4e5b68-5c51-4529-9b1f-f357ff2c0cbd", "comment": "Malware payload (SilentBuilder)", "value": "4661a012f5fb70770abfd2257c1a0bfa4f62b08e4fe99cd8887ce6a60ef378d3af7e14d9d7b7b3c98b9f4db99c69a560", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558659, "uuid": "45c6aadf-b25a-44c5-8882-c6b1ff5a1e51", "value": "T12B735AE763CB8C89EE65033E8DB3061463A7FCA69BE343476205B716ADB16C05D03667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558659, "uuid": "15a14327-0561-483d-ad2c-6bc63cdf7aba", "value": "1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643558659, "uuid": "3d743c7d-1058-4ce0-bbe5-1b0c32cd943a", "value": 78295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643558659, "uuid": "e897156d-c5d4-41e0-9f45-36fd97c78e48", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643558659, "uuid": "bfd87068-d7c9-4eb4-88f0-aaa4c36571c1", "value": "2022-1-27-2efc34139699ffb9ff7d18e20906136c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2b375b-81ef-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643562771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562771, "uuid": "ecb5e256-6134-4221-bd80-5e6c27092802", "comment": "Malware payload (SilentBuilder)", "value": "b42f98e05b288805606e818c4d8520f5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562771, "uuid": "38e5dc5b-45c6-46c8-be03-9443bd4c19ac", "comment": "Malware payload (SilentBuilder)", "value": "362c35d26fbc7d5034781be9a3600f8c63d132f36077b0526e79d42c0642cd3f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562771, "uuid": "e6da704d-9827-481e-9207-19cc82215cf2", "comment": "Malware payload (SilentBuilder)", "value": "f86ff4e40916fe0fd83534f824f53b5c0971fea4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643562771, "uuid": "7526813b-601e-49bb-a8b2-8d0260f6093a", "comment": "Malware payload (SilentBuilder)", "value": "0dbc876ad0e9c04a5d5d3d9bc7a0e34a1b4d0453840c32b095562c9a1a8ad910e42d7a1fc05955555e41ccdcd30f5257", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562771, "uuid": "a62db974-f51e-4c48-b4a9-36d573c09507", "value": "T128131953BA86DE4AEA5903380DB386696707FC159F6B57873244F3193FB89E0890361F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643562771, "uuid": "8ba11c86-350f-4b65-a6e9-5b16118ef247", "value": "768:hm+mk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJsvcJ8vHK0BTmDKmHL/veso:I+mk3hbdlylKsgqopeJBWhZFGkE+cL2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643562771, "uuid": "3f356c9e-6dfc-42eb-9a47-d92837637ce6", "value": 45557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643562771, "uuid": "7b8f16fe-89d1-4267-8f9f-00cbcffdfe21", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false,