{ "Event": { "published": true, "date": "2021-05-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-23", "timestamp": 1621814581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0e75eff8-efed-4ebc-af4c-522e7e1efe89", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f5000f-bbd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782200, "uuid": "8e2b55b2-3b7e-4fde-a43b-1234e9aa57a5", "comment": "Malware payload (Dridex)", "value": "8a03d63d5523a05ee0c062f34336173e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782200, "uuid": "54912b26-f5f9-438e-b4f8-29b623c32fbb", "comment": "Malware payload (Dridex)", "value": "0018eafe6674d2ca3c6f37b220e67e9f754febe20423b72121a0370ba030fb14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782200, "uuid": "5ed5fc25-8e44-49a2-8d49-a0546fe9bb63", "comment": "Malware payload (Dridex)", "value": "e718d90ae1f53c542a3fb07b286d6bce7fe41ff7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782200, "uuid": "b91e014f-64a5-4f7e-b9a3-aa3aa414ecb0", "comment": "Malware payload (Dridex)", "value": "ddea182587b97f248760ff8c7b0b615bc8799e41e55af2220b8a72b9e3848f3a93b3d153e46a21dd0f35773ac6901af0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782200, "uuid": "64d9c1a8-5aa8-45b6-b953-5f63f3acd1c8", "value": "B1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782200, "uuid": "19e9ec83-716c-4e8b-8464-1ff00afc2b72", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782200, "uuid": "989cf308-8d0f-4c1f-903a-ed409348d9ee", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782200, "uuid": "8fe291fc-1d6c-4859-a612-01fea3e0af97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782200, "uuid": "d85fde18-f69a-4290-bb86-e52869f1aebb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782200, "uuid": "b8d7b608-cbe0-4b96-bc4e-c2b75a36e301", "value": "8a03d63d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac25d2d-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756926, "uuid": "605ac91e-9f2f-43a0-a003-99802febff79", "comment": "Malware payload (Dridex)", "value": "899c04c1f933f483d5a147ed59ef5ac3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756926, "uuid": "52e26a38-5934-40f3-93b6-57d367b5e1cc", "comment": "Malware payload (Dridex)", "value": "00304aff87aca45cf710829c96c85413771c1db536ea17f4d6b8813371cc39c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756926, "uuid": "c910bd85-c52a-402d-b5d1-471bbd325e94", "comment": "Malware payload (Dridex)", "value": "b7a707d7950d648b65dc52050c65feaccee8026a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756926, "uuid": "47c5299c-0f0f-40a4-9fb2-be981501bc35", "comment": "Malware payload (Dridex)", "value": "4c43339860b1ee4389ba5a757c1c6d8df1f7b42e37d7bd1c2ffab21a03273118ec8c8f4d65064563d64105c083a3666b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756926, "uuid": "0b487c1f-3cc3-4f53-bd39-52c9b63ae050", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756926, "uuid": "5bb40886-91ad-4fa3-8f69-087feca73fc0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756926, "uuid": "ac0a60e1-a39f-4e25-9f34-5fba8e42fcba", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756926, "uuid": "09dbfccb-da8e-4e61-8294-03f3a0270504", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756926, "uuid": "4bc27522-d779-41df-9de7-45ffb4fcc6d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756926, "uuid": "9d1a42e6-c047-4dec-8711-07e92f66a897", "value": "899c04c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7b0de-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728075, "uuid": "7f16b553-d5da-4b03-ab79-0f4a291f1ef0", "comment": "Malware payload (Dridex)", "value": "9efc08446ffcd49efafcd34401b2fdd8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728075, "uuid": "9ec17a07-f2ab-472d-b166-59d969eed63e", "comment": "Malware payload (Dridex)", "value": "0042ab7b1ed7e9f803d0540b07681acf145f206d8cc1a3215cacea0b1c82e8ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728075, "uuid": "23b03013-8593-416d-9b32-fb9c3649dd43", "comment": "Malware payload (Dridex)", "value": "66972f90286ab714d294adb27118a3c272fbd3ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728075, "uuid": "9c86a1b7-7133-47d2-8cb9-bfdf17ddf506", "comment": "Malware payload (Dridex)", "value": "f12eb3c8a763921ea4135f05299b095d819b6d71dcc939f47ed7b2a01953dc510254aee6f4369173877f2c20d0d9fd0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728075, "uuid": "ae8f1471-e51f-4c67-938e-2e198cf3714a", "value": "F8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728075, "uuid": "7b3a76a0-a490-4f86-a629-7520177806c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728075, "uuid": "24f8cc7a-d525-492f-b751-fc1c598a4226", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728075, "uuid": "c3abb329-055d-49ff-9d50-f6b014664a4e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728075, "uuid": "f04a856a-8971-4e6a-9161-caa5846a2a45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728075, "uuid": "b2c41796-b4f9-4ebb-8972-37c9f274fdb1", "value": "9efc0844_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564e9c06-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731659, "uuid": "0b5ed1c4-23c9-4748-9970-5fcdcbb50c28", "comment": "Malware payload (Dridex)", "value": "35f875e1b53d0dbf9f28cd0488801a5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731659, "uuid": "7a8f49f8-056a-4d82-b313-5e873582a7e1", "comment": "Malware payload (Dridex)", "value": "00918b5bdabbdb0039dd6288c7674871177e875381567ce590ef4f99094f3f85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731659, "uuid": "c2b92b20-dafb-448b-93a3-2c74b29cc984", "comment": "Malware payload (Dridex)", "value": "e23928a55f709db14cd9581714054242cb802059", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731659, "uuid": "db994541-9d9a-40e1-b76a-0912af05ac52", "comment": "Malware payload (Dridex)", "value": "2e85a145966c208bdabc64bba1d3c6f66cf6f01bd6547852ad91e2d42ad16c0e1a19ee5287cb1bca0f5cc2ba8d8606db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731659, "uuid": "d0ea8604-7571-40ac-bf18-db577c78cfaf", "value": "65F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731659, "uuid": "54a8b2c6-b880-4290-96fb-9878ef14a492", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731659, "uuid": "2d9648f0-c6b8-4851-9b59-71307654eaa5", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731659, "uuid": "b57be0be-972d-454b-ab85-e53a6429300f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731659, "uuid": "f32f1fdc-54f0-488e-8479-2e84e63886b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731659, "uuid": "cb144923-dabb-4fed-8c42-81f570f80e67", "value": "35f875e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee456d47-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728048, "uuid": "100ad98e-d42f-439c-b73a-02512c0cb0fa", "comment": "Malware payload (Dridex)", "value": "719988e2c11a7c1493b7b65891875914", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728048, "uuid": "c522f833-b0bf-47b5-baaf-248e1d2760f0", "comment": "Malware payload (Dridex)", "value": "00c91fe555b741007aa50d5a8112794f7f83409d3afb55422f58da52306ca010", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728048, "uuid": "330b3462-5cec-4ea6-874e-ad4d5b91183e", "comment": "Malware payload (Dridex)", "value": "e736a0af0f6a8b7bcca08a7df7d667ae66a89134", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728048, "uuid": "74aa0c17-b4c6-40b7-a6b9-1ff1989a476e", "comment": "Malware payload (Dridex)", "value": "4ee663eacae8892ef894b23299abfcecf8ae39d978b34a0f40ef5bdf27045a1543ddda7a06fc1a64eb2fa15b657c9f0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728048, "uuid": "395029ab-eded-40ba-b399-aae6dcd3b579", "value": "B804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728048, "uuid": "f3e1a40b-f727-40f9-bb10-e8f671a871a2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728048, "uuid": "d5007e0d-a8b5-4097-9ad4-2f1d6ce29991", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728048, "uuid": "9ce05218-e37d-404f-8556-175dd872bb5e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728048, "uuid": "3a6f825a-268f-4e85-aace-c0e4143d8895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728048, "uuid": "80d174e3-24a7-4b8f-a04f-5188063e3fc3", "value": "719988e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61aba85-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728035, "uuid": "49e507f8-ccec-49bc-9956-ff22bbf47162", "comment": "Malware payload (Dridex)", "value": "a8063a6ee5c5f2e077fb5014762f549f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728035, "uuid": "1f337c54-d208-4c12-8f40-c7ee89ba517d", "comment": "Malware payload (Dridex)", "value": "00da0c26e7b0eddcc91e038ee6e2a9516fd8e909b4440c45e6140e4654d706a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728035, "uuid": "e82b28ff-a184-4e85-819f-424af37d3367", "comment": "Malware payload (Dridex)", "value": "001b5fec1ec0008e40df08f3a46585d035a803e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728035, "uuid": "445b7f9f-e35b-417d-bed5-fc8a4d792667", "comment": "Malware payload (Dridex)", "value": "ee81a8e3730d569b158411effa00a0e7fb13aa9a80c4860b59381479269aa37af3245ffd8a65b2b398d1fdb18b33d546", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728035, "uuid": "d6781b1e-46fa-4c85-a3b1-876c1a332517", "value": "C1F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728035, "uuid": "6d8f5d4d-9fc8-49f4-97a0-18818d07a828", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728035, "uuid": "ca80920e-5f47-4e9f-9773-aa394286b853", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728035, "uuid": "2d245e84-b27d-440b-a0b2-cd72749f62dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728035, "uuid": "ab2cbce8-9673-44c6-97ae-95ac5a377dc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728035, "uuid": "88166200-32b3-4cd8-b052-0bfc8a9b8cd1", "value": "a8063a6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a70a1-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764137, "uuid": "113cd197-56be-4fba-b193-1617ef62548f", "comment": "Malware payload (Dridex)", "value": "3b61b919651669f43c2682ca6d09644c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764137, "uuid": "c09b2e2e-3401-4f90-b786-82a67d18da24", "comment": "Malware payload (Dridex)", "value": "011cb75d15400f6179b5c086c3e8c5a920726d44e78ce174c4c760b86077d5df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764137, "uuid": "7bb40efd-c8eb-44da-946a-87baa5ab03a0", "comment": "Malware payload (Dridex)", "value": "004745b73adb46ae7de3feb3f4328ab05d0c77cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764137, "uuid": "a2cad8b9-cdd6-46ac-9d36-852b9ade4be6", "comment": "Malware payload (Dridex)", "value": "6dd616ccd9d987ad324cc4841de01adc3a7f019d8e082e7fe254632e4ebdf37c280060ce23d29271c46a27aa6e4b9d3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764137, "uuid": "1d1a6e08-2078-4f24-aeeb-3b3fe17cd11d", "value": "9BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764137, "uuid": "60a7d19f-2ab7-4de7-9824-5c514c1e101a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764137, "uuid": "a7ae66c4-61e8-4aa6-b936-def7afe374f6", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764137, "uuid": "8cb6800a-9663-4d45-94b5-8d5737eb0c7b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764137, "uuid": "71158ede-bcce-4b30-bfeb-116d19257625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764137, "uuid": "a92dea75-c49b-4d33-8679-59f3ffdd96ae", "value": "3b61b919_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6257825c-bb9e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621757449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621757449, "uuid": "51fa5ee6-5bf1-4830-b8d0-a7b51e6cf940", "comment": "Malware payload (NanoCore)", "value": "a816c00bdb4bd6b9cd94c35c476399a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621757449, "uuid": "f99192c1-1e15-4841-bee2-671be27a9b06", "comment": "Malware payload (NanoCore)", "value": "02406289cc1ddef9b934fae8ccbb5ad518204950a488018792a89328bb4fefa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621757449, "uuid": "90fa4d32-3267-487e-ba35-a0fd9cf47d13", "comment": "Malware payload (NanoCore)", "value": "cd347a00ec93db45f7adb012568b008e1bca9639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621757449, "uuid": "3d40f369-b143-48d0-9a73-a59e02091d6d", "comment": "Malware payload (NanoCore)", "value": "b309d147dfdfc5f2926cb1d1b68d8440533820543e8e665da1c43b9d0080281230336fe469021c8ce1d11a11604c2fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621757449, "uuid": "7264e896-63f6-45d6-bf70-ac304b5198a1", "value": "38C4122C6798EF59EABF5B3819E1600003F1D210C993FB5D6E9950BD3F77B8286A1643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621757449, "uuid": "32b85941-9107-40b9-abdf-061f48addb7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621757449, "uuid": "d0e44b73-fcc6-4c02-b859-0b7ad82c9533", "value": "12288:djfwRXPLRf5FgTy21wpMbTBKbth28ZFbPs1YjoM59Ev8QxTnFRXiYSKz:lfaPLZ5uyNMbT068Ps1YjooEECPigz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621757449, "uuid": "82a9c3df-69a0-4207-8791-902f4e6bfd3f", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621757449, "uuid": "e8491ad9-5b7c-4cfa-b111-f0e4aa895541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621757449, "uuid": "11bccc2f-5fab-427c-8682-413fa1c8b494", "value": "a816c00bdb4bd6b9cd94c35c476399a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12ecad9-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803645, "uuid": "c0d62373-d6cb-421c-94a4-46ce8ba8c95c", "comment": "Malware payload", "value": "131d386b3410a7b1d840e2d0117ff7bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803645, "uuid": "7e46eb6b-a5a7-42fd-bb8d-2bb43de41464", "comment": "Malware payload", "value": "03010ab06a0bc5071f4e57a5d636180a1e1dac435f6c995a52d4e2285b198c8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803645, "uuid": "deced54c-b4f5-4ab7-b01d-72d461bfbb32", "comment": "Malware payload", "value": "a3b8aa6c6356c072251c9e96bd12f00b9a3b8ace", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803645, "uuid": "a33b4540-7a76-49a7-81b7-b3a85cc7009c", "comment": "Malware payload", "value": "d5a9b4947d15189a54075e7bc53613bc888f09a65892d5ad4a7d88b69d1d114bb440a055917ed6761998ba22651a898b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803645, "uuid": "3e6f295c-d421-476e-8e0d-cef27a36a190", "value": "90F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803645, "uuid": "67412878-57c4-49e5-a401-80602945cfcb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803645, "uuid": "ffc10577-df97-411f-8c1f-f0d0f652bd08", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803645, "uuid": "00368e01-2a3c-4417-bd5d-dca3ff14702d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803645, "uuid": "82a448a5-e9d0-4a36-9231-3bf987d3a597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803645, "uuid": "88485aac-3cbd-420c-80d6-5157bf0a63a6", "value": "131d386b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7c8b5a-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756901, "uuid": "b60101b6-93df-4254-ba19-009ee19376dc", "comment": "Malware payload (Dridex)", "value": "c21baf6955aaaa7aeaddbd6abbb53615", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756901, "uuid": "a8352b6c-6a2e-4149-87c0-38d0f14a0fd4", "comment": "Malware payload (Dridex)", "value": "03ea9432865974c55cf7e46a6c17a04d50e69348e1e35f305b74803b94c19108", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756901, "uuid": "521c1fc6-f8df-4a9a-8a68-96a7b5b7d429", "comment": "Malware payload (Dridex)", "value": "607c8c39ed74fdca926fb8e8b36c1db26d2b8e96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756901, "uuid": "0f61cb98-3df4-4ba7-ba5f-d34fad3933b8", "comment": "Malware payload (Dridex)", "value": "98400aa30852e66551e39ecc8b3f58ced0cb9fc44ee413bedc9a27bffe9177ae780369236f7d8b0c97f6bafb31986015", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756901, "uuid": "722ecc9d-1ffe-47e5-a39a-f60a0d652d1b", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756901, "uuid": "b76332d9-a104-4b61-92c2-1e010d163abc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756901, "uuid": "f01783ad-ee53-47e1-b2eb-3d5f7d287581", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756901, "uuid": "88f25760-b9ab-4a9f-86cf-a2d2254b6e54", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756901, "uuid": "cc93c2d9-f68c-4172-ab67-22e79195f8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756901, "uuid": "ed75cdad-fa15-43ab-bc56-f440f42bb0f9", "value": "c21baf69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b783b0f9-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771336, "uuid": "27494b1f-8f71-49df-8e7d-5593cce016dc", "comment": "Malware payload (Dridex)", "value": "de1337d51bc23d94f81b29484c05d1a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771336, "uuid": "53e63b83-e5d9-49ea-9dfb-90d95d583719", "comment": "Malware payload (Dridex)", "value": "03f59f5fe06a308b64abcc2333f73af70e57cd9d7085be977d4df6a83b294868", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771336, "uuid": "25b8f688-76e4-404f-9f9e-b2682c279234", "comment": "Malware payload (Dridex)", "value": "c897c2b8a2142dc8379cddc29bb271cd662262f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771336, "uuid": "1e8d487e-3e75-485b-9253-0a2620e2c5ec", "comment": "Malware payload (Dridex)", "value": "fa298f46021715f1746b7878c80c81832fe879079bad198a7a7ff9349125e3442c478da4e0107c79d1a39bc3326179d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771336, "uuid": "19e178c0-9df0-4552-84d7-2201807cdfa5", "value": "24F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771336, "uuid": "2517aae4-297b-4163-a22f-e5fedd7a2cda", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771336, "uuid": "f35c7c72-f2bb-4ff1-b643-f3ba34c138b0", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771336, "uuid": "c1056f42-193c-4592-b1d4-701d1a10b495", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771336, "uuid": "df25abdd-a93f-4e84-bde2-46e727eef1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771336, "uuid": "fd617dfe-ef25-4111-be93-2603ae8b66fd", "value": "de1337d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910cfe81-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742495, "uuid": "08824473-65d5-48e8-bd6d-12749ee50c53", "comment": "Malware payload (Dridex)", "value": "3edd212c3e85e1cbf06ea2cb6be5c209", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742495, "uuid": "857830f4-f431-4e76-a608-1d294516c0eb", "comment": "Malware payload (Dridex)", "value": "04e8a06f0b60a19c20064b68a45c1a5ae05e9d3fbfe3666221b6b417b1b179e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742495, "uuid": "9392f5b9-ae28-445a-b9ea-c86454b8c7dc", "comment": "Malware payload (Dridex)", "value": "1da7d10204abc063edcd4bc475647cb0887cccaa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742495, "uuid": "d739d4aa-134c-4025-aaee-634ff5d4385d", "comment": "Malware payload (Dridex)", "value": "922c6f3b396917133072104379688065bb0c75d6b2f119576a89442d60601a0d92d359af42338c6ceede52cda8d60004", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742495, "uuid": "ba9fc34b-c072-4f63-b469-982b6fe33ec0", "value": "A9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742495, "uuid": "dbb88b9f-5e74-413b-bdb6-783a74ac956e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742495, "uuid": "19e5cdee-f3e6-40fd-9705-25eae737b75b", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742495, "uuid": "d52bfe43-bc1d-4edc-9035-644b566e2c24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742495, "uuid": "7cbc827b-37e9-44e3-b546-1ac850c2ad1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742495, "uuid": "690ddc10-29c6-4e74-a94a-3bd04e996e4c", "value": "3edd212c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103ed759-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728105, "uuid": "73ade6f5-4418-41c6-92d3-b4ca35d05c4b", "comment": "Malware payload (Dridex)", "value": "fb10dccc56e64bb07d1d3a78ea187657", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728105, "uuid": "d2b928e9-f493-462c-a775-c3d1483dbf7a", "comment": "Malware payload (Dridex)", "value": "04fa457943fe3c9f1bc144385fe36b176dfd7d4b58ea46f8ae1bfe45e50ee37a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728105, "uuid": "e82d8174-29b6-4980-aa96-378ada4a70e6", "comment": "Malware payload (Dridex)", "value": "83fad40073623ed2513f00126ede10090d3a9a79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728105, "uuid": "3f890e97-eabd-4752-9bc7-5e042667c1e4", "comment": "Malware payload (Dridex)", "value": "2dc1ff98a4831660340aad51eb76cb7ab3da33f7ae8100e1d934463c8989f11d0fa1656ae12fd67b90e71634831909c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728105, "uuid": "598d83e8-cbb1-4c83-84cb-08d2cd7ad5d9", "value": "FBF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728105, "uuid": "84ad0032-8a54-4bac-960e-85f811005127", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728105, "uuid": "08a2271d-515f-4a01-8a4d-3bb0c8dbe54f", "value": "3072:xIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728105, "uuid": "02c188cb-6c5f-416b-9a45-2c106a363849", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728105, "uuid": "0b94bdac-392f-45e1-88d9-ec795f0c3398", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728105, "uuid": "4fa45588-4642-479b-843d-c33f452b2ea2", "value": "fb10dccc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930c225a-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621779435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779435, "uuid": "5177a144-bc65-4a6a-94cc-9099b51721c6", "comment": "Malware payload (DanaBot)", "value": "63d270bc6d03003f7937214b37bd5e8e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779435, "uuid": "c4cdb214-3cf8-46a3-b600-0472616f5541", "comment": "Malware payload (DanaBot)", "value": "054d00eb13d64e28f77951a8b55ea3882acf5d585fbf322b868c0d585f35a12a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779435, "uuid": "f98162d9-b90f-4dbc-8591-27ad25b0a552", "comment": "Malware payload (DanaBot)", "value": "29e465bb174aefb2abce9399470193efb3574607", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779435, "uuid": "504cc0b9-32cb-42dd-b1dc-6ce506219cf4", "comment": "Malware payload (DanaBot)", "value": "d9068a2d43396bcb63b1e0d789c2d09bfd687946628ea8717571e78df63c647f88e76eb191ae567795d9f032ca6e29bf", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779435, "uuid": "65f37f31-0a35-43e5-81f6-f1e33ea287b2", "value": "8D563304A7B0C477E3FF19B4083D81A5612FBAE0935841FB62D62FE456255E46C38BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779435, "uuid": "7c43e27a-29eb-4741-a033-584c2df0f289", "value": "4763dd25f70ae26818bc41154c9cfe76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779435, "uuid": "b19be5ba-1230-4324-934d-1b6b83e0ddc6", "value": "98304:uKvqk2IcWmW63tUxZjrhR38LX9jFj18+wN3Ji0Q7ZtRJhuddBMZNg3OCcwX:37wWmt3tsRrho9j23QHhsuZu3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779435, "uuid": "bc678808-531d-40c2-bf63-96aabcba42f1", "value": 6327296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779435, "uuid": "61704e0a-1434-4f1f-a2be-06782f616c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779435, "uuid": "b56d28da-1d0c-4939-83b8-0ec8557d508a", "value": "63d270bc6d03003f7937214b37bd5e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05bd8c-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735244, "uuid": "19df10e2-b2bb-4424-8d9c-55abe4554fe8", "comment": "Malware payload (Dridex)", "value": "28351f586b4c081a673f6a1380dee752", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735244, "uuid": "815c8a90-4a1f-42b2-a958-1df46b7b9baa", "comment": "Malware payload (Dridex)", "value": "056e824157eb8071d888fadbc2e7a8786f41efb87ce5f9aa7156013e5959a8da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735244, "uuid": "482540a8-9435-4630-8ceb-17bbcaaef214", "comment": "Malware payload (Dridex)", "value": "4d80dd675197e73bebe85b7dcdda4e959f9f896d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735244, "uuid": "279b767a-8094-4f2a-bec9-92f911f42108", "comment": "Malware payload (Dridex)", "value": "4742dfbed7e8d4534e50cd30946b9e5d2146ce4625f908d474fda35ad0702f5e9e43619ae598f76fca4c3e5b47bf163d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735244, "uuid": "d91ffcef-6889-47cf-8633-0bc89a5612e1", "value": "05F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735244, "uuid": "bcca0c98-b3f5-4f9e-a2fb-1d7cd8a0acd2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735244, "uuid": "872176a5-55b5-4218-b210-60f9876db249", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735244, "uuid": "999d0a64-4c00-45f7-8749-08fcb2852cf6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735244, "uuid": "602758dd-5949-445e-a794-54da1a2ac0bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735244, "uuid": "acac40e0-f5b4-4f14-ab80-dd0048120612", "value": "28351f58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb58a46-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756879, "uuid": "7348b2be-91f7-41f1-b2aa-fdb1f9a8701a", "comment": "Malware payload (Dridex)", "value": "7b4295d6d52e9967e0f3514ac6736cc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756879, "uuid": "87163259-7889-4e65-9307-65034b366647", "comment": "Malware payload (Dridex)", "value": "0646d3fe4ca9f9f52f9a103880e5c67bd74a571666b171ce63a30f35ea85d10d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756879, "uuid": "368ef28a-80ec-41a4-bc2c-f7a9ac73ec31", "comment": "Malware payload (Dridex)", "value": "7da2971d009ec1f8cd8e5b26a16a69f5f64e7200", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756879, "uuid": "938718a8-fc7b-43e9-8603-da2cf43659d7", "comment": "Malware payload (Dridex)", "value": "d091043fe715c1c98a17d1807fd65544d49eec64116f94b1ccb7f90b460c3724ae7cca2223ba759d63c27d3bcda8c578", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756879, "uuid": "a2496433-4e92-4be8-abbf-170d6220616d", "value": "02F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756879, "uuid": "6e0fc694-60b3-47e6-bf4e-132b15d5bfb7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756879, "uuid": "985535f5-36e5-46e7-a3eb-f9d60b9024df", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756879, "uuid": "154a0634-435c-4d09-83ef-0388564b7123", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756879, "uuid": "ccc0c637-fde2-441f-82f5-78b08b735436", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756879, "uuid": "df12c75d-c6c6-4154-9c74-c1fe2b9488e8", "value": "7b4295d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feacaea-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731702, "uuid": "00f57ea3-b68e-46bc-bc26-f942d7ecd977", "comment": "Malware payload (Dridex)", "value": "329bfeac532033a294e8a375c9e4cb57", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731702, "uuid": "1c0952d0-4e60-4da1-92b0-cd0668d6223a", "comment": "Malware payload (Dridex)", "value": "08928e353f970ec0e2d1f92ab0edf7acf405552b5a3ea6636c3491c5284ef282", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731702, "uuid": "5d075098-01ec-4c35-a64f-209b379e4678", "comment": "Malware payload (Dridex)", "value": "37d6f181d67503a91d6ae51f6f6a39d7d8a034ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731702, "uuid": "0555f086-12cb-4d8e-bf11-63c285b080dc", "comment": "Malware payload (Dridex)", "value": "afe1507296349bcff0babadc3fa8f06ab4c352f694067820c800cbe6fc3b68a1eddee6ddd9a00dc9e4c0d9081a972832", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731702, "uuid": "f729417a-c037-4a74-8d6a-a0172c4356d9", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731702, "uuid": "6bd277f4-ae94-4145-a366-06bb55580a88", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731702, "uuid": "ac5e7134-d5b7-46c8-b6ab-dcebda47b5d3", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731702, "uuid": "40e4c274-a878-46f6-9fc1-1a9c8f8d42ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731702, "uuid": "5ac7da18-c8c6-45dd-a44c-61b06d2b9d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731702, "uuid": "0285f53a-a33a-4780-9a8e-fbc58094df97", "value": "329bfeac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea07542-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782166, "uuid": "6d37f7e0-e14f-43a2-b2af-1e9ca976c0aa", "comment": "Malware payload (Dridex)", "value": "889d4209d89101909e1c454f32592351", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782166, "uuid": "248c2541-c322-4095-9f26-875f3d337e0d", "comment": "Malware payload (Dridex)", "value": "08d6e00671312906a7ae7137572eeb3d72354b554cc07677cdf9e90efc97283a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782166, "uuid": "daba26c4-081e-4e44-931d-66e8bcf8c404", "comment": "Malware payload (Dridex)", "value": "c72d0bda3c4d6feb7738172e14f43de3b4c39637", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782166, "uuid": "b9948582-e0f9-4750-b287-b6e9dd15998b", "comment": "Malware payload (Dridex)", "value": "208e27c94b0e53f76916cc82f3d71cbff665208c136cbf2fcfc6c4786ff4482d45a46b71e1b77f734a8387fc9b57fb9a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782166, "uuid": "7bd7d990-d8a3-4c18-b346-fecd6c160872", "value": "A0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782166, "uuid": "ee4b2617-fca3-4046-9234-a528f3ff75b8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782166, "uuid": "b5664746-9bf7-4f64-9d77-db04fbafc280", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782166, "uuid": "992828a4-5c4b-4dd8-b354-6cf4f60add6d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782166, "uuid": "bb49ed0c-24dd-49ed-8853-6e08abc323be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782166, "uuid": "a80fee2e-51eb-4268-a905-f6afb30f4773", "value": "889d4209_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0b4500-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774915, "uuid": "a5562230-183c-456f-a8de-740f0f4afa10", "comment": "Malware payload (Dridex)", "value": "e6774048168e5e3f03a4db33356d013c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774915, "uuid": "ccdbd824-8501-4020-807a-1fed35312347", "comment": "Malware payload (Dridex)", "value": "09d5b44b9927cce67d0bd86b79d0932a83e548ec403e8ac8f748804bcfc6b1b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774915, "uuid": "a6d9834f-feea-421b-bf9e-aef3ba9dc6bc", "comment": "Malware payload (Dridex)", "value": "1f747b631b5b2d6a8d76af527a3543a5518ecb87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774915, "uuid": "53765e7b-e5f2-4773-9291-a6271ee9b3e4", "comment": "Malware payload (Dridex)", "value": "21fd0617c6e9e1ab842b9f50c56d067cb9dc9f2564afa0852f0d370d06db1a19d58b0937fb7b03c8fe8360d9da4cd21b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774915, "uuid": "329d1528-ef52-4a50-90a9-fc5159f65538", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774915, "uuid": "ede9883e-20f3-45dd-bff4-21071e20a71f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774915, "uuid": "dccacdba-5597-4fe9-821d-9ed034c9c646", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774915, "uuid": "7080649b-b719-457d-a389-11fdf709c07d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774915, "uuid": "35b30a72-4750-4926-b1b2-6cf9f086f2eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774915, "uuid": "fa40576f-99d4-4112-b18d-86ed5836e275", "value": "e6774048_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37e4263-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810923, "uuid": "f77b2e85-b9fe-42c9-87a7-4c3287d0677c", "comment": "Malware payload", "value": "413e4b92064b570aa385b9e97a9a7669", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810923, "uuid": "17748bd0-bd91-4e33-ae33-045d5d89de99", "comment": "Malware payload", "value": "0a595367e75f5ed5c91c947a7353cfbafd034c965d5cac2d3787460b280ebacc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810923, "uuid": "bc8d0566-6053-4c59-ab2e-686a63b3bcee", "comment": "Malware payload", "value": "41a20675766cd6a238661d7c71466a964f54a59b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810923, "uuid": "10176d4c-c06c-45e0-8056-3573bdc6dc04", "comment": "Malware payload", "value": "5ba63ee9e94eb25c353a2a22ced3d965f29c7626af644a2d5508cf8a1d83ee96a05ee24dd33abbd4a1df596baa876c83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810923, "uuid": "0beeaa17-5eeb-46d4-b1b3-03c7be9b371e", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810923, "uuid": "816dcc8c-89dd-4ae9-bf82-ed3de7462ce5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810923, "uuid": "0c58e46e-a0aa-462c-8daf-cb23bf786bce", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810923, "uuid": "553b6fb4-d332-4b2a-8d8a-7a8a84570d85", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810923, "uuid": "d4fdebf0-6994-4cbf-b62a-8f79749e9bbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810923, "uuid": "1aa7b0f9-e5d9-4b75-b612-fa5c72b4def4", "value": "413e4b92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631849aa-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807272, "uuid": "466addf0-a0e3-436d-b341-f57da2bffc64", "comment": "Malware payload", "value": "43679ae297373d79831ddc904afe9061", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807272, "uuid": "b417db20-2a53-4049-b9fc-d7985f7ab7ff", "comment": "Malware payload", "value": "0b662d610adf9f2ddabab32f6f1eed9b387d0be7b41b559d59cad29444c718e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807272, "uuid": "191ee174-c29d-460d-9164-e877c7ff0e3e", "comment": "Malware payload", "value": "9cd987d355e1846fbb285d47f85586e2c9fdcbda", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807272, "uuid": "c9093720-aad6-41ac-840a-8dd1a3ce1ffb", "comment": "Malware payload", "value": "6c83c6c4ac050dd921014d995a425341319d561c223d67909933e360f59b962586a56c5eecaf458454bff4e2cae2c286", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807272, "uuid": "7ea7b6db-65e1-4bbc-93eb-bd3de9f9aa3c", "value": "90F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807272, "uuid": "11507b1e-e9ab-4b50-8730-94ef178091be", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807272, "uuid": "3ec06387-c4ba-422d-b291-bce0206629b6", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807272, "uuid": "c98c04c2-a7e0-4548-8312-46818aac19cc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807272, "uuid": "201d6260-72df-4002-b096-ad08869aaa70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807272, "uuid": "82544a44-a7ad-4963-93a3-203c05f7ae4f", "value": "43679ae2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378f9d13-bbd6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621781429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781429, "uuid": "f91d87ff-763c-4d54-8d7d-3f754ad38dd5", "comment": "Malware payload (Loki)", "value": "b64447a2d16a64aff8245f0eb5a155d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781429, "uuid": "c49dea8b-fbcd-47f4-a3d7-d1889197ec3d", "comment": "Malware payload (Loki)", "value": "0db833d0f09ea6ac635394e004f49f4ce0d393bcb94e8b0d3f703c5705aac993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781429, "uuid": "c263b832-e012-4e2d-a26a-45e03d89edfc", "comment": "Malware payload (Loki)", "value": "db6dddef857185d2becede777fa4952b1abf5d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781429, "uuid": "9913485e-9bd9-4469-9596-1d04f7c0bf8c", "comment": "Malware payload (Loki)", "value": "f41774cb43bc457fc9e96000a787c28542047faa64016bc4c79dc137e4973a16611183b846d5fe71190d3affa8563402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781429, "uuid": "2e0ea999-67c1-479b-bb76-649c148ca22c", "value": "E2F4F03C0348F92BD33A6476D004662C93F0D026B793EF8DA6426139A557FD674E2AF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781429, "uuid": "06437d8e-e5b2-4af2-bcae-2c24411d798f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781429, "uuid": "7c084870-3176-4753-8ab0-4ab12f16c44b", "value": "12288:VLZpBKzvypPUw7D6Eoh+x+3h20w67z1OntTwWcBD7RS30FCPRRj90TJX2sbHLm:BYzMUM6te+R2actTwWcBhWJh90R9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621781429, "uuid": "1ec67ea9-97bf-4b9b-a94a-5d4eca65d3b2", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621781429, "uuid": "6811bed5-8d43-496f-9e67-cee83495bcd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781429, "uuid": "300afd98-fd72-4fdf-b5d8-26c26d41b10c", "value": "db6dddef857185d2becede777fa4952b1abf5d03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbf7fb9-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731670, "uuid": "160426c9-455f-4bdb-baec-3d0aedb350c4", "comment": "Malware payload (Dridex)", "value": "f37018a322f1de387c7619569a675dbd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731670, "uuid": "410f994a-f1bc-4683-8497-12ec304eeb3b", "comment": "Malware payload (Dridex)", "value": "0e52d75256de11fedb409dd9c3de9eae143d802cf22e1b116511e691774a3a07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731670, "uuid": "eaf62764-9783-45d4-ac10-1e48bdb741bc", "comment": "Malware payload (Dridex)", "value": "6e920a191e50a608ba1f443150a1755535334ce4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731670, "uuid": "3c43e226-7b44-4cf0-b37c-f4bf3a96c32e", "comment": "Malware payload (Dridex)", "value": "000a070b8eb582c029312b29c08f4501f40bdbff631337ac9ff72710b9e22069f68fe961ad1393c8c25b7dd0c4c70c57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731670, "uuid": "9cdd6993-b8e1-4e7f-a460-2598f6369460", "value": "9FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731670, "uuid": "983e87d8-e5e4-48ba-96cd-c58107294cf5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731670, "uuid": "c075a4cc-eee4-4871-9ab8-64056d973e49", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731670, "uuid": "9eac1df2-3331-41dc-91e9-152b0f0b26f5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731670, "uuid": "f88214f8-ac97-4299-9c88-2d742490a84c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731670, "uuid": "d9515e8c-b31f-4a76-baf2-aaf33745b1b7", "value": "f37018a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd9b033-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753359, "uuid": "3ca1d826-2f09-4f2f-af0f-e6f8aea62406", "comment": "Malware payload (Dridex)", "value": "0fe40e4ca831d4510c049f3265496488", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753359, "uuid": "749e4c9e-a28f-4b7c-a5c2-f31d6fccc55a", "comment": "Malware payload (Dridex)", "value": "0eb8fe9b65b4801a7bee3a568203299095a3f9382fc3046f221770e9e6c720c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753359, "uuid": "928224df-d484-4c91-adf3-d0df567eb874", "comment": "Malware payload (Dridex)", "value": "50cf54e04b158aa3dde021bdfd61a45fd5ab7b86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753359, "uuid": "6ddab8ee-aa08-4238-9997-ab1a11733959", "comment": "Malware payload (Dridex)", "value": "6821f778e34e1326a8fa9b0f30530ccdf896304a62f88df796294b8a01cfeb94fb49dcab2b868d6e584427c4671c7bdf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753359, "uuid": "d27af5d5-1b38-47ca-8ae2-1726a6b77604", "value": "23F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753359, "uuid": "4d5f06a3-6168-41e7-a756-b97368c068dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753359, "uuid": "13c1173d-8612-41b5-b086-16814d9efb42", "value": "3072:SIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753359, "uuid": "57d369bd-7ecb-4b46-ba25-9d6dc8cb9d35", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753359, "uuid": "9268b810-d290-4d2d-9c4b-d30bdffddbe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753359, "uuid": "65f2ca59-4586-4a05-99be-ee57a86b31c5", "value": "0fe40e4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643a5863-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731682, "uuid": "b8f9574a-abe1-41ea-a066-5e46b0af33b3", "comment": "Malware payload (Dridex)", "value": "6e4accfd5685798ebb5914333b673db7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731682, "uuid": "ffc6b1b3-99b3-4bbf-bccc-c08a1f9e8011", "comment": "Malware payload (Dridex)", "value": "0f4574ffa94c20200e362ec2c3f7935c2b9d627e97f88d8cb216306c8c96cde0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731682, "uuid": "988a5190-7975-4a0c-8ff0-7d88a50dabaf", "comment": "Malware payload (Dridex)", "value": "40f9735d61a0390ce02fd76aa3d53614c7b77754", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731682, "uuid": "455d8759-25c1-4a86-8cf1-130549b77671", "comment": "Malware payload (Dridex)", "value": "bb07d1394c27385c351519c53d281182d182f95dea041f55170009b4d006247c76c295fd5484889b62d5d9bc9acc43de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731682, "uuid": "555810e8-2106-40f1-9211-a3448adf5d42", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731682, "uuid": "33c02a03-8ab4-435a-a3c2-467e9f6e39cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731682, "uuid": "a252ec00-b94a-4e4a-a22e-1b33da927ba4", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731682, "uuid": "9e5d6d2e-4946-4b13-bc0c-09194b684800", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731682, "uuid": "8fcfbc29-5a3a-4d12-afbe-dd28a3da281c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731682, "uuid": "c87351fe-0854-4e64-8e2a-2558e1d37a61", "value": "6e4accfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24adc600-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796430, "uuid": "6e667aca-429a-4ae8-ba89-ca873767538e", "comment": "Malware payload", "value": "96430208fec7dee25839dcc0a7842e71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796430, "uuid": "d6221d1b-5611-4b6a-a502-9786e9c62315", "comment": "Malware payload", "value": "0fcc2dbe8599bee1dd9b82ae5428909bfac1f2f215c530bf0026e44973fd6cf6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796430, "uuid": "5d316da5-ea4b-48de-8ca5-e46c6b67d7c6", "comment": "Malware payload", "value": "fdda27c89ce40476b7bbf9d9a2f1b105e3729fb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796430, "uuid": "d631d0da-02ea-47d3-a9eb-fce2d8d1614a", "comment": "Malware payload", "value": "4ff319abe12e7715b44063cefd6c9f18789e892e3de61f5d6551e0127208532c7f436151fa6b0537bfc7aa9272848a81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796430, "uuid": "eefeda1c-9d57-4b53-b2c0-861e5d6ceb3a", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796430, "uuid": "874876a3-2332-48b7-8b8d-401f24e59c7e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796430, "uuid": "81715e88-302e-489e-8100-a646ce6ad3a8", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796430, "uuid": "11305773-1988-488a-8208-e5a11cda5c62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796430, "uuid": "01ed2d79-107e-4f11-96be-af84ee52c901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796430, "uuid": "c27e0f05-78a9-49dc-b3cb-aecb5f6b7027", "value": "96430208_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cccb619-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621749682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749682, "uuid": "aebd7dc4-3b93-4bef-bd96-18bb8ce73896", "comment": "Malware payload", "value": "1ace00922c49dad018961189f44f83b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749682, "uuid": "8b71642e-e9ac-426b-bfeb-e0b51b5f2fff", "comment": "Malware payload", "value": "0fdbc3d3ca90e1d945d38fcb309ba157e2f6706b896c330dc58950fa47cd296d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749682, "uuid": "1d76b7e5-fea9-4108-a1c0-60810dc2713f", "comment": "Malware payload", "value": "9e2f35a052528d837d23d04febb2ddbac5a6e0a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749682, "uuid": "37deb2f4-2584-43b1-a419-6ea6b539b76c", "comment": "Malware payload", "value": "a433c83eddd2af7a65df8802d32c37aea1b11b3baf17a3f8917ebca757e5eb2132e3614b99c3d35b8ab891ce1f704b43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749682, "uuid": "c00d1e1b-afd9-4e5b-b491-157435f9dd63", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749682, "uuid": "3338ed65-7216-413f-bf07-3b23545b56a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749682, "uuid": "4595d3ab-24aa-4508-92ce-9dce7e420782", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749682, "uuid": "a67249a8-5553-413d-9ca1-08bc0577fd0d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749682, "uuid": "679547e7-ac59-4b6a-8ee6-0beb2fc445d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749682, "uuid": "11e6cbde-5837-4102-ab81-06c32b0fd3a0", "value": "1ace0092_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1eb21f-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803633, "uuid": "05774bab-5fd5-4215-b67a-f0308d49c1be", "comment": "Malware payload", "value": "f13541cabc5a93ecf7a1aa86dcc4e4cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803633, "uuid": "bc2a63d4-d3eb-4976-8df9-6627eb29690e", "comment": "Malware payload", "value": "1086525bd011c224f7489828bb03edf0277db9f367ddc9daeb89b17b4a2c5108", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803633, "uuid": "5c9d73c0-390b-4b3b-9d51-81174a6de185", "comment": "Malware payload", "value": "975909b5ef81f5e2774604302be36de701eedcc3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803633, "uuid": "8d1f30b6-6b7c-408b-8492-d7c319e2658e", "comment": "Malware payload", "value": "6e502d8e2668e8d2a7fec3dc4e2b21dc9cf25ca38d1e440f6de05bc11467e8a8511c1501972b8abb4e39a2d4f9c7f491", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803633, "uuid": "b628948f-27fa-444b-8e3c-c8f81c8f1472", "value": "4FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803633, "uuid": "882e8c58-26b7-4089-b08e-d4ba0fe07970", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803633, "uuid": "b12cddc1-2129-4c73-a054-63baf089b4fe", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803633, "uuid": "e72ad417-3825-49d7-8077-09c0475065ba", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803633, "uuid": "06e58075-47e1-480e-af62-acab7be135c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803633, "uuid": "e958dd39-f2c8-4a38-ab1d-bbe308fc1035", "value": "f13541ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1747ed7-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810839, "uuid": "d0facffa-d27d-44ea-8a9a-a7f1fe3b5f08", "comment": "Malware payload", "value": "c941f65ec1a1a18a2b1a9abb13f68f3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810839, "uuid": "3b169820-174f-48e2-9273-df467a2fb8ab", "comment": "Malware payload", "value": "1171fc15686ee3f85c7d0f4db973b209c22d52e20ea43ce73d76ff24aa530e59", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810839, "uuid": "3e7a6a27-8016-4a3c-b900-73b2362cab61", "comment": "Malware payload", "value": "24ae98ac93e0909a642e20c2ce5d7b029f05f804", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810839, "uuid": "57fed11f-1803-43cf-87ca-04f9556c7a42", "comment": "Malware payload", "value": "ed5851d7257b4b75e489b365376d554de5b0eb0999cbfcfc36051b15b756b59eafb973eb97a57f72780da0683051be21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810839, "uuid": "87e19229-53fa-4bec-80eb-3a6c0e9e6e11", "value": "2BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810839, "uuid": "9c43e8c7-d2e3-4a16-a8e5-f5c799c3bdc1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810839, "uuid": "87e435cf-0865-4394-b43a-1f58b2994b64", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810839, "uuid": "2ef3881e-3ce6-4f56-85d0-6430c71fd5f1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810839, "uuid": "cb54e63d-6efa-48d3-b222-a69ce64dd9c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810839, "uuid": "6d6dc003-1700-4a90-8139-d7306d154ca8", "value": "c941f65e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518f1f61-bbdf-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1621785338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785338, "uuid": "68c42dd1-0d42-4cce-85ee-a71587731f4b", "comment": "Malware payload (OskiStealer)", "value": "1fa31ec68a8c7b2261d965191f863c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785338, "uuid": "df0e4aa4-f95f-478f-86d0-c4e18e99ea54", "comment": "Malware payload (OskiStealer)", "value": "12bf1af82800824feaa1e3322543c477bda5fb78adb178bda9fc3439f78c22a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785338, "uuid": "b6472380-0410-4c39-80a3-be17dd771405", "comment": "Malware payload (OskiStealer)", "value": "0a79f8c5bd035b063f6ec1405b7e536dd0154673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785338, "uuid": "c22bac8e-67eb-4bfd-bc5e-00e633e5fd05", "comment": "Malware payload (OskiStealer)", "value": "7e67e00db86e67aae147067a0b54be42356eae54a52ed28bbaa32613668a5391649936d1809113c5cfcf6e2b9eed3146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785338, "uuid": "c7ea3d52-79e3-4df7-bb13-e7a0a4b2e986", "value": "9C146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785338, "uuid": "7efef73a-6d1e-4bbd-970e-6dd08d4ec778", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785338, "uuid": "3e624e04-a0f2-417e-a221-d03de542d262", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIV1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNE1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785338, "uuid": "18fa81bd-6435-4f6b-9fee-d54289980856", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785338, "uuid": "71c7b8c8-1489-4630-a14d-4a7f028d8078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785338, "uuid": "c3221cb5-e1d3-4f30-b4b9-3d62034d0790", "value": "1FA31EC68A8C7B2261D965191F863C9B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4876c8e3-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807227, "uuid": "cf02fb35-846f-4889-b74a-5b4d7025b745", "comment": "Malware payload", "value": "a2581d80e54d75032f0a41962e05ca46", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807227, "uuid": "b4febca1-4e42-4d0d-8fa5-92e9ee5eead8", "comment": "Malware payload", "value": "12cb49631b3e868e5144b8458fc7d67a34bf16caf967d312068b7eef757fec6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807227, "uuid": "477441b6-728f-4567-9ef5-d369fa765ceb", "comment": "Malware payload", "value": "e34879ec3880920c19afa057e4093ee2862517ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807227, "uuid": "c269c0f8-bede-4c80-b97d-9a784f022c73", "comment": "Malware payload", "value": "f398500d10f48226f4f5a154d2d579c0c23f710f2496ae265f3b3eded96f7ef23f054e19a56e27965d09814a0d253e0c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807227, "uuid": "7b7d90be-3f2f-4e59-a4e2-5def28ee1397", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807227, "uuid": "a90fe1b7-4de7-43fe-8c7b-fcb89ac32a27", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807227, "uuid": "cf64d61f-7c89-4dd4-a3d9-65a1d6e5baa0", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807227, "uuid": "1d092766-9ef0-41bc-928c-f395763933d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807227, "uuid": "b4dc6857-a051-4070-be0e-b94c2b389dfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807227, "uuid": "261c3065-f8f2-416d-917c-ef9f3426a269", "value": "a2581d80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7982eea5-bbea-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1621790130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621790130, "uuid": "07122519-3da3-404f-b0e2-d72969a4aed8", "comment": "Malware payload (Adware.FileTour)", "value": "331317b4cae70b90441e0a2c8fb2e6c6", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621790130, "uuid": "ad6f32d6-7537-4c97-8feb-b8c3f6eeeecf", "comment": "Malware payload (Adware.FileTour)", "value": "13282c40dd66c53e866c60202f428781cf9562bb0f02e30027ebb7fb41efb5b8", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621790130, "uuid": "cc93362d-212a-468b-b467-df8d12ac93fc", "comment": "Malware payload (Adware.FileTour)", "value": "a69df46202eb2497bad5c4ddc39e0e83efb8482a", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621790130, "uuid": "d91bd072-b04b-4ccf-825b-28efbc26c993", "comment": "Malware payload (Adware.FileTour)", "value": "33500b3734717f38aca4a92b9ba20d64fe8b22b40265837db2426f760fe1007a048e61efd70cea4273b639a0da84bd1e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621790130, "uuid": "9d69134a-9669-4915-b044-dee28a2b4c9c", "value": "59841242F7E18839E073CEB01C90E962893B79654DBC650837ECAD8F9F3B5825256793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621790130, "uuid": "8aebe39c-8521-42e4-aa86-045bbd1742a0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621790130, "uuid": "aa20f2b3-c708-4b7b-8bd2-1d345880fef8", "value": "6144:x/QiQXCckm+ksmpk3U9j0IkquROGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglMb:pQi3cP6m6UR0IuRlL//plmW9bTXeVhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621790130, "uuid": "60770799-8bdb-44e3-8db2-b67c2dbc434a", "value": 390100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621790130, "uuid": "5a03ad9b-3b41-49b3-ab5d-7fcf2005e5c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621790130, "uuid": "ec0c6ad2-ec10-4598-b37b-2d896d5bba96", "value": "331317B4CAE70B90441E0A2C8FB2E6C6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b428864f-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771330, "uuid": "61bd8954-56cf-46d2-a973-e0bb01dcf352", "comment": "Malware payload (Dridex)", "value": "089a0a343abe41e1b090d81398b1d143", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771330, "uuid": "aa79960c-7eae-4cd1-a66c-552abe69b7d6", "comment": "Malware payload (Dridex)", "value": "132b5d7debaba92b1f80ed6d6d4bd217360905edfaf515836c539e8d40031731", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771330, "uuid": "40b9fba4-de6c-4713-a4a1-5153b7665777", "comment": "Malware payload (Dridex)", "value": "3b029b7b209eaf8725431cd7599eed6213531101", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771330, "uuid": "fdcd0c1c-fdb4-4022-a9fd-b9a16abcbbd4", "comment": "Malware payload (Dridex)", "value": "50858b1eac92f6d1f00a69ca520518d7a7344accd7d3dd48b87d81a8081caf81948bb2a75a0e85a56c30302f4d638470", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771330, "uuid": "ccc6d799-c52e-481a-89a5-7e9fa5ce744a", "value": "45F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771330, "uuid": "81f82703-1b24-4c05-8bad-ad4772ae90ea", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771330, "uuid": "7534585b-6c1d-4ef1-8e9b-d077131e6dac", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771330, "uuid": "c7c42e2b-96f9-4bcb-9a3d-4650f4e61fc7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771330, "uuid": "59b2adef-bab6-4771-b33b-c3caea99595f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771330, "uuid": "5b3ea0e5-133c-49c3-8dbb-2f8965252c07", "value": "089a0a34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59e833e-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735255, "uuid": "a937cbe8-05e0-478b-b18e-8370ec19ccd2", "comment": "Malware payload (Dridex)", "value": "e742703b4e401802634cdbc5b177ce89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735255, "uuid": "22536980-2417-43a8-9098-cb0587ef488c", "comment": "Malware payload (Dridex)", "value": "134fe5921ed20570ee8f531ffa74f8d721d38fd5d709117171fddf17177d58d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735255, "uuid": "a9a10698-574f-4ac8-a77b-9609c812f6f8", "comment": "Malware payload (Dridex)", "value": "05334243e84282988109a826acfd0b0b8bf205be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735255, "uuid": "bf747d0f-9469-4b91-a25f-1d9aaf57e754", "comment": "Malware payload (Dridex)", "value": "fed7303a396c1f0b2f48a35476d5ff42d7b14c30fcf3b599f84f93351d95b5a820f63bec928c9712938c0efc193266bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735255, "uuid": "5e297bc9-a754-42ca-9b4f-1eadce1e6517", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735255, "uuid": "7274421a-d859-4e7f-837a-392c879863e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735255, "uuid": "ba51ecec-df9b-4c04-9700-7bb0c5ec215c", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735255, "uuid": "fb775239-114d-4bcf-918b-3bc5b6176ba4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735255, "uuid": "12cc07d6-d1e6-479b-965b-933dd318a639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735255, "uuid": "f641e978-64eb-48cc-a02e-0b3a82d3fe61", "value": "e742703b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680a3cf7-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742426, "uuid": "5072e056-18ba-484d-85d4-6bf26b7f8dfc", "comment": "Malware payload (Dridex)", "value": "dac5a673480aef5ae95ebc5e975a4b65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742426, "uuid": "196fd5e1-42fc-4588-a6b9-dc703df4ac54", "comment": "Malware payload (Dridex)", "value": "13f6aefccb04e6b27824ba05ebc3eeb5d3b1385d78b4bbf21243eb7e93c68eef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742426, "uuid": "924f7833-f0b5-4d29-867d-81362089bea6", "comment": "Malware payload (Dridex)", "value": "ae33bb4b5695502d90f2ee1b902241b69ba6beb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742426, "uuid": "dc9ab8b6-2904-4010-9e73-91a0753b152a", "comment": "Malware payload (Dridex)", "value": "b0cf6c113a48de62f93ac756f6e8263e530196c0b7c51ef9baf14da66ce87b83915b07c6f815128f04bc9c22472ef932", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742426, "uuid": "9884b8a9-c598-402f-8437-be0e7d4f7b51", "value": "C4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742426, "uuid": "de3c3d80-b192-4ba3-8ff1-150937bcd169", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742426, "uuid": "9ab1a7be-6c22-407f-9533-c54e4e03c328", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742426, "uuid": "81f6d1fd-e866-4ebb-b12b-ccb4d27e50af", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742426, "uuid": "c2ef7c66-ba94-4e7a-9e36-99fdb01381db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742426, "uuid": "4e0a9519-a9e5-4069-9833-01548f9d29ec", "value": "dac5a673_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a68821-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796453, "uuid": "53ff2979-1a75-4964-84af-0b6a6f2358d5", "comment": "Malware payload", "value": "ccddff278812e16e297ae82ffa944d20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796453, "uuid": "7056f45b-fe54-49f1-aac7-3d9bd496eea1", "comment": "Malware payload", "value": "144381de34bb5e47966d55477bdf46dcf0aaeb621cac63cbb58a513cd41e528a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796453, "uuid": "29d89017-0ae4-4b5f-b727-9211e5d40ff6", "comment": "Malware payload", "value": "1e34d0d6dc741bc0c0151709d0f67f5292cafdf5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796453, "uuid": "b212b439-25ef-4fba-aec7-e5609311cd16", "comment": "Malware payload", "value": "b0a6d83aadb46faf82ff1e3674fab8cc7c5ed178daa438c320f02e9f4e29395ea6f55a1834c6ac6d5da1c38b6d75c867", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796453, "uuid": "b46358e6-eaf6-495d-8dab-6a4e33f1f071", "value": "24F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796453, "uuid": "c0c29788-7caa-4066-8526-6d384d0dfbc7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796453, "uuid": "6f209f07-ee03-4355-8ddf-826d8f226343", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796453, "uuid": "4d4a5f02-e0be-4aeb-bc95-b779ea81b209", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796453, "uuid": "d8949f6c-0cd9-4ebd-8891-551ed8327d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796453, "uuid": "b24e6603-e312-4128-9c3e-995848eaf5c7", "value": "ccddff27_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71830fc8-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778520, "uuid": "4fef47c7-6e69-4709-8bae-9dfbc39632bb", "comment": "Malware payload (Dridex)", "value": "8a340602107e7ba1ab6e684ed748e45f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778520, "uuid": "d5eb439d-909f-4d85-bf6a-73b3d0ad3004", "comment": "Malware payload (Dridex)", "value": "14463b97b96b57c05470e3362f197ee27b942e1aa71f4cbb43686c686f1b144d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778520, "uuid": "e63de861-29d2-4e29-aafd-e065149d66f6", "comment": "Malware payload (Dridex)", "value": "4e785d02fb5a78425d202089dde5422543f477ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778520, "uuid": "a6673d4b-7c70-4ece-a114-dbac4443ffc7", "comment": "Malware payload (Dridex)", "value": "0763f6d09cb7a9348c30c12794d2bae4c08f44d78ca22b76b8258d4bb46614d8cef69962c6fa9c6d12a438cc66033503", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778520, "uuid": "7359cd72-9105-4832-bab7-91ef7bfbb2bc", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778520, "uuid": "2c393e70-cad3-4be4-a204-63c002df358f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778520, "uuid": "63472910-15a7-4b9e-abdf-588b7127cbf7", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778520, "uuid": "02926757-c105-4b61-ad57-eecd99fbe232", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778520, "uuid": "821f4efe-7c96-4f95-a269-7148e8b514f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778520, "uuid": "a0c4d73f-364a-4eb2-a290-c09ccc78efa0", "value": "8a340602_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ea411a-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731638, "uuid": "305578ad-d6b8-44a7-b513-25eb9c5f000d", "comment": "Malware payload (Dridex)", "value": "5ae6602c2d776f95f553b459a230823f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731638, "uuid": "da765b87-8071-4240-8290-0b2c915a62ea", "comment": "Malware payload (Dridex)", "value": "1486c718f777a13009e7177bcfb0f018cda214c6aac4d839a2dc941135be31e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731638, "uuid": "04b3f692-3a9c-4fe5-93ab-b4b531d6a89e", "comment": "Malware payload (Dridex)", "value": "c9af9634a6c70aae64b5d90cd9a7679b1a55366a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731638, "uuid": "d0109bbf-aa18-4519-a260-48ba51905656", "comment": "Malware payload (Dridex)", "value": "f9ca35b61d2a51b65096fdd00fc938096fa90f63d12988431b1e37acdf44ae907a94ff8f8cc7547bc148bc916c31d8fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731638, "uuid": "3d6dffac-4bbd-47bf-8f4d-15d85f41ddcd", "value": "B8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731638, "uuid": "f0d58d1d-510b-443e-a80a-9fda1e1023ce", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731638, "uuid": "db935ec8-e404-4f6c-b424-38bbff394466", "value": "3072:slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731638, "uuid": "00574745-f6d8-4853-9119-199b0c426535", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731638, "uuid": "0288f8b2-9bdf-46c5-8f61-36d7b3ae38b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731638, "uuid": "64d9e944-d69e-4da2-8b6c-6a949b16a408", "value": "5ae6602c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a4b1c0-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774868, "uuid": "895ebc72-9a94-4903-9679-e30918d56bbf", "comment": "Malware payload (Dridex)", "value": "0a690e70d93457702328e2da7835d5c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774868, "uuid": "f3852652-d51e-469f-9016-9984f0e98f95", "comment": "Malware payload (Dridex)", "value": "154f14e519a51f88c4ef646f16b9edd657cdf9e66d91ac55b5acb4a77b26f22c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774868, "uuid": "85f26cd4-0095-46f0-b40b-154437e80053", "comment": "Malware payload (Dridex)", "value": "c27f3151efa186c6617a1acfb66546cc8b32a4d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774868, "uuid": "aeb5af43-0000-4c88-876e-076d66c9f2b9", "comment": "Malware payload (Dridex)", "value": "198416f10485d0ad93f66bc197f18775bda6be13de0500806a32bc8016192eaf510d0537441b61a9666f41588d8f8764", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774868, "uuid": "de9fa751-b38a-42f9-b64d-2f8c3ea13ebe", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774868, "uuid": "6d42accf-ff0b-4d4e-9e1d-e69252105d73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774868, "uuid": "8e6b8cde-088a-455e-ac57-9f415104bade", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774868, "uuid": "fb0f3867-75ae-4a43-a634-2a417fe4d7ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774868, "uuid": "7969a2a7-3fbb-41ae-8e28-ea2d2d6c0dd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774868, "uuid": "8124431a-2dd9-45e7-aa7d-90569fedf259", "value": "0a690e70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492026b6-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796491, "uuid": "56cc83a8-84d8-483a-bfb3-80fef9226337", "comment": "Malware payload", "value": "b847a6b4de5e0acffeda91ac010f84c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796491, "uuid": "07be392f-bb70-4210-bfbd-cdbd4918cec1", "comment": "Malware payload", "value": "162fc109e291ac84112cffa5786a76cea4ff69a620524f903e97b9e089d384bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796491, "uuid": "ca3b3507-c811-4369-b585-83d6af4b3773", "comment": "Malware payload", "value": "3cc3c54b77578f5672802d306ae6b3f521ab5ccf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796491, "uuid": "3dab2d0a-3e68-40c6-b346-f835e802b901", "comment": "Malware payload", "value": "2c6d804ef251674e91b8d5e20ae71ea886c7d42ccd4e88b7719de9d663764ad5b27606a54a718d14bb87bfb9adae1630", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796491, "uuid": "d6be1277-fc2a-4002-8f51-ec38973444b6", "value": "61F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796491, "uuid": "12b4c788-fa70-43a3-b467-2c9cbb8293dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796491, "uuid": "c43c9055-9cd3-477f-8335-8b785befba10", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796491, "uuid": "0d1b30c3-a9b6-4d5c-b4ca-0b16ea987a60", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796491, "uuid": "18c14ff7-7720-45a6-a3d4-aa71d6694bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796491, "uuid": "99fc20bb-d2a6-42db-81ee-dc158148eacb", "value": "b847a6b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c12f97-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735314, "uuid": "3b0ed0f9-a6d6-4009-9311-f45243a3abf1", "comment": "Malware payload (Dridex)", "value": "9125d67f4e011277f0e962b8ce13930f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735314, "uuid": "58756a6b-30e7-4bff-b7e0-0cb71707c3c8", "comment": "Malware payload (Dridex)", "value": "1632fb6fff2e22ba3d3cc2a9da47699745c0ae3afbe4effce1f669bbc49521af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735314, "uuid": "a48860f9-375b-4edc-b1ce-72904d3d55a2", "comment": "Malware payload (Dridex)", "value": "63bda841d8b36d67c98cfd6620b7cf1920773b56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735314, "uuid": "9644d95f-e4ee-40fa-b77b-7780e0063a72", "comment": "Malware payload (Dridex)", "value": "2a30125580809504039ab0f92736473289efb99029671d560df5464709de8c86612df9e0d77e244536c692cce34e7c72", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735314, "uuid": "49f2361f-09b0-47b6-b892-211b8f3c4033", "value": "3204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735314, "uuid": "e0b91e19-9396-495c-adcc-3e97d82bd2d8", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735314, "uuid": "dac867ba-8283-4272-989e-31c3094973a6", "value": "3072:GWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:GWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735314, "uuid": "84a21578-f1bf-4947-96a4-ce7d7f13b6d8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735314, "uuid": "311fa64c-12c3-4013-8cb7-f6c8a24f609b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735314, "uuid": "ec3e83db-6f06-4add-824f-e7311f16d635", "value": "9125d67f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb000cfc-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735264, "uuid": "c3079f26-3b2a-4df4-9886-46b96a5b5892", "comment": "Malware payload (Dridex)", "value": "5edbf5abe829fc45cc45435418d0645c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735264, "uuid": "6a8ffe72-b6ba-4e4f-a77b-e4b86b59ed2a", "comment": "Malware payload (Dridex)", "value": "1634807c4b4bfd84b8c66b15ebf559f9c86de51fafc792b2829540d8adfd0cdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735264, "uuid": "8baf04af-5d95-4554-ac90-a3613e1c8b0b", "comment": "Malware payload (Dridex)", "value": "5af6b0f3d0635960dcdd2043032e05e1e1840020", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735264, "uuid": "fded6fe4-ef9a-4fc3-8d8e-3573b0cc8211", "comment": "Malware payload (Dridex)", "value": "851dce9b932fe4b56f2519e48f09fad0a29ee27f35d66ac55fed3533c8be436f85aca71f510aca3398d9085f8cf032cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735264, "uuid": "f77b024e-6ee9-41ed-9b60-1cb8e013c80b", "value": "5FF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735264, "uuid": "f580169b-34d5-4f89-9255-5e6abcd27b65", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735264, "uuid": "a99dd6ea-3443-4803-a8f7-40ef76586413", "value": "3072:59F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:59F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735264, "uuid": "5afdf6b2-bbf7-4e82-9d15-786391478432", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735264, "uuid": "db536457-7546-4b06-bf83-99d26e4e16d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735264, "uuid": "89acd1b9-0bf5-46be-abe4-e9f40d13386c", "value": "5edbf5ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89806a6-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803657, "uuid": "c9095b94-bceb-4e5b-b84c-e5a19c36ab3b", "comment": "Malware payload", "value": "dbe595cdea6ba4b5abdf1c197231fb22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803657, "uuid": "335b430a-c01c-4810-a15f-8361c77e0393", "comment": "Malware payload", "value": "16a84d55803e1f1cce80ac231db90a130bead6815486ee1437a9585b22d8f0e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803657, "uuid": "bf028b4c-7554-41a6-b222-d46c2a9b4d51", "comment": "Malware payload", "value": "22685d2edc6dfaf59e184ae00edf21ddbb168454", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803657, "uuid": "2df7fcc3-3504-4b8a-9d8f-91493401aa90", "comment": "Malware payload", "value": "ea1a76862c410538e2a6ee68c86434d1004f3b99a3cae16c0a6550627d95db1b19db404f22c11aeba2ede67e736efd1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803657, "uuid": "a9052f88-c8f6-47fc-9e6b-0428fe1b0567", "value": "B804B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803657, "uuid": "0c308395-87f3-4054-8dd3-e030923f2cd6", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803657, "uuid": "27aeb35d-e19f-42cf-9949-201f88921279", "value": "3072:BWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:BWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803657, "uuid": "5ad32802-2b2d-488f-a440-924f605634b2", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803657, "uuid": "847ebc3c-4568-49b2-9cc7-829905c95cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803657, "uuid": "ca6e20b5-f62f-4e32-8fd5-087a880113b3", "value": "dbe595cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089e84fa-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803684, "uuid": "85f4a899-c3f5-4c6c-b887-86da13aee801", "comment": "Malware payload", "value": "e1afdfc1b286c627d7cf3b4a86352b87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803684, "uuid": "ee83a2bc-06bf-4edb-be6d-af07da397bb8", "comment": "Malware payload", "value": "16daf81e7b2ee4342e62c515cafb5e65178924627c0ba12d2e549abb255ca4bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803684, "uuid": "b6564ef0-8347-49d6-b7b6-4bf6e8a19d33", "comment": "Malware payload", "value": "356de054375d87a0adfba996ec7e2e636f7b0c2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803684, "uuid": "627decb3-7581-4ac2-9253-e5d996c46276", "comment": "Malware payload", "value": "9c5372777c6b4ac5958184171fe9dcb0d184644e25264948c150144eab6e78f1ad109360433e7a5026f1dd31c2913226", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803684, "uuid": "492d8583-75d7-418b-8c6e-bef6dbb0a91a", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803684, "uuid": "89bc911e-4707-4349-8699-b54d8938755e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803684, "uuid": "cc2e4d83-572e-4362-a131-872488770394", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803684, "uuid": "6ffdc873-5375-406d-8ccd-e1ff7b83db93", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803684, "uuid": "db4422b0-ee01-4690-b828-04ddc05f0044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803684, "uuid": "da0461ff-1d9b-4332-9d7b-e5370d673ffb", "value": "e1afdfc1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fbe98d-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728065, "uuid": "30b77206-647b-4c9a-b8d3-e7104226cd60", "comment": "Malware payload (Dridex)", "value": "24d8e504eb9606d674c980a355b942c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728065, "uuid": "c01835b3-3ad5-44f3-a763-2707730ba79d", "comment": "Malware payload (Dridex)", "value": "17b05610420f755f36a64585be1cd5c66fa022a94f99a00e29a3f3dc886f51b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728065, "uuid": "aaeed6e0-52cd-4cd3-a7f2-0044f23809bd", "comment": "Malware payload (Dridex)", "value": "37a8e3506d62fa8835c23d2765ed1be7f6258041", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728065, "uuid": "7a937e48-fa92-4e54-abc2-c8024aed59e5", "comment": "Malware payload (Dridex)", "value": "b9805dea5227d373e63fbb5b15c386d727e5fba7e2d8259487a46020984684199a3b129ebb49f40bffc5d9b38788a370", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728065, "uuid": "88af195a-2319-4ec5-abbf-90587e0f939d", "value": "92F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728065, "uuid": "740403e8-97ba-44d7-8d14-4b17876d1107", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728065, "uuid": "c8c70e8f-d218-4eb9-aa0a-92f92b0371fe", "value": "3072:W9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:W9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728065, "uuid": "2ed61ed3-a092-4ada-8f04-7649641f803b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728065, "uuid": "4b0388dc-c1c6-4d14-9907-af03f96fc02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728065, "uuid": "599fe782-c42f-4eb0-b36e-6029e8c32cbc", "value": "24d8e504_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb2ed39-bb77-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1621740932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621740932, "uuid": "fa9eb9e3-21d3-4506-8be5-28bf41bdc777", "comment": "Malware payload (IcedID)", "value": "a4017c06209e16b8f47fcf6e5845aba9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621740932, "uuid": "00957e8a-8985-422d-8139-58f1f0be0719", "comment": "Malware payload (IcedID)", "value": "1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621740932, "uuid": "7ea41bf3-5c1d-4638-9c22-de5770e39261", "comment": "Malware payload (IcedID)", "value": "66d99a1cc92ed316e0d7a2ab6df466c289154ec3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621740932, "uuid": "197f7592-f6a2-45c1-83cf-2d33e3a1deec", "comment": "Malware payload (IcedID)", "value": "7405f8a857f997c0ae9a6e3b672f722741d5d1cd8301c01c09bac0e3160fcc907c9417f8592ab5e338ae9b333b643dd8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621740932, "uuid": "d310862d-97af-4abd-b067-e77a5193f199", "value": "E80339A3F290473CFBB640B2D21DEA909A85EE617D4E7557A07903C28F33B59E785B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621740932, "uuid": "2814de92-d885-4498-a9e7-729653d74448", "value": "3d51d3fa0835c459058650f717b0a385", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621740932, "uuid": "17200cef-e15d-44bd-b2e4-5bf2cff71509", "value": "768:tojIJWP0znqX60+KU6nCVUO2gTjZSXulSJ474fLv/zkSf2Vz:NnqXn+YoQ+lu474zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621740932, "uuid": "8c0b4efc-4602-4019-8fc8-5170abfe7eb7", "value": 39432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621740932, "uuid": "3f1d3da6-ec6a-48eb-973c-1792dd1592d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621740932, "uuid": "ed7fc473-964d-41a6-a720-a7b737ee9cd4", "value": "a4017c06209e16b8f47fcf6e5845aba9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575a2b66-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767738, "uuid": "82f41a87-f613-4702-a24a-a3e522181802", "comment": "Malware payload (Dridex)", "value": "d65ef009e5ed84a9dc45d7738144fd75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767738, "uuid": "d16f8776-2d70-4a99-899f-db8100b093e1", "comment": "Malware payload (Dridex)", "value": "18617dc5827195435724418c39056ad61faf00fedd429c0cba18fa1ba9c59bd6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767738, "uuid": "0904a65b-332a-45c0-bdd4-84fafa903007", "comment": "Malware payload (Dridex)", "value": "f60a0abaf33fab7c2aad5266c7264620ab1032c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767738, "uuid": "86f67a8c-90ef-4cce-8226-a5bd300529a9", "comment": "Malware payload (Dridex)", "value": "9db76e9dd177b567da583fe58d227b75b4d128b9c88efa0aca5a4d41a27dfa2bad114dc53a05afe1b7027fee8611faba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767738, "uuid": "bce87e8b-472d-455c-9e99-ae79d9a0f043", "value": "E0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767738, "uuid": "f60ed616-87ff-40aa-9ed9-4c717175ca57", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767738, "uuid": "2c789a00-7a5b-48e9-a543-40edcfc5edab", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767738, "uuid": "730c723e-543e-4bcd-b3f6-e2f1339a0137", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767738, "uuid": "369f7f33-5302-4b54-8e92-ba58b9964ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767738, "uuid": "3da44594-f8a9-4620-9f27-fcd3cba5fc52", "value": "d65ef009_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdceba4-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621779450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779450, "uuid": "13061586-1bb3-4f84-b590-fb0c485be840", "comment": "Malware payload (RedLineStealer)", "value": "fde1a972ad08584b5ab74d7f0775393d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779450, "uuid": "d1c37476-75ae-434c-a900-15b86aa04eeb", "comment": "Malware payload (RedLineStealer)", "value": "1865d433a8fd321a505fa57cb37ad8b8c8cf6d1b5a075ce66c55978ad0ee8711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779450, "uuid": "4c60ca8f-79bc-41a1-b233-9fe9c7f5f55f", "comment": "Malware payload (RedLineStealer)", "value": "1fc34fd34dc9777829a39a3d6872f9f82fa01b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779450, "uuid": "fb0666ef-559d-413d-bfec-50ea81fba40c", "comment": "Malware payload (RedLineStealer)", "value": "1b07556c69af93a12f5b21a53fff724c39efa434b716b37327cf94feecfdef224cc08a632022ffa375d498ae6975e75f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779450, "uuid": "daee170a-3cf8-4c02-8af2-877f35d3f451", "value": "43E4E130A6A1C035F0BF15F459F582B4A12A7DA25B7440FF22D62AEA46345ECACF135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779450, "uuid": "036ca94b-266a-4b16-b2d3-e531ac4ddde0", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779450, "uuid": "975a60b4-d90d-4414-b292-2037c2082a55", "value": "12288:qD0Mnx+BwxZnwTwqSeLfjaguKMskCZ6fd8aRZ41VCMVlYccBz7+h7XsLe:rMnxxrYBSeLragEsQfd8aRnimcwSdXsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779450, "uuid": "b1eb1f4a-e972-49e3-b7bd-cd7584b43cbb", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779450, "uuid": "d1030f17-a08c-4fc0-bbbf-e0630eab6e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779450, "uuid": "a8fdcc53-d121-4de4-af4f-d92fd88bc056", "value": "fde1a972ad08584b5ab74d7f0775393d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0aee00-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771233, "uuid": "5c258a80-1898-4641-bb4a-027b09882797", "comment": "Malware payload (Dridex)", "value": "d82ef03cd656dc1379f50306a2ba803a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771233, "uuid": "dc7b0b5d-05c5-47b5-8841-57eb3eaf9a0f", "comment": "Malware payload (Dridex)", "value": "18a1029a91060f485b820d91c0cdf7c641fc98654bdf9d6f4465467ff296ec5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771233, "uuid": "fd471a3b-18db-4275-99e4-4bd09c576057", "comment": "Malware payload (Dridex)", "value": "2252846c044096124d785de0efd8ea7d4b36e351", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771233, "uuid": "f78a86be-a8e7-4725-9294-f7d69cbfd060", "comment": "Malware payload (Dridex)", "value": "b346997f23d974659e2b346a5f658d89cd43d8a78bcd4e1d17fd712d9ae9d588f3261789f5b82101c94c6048e7ecde86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771233, "uuid": "379424a3-876e-4f19-8934-ff3573018580", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771233, "uuid": "c58fee96-2826-4c75-8341-a92d8a838654", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771233, "uuid": "ea149a03-bd87-4128-9254-5a086a6e450b", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771233, "uuid": "57b6097e-74d7-4f34-b2af-e1072fb34147", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771233, "uuid": "c19191f4-e071-4a5f-b083-b465ab29f197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771233, "uuid": "07439c85-a48b-42f6-9628-501b16928bf2", "value": "d82ef03c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08f5e30-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810891, "uuid": "8625ccb9-f0db-4eca-acbb-3beabeeaf215", "comment": "Malware payload", "value": "1fe6cc19c24ea3bce8b9eaaed614280c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810891, "uuid": "e41acf01-d9be-4fcb-bd0e-52c81f18bd80", "comment": "Malware payload", "value": "19996d29bbebfc1240c8b453db481e0b20f3b02786d56f68d39e2741f2be3c55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810891, "uuid": "8e3b376d-66f3-45d6-8535-0b8475f81f29", "comment": "Malware payload", "value": "7f31f2b779160f628670aaac9275e38941803c85", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810891, "uuid": "010c1077-346e-4ecf-afc2-12c275f1de4a", "comment": "Malware payload", "value": "7e5054d8a0d1690ee4dffd1588baeef0f6805e26a6a76ac776cf5202cec06514dfbeefbb0292178f41a1a6eb902666f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810891, "uuid": "5ebd56af-b91f-4326-86b3-6786756b2f2a", "value": "A6F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810891, "uuid": "e5c6aeca-a32b-4e61-8bd8-e1d3950c3155", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810891, "uuid": "95523f30-76ab-4722-ad89-88ec284bd52a", "value": "3072:oIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Bc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810891, "uuid": "9660d5a6-8360-44ce-aa0f-e45d2b8c6ef5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810891, "uuid": "43e98d4a-3865-4d73-8bf1-8887bd9c3f20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810891, "uuid": "08494a80-c267-4c47-b510-addba08b02e5", "value": "1fe6cc19_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8d2943-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782194, "uuid": "7672b152-ca2b-43d8-9340-9978c5ac1b8e", "comment": "Malware payload (Dridex)", "value": "ce6d1cd4272ef8ac4de2ba9539124903", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782194, "uuid": "bf69f8b6-1a87-4291-8491-497fe9bde590", "comment": "Malware payload (Dridex)", "value": "19ca4cd2868e6365350171d1925623ce22b6667adca7e9798df8708f1248e1a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782194, "uuid": "263a3295-5f3e-41ab-ab5d-f357b1386b5c", "comment": "Malware payload (Dridex)", "value": "8a5e4b66ac0d12cc457ddbe054e9003fdb03ad88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782194, "uuid": "e8df3650-4040-4b58-a16e-9db07086baee", "comment": "Malware payload (Dridex)", "value": "328fe7e747b00f826f49aff43ee5fddb184adbd283c4f4a73b4e9d7c5188947621b67d45b22ffa96328b5ac237070198", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782194, "uuid": "c8fe11c6-1692-49cb-9066-6f0eab3bf062", "value": "73F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782194, "uuid": "168185c9-5381-4afa-a841-19727f2de903", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782194, "uuid": "a4c6b2aa-95ff-4acb-81c1-3fea57fbee8d", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782194, "uuid": "307a47ce-91a1-4e95-bbf0-7e5f8b624452", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782194, "uuid": "fe369972-f55e-475f-9cf9-6fb181b5e9e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782194, "uuid": "e5a52f31-8776-4433-aa15-4eb9bb85df93", "value": "ce6d1cd4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b49d948-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800065, "uuid": "7ea3f984-c77b-4dde-a29b-a391485d38ad", "comment": "Malware payload", "value": "9c8fca0fba49a9f5645f9be378457171", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800065, "uuid": "7f5e3e72-f328-4ca8-80e5-8659bb78db07", "comment": "Malware payload", "value": "19cb4ca01aa65f1b86eac9a754d30aa631ae701a32948370c63ee7e79cabfb72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800065, "uuid": "7859b8db-28f5-4374-b3cb-b4b4b19a1235", "comment": "Malware payload", "value": "7e31522e345989a00fb98d86e5354c1c87eda999", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800065, "uuid": "49bf274d-9aa2-4cf0-ae3d-40b326af9e25", "comment": "Malware payload", "value": "c8563c737660814ee124ec12e78f92b7b0fcb7c526fa88b66d713235d1925e7f2df452f7c8ec8689d41ddb0791d68ebe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800065, "uuid": "9830da62-a8b3-49c7-b147-efe51a8f63da", "value": "8A04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800065, "uuid": "e20a1589-2988-4ae4-bcc2-52604dbe651a", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800065, "uuid": "f785ddaf-afa9-4a21-b8d9-dc223926b450", "value": "3072:QWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:QWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800065, "uuid": "ed47f4a3-6c6d-4345-b763-9b759dcfaa73", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800065, "uuid": "eb7848bb-b68e-4447-b20e-16042c1214f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800065, "uuid": "c92f3534-6141-4ebc-b488-267784465f6d", "value": "9c8fca0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce18811-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738864, "uuid": "513a294d-80cf-46cd-879a-e680732a1e8b", "comment": "Malware payload (Dridex)", "value": "755dace55373a128a763f089397cf379", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738864, "uuid": "bd89d9b6-efa4-4a58-b9a9-af5d29c0ee54", "comment": "Malware payload (Dridex)", "value": "19e5c972fb5a96d0d1fbabdca868125199a839aee4b1cd74b6b811393c419669", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738864, "uuid": "4db8f767-ecb2-49c6-a5f7-7b8d7b3d7afc", "comment": "Malware payload (Dridex)", "value": "ef76b4af1a80914b177ada82be496d693e7bdf83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738864, "uuid": "5093c42b-baa3-492a-85d0-6c7d38d232c9", "comment": "Malware payload (Dridex)", "value": "379dacccffed2acfd9abc78de42b67179fbbf312b34b46aa3f345dc0dc5e22449657c06a20f87f06f2df7db133f7519e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738864, "uuid": "8f629af2-e1a0-4084-b919-43f7382b9f08", "value": "A8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738864, "uuid": "0be1a471-3483-4de1-811e-26d323e0ebcb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738864, "uuid": "f950c17d-c607-4d73-8a53-dcdc751ef278", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738864, "uuid": "346d588a-fcb8-439b-82c0-e0ede5aa0e74", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738864, "uuid": "7f24ebc4-0d59-4eea-a4fb-c1bbd5fc8ef3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738864, "uuid": "660d7325-0293-421f-8e83-d1148ba37894", "value": "755dace5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dce30a-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796457, "uuid": "f97940cd-a35e-4eff-9a33-704984708588", "comment": "Malware payload", "value": "da6eff84724bff724368d28e5ba335d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796457, "uuid": "a8263f36-1216-47db-bd00-a6c3565bee6c", "comment": "Malware payload", "value": "1a3617d9b3b3d79142b61e5c74b2a31993db20694d0a59bf6bf13071c9877295", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796457, "uuid": "0f4564f6-386d-4f93-b46f-c3b02a7904a6", "comment": "Malware payload", "value": "6a381c28ffd4bcf3a0b2df1bd2cef08a145626ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796457, "uuid": "e5edd32f-f419-4e37-847d-d7c6b338ae54", "comment": "Malware payload", "value": "630488b51b2005422e5a625384fa5927642fa8fdb96d6dcc445e492e9ec93442529a2b46bc09764d950ed722bfd64e0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796457, "uuid": "17a06e44-e833-4d8f-b9fe-f0315477afc5", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796457, "uuid": "64057e08-1e71-4c92-8c13-d2c5f813dcb3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796457, "uuid": "f7935684-e289-4aa3-a504-0ef5392cc0a0", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796457, "uuid": "9a909652-e317-4258-ba1c-51be581b863d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796457, "uuid": "5c3cec96-e414-42cf-b722-e240843b7299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796457, "uuid": "a27bee3c-4767-4330-863c-28bd118b0e78", "value": "da6eff84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9707dda-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782076, "uuid": "622fdb40-ce1c-4bc5-8bb7-2fe621109d82", "comment": "Malware payload (Dridex)", "value": "4530012660e84249274e8f842c04e358", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782076, "uuid": "9dfba902-627f-4adf-b0d2-352e77d3a9a4", "comment": "Malware payload (Dridex)", "value": "1b122a91f625222c9deb8b3efac79e1a4e2e85d1a870d6b41b39e866efdf60f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782076, "uuid": "9f72c1f8-1b3f-44d5-a15f-24d6e92551b2", "comment": "Malware payload (Dridex)", "value": "d3401590f50747c66dbfb0d9a48cd5e7c24534d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782076, "uuid": "59b7c78d-542d-411b-930a-422da797cd92", "comment": "Malware payload (Dridex)", "value": "b545b987686d62bdd00fb79b574353d4e26abfb77cd9066ef6c4ab682367de508e8bf6b9868ed8487f4acad26ca911b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782076, "uuid": "24878b3a-1ad0-4083-92ab-925a71739481", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782076, "uuid": "e20f4bc9-f5b2-49af-909d-54233cd0bea2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782076, "uuid": "2d3ac39c-0dc7-4352-be46-fa96d1320ed7", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782076, "uuid": "ad1c5e3e-5b2d-403e-829a-219062c02cff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782076, "uuid": "33ed2f75-d3c4-4e60-9e81-0f24d4bddea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782076, "uuid": "ad423a57-464c-4e14-9d43-f44e2307947c", "value": "45300126_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc37054d-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810857, "uuid": "fc29de06-27f3-43ad-85a1-1dceeb63a9d9", "comment": "Malware payload", "value": "9f84820a5ff0fec444ecdebcb2ab785f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810857, "uuid": "f4426ad0-014b-4bc0-8e45-797acde23735", "comment": "Malware payload", "value": "1b239b862042a375da0db7476969b5a99a1a34d412a810d07e10cd7f1d6a94cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810857, "uuid": "7d1e63c2-30d0-45fd-8bbb-825c5a0564b0", "comment": "Malware payload", "value": "460ff85e2d9c72c07a955c758c059a6bc6cecfee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810857, "uuid": "6d1f2353-f616-4f2f-95dc-f458172fd493", "comment": "Malware payload", "value": "041e19d7f28a8ed8228434f7c453a4e9ea0310f02e68bc89203736b58d162b640c43a0e9d114f9c6a265e83eb3a50932", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810857, "uuid": "da13d993-fe1d-43a3-a789-6e402fb50d75", "value": "07F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810857, "uuid": "f87f7280-dcc9-4e17-bfd9-41169e1d0317", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810857, "uuid": "749970a2-644a-49e1-a772-6a4d9fcafa63", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810857, "uuid": "43593a55-1d07-49f6-9675-16511ae1a744", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810857, "uuid": "70f82a4f-22fd-4ae0-a1b2-fd18700b64df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810857, "uuid": "93dc6fc8-f349-4f84-b048-f288e7195f34", "value": "9f84820a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b706701b-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764033, "uuid": "fc356917-8eaa-40de-80c5-d20c2c236665", "comment": "Malware payload (Dridex)", "value": "b81dd257cc601afa8d4c46d710f41894", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764033, "uuid": "e68e8551-7952-4d3d-8591-b0b6697348b3", "comment": "Malware payload (Dridex)", "value": "1bcca6f89a3456f838f51215ac5a5b03670f64b89c292dd1816e07857de75443", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764033, "uuid": "ed4c6ca7-89ef-4edc-9080-f69656acc448", "comment": "Malware payload (Dridex)", "value": "969694bff8363d62bc623e2556087f3606ec87dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764033, "uuid": "9cf5b81e-0785-431d-83d6-08f38956d22b", "comment": "Malware payload (Dridex)", "value": "049a62b3872d46834494033a03485437ec2846b811edcb20d28e78e3cbb81545f73e517af506f24bdbd709e15fb64bdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764033, "uuid": "215f136b-f540-4e93-ad17-76095386185c", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764033, "uuid": "5b841050-c698-4010-a71f-7655549bd417", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764033, "uuid": "fcd380d4-6347-45ac-9c59-abfd0ee8dd13", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764033, "uuid": "de846aa1-91fd-482e-bd74-69941a0cbbd3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764033, "uuid": "2f86a6e1-b7f2-43e2-ab55-03f60e63dfc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764033, "uuid": "6318d3de-5208-4dbb-af34-f5e9da5961e9", "value": "b81dd257_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4a44ee-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749627, "uuid": "178faf1b-02f4-4c5b-a86a-d6bafecfb32d", "comment": "Malware payload (Dridex)", "value": "2bb3b43247197a972d32d58fcde1dac1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749627, "uuid": "0139e821-63a2-4d20-9730-2e8b1b41357e", "comment": "Malware payload (Dridex)", "value": "1c34d55ecd1d29e4faa9b8bd65c0a78fe585b6f341cf0dbb0f4f4902d3e7217d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749627, "uuid": "cbd35773-2953-4eb4-8589-ce00d34b5aed", "comment": "Malware payload (Dridex)", "value": "fbe6f264f6f48fe455a30c45ee8557b2cd752ee2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749627, "uuid": "f84fb448-f658-4233-8690-0fe164782980", "comment": "Malware payload (Dridex)", "value": "0688105c94d2ef587874d80afe5e0379fb0203e005fe51d220e1b4d219db9fd0d7ff1f87fdf1f5d1e5b534a065e40677", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749627, "uuid": "6395908e-847f-4c27-b00c-6499a0490313", "value": "1FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749627, "uuid": "aacf6572-7592-49ec-b022-200c4b6268d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749627, "uuid": "8c5f9958-1426-4c36-83a2-4a1c67ab686f", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749627, "uuid": "adf74721-360e-4893-821a-51d503792021", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749627, "uuid": "18fd6807-e75a-4261-9ba0-65166e336094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749627, "uuid": "4eb41a4a-98da-4e34-8ff7-544f202a9f0d", "value": "2bb3b432_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a62551-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764053, "uuid": "8a372c22-1227-4c7e-bb84-dcf5bcbb128c", "comment": "Malware payload (Dridex)", "value": "a4f4a08a5f2c2a632389cadbffc42598", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764053, "uuid": "17f49a55-f5e8-4c3e-8d46-71f2bccaaded", "comment": "Malware payload (Dridex)", "value": "1c6a43f57b639216f75264502b2a5896f25b9770b7e77df69b5e38d3d785bcc5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764053, "uuid": "d328c8f7-420b-4595-a3ae-49d1a59f0488", "comment": "Malware payload (Dridex)", "value": "8347f6e11ebfe8de8760f007a8297d849843e247", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764053, "uuid": "057d0769-dbf2-4bc6-8696-b5eaf5826b08", "comment": "Malware payload (Dridex)", "value": "3ae63e9c6c0f3d97daa0d2109ab03b30054ccf99372cb3ef91a4010114978e3b01de9efca260764ac4b143d27e76b640", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764053, "uuid": "8af0dc87-5e21-4a20-9459-a2ca090a3ef3", "value": "5BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764053, "uuid": "c068e3f0-1e01-40c5-99f2-3d5800387b45", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764053, "uuid": "d1e461d6-1ddb-4feb-bc94-2688cf62ad3f", "value": "3072:lA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:l3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764053, "uuid": "0b97ebc2-b683-4620-b9d6-5427d25f8d9d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764053, "uuid": "e2ef74be-8709-4a35-9d35-872527addec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764053, "uuid": "b2b684ee-f2bf-4539-a15f-5ac5446cfa87", "value": "a4f4a08a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd23e61-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796524, "uuid": "23e34407-16e3-4c4a-9237-029c43eb77cb", "comment": "Malware payload", "value": "e354d41e05c848ef1f4188566faf6289", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796524, "uuid": "4dec3c7b-5172-43ea-84ef-5c3bc68486d7", "comment": "Malware payload", "value": "1d2094c7a56ab5f76f6c1724b2b6116a71a6ed3bdb9b2b4b91c9bafae50f2749", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796524, "uuid": "1bd192d2-88bc-46d6-abde-f3e4baa60aee", "comment": "Malware payload", "value": "b5cb48b00ccc83bf6ff299d6d10a0923bcf63efb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796524, "uuid": "9c0175b1-3e49-4fe2-8cae-6a6f9e5fa893", "comment": "Malware payload", "value": "cd29b9f7cedade8c9ad6bfa69d1853fc23bdfb4c209cfcfdc1f477a2600bcd124078408d48d913417603f421c45d5ee2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796524, "uuid": "27cf103a-49e3-4510-8eac-9d040e355bc9", "value": "EBF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796524, "uuid": "8acffbd0-9ed8-49e1-aa38-3dfb14832241", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796524, "uuid": "1453008a-2888-4dd9-bc69-ae493a37845c", "value": "3072:39F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:39F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796524, "uuid": "01beff42-0649-4f55-9425-753bf48e0847", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796524, "uuid": "e76afa09-b7d9-4237-be68-10a2f98ced21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796524, "uuid": "5e704808-0d07-49b1-be29-7aaf00fafc1c", "value": "e354d41e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70a93d2-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803628, "uuid": "db9bdeb2-8d3e-4bdd-9042-a579231f3ba7", "comment": "Malware payload", "value": "db35ac48e6444f3bd42a1e1a769b6030", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803628, "uuid": "c9540e67-4389-4b4f-be5f-da8f0f61940d", "comment": "Malware payload", "value": "1d46dee5219b5a1d0be42342d5a8e09ce70c346550b4ab1127bebad8389e4146", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803628, "uuid": "a75f4898-88a8-42aa-9284-da657f8b125b", "comment": "Malware payload", "value": "76a6ef2b8e72197bd05e12e629ec816cc18bb357", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803628, "uuid": "638c88a4-94d3-4587-86b7-c2282914260b", "comment": "Malware payload", "value": "9d79e5f7aa9b1fbececd16bfabf74be33e63b0ca8278371851b16a36cbd23d60e2027c1d0d61659d0c74598807f4d86a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803628, "uuid": "a9e85a4e-3e61-46c2-a5f4-c1f5a66f7a11", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803628, "uuid": "6f522cc5-830b-4772-95e5-4a8d0ecc3903", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803628, "uuid": "140a4e6c-1c5a-4c3b-9840-3102960d72f0", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803628, "uuid": "10c2e701-7b96-4835-bb98-0781ee83f399", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803628, "uuid": "6dfc1bb3-ac0e-44aa-83a1-bc5067beb28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803628, "uuid": "0f2c17f0-4e5c-43b9-b749-10fba6e06228", "value": "db35ac48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c79576f-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796496, "uuid": "913a625d-e0ad-4678-add3-b78673b17542", "comment": "Malware payload", "value": "79935339f598c81ad47c3383688931ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796496, "uuid": "cf64b320-b2c2-459a-abe1-8b56e1ad9005", "comment": "Malware payload", "value": "1d7051ad6ad4f278e54651e289fb01c034261bdb3e366ccea8c55fa834979118", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796496, "uuid": "ae127f4f-62ab-497d-ae27-d30f82c4250f", "comment": "Malware payload", "value": "628121b966482da92ea599c74156e47abc4a3817", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796496, "uuid": "cbaf31c5-913d-4ac4-a1d3-6d418bc62da3", "comment": "Malware payload", "value": "97d50a8ad12ba1802ca97b16137092ff9ccd074672b976d3939348bb0f8c0abe9ec5070cedad0a331fc882987f9f12c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796496, "uuid": "7b0742b4-852e-4c68-9168-a7e95d8d3bae", "value": "1A6423B2CDA583F6DB6A3554CFF45C4F72BF4A223E594284E4EB505D0992483838BD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796496, "uuid": "16c42c56-1cf1-4326-869c-49fffa7cb0e9", "value": "6144:fQ5eSMYW4sL8Ute8pvc1aTv3TtP3zxZTpqnYExqow9FUTSI50q7LAj1cLXnJKCb:fQP5W4sL/te8FIGvlDxZQndtle4LXECb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796496, "uuid": "eaf9a9bc-f945-486c-a031-54684a201ce6", "value": 327998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796496, "uuid": "75913b64-bc9d-4e2a-a879-0f18d2dfb113", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796496, "uuid": "e3f96097-a2f7-42a9-926c-160e43c3fd93", "value": "79935339_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d715b7d-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621749817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749817, "uuid": "7ff22e00-9638-4b57-898e-eaa0b5d6cd2b", "comment": "Malware payload", "value": "f3dde9784d27f2f9d312d3a5c3eb813b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749817, "uuid": "de49f6ad-42ad-4d4a-9929-0cb997a707ca", "comment": "Malware payload", "value": "1dbaf4ef51f0be9f5630472bbac96788e2b18e500a0bd40084ad3a21557d438a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749817, "uuid": "aaa0c644-11b2-4e4b-b1a3-98286a77e566", "comment": "Malware payload", "value": "a9f245da270353f4c9f18b5f438616132a6106d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749817, "uuid": "f6cc8be6-6660-4283-bed7-23fe9de2c64a", "comment": "Malware payload", "value": "e6c1b58697d0fa60620c5f19d52833923eed4b1ce6076b4ba17c0465da8835190de699d23d96b076216904a0c695f7af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749817, "uuid": "d6fe344e-86a4-4f66-9627-6e6dd29b0aed", "value": "1B442386B5F45A69D519137B666B8FFE3D36F4E189F0333A0462B90F3C34662ED20198", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749817, "uuid": "44b84514-4503-42d4-8bc6-534aeef9a213", "value": "a47a8f374586a42b20d3b48a138e11e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749817, "uuid": "d3e7966a-be60-4d10-af8f-5293a79e0343", "value": "6144:PknN4CVUIm6uk06ZLYgvBA+8xmrxgmA+3cclptVopAWm8mZe:8nNhuBoY8SorxgmA+nlvVlcmZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749817, "uuid": "a454cf5a-916b-4d95-a08e-c1b6fef2f31a", "value": 270379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749817, "uuid": "411217a1-6522-4b53-91f4-8e45eb68d62f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749817, "uuid": "eef0a3ff-3490-4ed6-8c5c-a154c4b19240", "value": "TIMER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbaccf5-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742520, "uuid": "129db33d-ffaf-4945-a5a3-067e45eca970", "comment": "Malware payload (Dridex)", "value": "7abf36748bbe3ad571d49828df86ff38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742520, "uuid": "ad8107d3-a840-4e55-8870-06ed5d6ce6bc", "comment": "Malware payload (Dridex)", "value": "1dfcbf999f1daa9109a46c3e60f9aad3f59eb09049f0272c30367459b343e014", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742520, "uuid": "d395ea46-2c53-464a-a530-2b26c0dbb02b", "comment": "Malware payload (Dridex)", "value": "90c7cc93518e0b794572c913904a055cf079d2ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742520, "uuid": "2aaed9e9-5fa7-4f35-af79-9f65acbe5fdb", "comment": "Malware payload (Dridex)", "value": "eb018b8fe39add7e4a0feab2cefada35e3fdb0d4a86ab1e8bec6752adbd4097cdffe4dc82ab1a20ae2035e5fe69eac10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742520, "uuid": "228e11d4-ac37-47aa-ba68-9ae5874676fd", "value": "CDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742520, "uuid": "b9e73d6a-727f-426e-a53c-a1809c9edf07", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742520, "uuid": "247a11bc-6319-43b0-8ac5-982e89664d73", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742520, "uuid": "a4980bf4-5b37-49d1-8ceb-8f3a044c9da1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742520, "uuid": "8ce92d70-aaad-40f9-9ccf-1734b8d582fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742520, "uuid": "04d15efd-3551-41f5-8c15-7a5a735aa173", "value": "7abf3674_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ee7538-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796537, "uuid": "cd564e06-ca8c-42a7-af37-088212667be7", "comment": "Malware payload", "value": "2dc75d76accc0a8db68a80dcf895176b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796537, "uuid": "76162595-a98a-4b6e-8043-dc46a895ef87", "comment": "Malware payload", "value": "1f04ec23956163f27fe19d962cfea637dd481349c7263c445b867f14bcaba89b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796537, "uuid": "a945b25a-cc45-493d-8fef-f2456197bb49", "comment": "Malware payload", "value": "d301c1e33f7fbc9127e60d539b43b83bf38f3fb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796537, "uuid": "0fe8f96f-953d-4829-a79c-cad46419fbfa", "comment": "Malware payload", "value": "bdf86272fd3ff1de80d42e2bbc9443c278a19c834701ddc18fc5f4026663fb4d12ba7d99bfc835ee29730bc7b155add1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796537, "uuid": "2cdc30cf-aa02-4427-9f26-3880b312125d", "value": "19F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796537, "uuid": "b177d6b7-923e-46e2-a77f-d124d52c4c82", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796537, "uuid": "3d3d26a2-88a6-4d5d-928b-160d3ca53288", "value": "3072:fA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:f3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796537, "uuid": "4e4ba5b6-40d5-4f49-aafe-80633cd78983", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796537, "uuid": "097bb4be-5d59-47af-9880-7dbe6ec11571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796537, "uuid": "96e3a24d-963b-41a2-842e-cdea0d04bd4f", "value": "2dc75d76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727e0692-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760482, "uuid": "6a6bf7aa-70e7-4930-9e1b-d19ea3a513db", "comment": "Malware payload (Dridex)", "value": "e7baa6de4dde52154a32bc4225351779", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760482, "uuid": "85deabb2-4b57-4ca5-8221-dc4152e55736", "comment": "Malware payload (Dridex)", "value": "1f5ffac99bc63a84150a4a003780e3b536a7cf101bbf905d445bfa977dfc7f55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760482, "uuid": "001b8a41-9992-4626-aa09-7325525fdddb", "comment": "Malware payload (Dridex)", "value": "da8b0027edcef930af20078099eaa119d9077b39", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760482, "uuid": "02e3928e-6fd8-408b-a90b-6cccd923caef", "comment": "Malware payload (Dridex)", "value": "632a2cafcf0cd7984474acbba4c9b8e493d0e103b11fd05b367f9c994882a8c89548fb6e17762f6af0bb4c9d44a3bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760482, "uuid": "291166d5-3f23-4736-ac96-d872058ead83", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760482, "uuid": "260df9c1-4386-4ded-b72a-d4032b2fee2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760482, "uuid": "2a0499f7-f56f-4318-ad09-59df04c00751", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760482, "uuid": "bf6f7af6-3184-448b-9af4-0c1fb4894cc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760482, "uuid": "d42bba58-167e-4080-a772-20db6cb405ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760482, "uuid": "66c5eb60-4a74-4699-8946-84748c46d8cb", "value": "e7baa6de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115cc92a-bbf1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792961, "uuid": "444e19ba-9912-4317-9815-df09b2548dd6", "comment": "Malware payload", "value": "4e6ef968433f483735710977aa84aea0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792961, "uuid": "13a373d8-9be1-4c03-84e9-b67b9862d535", "comment": "Malware payload", "value": "1fc1640be4122a2b95746fcfb77769c1e9cd93b0c80e80c633f96f7a362be0db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792961, "uuid": "044acf12-c06c-47e3-8df8-40ce482f01ea", "comment": "Malware payload", "value": "284e7b0efaa2436d223fd770df9f35d03c170b56", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792961, "uuid": "f76661bf-0230-4029-8b8d-6b44cb28da4b", "comment": "Malware payload", "value": "19ac61394a32d10c6df2b16b29c7a296a85a1dae6a2df188ad636b8df0d6854c5433cacc7a6ffdde18e4fa7eb644b359", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792961, "uuid": "9bda9f58-52c3-4f5b-a3bd-11006e6b347f", "value": "CFF3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792961, "uuid": "66d2fe9a-6cba-41ad-a129-eebc4b5dc5f9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792961, "uuid": "c8449f41-dfbf-4f5b-94ef-c3c22585f4ad", "value": "3072:XA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:X3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792961, "uuid": "edb61e14-911c-46ef-b0d7-8ed61292478b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792961, "uuid": "730c88c5-c292-46e6-a739-da4e4f2634ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792961, "uuid": "35225d81-1a1a-4aae-9256-bc9fb80811a0", "value": "4e6ef968_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303038b5-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796449, "uuid": "3a04b711-1959-4847-8671-04a079e6bd42", "comment": "Malware payload", "value": "7a1695696368859452270d330d034288", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796449, "uuid": "379bff32-288e-4416-9efb-1113b487c0a7", "comment": "Malware payload", "value": "1fec98d8e85ee6fcfd38da7d908c1e474177744c5fed7cab6b6ea8d4a80e502b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796449, "uuid": "92ec6edb-f8e9-49e5-a370-3df7f88984d7", "comment": "Malware payload", "value": "d13e93c3939768fd25acbf6c1b3fe0d742aff9cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796449, "uuid": "5417be60-70d8-448a-8b44-aefab0d52e2b", "comment": "Malware payload", "value": "a6b4fbceda1ffa0ab8757388e0b691656311f948b79e99bb21c0290e50671dea70c401653948ca4227a11f88ffc73e51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796449, "uuid": "0204b1b6-8c85-4adc-a431-cecf6926851d", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796449, "uuid": "918db3cf-ae6a-4547-a466-7c692383bf33", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796449, "uuid": "8dbdcb03-169b-4322-b8cb-1daa4ed57806", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796449, "uuid": "3ec22242-2c9f-45d1-a0b0-3d955cf397c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796449, "uuid": "f1986eb8-d2c3-40c0-b692-b07a50c4abb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796449, "uuid": "7ec27891-efbf-4e04-83f9-2815753d8368", "value": "7a169569_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53382fd9-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796508, "uuid": "a9e76779-ebde-4156-a171-a9c567b488f3", "comment": "Malware payload", "value": "e43662c2894aff6bed7aaf3b11484eff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796508, "uuid": "3124087f-a2b0-427c-86ae-b5d17bdd6076", "comment": "Malware payload", "value": "2029acb1856f660afb9710e632dac7b198f5650bd7074c041d3c17a77efbc096", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796508, "uuid": "fb2141a8-3df7-47cd-965d-97a0ea9d155b", "comment": "Malware payload", "value": "8da72fd7571162c52aa21df834baf6759646c329", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796508, "uuid": "9044645b-6421-4ad7-9a6e-43873363d099", "comment": "Malware payload", "value": "86d1fccb9b7c3f9ddab3a66e7c4d2ea69c14e21eee7544b38e5144bde68685720a121d946663144e7dd26985c36b2f7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796508, "uuid": "7e6c9259-b05d-43fd-8942-bfc2c89d16e3", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796508, "uuid": "b2ee075a-3f64-423e-a9d1-1831e9566f1f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796508, "uuid": "78d0ddad-1d0b-4a6c-b9d2-1fe99c1da085", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796508, "uuid": "60a07637-3b9e-4385-8051-7b197917b09b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796508, "uuid": "3b83b8d0-c15f-456a-ad61-15a34b2efd36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796508, "uuid": "b5a11026-f0e9-408b-8775-bd4ff08e07d5", "value": "e43662c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c001c752-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771350, "uuid": "78be9deb-a335-4bf0-98bc-5e68ba418965", "comment": "Malware payload (Dridex)", "value": "79386ea8afde0d75dff77bf70e24ff0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771350, "uuid": "de4019d6-d3bc-4cf5-bd50-f718f9fcad77", "comment": "Malware payload (Dridex)", "value": "20532471fb9d066cd38de2f21b7cf36e8a5841b9b9de8db6f14df22182955706", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771350, "uuid": "baf38b7f-60cc-479b-9d2e-eff117af7bcc", "comment": "Malware payload (Dridex)", "value": "ed64e0d5157c6aa4d79ab78039b9816ad46dbbf2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771350, "uuid": "5fe8746a-ea24-47d2-b18d-5eac66fbf21e", "comment": "Malware payload (Dridex)", "value": "283c9dc927e751f342fd1d0dad29bce76a5a37596c1b4699e2a5971f7b4e8316068a0ef0d2cf5b9472233bfc99f4d07e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771350, "uuid": "33c916e6-e51a-4721-9266-c3e2df85f2e5", "value": "5EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771350, "uuid": "14f27d4b-abce-47a6-9222-37992ef6c120", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771350, "uuid": "d017aa7f-faac-4eb0-8bc5-5720d82d276e", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771350, "uuid": "46df9d23-7647-48d5-9854-5f649822acb2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771350, "uuid": "c82015e5-9748-4830-8252-446501d44487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771350, "uuid": "5b87e1b6-f1c7-411b-8bdc-f8c3c28680cc", "value": "79386ea8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7f3697-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621782033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782033, "uuid": "96ce7155-c074-4e8c-8f57-f0c73b81adf9", "comment": "Malware payload", "value": "314001b4a3dcaa6284d13e61fef35121", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782033, "uuid": "f0a85160-9f60-4441-a500-94bf9168da44", "comment": "Malware payload", "value": "20684fa294d9450bd4dcdd4fdab9c221fd775720148c79d2f21fab2120de0ae5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782033, "uuid": "a93404c8-6f15-4cde-802d-3eaeb55c5834", "comment": "Malware payload", "value": "c5bbd995d61eedbf4d36df3fccbf34e079c4b6b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782033, "uuid": "7dc73d3f-70f7-40ac-90ca-500706149df0", "comment": "Malware payload", "value": "d59d1265cf061b2db4008fc29107a2ce3ad92305c87189bc047933a4ea390ee11ba2e0757bae1ce1260f1bf4940f8ca5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782033, "uuid": "ba9430f2-6597-4e4f-b841-33ca29912045", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782033, "uuid": "22831bb6-b274-463d-83b3-d83ed357a0f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782033, "uuid": "60a24143-b2a8-49ac-b737-df3aaa8e88d7", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782033, "uuid": "debeb5ec-c4ae-4cb1-ad6d-007ee622034d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782033, "uuid": "be8cfe14-78ce-4e51-9fd8-6b4c02645281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782033, "uuid": "4997a2ac-6522-4faf-9c09-1da1053c4d17", "value": "314001b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cad7e8-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749667, "uuid": "e65abf0e-00fc-4d4e-91a0-95d4b89507e8", "comment": "Malware payload (Dridex)", "value": "01dcffed980b3649e9bca1e6c806f070", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749667, "uuid": "2c08f6fa-3ac5-4432-af85-ab6b26a4acec", "comment": "Malware payload (Dridex)", "value": "2078f297e2fd8a6f73dd43a68d813101942430c8debf414b19eeac05fcc5b5bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749667, "uuid": "717d7c58-35e0-45ab-a25c-fe5e581d9a0c", "comment": "Malware payload (Dridex)", "value": "be636d807aa9d74868aacbd5a3209bdc3205836f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749667, "uuid": "6e23bc2a-8a15-456b-b0d5-de58e2253171", "comment": "Malware payload (Dridex)", "value": "130061cd03302cba6421579c239da8898959e67bb83efb3fc6f7836034cf7f24ce192b3bf288280df8218c75ca921423", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749667, "uuid": "3959ab77-77e4-4ac7-a620-f578e8bb25eb", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749667, "uuid": "e904231c-d640-4bd0-8adc-e165fb0891d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749667, "uuid": "490452dc-2913-4734-86f5-d0100099ae8c", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749667, "uuid": "b04655d4-2a52-41db-880b-a56576a78006", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749667, "uuid": "6f3fe6ff-d885-46c4-bb13-711753b8a8f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749667, "uuid": "12fcd0bb-abb1-460f-ac06-33fd5eaf6d4b", "value": "01dcffed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a10e412-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796519, "uuid": "eb9c3d03-a6a6-45c5-bef2-09bbcd98f563", "comment": "Malware payload", "value": "868d31653722668a8d41cb920e933526", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796519, "uuid": "9f9bc847-e2ef-4e0d-be27-95d64d35377e", "comment": "Malware payload", "value": "21061e1cae42e661954ec1ef586c124218d5b6399f41639fcffef136535298a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796519, "uuid": "97a99775-2baf-4e61-a272-09ae92d9c9c1", "comment": "Malware payload", "value": "0d58ec4bf31f0334a463b5af76bed2568c23023c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796519, "uuid": "a58ce76e-a399-410e-8f90-361acb4e9b0d", "comment": "Malware payload", "value": "a0f45b45c76dc3fc4f13261ed98add3a7d9a85026fe8be89d2b1b57d45f9b84adc5de50e5872f049a7109aaf11b29907", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796519, "uuid": "567d5f3a-1d37-468f-b990-668acf2494e3", "value": "82F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796519, "uuid": "245f8977-7373-4464-90a5-39549ba38a77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796519, "uuid": "b3e252c7-a7d5-48a0-9e79-d72bab957266", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796519, "uuid": "f62cda56-24b8-4d08-a8d5-a9db41b17a0d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796519, "uuid": "dbd740b9-6199-4a82-a60c-7a7aa6686d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796519, "uuid": "e905d2a1-9f7c-4202-86cc-8cac2dfdc379", "value": "868d3165_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28c0529-bbd6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621781743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781743, "uuid": "a0cb51b0-dd83-4715-8c73-a01a783e62f8", "comment": "Malware payload (NanoCore)", "value": "10f697d3f0bd1656a58045faf093d2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781743, "uuid": "7fc7c9f9-8875-401c-9984-49f143945a74", "comment": "Malware payload (NanoCore)", "value": "211e24652cbe76de799a0748dd0643c94d0b6ea4702b1eecef3ec341aebfac31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781743, "uuid": "e2c21c16-d896-4d27-85e1-f3aaeb2d5cc9", "comment": "Malware payload (NanoCore)", "value": "3c45dd9c4c08e5f3546c2b9dd21187f66272b9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621781743, "uuid": "3e5b4a78-1d4b-49ef-904a-db00131f5b07", "comment": "Malware payload (NanoCore)", "value": "3a79a8b7db9a5addbd0ec52d60509843688946873daf365781a27cb9720145d107ebdc209349e261618eea9c4d3c2362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781743, "uuid": "c381cc7b-efee-406a-b2ee-9ad27816a17c", "value": "98C412A417119E2CCBAA93B5883169E363B52C131E56F27C0AD375D7ED31BE2C290B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781743, "uuid": "9975056a-e4eb-4e16-bfe8-633895039622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781743, "uuid": "f8769105-a9e0-4802-88db-ad847e1cc731", "value": "12288:i26YC8Li/TdBmtyz/qH/+4P92LX9vp6A2Zms/bAXKsoQ:f6n8IBmQqf+M92L9v9sUXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621781743, "uuid": "b8b6655a-fec6-497b-b6e1-93c5589e4902", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621781743, "uuid": "55c8a0bc-0754-4dbc-83d3-43c748b6c012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621781743, "uuid": "6c7c7dab-b358-41d1-9fac-d6c4c9c86320", "value": "10f697d3f0bd1656a58045faf093d2cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03977e1-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621751567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751567, "uuid": "0d9782ab-d6d0-4a76-9fc7-4549e68195bb", "comment": "Malware payload (ArkeiStealer)", "value": "d69ad8d2f432e57d4f5ecf5d7e7f9300", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751567, "uuid": "750e4cd8-7949-4b59-a965-5923a1acf831", "comment": "Malware payload (ArkeiStealer)", "value": "21415b4bd92f908e375ef73e62b8539724488e9372c6df980d91c01e47ebfd15", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751567, "uuid": "0bbc631e-ae70-48f2-94be-a39dd86f9f7f", "comment": "Malware payload (ArkeiStealer)", "value": "4db420d6dfc64506e6e8b71ff63e4b240f2a562c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751567, "uuid": "64de40fc-c8a9-4203-9b77-7e2214dc664a", "comment": "Malware payload (ArkeiStealer)", "value": "526ab5e68275d922fbfe7ff78398786838b9c9d343f58f41324502f91be16bc8b4a05720d71c4be09d586a94a4429760", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751567, "uuid": "1f0e2c48-f910-44dd-a386-fd3252a79366", "value": "4656337BB292843AC4A218301CDFA1B6F479B7648F74188F4BDA4E6D48336E55F36583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751567, "uuid": "de669dbe-d9db-4378-8657-8e8030108b96", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751567, "uuid": "7b378a01-7638-433d-b8c6-51ae7edc825b", "value": "196608:it8ocoSzMfJbTIiDOVcYtdkk+HiS8pamD:zoSiJbTIiDOVcYtdNs8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751567, "uuid": "c3c035be-d076-439a-abc6-1c58acf56d58", "value": 6356450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751567, "uuid": "2d682257-f10d-40dc-a678-570bdd84ea9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751567, "uuid": "fafcd1bf-0940-4a0c-ae65-156b14e351b4", "value": "d69ad8d2f432e57d4f5ecf5d7e7f9300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4bb38a-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807291, "uuid": "64417408-ce83-4861-bb2d-1b81eb049e2f", "comment": "Malware payload", "value": "63e7f665f672addb9ae58f79d6f71419", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807291, "uuid": "9344ccc9-2ea1-46d9-a6de-a5b443e3306e", "comment": "Malware payload", "value": "215dbd7342e654f6581f66727cbe4977741c0f774d40213728c8be21312d0c3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807291, "uuid": "969b76b3-cfa9-4f87-96c8-7ddaab9c3ca3", "comment": "Malware payload", "value": "dbd2a6168bdb5c881c25f81effce12658067428f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807291, "uuid": "e9558b8a-05c0-4c66-a2a0-79efe8ddccc5", "comment": "Malware payload", "value": "3190a454e9872b6de485ea5f2bf9a60d4e7bff5f5743f1be1dd9dfcc74e88b9e382d7eb9d6ad5d7b0e8a4bd070700b5f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807291, "uuid": "2b13fcf1-863d-47f6-b721-3d10d19f79de", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807291, "uuid": "7133890d-d7cf-4b74-8204-a516877c9af4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807291, "uuid": "30102a27-df08-470c-93f7-f8db21894255", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807291, "uuid": "b22ab634-58ae-49b3-8131-776e7b5d6b88", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807291, "uuid": "c7bcf839-ccac-44e7-b374-81cde263c505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807291, "uuid": "fc8d75d9-9a74-477b-9915-f1011e9deae3", "value": "63e7f665_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631fbd93-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778496, "uuid": "b45e17c2-fd75-4181-aa2a-1bd21b89220e", "comment": "Malware payload (Dridex)", "value": "09df4a9b4190775fc01459848d9e2f6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778496, "uuid": "ecf1f55a-2b96-44d2-8d15-eb0cd22a81ff", "comment": "Malware payload (Dridex)", "value": "21c3ed3c26457124488a059dee555e402b3fc47e0ba56550633868dab60179a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778496, "uuid": "60ab5187-dd47-464b-af6a-560e4517eddd", "comment": "Malware payload (Dridex)", "value": "23a155c514f9b6dca8f1ddb53ae65c941ea153a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778496, "uuid": "154fdee6-4a0a-4634-b43d-9a69324f3c0e", "comment": "Malware payload (Dridex)", "value": "abf7be3beecf528a83e480062c92062e40f35499481468dda639ff798ce16f69786e27a4749dec520761696a3f1f39e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778496, "uuid": "61c45c2e-a956-4f50-ae7c-5fd2f82f222d", "value": "3E04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778496, "uuid": "752a7c73-f029-4ce6-925b-f8dd0915aae2", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778496, "uuid": "39726ac6-1e49-4c2f-989b-b8044e954e6b", "value": "3072:2WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:2WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778496, "uuid": "03d22ff4-a4ea-4e96-8988-2cd4c4155724", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778496, "uuid": "4a5243bb-4a72-487c-81f9-36f7819edf30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778496, "uuid": "c67a0c09-97b3-4e1a-9940-a057634a779f", "value": "09df4a9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84101d13-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771249, "uuid": "5be7aaf6-2cb4-49b9-84d9-a177d685ec3d", "comment": "Malware payload (Dridex)", "value": "b3787a0db3f380b6a0ec1e53a1ca4626", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771249, "uuid": "511cbac1-f535-4791-8ddf-e95e81a4d835", "comment": "Malware payload (Dridex)", "value": "227e679b4452a647696e7acfd7fa6950fe3f83fc1d2faef86870d48e97740559", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771249, "uuid": "6944c3ef-2f55-4b39-95dc-e47cc951a4d1", "comment": "Malware payload (Dridex)", "value": "285cd347810211aca2ff51fa65b51bc0481d4869", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771249, "uuid": "d8c5b169-89c0-4573-8a18-af9a6748279a", "comment": "Malware payload (Dridex)", "value": "3af7313dd72b498df2b7edb9a2bef7c9e3266d05147b286e98314eadc2b343dce9fd67ca18756dd4a358cd94d895ec7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771249, "uuid": "b5fcdb58-6a28-47a7-97f0-083fa4b45ec1", "value": "CC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771249, "uuid": "092c3c71-44b1-4048-a864-3caeca12200c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771249, "uuid": "ea6a745c-465d-4318-8e22-4b314171c5f4", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771249, "uuid": "a8361f79-850d-4638-96b1-4980efe2955b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771249, "uuid": "3df040a1-aa24-4d73-adb2-dc900d5ba8a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771249, "uuid": "9dca9a7b-e51d-47ce-9d81-3a30a04981b5", "value": "b3787a0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7889c9-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767643, "uuid": "cc69cc3a-7f0a-4139-942e-cf3ca36bf356", "comment": "Malware payload (Dridex)", "value": "23b1a9e6e1d3a9b0b8b35b00d4aa59ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767643, "uuid": "e00ad635-7c13-4748-ab58-81245cd395a5", "comment": "Malware payload (Dridex)", "value": "230bd1ea8692cc50d6068b7841bb0132783e412f1602a24c949f713ca93e32e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767643, "uuid": "7921b25f-5822-4235-8b30-862d5bd59bd2", "comment": "Malware payload (Dridex)", "value": "0ff0979b27185b06ba8e58499d14100e681139ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767643, "uuid": "30c64457-6a6e-4a96-9478-5c6a1e48e425", "comment": "Malware payload (Dridex)", "value": "bdc6ce0258ca86436ed5a3db52212a7406f28411bbd06b794da6b66df8896771f58a9c42d26dec378d72c585e7bd7fae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767643, "uuid": "dc612593-147f-4904-901e-473cabe2472c", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767643, "uuid": "80ca560f-ee62-42f8-8af5-d02d97a7bade", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767643, "uuid": "78f4f68f-60fd-483d-afb8-52908ed5405e", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767643, "uuid": "877ce8e5-ef49-45cc-b8a0-277d479abc9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767643, "uuid": "12e2de3e-6dda-46ce-b170-9d7407101e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767643, "uuid": "26b48e37-8c64-4a50-ba01-321b2345e934", "value": "23b1a9e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b116901-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789273, "uuid": "b68a78be-afe7-4338-aabe-bb24b0ff353e", "comment": "Malware payload (Dridex)", "value": "39ec22683f2af49e8df21b75a46bbde2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789273, "uuid": "93cc17d5-64aa-4fa4-9154-61e0b9764fda", "comment": "Malware payload (Dridex)", "value": "2333f0b502c6295a3ae0835709fd4ad8fe7b22f00b96bf28fb6ca0630afb6a82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789273, "uuid": "98701bf3-950f-43a7-a3ed-16e7b0a02a13", "comment": "Malware payload (Dridex)", "value": "25a5d8adf7ff56cf1e2398b81111c31c74e88b46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789273, "uuid": "9308de4b-8a38-4f62-8f89-a5c4795f8864", "comment": "Malware payload (Dridex)", "value": "466e54e761a8ec678142a0226d032f48aec361020f6a579239e829d5649200d9643a8fa65b30f3b8a1c1b3660cd4a67c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789273, "uuid": "bb4a7e18-62d3-47ad-a97b-1b3df621f158", "value": "0DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789273, "uuid": "ef6456d2-ea69-4687-bfd7-7a891e7501e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789273, "uuid": "19b55d8c-52c6-49aa-bdd1-f797ee206403", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789273, "uuid": "8e0ae010-98bb-422f-bd8d-bd88fc969b2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789273, "uuid": "015dc04c-f58f-4311-9eb4-a42792059b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789273, "uuid": "7c7cebcc-b7b4-439f-9795-cb7b7c1b65cb", "value": "39ec2268_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f31070-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731653, "uuid": "f4328404-4a74-4ae9-98be-ae5fa2be6922", "comment": "Malware payload (Dridex)", "value": "134c7e31d1e7dda9373a306180430af7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731653, "uuid": "5cfa09e8-fa16-44c6-a7f0-72906e291a79", "comment": "Malware payload (Dridex)", "value": "23dd1a42cf3c53dfe0eab4c2c84456adf8d3daf4c453a7447b873eeb8a79d383", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731653, "uuid": "69d73e7a-24d6-4f69-b96e-f67fcabff1de", "comment": "Malware payload (Dridex)", "value": "486f167e0d948a56d195f14f38bb42ef5c7b9153", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731653, "uuid": "b84adfe2-3a02-4564-8653-74df1419b147", "comment": "Malware payload (Dridex)", "value": "0adc9636330810c8511cd5020ee68745c9436e43eff97fad752c685d6f3ea8323af650bb75d2541fbc9d5ec330218cc8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731653, "uuid": "f523887c-986a-4269-bd3d-35d11b4ec37c", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731653, "uuid": "6e1e0fdf-2d61-4aad-9745-18bebf2ae870", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731653, "uuid": "269bd41b-19bd-4947-884c-17992a50d9ce", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731653, "uuid": "5b273a88-d685-44e3-9767-dd33ce368448", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731653, "uuid": "a0a31cb7-864b-448c-a6d3-e2bc6c3290de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731653, "uuid": "50ff8229-4e93-4175-b57b-8d74cea5d1fa", "value": "134c7e31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc39f5d-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803637, "uuid": "d7cfa0aa-a2ca-40ee-b8f1-5e2d7d9f8fa5", "comment": "Malware payload", "value": "196cc57d6320b1ade3caf492a452c5b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803637, "uuid": "5f90bb20-1bb0-40f4-8384-b6bce3d6737a", "comment": "Malware payload", "value": "24b4463e84b3e295cd9ff32fbea284ef32995da49ce784cf5cda40d4d89c149d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803637, "uuid": "f8d98419-1502-4990-a62b-af8a5d4719bc", "comment": "Malware payload", "value": "88b7754ec3d899adb7ee473e73ef635388d75f92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803637, "uuid": "e89fc8aa-e05a-4b80-96df-4e73731ebf99", "comment": "Malware payload", "value": "45aa6b98c7bbcb579cbb68d7ccf1537304191d1f7a59dbc0eb9a14661b975fe9e72620a92749b6adb5af43d12e9dfd10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803637, "uuid": "dacc0cf0-c4ab-4fee-9e2d-ada1d49852da", "value": "5EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803637, "uuid": "0f84dece-2593-4042-afe7-89a71d1e64d1", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803637, "uuid": "f51684db-b801-4b39-a556-7620cf1fd2c3", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803637, "uuid": "2adbfe3e-9b9c-4e76-90f4-86a833d6353d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803637, "uuid": "e04da420-c4d1-4a95-b6f6-e01d099cba29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803637, "uuid": "97c1691d-2586-4710-a8e1-94a9200119e2", "value": "196cc57d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e109957-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753254, "uuid": "ab5b7bc4-32fc-471b-8483-16d65e2fe6c0", "comment": "Malware payload (Dridex)", "value": "33f3e9f0c3cdd83555450f549ec545c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753254, "uuid": "91f1d023-2e7e-4753-b3e0-b1a80baca630", "comment": "Malware payload (Dridex)", "value": "25c86eba176dc17f3c68e271115cea8ff48fbef4763864a5589f3d6e6be8fcc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753254, "uuid": "0d172e0f-486a-4405-9e2b-b9f2910c93d0", "comment": "Malware payload (Dridex)", "value": "c1851e0135d644318d177d40dd6a9b65e5cfd498", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753254, "uuid": "e93b54bf-0bac-4bfa-9fd9-1d1ae5d8282c", "comment": "Malware payload (Dridex)", "value": "82fd9bf167aa574ed1a0a83d26a614e8aa465efa68de74edf9cb7474df8fb96b8f0f276c1d469edcf9bd9a1b2427bfb8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753254, "uuid": "cacd0a41-c0c7-4866-8dde-df01fb7368b9", "value": "41F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753254, "uuid": "8f781010-7539-43a6-9290-559436f7cca8", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753254, "uuid": "15dd7c19-8451-4843-83f2-98bb3ac22abf", "value": "3072:b9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:b9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753254, "uuid": "ace4f2f1-b75e-443e-8bd5-f9f2d1eb79da", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753254, "uuid": "90cc6590-4c7e-4b04-88cb-564b3850eda7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753254, "uuid": "5f92de28-905c-43d3-a108-85c40586cae2", "value": "33f3e9f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56a7994-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800108, "uuid": "da57f434-6631-4937-b7d5-4423f3b3fb0b", "comment": "Malware payload", "value": "4abd9c60f0709911c9e36ae1bd475dc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800108, "uuid": "72b0ce6a-d342-480c-8513-cb7dc0d837e7", "comment": "Malware payload", "value": "26402410baa3b7736ddc11764c7f49efa4829b7f78b56567a9d423f1e3f76c86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800108, "uuid": "be08fff9-fab2-44d4-b249-6d2173175b7b", "comment": "Malware payload", "value": "c51e971722abc359712af6b4b643765cedbcd782", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800108, "uuid": "90d75688-e1f7-403a-a106-d90fb49a2cf2", "comment": "Malware payload", "value": "e9b49a274c57ca4a478c8f54b458772cc914818a8c34581da20fce9defb0f3c85251c95070a5a3b8502ccd207286c789", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800108, "uuid": "9c9fec0e-b458-4c83-a374-d52118a4a9e7", "value": "D3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800108, "uuid": "f7015c1e-eae5-47d7-9622-e6fafe784a57", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800108, "uuid": "671e989c-a14b-49e7-9947-09bc5a4dd0b5", "value": "3072:sA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:s3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800108, "uuid": "b786432a-36db-4121-8aef-a85bb15fd20f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800108, "uuid": "37546b01-5ee9-49a4-821f-2e9591ab1ab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800108, "uuid": "b3e2b211-5dd1-4711-a98e-686ae23320cf", "value": "4abd9c60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8810eead-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789295, "uuid": "37c6ea8c-468e-4510-8e85-704df4ed7bed", "comment": "Malware payload (Dridex)", "value": "ac0ae4f7c1c9d73bacd019aa84db4bd7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789295, "uuid": "66cdfeeb-9214-4b89-9b20-9a7a8770a9ca", "comment": "Malware payload (Dridex)", "value": "268a2a33081cbf96c7fd1ed6d24f0545012df16aacbf0610731a10c8663bef74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789295, "uuid": "6865eef1-dcff-455c-99e1-e77701118e01", "comment": "Malware payload (Dridex)", "value": "f2dd7f72aa8637723e682b5866d59b79ab960669", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789295, "uuid": "9d101b13-0e5d-4d12-b599-dc867189d7fc", "comment": "Malware payload (Dridex)", "value": "b5c16a68a629b1f23ef81fa3683df170496e80d9bc0111499f8ae9804a7f8d925f1809c476b2f076a405f577c0cbfd05", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789295, "uuid": "ce967dd4-b19e-407e-9cc0-a919b93c5532", "value": "75F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789295, "uuid": "fe32877e-72e3-4676-8e6b-8b24580b959d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789295, "uuid": "9be26534-98ab-4db9-8b5f-f466a4a51b1c", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789295, "uuid": "4ee86520-1bd4-426f-96c6-f2a54dfee041", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789295, "uuid": "4b7ea887-97e5-473a-815f-7f31b20f66a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789295, "uuid": "5e02598e-995f-49dc-9bf8-9e7bcca0d731", "value": "ac0ae4f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875da4d0-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1621760517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760517, "uuid": "55a03ac1-7069-47c7-b209-d5a0a90a5642", "comment": "Malware payload (CoinMiner)", "value": "e95dd2dbc9d657c1dc4671b8571f1fe8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760517, "uuid": "0adf746a-49e4-4c6f-a2fd-b9ea6dd23af4", "comment": "Malware payload (CoinMiner)", "value": "270b543084ea839fe36a7b31bf1f38947fe95364d6762ba2dc29eddc91221320", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760517, "uuid": "9a6abbb7-a26b-452f-98a0-3ae56eba3a9b", "comment": "Malware payload (CoinMiner)", "value": "4222ba0b0fbd00f999bbb94b859c17e9b6b519c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760517, "uuid": "04421cc5-663a-4317-b52d-841420d83ccb", "comment": "Malware payload (CoinMiner)", "value": "94d3e4b1ece52410bc1613de499d257d328b7241da1773da9a719ab58a6da36dad04a392a958b8997f504573a6e5b211", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760517, "uuid": "f01179fa-ee63-4dea-8ae4-eab6c1d7f0b3", "value": "E0A533E17C6A381ADEA391E19468C31DD745F8DAFA47989232405ACFF5DC2A50CF0E63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760517, "uuid": "31688e01-da23-4777-ba3b-91fbbfc21a3b", "value": "49152:DTyYk6bn7JsP/vwf3V0KPDmSlhGkmwUtN072O8BTNs4wr:DG6bqP/vWmSrL1UC72nG4wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760517, "uuid": "96dfcbec-0d36-4292-8f1e-064674585b02", "value": 2208756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760517, "uuid": "894877de-5ac6-4c21-984d-0c233b8f7984", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760517, "uuid": "4659893d-101c-4473-ac51-d81814014254", "value": "e95dd2db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caf9818-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767720, "uuid": "280ad069-41c5-4500-90c9-1f148491beab", "comment": "Malware payload (Dridex)", "value": "890250719ad8141eb0805fea99492be8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767720, "uuid": "82c5f129-e6a0-4319-8fbe-22492aae30cc", "comment": "Malware payload (Dridex)", "value": "275af50f7179def5b0632c156121c912b2d8750574e6dffeee0a3004823b1e33", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767720, "uuid": "5ae8539e-3636-4ae1-bc29-bfbca4a3b0a6", "comment": "Malware payload (Dridex)", "value": "1d813f27bd47eaf3288bae618a01b453310c8e2e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767720, "uuid": "84537f29-0bbb-4038-923f-bd6270e5c636", "comment": "Malware payload (Dridex)", "value": "9db248778cae85c62580acec26641c763af00be5740d358049896f7b4c6a97288fb425d3a6b4cdff794343fc1056c058", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767720, "uuid": "2569c7cf-afe7-4ad4-81f9-606dd047779e", "value": "0FF3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767720, "uuid": "7365dff5-217d-44c7-bf0a-cc8458a26008", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767720, "uuid": "b98446b2-0af4-477e-b2e3-598d2ae458b2", "value": "3072:H9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:H9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767720, "uuid": "6709e163-6d03-4207-8864-49c50856baae", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767720, "uuid": "4c80749e-7575-41fc-9b56-162b216e0f85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767720, "uuid": "887f66ae-588b-4707-b51f-8eee6da41c78", "value": "89025071_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3852484-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782066, "uuid": "d9f0cd79-b487-4986-b6c0-5177d9e4de5d", "comment": "Malware payload (Dridex)", "value": "beb83a80e596c97023c0097cdb04f595", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782066, "uuid": "3a01d0f2-4278-432d-9bee-1684c0512839", "comment": "Malware payload (Dridex)", "value": "278645a912b4d7ed77cf71d3ad0720fe69d641bd8db6dba9895cceda99542491", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782066, "uuid": "32731b07-1d03-461a-b168-acc45f72ec97", "comment": "Malware payload (Dridex)", "value": "ed5b421a45b9ce2cbb742c80546421b86c6b751a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782066, "uuid": "561c399e-451c-410a-a4a2-d2ce76088be8", "comment": "Malware payload (Dridex)", "value": "f0856be8b5ab8ba18c2c12a99c74c8c1e55d8fbb7c5210dcf325aa427730a2ccb4bf7f60fff8eaad0718af87d72e2a64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782066, "uuid": "37b30d4b-eee1-48f9-ae48-abbf2271c90c", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782066, "uuid": "6093eed2-e6cd-4699-b39e-ea6616c0b79f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782066, "uuid": "e8c0feb2-87cd-42d0-bd8e-a6144d41b627", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782066, "uuid": "73b45b07-49a9-47bd-98b5-d52e61bf596f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782066, "uuid": "f069e7a5-ac3e-4382-988a-9b4ce29aa503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782066, "uuid": "c803f3b6-ec07-4873-92d8-47a7c57add56", "value": "beb83a80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33161d65-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749639, "uuid": "e075a447-507e-4ea8-a0cc-528d0ea012eb", "comment": "Malware payload (Dridex)", "value": "1982767fc89466ddc6cd71e0c776333b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749639, "uuid": "507e7abf-456e-4931-a1a0-24a46e908d7a", "comment": "Malware payload (Dridex)", "value": "280bed62a37a91c9ddaa171c4b91e18f29595b82eeb2b79118490a86faf86bc0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749639, "uuid": "59408acb-9193-45ad-bdc5-4447260290d8", "comment": "Malware payload (Dridex)", "value": "2cf624a0f96b9fd42b9d4cda8b9bacf375565094", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749639, "uuid": "2c2ae1e4-ecf9-420b-9190-a82c90917a05", "comment": "Malware payload (Dridex)", "value": "efec8980586f698c86506ba8c5ff5e112869e624365b989cf848e14079376fce03c06872ee6d927fa8d74581e72eee9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749639, "uuid": "972e5cdc-933b-42de-82a1-b132e3bc24ff", "value": "0AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749639, "uuid": "e41df071-2a89-4ddc-b950-f9843f4823fe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749639, "uuid": "8f5834a7-6549-4d3e-baa1-3c3fba6cac4a", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749639, "uuid": "73b475ac-919c-40a4-96bd-e014ca3e022b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749639, "uuid": "5ca8ba60-bb48-4525-be55-3be07f4b618c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749639, "uuid": "efd989da-e7d3-4a23-be26-b5ca785c2868", "value": "1982767f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ac8595-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756911, "uuid": "10a37363-9a94-4d68-8081-af80513d2234", "comment": "Malware payload (Dridex)", "value": "28c76867d7e428a7cd935e0a8b9d7515", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756911, "uuid": "8bb64883-cb4c-4e6a-b9db-df9c2705a180", "comment": "Malware payload (Dridex)", "value": "282f7b081d9a82f9785768a9564e8a3bf4c43783f1ccc64b6515b24e0322aa74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756911, "uuid": "3336fcbc-7da1-456e-a252-3933228cacfb", "comment": "Malware payload (Dridex)", "value": "bfbdce0c61fb25a4c73d003cd192413f80500453", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756911, "uuid": "3ece82b1-9549-4c42-8a12-85900b5e427a", "comment": "Malware payload (Dridex)", "value": "9769f3740e3a3541f1c7c4af6bd5305c773881156f503d9e37c68f839f4529f2deed83afd338044ddeae6873f6bc75dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756911, "uuid": "89cacf22-4b87-4d1f-89c7-25d3caf92560", "value": "3DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756911, "uuid": "b27605bc-6a6b-4dcc-bb69-bec77e416239", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756911, "uuid": "6b5ad151-fc51-419e-acfa-f88fa7397f91", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756911, "uuid": "466b1a7a-bdd9-4410-9f9a-d017c8e519b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756911, "uuid": "e696633b-68a2-46d7-9724-eef1107a5ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756911, "uuid": "c5fc91ff-c128-4a28-988e-6c927ac1c016", "value": "28c76867_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e9eb08-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738929, "uuid": "8b470d90-7af3-4c2f-9075-9e26707e1e07", "comment": "Malware payload (Dridex)", "value": "312d32a0756e5f68346f76343bf88faf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738929, "uuid": "ea8631bf-80e5-4fa6-bce4-710dd098c600", "comment": "Malware payload (Dridex)", "value": "287d6b02d2e7cb730eeb2f15fdf8ba5ba84713e4bb8c9352bf6b24bac8cc2c10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738929, "uuid": "513265c9-f1fc-4706-93bd-f713b6f08022", "comment": "Malware payload (Dridex)", "value": "5035b01868fd1162ba2e292323d58ed85876cef6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738929, "uuid": "b0933295-ed95-4987-ac4a-634911d8db97", "comment": "Malware payload (Dridex)", "value": "2bf6daeb2a9f3c8a3b6d31966c52ade7b1f6107e47df3754adec6ff1b3ab8acfc86f45fcea6c1706039ce28f33728ed6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738929, "uuid": "aa2b88c7-450a-4ed6-8ece-4a252594459a", "value": "3504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738929, "uuid": "1fbc0958-642c-4017-8d97-e5000e480dca", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738929, "uuid": "c3a07519-bf27-42ce-b756-a0aa7aeddd1c", "value": "3072:oWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:oWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738929, "uuid": "b1ab4664-a2f3-475a-9710-b9cfb64ed63e", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738929, "uuid": "3fe71a10-43f6-43df-80be-aecc7af1958a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738929, "uuid": "7fbf2d83-b9a3-41ca-81dc-1aa77086f961", "value": "312d32a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681b667e-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731689, "uuid": "debf166c-728c-4047-aafa-89b4fc8d1bee", "comment": "Malware payload (Dridex)", "value": "3be30246afd6c4bd6013d8921698e78c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731689, "uuid": "bc95739a-25b7-45a5-9d3e-bb9cd895436e", "comment": "Malware payload (Dridex)", "value": "2926543e668be07119625cc360d2ba3c4c291b7c90fe6785e6e410c993dd8bda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731689, "uuid": "23fbf093-6519-4eb4-b78c-5393fd9d7083", "comment": "Malware payload (Dridex)", "value": "485b30f391698df9d6454dd9960a75a292737aaa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731689, "uuid": "3232dc4f-a3a7-4217-ae23-c6c6c32aeb4e", "comment": "Malware payload (Dridex)", "value": "f53d4b45f614a1df9f02ff146c96523ad6fd3b5577a10ca1ddee318e97b58f9ad3dd29597335f55381a909279530abb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731689, "uuid": "116fa83e-0331-402e-8d37-680437928a18", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731689, "uuid": "9ab45329-f243-4abd-9514-2cd61bf01eb5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731689, "uuid": "e405f8f6-1133-4b0c-be3b-b37a65df4a5c", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731689, "uuid": "2728d3d7-95d5-4273-810b-995061585b5a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731689, "uuid": "fea42a6b-699f-4273-b23f-ca494a0f3e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731689, "uuid": "2f9583f4-a800-43f2-b448-183c9982f1b9", "value": "3be30246_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac9381c-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767664, "uuid": "fe93e787-a9ae-4296-9068-a9885de1d6eb", "comment": "Malware payload (Dridex)", "value": "cb2c75c06a67e991c9e5aa5a1d5c98e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767664, "uuid": "fe00917d-24e1-42de-b2b7-2d8baccb8185", "comment": "Malware payload (Dridex)", "value": "29cf05fa0f46b28e5b3dd14318a22ee38be0d4dc34e9ea343a8a6ea990fb1892", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767664, "uuid": "85c1cec3-55b2-488a-97ab-a401198c5987", "comment": "Malware payload (Dridex)", "value": "c7e01677ddf52d1cf17117a972e4cb905af48d1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767664, "uuid": "5d084b98-4fcb-4777-a4e7-b3b4eb88c794", "comment": "Malware payload (Dridex)", "value": "6a1aa5138c7c8d3050977f1a1b73007cfc00df51010362b0a62669c6d464ec55831a992805946dac4c83a4c67f1f49c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767664, "uuid": "eb62d72b-aac2-40bb-8449-522623f0a5b6", "value": "06F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767664, "uuid": "53eb1205-dd1b-4916-a540-b23c10c31e9e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767664, "uuid": "0cf534f3-2320-4889-b9bf-a520661e6e45", "value": "3072:cA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:c3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767664, "uuid": "48dc7fe0-83bd-4d53-bda6-d959582de672", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767664, "uuid": "4b6b8b7b-6562-447b-8c68-be3fec40bfa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767664, "uuid": "fd2d1e40-2320-43d6-96da-2e4cf433640b", "value": "cb2c75c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fbcd03-bb79-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621741560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621741560, "uuid": "a5c6b1cf-d8aa-4f35-928d-aa4eaac7be9e", "comment": "Malware payload (RedLineStealer)", "value": "a0c8562bc34f48e12d02611bd815eb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621741560, "uuid": "7d96c737-d5df-4685-9fec-0d2cb89bb8f5", "comment": "Malware payload (RedLineStealer)", "value": "29e852d6a556df006e46464f0b601724a91d72909ac519d0d013c3bd9a6c6bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621741560, "uuid": "2427b30d-83b3-4b88-91df-e3b5a0b7b757", "comment": "Malware payload (RedLineStealer)", "value": "c865260efcc21b6d67b303b977bac8835423d27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621741560, "uuid": "3e3d08ff-a59f-40b8-9b89-4ca923879f23", "comment": "Malware payload (RedLineStealer)", "value": "d6db9273c75870d6b964b59287c65fc39088ed389ed2d6831658508d15db696c51b72f84e0ab220168a5bb0170a7f42c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621741560, "uuid": "9ebccb3c-5287-4ad4-b4cb-8a2da50173d1", "value": "4C14B55437F19BB2C2AC8B3864BA12153734D50DBAC7F31789941A3E2DE6BA71CB9053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621741560, "uuid": "2b021d3c-749b-41a4-a4c6-51cf6c9c6a96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621741560, "uuid": "1440267d-4798-4c0f-8269-d1ebcdd75018", "value": "3072:0BDnH2PLjc8ixxvpEOhSzBr/IEMXvAadV3/aQ7Z6gTwsyXwJpjHIYX:0BOcR5oNrgDv13/aQ7bwsyXwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621741560, "uuid": "3a4ef2cb-2c38-42f2-963e-2adae5d8df9f", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621741560, "uuid": "1368a80f-0bb3-41bb-bb18-a326948602b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621741560, "uuid": "6d473529-8a13-4c05-8e1e-2a576a3e345f", "value": "a0c8562bc34f48e12d02611bd815eb08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e3da90-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749749, "uuid": "754e4f85-c191-4327-81b9-cb0521880e4a", "comment": "Malware payload (Dridex)", "value": "02430c72b6a67d6d5f08675153e3206b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749749, "uuid": "d8f71a0b-f69c-4681-8a5b-a29bb1e6d675", "comment": "Malware payload (Dridex)", "value": "2ab8cbbf15a04f5aabb7e28945a9d24c5013d8236d15982eb307f8552ca354c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749749, "uuid": "e7606094-0101-42cd-b1aa-4e2961f4e2e0", "comment": "Malware payload (Dridex)", "value": "f190e413894eb6ba0192f4ad40e3382e67bcf6ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749749, "uuid": "8db6c35a-9424-499e-918f-963fedf9c5cd", "comment": "Malware payload (Dridex)", "value": "c261796f3f46c85c4641c11c23f990c78809f182aad9e9e84f1b68593406bb26ddd1e2c8f1560b3322b920df977fbcd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749749, "uuid": "b5d9a602-3516-4c0f-b561-7f36887551d3", "value": "D2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749749, "uuid": "5a366c87-4a73-4742-9f71-85e0038d89c8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749749, "uuid": "57795f60-dff7-46bc-96fe-3ee7842b3ac8", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749749, "uuid": "81f92d5e-51db-4b0c-be05-a1d42398c285", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749749, "uuid": "4d3307ca-7305-41c5-bc8c-be2804cd1f0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749749, "uuid": "c5f1f255-e67c-4fe2-8813-e7a3cd9be7ce", "value": "02430c72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f050ec-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803713, "uuid": "4a183914-42ed-41dc-9f93-23e6a584c087", "comment": "Malware payload", "value": "2693e8d5db9e46602e85ffe7b4f54447", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803713, "uuid": "f6893069-76ca-4292-afc1-13d13f3a52d7", "comment": "Malware payload", "value": "2ad087eec80297debcc67aeb6e06a006b79e3bf12327d2698630856fde4cb9ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803713, "uuid": "4e50c250-513b-493f-91aa-6e195d82bfce", "comment": "Malware payload", "value": "fe69dcca379c5f25c206d32d63ff6dfefea6dd2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803713, "uuid": "953ddf18-c94f-4a97-9eba-89d08c26bd4a", "comment": "Malware payload", "value": "621ac4cd841a63a185eb23775f2d3824c8348005647c62eb4ba26e4cc8f478cf64b721c78240a45f3f95703e9e91d862", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803713, "uuid": "2096e52a-6f32-4c48-a17d-7e8cc4e1f0d9", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803713, "uuid": "7875e78c-0f8a-4d3b-aec5-40b8eb83d784", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803713, "uuid": "e3a8d442-2d71-4dac-b67f-b380a30ccb12", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803713, "uuid": "850ff3d8-88ab-4144-88ae-a1478d18a8a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803713, "uuid": "3af639db-0a77-4948-8a1c-bf1d8ee3c040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803713, "uuid": "7575624b-721b-4d8f-ae71-80c414554c5d", "value": "2693e8d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a507f-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803745, "uuid": "8b0cfc6b-4daa-4e74-a808-42e010e91517", "comment": "Malware payload", "value": "8e12275243a2dae7de59add4429e7caf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803745, "uuid": "7acbaf96-0054-4e48-86c5-40e0bf4dd324", "comment": "Malware payload", "value": "2b0f196feda9aeb120b2fcbc612f825c2fb9ee82a0e588992ffdcc35fdbce02c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803745, "uuid": "a3d3f9dd-9ab0-4ee3-9577-9b94aba26d11", "comment": "Malware payload", "value": "2b9ca56959fd3dea7651a64502469ec7ecb48a10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803745, "uuid": "af6da8a2-669d-43a2-b74a-1e11cd121cf9", "comment": "Malware payload", "value": "d09a5e15c4d065fd74f56a3300014c56ddf9b8f7950cb47f174dbb1f5958f5d59c5562ac887a4ed176299c1beb4bbf97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803745, "uuid": "a1d1b060-60ed-4e92-bc2a-55064fae67b5", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803745, "uuid": "1d4c0b63-a588-4662-8221-29080e2853e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803745, "uuid": "fcf39b19-5b55-4181-bc9e-7a84a020e189", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803745, "uuid": "d91acbf9-c527-4060-9c90-fc518fc4f40a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803745, "uuid": "c5b909f1-0df6-4340-92ea-c6163e0cc89d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803745, "uuid": "e9b9c2ac-c378-47ef-ad64-2f9835011f60", "value": "8e122752_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81162dd4-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771244, "uuid": "36b003e2-b1a5-43f7-bba0-6fcadc3321c7", "comment": "Malware payload (Dridex)", "value": "b6e8970cbbb06f05b0115b05a38fb03e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771244, "uuid": "c6d0e106-348c-4922-b1b1-13995e9c76ed", "comment": "Malware payload (Dridex)", "value": "2bfcda389f8baa083ce0f98cd9c24e39416e74ae2d81e4afa9e745101288944f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771244, "uuid": "d9adb715-7e48-4b41-aaf0-c739fca32fef", "comment": "Malware payload (Dridex)", "value": "e119d77fc212decbf48b0b91b9fc76658b3a0cee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771244, "uuid": "4dac46ec-6f1b-429a-bee8-903b45775707", "comment": "Malware payload (Dridex)", "value": "ed99012e97841058dbb637b5849570f1f77a984d7eb6b1537de4d29ec051fecff53ed26db173824f973a147fecd25750", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771244, "uuid": "15c1a782-a77e-4611-a99b-a37a2fa7ed2c", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771244, "uuid": "6d8e7251-90c1-442e-9a6c-da51cda7d8bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771244, "uuid": "b57fa8c6-f527-485f-af8e-43c376f4ca47", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771244, "uuid": "cb14815c-29f7-47f4-9480-f1df0f8b6dee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771244, "uuid": "6856b654-d746-487e-925b-b7e94d5bb652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771244, "uuid": "31299f8b-b9f6-4a1a-b40c-5140e98d9deb", "value": "b6e8970c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb0a862-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735299, "uuid": "193af4aa-ab83-488e-a46e-a2699e4cdb02", "comment": "Malware payload (Dridex)", "value": "406628f5507389ebe3f0e8872de736f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735299, "uuid": "29bc89f1-3451-46bc-946a-96e434881c74", "comment": "Malware payload (Dridex)", "value": "2cb3dacff1c5f204242472ec34f69e0cf8b073d96a77b640036b2ab60ef9d425", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735299, "uuid": "f2cc9e50-d178-4b07-ad32-8a09af312ea3", "comment": "Malware payload (Dridex)", "value": "97384ee42a3db5c6081f86af661b9306df4e0315", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735299, "uuid": "eddff6bd-bf44-4bb6-9edf-b52ba96263ef", "comment": "Malware payload (Dridex)", "value": "e7beed11e9169198a5fa83a833d9c73695ab3f1fd114062d520b4fd05bc5b3058cdd0f15d53a054a457da72d8ee0320f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735299, "uuid": "1534cc09-1c8c-43ca-97ce-5d911e586076", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735299, "uuid": "17b8a3b8-8fb8-421e-8c50-1e74fafa0cec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735299, "uuid": "72773ee0-fe77-4c7c-b32f-2b77263fa779", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735299, "uuid": "1237c2c7-ffbf-4b2e-800a-5341bf5f5d15", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735299, "uuid": "c22e1893-56b8-49e3-a3ba-0b760a723bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735299, "uuid": "3128977d-56a1-4f05-b7a8-e8438e2df66e", "value": "406628f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b29208c-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728097, "uuid": "bd0ee999-6c67-4c53-b4a6-3b9cbb63998b", "comment": "Malware payload (Dridex)", "value": "f4f63e43fae833f2507600135f9fe298", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728097, "uuid": "b0d5ded9-6626-424b-84ae-923ebed879f4", "comment": "Malware payload (Dridex)", "value": "2d85ecb74aa8eb9d0b56ff0125444bb2cdf0fa4c515197d39676d10365767df1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728097, "uuid": "e8b637a3-c877-42af-8a29-5053df170111", "comment": "Malware payload (Dridex)", "value": "ebe4ce4e69e8feddc0e4039db266eebf77f32a0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728097, "uuid": "300ccfc9-6a01-4766-b0b0-58c470ed4998", "comment": "Malware payload (Dridex)", "value": "c9ff455ee7b7343cbd8c837413a28d02a08e6462c945e59400465310714280cd5ade365fb707c62f5f7e4e158d524fe9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728097, "uuid": "627f3a05-1483-40d4-b5ff-0adafb4ec3c2", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728097, "uuid": "5a8a8e79-4bc4-4491-b3dd-3aab0e0e01a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728097, "uuid": "4007afff-b635-419a-8295-7d0eec27d3da", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728097, "uuid": "b3083322-cdc1-4df2-9d40-6dbf463a584a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728097, "uuid": "81a2317d-8bb3-44c8-b017-ef2d6b45061c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728097, "uuid": "0ccd51fe-bd40-426b-86c0-6aa2ac577dd6", "value": "f4f63e43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a2618d-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803708, "uuid": "cb64c284-30e4-466d-b317-e45cc4f57d73", "comment": "Malware payload", "value": "20a67cb7ff416617f28264e97b5151df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803708, "uuid": "c7d0a813-266b-4e80-8240-e2156220f29a", "comment": "Malware payload", "value": "2dba9e1b2062e185fb8283e0c4fec6216e0c5319361ac50117e437cd48c1f11c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803708, "uuid": "f379e4a6-8751-4dd4-923d-4d6017bae6d6", "comment": "Malware payload", "value": "378e3f405ef874835dae781a1a9bcf1c0dde564d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803708, "uuid": "461389ac-8153-4c88-ac54-67948da1ddcb", "comment": "Malware payload", "value": "5f760c757e81c81cb176796cfcfabd49e5285c7d9eb27c2b46f9d1fa615a86c0c2aba68b7d0f8e8b0a840e6f6e5bfba1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803708, "uuid": "7be4eff6-bfc1-4181-9689-190998407704", "value": "9BF3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803708, "uuid": "2a36536a-19cf-4a67-9673-d986100045a8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803708, "uuid": "b8c38c67-3ef6-4186-9b79-35897c09b92f", "value": "3072:rIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803708, "uuid": "607f3a33-23ab-4bdb-a456-542e3b5fb404", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803708, "uuid": "9861bbb0-43a8-4eb0-9e13-48edf0128a35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803708, "uuid": "eb2d27d2-5100-4dd6-8306-bb583362f7ea", "value": "20a67cb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab93c17-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789326, "uuid": "6bb50cca-4aa6-4e40-bf64-b950454ff138", "comment": "Malware payload (Dridex)", "value": "e7c5970d888061c4d1c7d679ac671816", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789326, "uuid": "7b460397-d996-420b-a1ce-1c0a5d7d5280", "comment": "Malware payload (Dridex)", "value": "2ed862d23865e49e041c7192d72190d6a912f5ad2e5afb3dc5fcafd594778f59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789326, "uuid": "258e9f8c-4250-4a48-8303-644e5ab72929", "comment": "Malware payload (Dridex)", "value": "8a894dfc4a426fe47218e9b992a30fd45fec839d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789326, "uuid": "8631bedd-3860-4c4c-87c9-15177387749d", "comment": "Malware payload (Dridex)", "value": "10893dc0c90041f69141c30a340fda42c0e37e18474c42feb8c3f510612c0d3ec2ddb7543ab61cace034844e2140a56d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789326, "uuid": "beaa5c2e-7e5b-4f1c-8cd3-8acc22b57cbc", "value": "DEF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789326, "uuid": "eb6e632a-7c21-4e4c-b445-a1573351659d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789326, "uuid": "03e02b9e-ec25-4b16-b806-e13c8e93bcf6", "value": "3072:sIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789326, "uuid": "13d3f1f3-e5ed-406b-881b-1bdaca01a240", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789326, "uuid": "68c8d94d-16ee-40b6-bb25-a81c991b52e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789326, "uuid": "d3057092-fb77-4cca-a1d7-db335b30c6f6", "value": "e7c5970d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc92c933-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621749869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749869, "uuid": "0271bf1f-9363-468a-aac4-182ba858ba28", "comment": "Malware payload (SnakeKeylogger)", "value": "7eda7f6ab8cf7d4d00fc463748e876bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749869, "uuid": "e055efc4-34ef-4375-a146-2f2b4c6a91d8", "comment": "Malware payload (SnakeKeylogger)", "value": "2f20c054ff4637f4a052b973cc20d4ca7f80503abde935c68731ef0fdc737319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749869, "uuid": "cb198371-aae0-4d1d-ab30-dffb8e2c6c47", "comment": "Malware payload (SnakeKeylogger)", "value": "8c24e9c598aa17b58d82266a33da48f9c68165dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749869, "uuid": "0ef7d60c-c51d-478e-b5c6-3ce80ccdd0c5", "comment": "Malware payload (SnakeKeylogger)", "value": "2ff4f3c1df34852a39c19a0c5b8730b9d87c395defbe3104b9b33ba5b349dfe09bb94111ec7ba5275d1ccc43932fdbbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749869, "uuid": "45b7945a-bd25-41e5-ac79-0f2be392ae5f", "value": "E1C4CF2337E89B61E0BDA7758420152097F6B46AD736DE1D3E98809D04A2FC5C7E2F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749869, "uuid": "c83afd9a-731e-43ae-8cf1-6f2f845790ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749869, "uuid": "b3321a1d-1975-4a62-83ea-c3c00efa5da3", "value": "12288:HWXLA3ADKzYQNJDSplXv91n/a++ci1kQZtm54KAH5iI:Hx3AmzHJyDqcFAH5iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749869, "uuid": "ecee5cf3-1619-4a9d-a97b-08235f0cbbf7", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749869, "uuid": "3cd79078-4239-4749-ba08-b05f28649a76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749869, "uuid": "18a6552e-1cfa-4b33-b579-775e2330e53c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fb7773-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731714, "uuid": "6ae6dbaa-22c5-41b6-bbfc-fc3567e0dd8d", "comment": "Malware payload (Dridex)", "value": "3062355c4e682f004da95fbcea065439", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731714, "uuid": "a5c02b61-0c45-4b28-8d64-cfd7f2109435", "comment": "Malware payload (Dridex)", "value": "30a62659f19f811bd88129294cfcabaa8d02ebe422d9716fa85ac480845a2a36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731714, "uuid": "dee7dafb-776a-4c42-bb04-55ff9d090177", "comment": "Malware payload (Dridex)", "value": "13e66c1e03d167552dbaddd266fbffb16530cde1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731714, "uuid": "ef5213e1-454d-4643-b43a-94c11c987c08", "comment": "Malware payload (Dridex)", "value": "87af8b90a2d9842a1e1bc95b98b1948043caab9b573c0ebf1a21a6f82a356d04333c7d91022e1cc7f97c2046d619e4c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731714, "uuid": "f6222113-ec4b-4c89-9926-6000d3fb09b1", "value": "3CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731714, "uuid": "87575012-20d2-4ff5-a9e8-d03a6a682f17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731714, "uuid": "1ab1e9a6-6094-41cb-8807-5e481d6f00a5", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731714, "uuid": "a97222fd-5519-4758-a6b1-2bde897e045d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731714, "uuid": "127c0c5b-cb3b-427d-90d6-7703348eac7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731714, "uuid": "04e68958-1696-4752-a506-3b93bd4e47c5", "value": "3062355c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b8f772-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621735258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735258, "uuid": "3d68f8ce-5e08-42af-a415-553806cff6b9", "comment": "Malware payload (RedLineStealer)", "value": "8633ed956b53689d6da472604c153d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735258, "uuid": "0303f45f-f2d7-4259-86e8-9623395bcf09", "comment": "Malware payload (RedLineStealer)", "value": "328373a397ca0334ad32e1932b8d9455a40e6efb4c4d1006c9d2cf6b4d6140b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735258, "uuid": "979983dd-6cfa-4ae6-ae0e-ffb212413ad9", "comment": "Malware payload (RedLineStealer)", "value": "6afc0ba48e569914e9672cded91ddeb992baacfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735258, "uuid": "57c559a3-43a1-4d57-8e0f-7f2fdb1570e8", "comment": "Malware payload (RedLineStealer)", "value": "604e2610b27e1b539a3eba3507497b35d8f982d1276a293a85251e3f4e7e2e9655e5983b48d11c566b512d90af731f66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735258, "uuid": "3888187c-9046-4285-b037-9ed2e2171435", "value": "AB65D02026BD8D2AD060E37F89DF453BC7E6DEC07223466E6B60365D9975308ADD3493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735258, "uuid": "80470fb3-15d3-4ed3-9075-cd4365c585d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735258, "uuid": "779b8609-0713-42f6-965f-df46f22327fc", "value": "24576:nD7SC34FyNPW+CyFqCYNaxq6XKETyT0ELMq0KaA880z6I+Mj:/ZPdq6XTFELEKivzRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735258, "uuid": "d2af50e3-0410-417f-aaf1-fc4d4d015df4", "value": 1531392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735258, "uuid": "82640ed4-c84e-40f6-a00f-724c020ae97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735258, "uuid": "7a2a6944-fa92-4f1e-9174-7ac9449da94c", "value": "328373A397CA0334AD32E1932B8D9455A40E6EFB4C4D1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66c7b90-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782071, "uuid": "f5e9f4ec-cdd2-4dd8-8760-3d2a4c5fa104", "comment": "Malware payload (Dridex)", "value": "c88a2bb484e5904dad5d1e4bcd32b17b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782071, "uuid": "ace19578-2c1f-4c3e-946f-5742bfaa8659", "comment": "Malware payload (Dridex)", "value": "338eba842bbbe41aaac56bf95ef1e1c1c121b293145e87cbea9acb60b02d8ae5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782071, "uuid": "363b8d0f-e745-4134-9324-8223f7cdbe6c", "comment": "Malware payload (Dridex)", "value": "4f318e20aefb411344f8f374ce97b9d6e55f5957", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782071, "uuid": "09f0d3e5-c075-4099-a85e-73a010999633", "comment": "Malware payload (Dridex)", "value": "a153a587d4559d13af8b8cae19d754d526d8220b5cbc9258b459f5999a37f3a637525a71cebf0f87e6da527583b7f81b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782071, "uuid": "c7a1df9f-6777-4d05-9ca3-a2ffb575675e", "value": "D2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782071, "uuid": "d4979710-74b2-4b82-8453-4aad8956ee01", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782071, "uuid": "a99338bd-d3b4-4a6f-b046-c4a9f68eb8d9", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782071, "uuid": "256d7f59-7c11-4654-9f2d-22e47e20153e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782071, "uuid": "2ebf7490-6dfc-474a-85e4-105e82e9db1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782071, "uuid": "e7de9f5b-8d0e-41b8-bd77-382cee8dfdb4", "value": "c88a2bb4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7397815b-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621751894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751894, "uuid": "81b9ed47-49a9-49fb-9c0f-e1cf2832664a", "comment": "Malware payload (RaccoonStealer)", "value": "b7aa24bc2000e724fc8cdd8f09126e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751894, "uuid": "5791297f-0024-4ccc-ae19-d072dfb3d6ca", "comment": "Malware payload (RaccoonStealer)", "value": "3395ac38b64dc4fc6bffa4941523d2226212a8015b079c65ab8aa592b9ca33a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751894, "uuid": "9ccb954d-d83c-414a-9675-6e10073edc60", "comment": "Malware payload (RaccoonStealer)", "value": "fe71579443e4ef8c2a60f07b1e02efa818cb883c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751894, "uuid": "ff52fefe-3fa7-4c85-bb75-a1e5590c9fd4", "comment": "Malware payload (RaccoonStealer)", "value": "b8fda0668bd3c0679de5722a9fb65578437b0eb19b3df44c2528704514632d77a6d3200f5ab6315f01bfd791bee6a927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751894, "uuid": "6f5c1989-25f5-4e93-af4d-5a66faaeedfd", "value": "AAC4CF00E6A1E034E0AF76B449FA926B653E7DA1A720C0FF22D635AA55745F09F3071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751894, "uuid": "0cf6aa5a-d45b-4ed9-9b9e-90ab97f1ab51", "value": "9c13ffc0731fd63a88f615cce05b6735", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751894, "uuid": "bf42cd7a-9022-45e0-b6fa-67ef4c32769a", "value": "12288:7Y9SpZ+evgGTuDpsNKWD4y/vm6cu8f7oMXSSIrQqnXsL:7wSp9TR8sPT8joqSlrQ0XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751894, "uuid": "856a1ca6-57f4-4d08-97d1-f5e382b538e6", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751894, "uuid": "3d81fff9-cfad-4bf3-8dab-863cb05cd751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751894, "uuid": "ea193fab-cce5-4326-99ed-b6b9708a70ca", "value": "b7aa24bc2000e724fc8cdd8f09126e42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe8f344-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789254, "uuid": "4e6e72e3-d712-408f-8bae-e5d8542372bb", "comment": "Malware payload (Dridex)", "value": "f6809fb603bac7badfc4fa9dc1c15b51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789254, "uuid": "8b9f9a32-5fde-4a38-ac14-49d77e8c20eb", "comment": "Malware payload (Dridex)", "value": "33efa40b03552844ac3388d320b71aa48cafcdd8067d82305b03ae363c8bafa0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789254, "uuid": "0a77d88d-cf27-4150-b535-b3b3ef42c3a3", "comment": "Malware payload (Dridex)", "value": "c22d078542f591b736c9953fbae440f6b837a65c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789254, "uuid": "3c28f296-d09b-4c8b-aa87-3a633d6c54b4", "comment": "Malware payload (Dridex)", "value": "b07305deafd4fe8b9083dc8bdbe41f3e691f30035a3d37b9dd552831304014dfc1f4f2d3b832adbccaaaba40843ef788", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789254, "uuid": "a6f0010a-1038-4796-9b4a-1f295c08a2ec", "value": "46F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789254, "uuid": "4469e7fe-0ff0-4e44-8a15-27af79aeae44", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789254, "uuid": "8189ce09-8701-4ef2-8fb9-3a124d79cc6b", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789254, "uuid": "fc97ffdc-7674-4a67-b36a-dbb2a2899494", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789254, "uuid": "51a571ce-a6bd-43da-9da0-a5949ddef432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789254, "uuid": "21ca274c-8d22-4828-b541-8c2372700868", "value": "f6809fb6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bacd88c-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807286, "uuid": "78f23897-e4a3-470b-a376-12c61a88c290", "comment": "Malware payload", "value": "e9d319fe0fc9bedd60da30861a9de3fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807286, "uuid": "1307350d-fab2-4967-9245-8d3894a2dc1e", "comment": "Malware payload", "value": "343757a4dbb07f322076ba38675192101ee4adb967ef0c3b421fa8caddc50414", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807286, "uuid": "1b24f87d-a823-4849-aeb8-8c540b5ba3ac", "comment": "Malware payload", "value": "c4bd0ef517e87a5293825b5b09b91bf0c14102ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807286, "uuid": "e9747404-adbf-4979-9ea2-a33f4cb3f4f7", "comment": "Malware payload", "value": "6643c8077421fb4defdc65fbcf2cbf208ebd048b26dc238435ce6dae450bf8e1e40cf5968dc565b74b7b42134be9bf35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807286, "uuid": "8c168369-0c03-4490-b8cc-f6d9a9b16379", "value": "06F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807286, "uuid": "67a99434-6dfa-452b-ba5b-67189f4993b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807286, "uuid": "c891a808-2965-48b7-984e-ebb21867131b", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807286, "uuid": "e3b88b2d-3c93-468f-9dd5-b73cc93c0382", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807286, "uuid": "a26cd847-ac46-4c4e-aea0-987426c360c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807286, "uuid": "00d64a40-7197-40fd-be86-6adbfdbad93c", "value": "e9d319fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f24d7e-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782094, "uuid": "d6c0a5fd-dfb3-418a-9d7b-94d458076845", "comment": "Malware payload (Dridex)", "value": "2cdf7d083d337c2b6d9f5e4246e5bf96", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782094, "uuid": "8f16eb6e-f290-427d-9319-e78f4bf024f9", "comment": "Malware payload (Dridex)", "value": "3483e4c85ca745e3a374bc83346060bfdaba634a7b6f6505443f8c7dd0516a40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782094, "uuid": "b8bce3a2-23e0-4dcf-b6cc-60650f895d3b", "comment": "Malware payload (Dridex)", "value": "7e94d98aec15201c6cf26c8ed9ccfe6a14e3e9a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782094, "uuid": "36609729-bfa4-40e5-8c90-9323debabae1", "comment": "Malware payload (Dridex)", "value": "2a48e0b0c9c42d0c8ba8ae62f8b73c0aa50f92e91a2b7f917f6a3570ea7ee9e9b87514da8944ecbeb6548d1fc5bfcd97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782094, "uuid": "5ccadf19-961f-45e3-84d4-5fd4a5464bae", "value": "5004B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782094, "uuid": "e3d51d88-9d09-4553-bdd5-8a46ba8a3f2d", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782094, "uuid": "efdb094d-45d1-45b0-a431-375eb5156c23", "value": "3072:dWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:dWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782094, "uuid": "525da977-a775-4f74-9446-0763894e4aeb", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782094, "uuid": "2266bdaf-b9a4-407b-ae9c-70bd504e0d0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782094, "uuid": "7bb9ae5f-0d5c-486d-b23f-0c226fb472d3", "value": "2cdf7d08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424c97b2-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778440, "uuid": "9786500c-4d26-48f2-9849-7de2d3caeb24", "comment": "Malware payload (Dridex)", "value": "c49aee8759ff11dba4d076ae95b0cdbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778440, "uuid": "062a793a-ecfa-4843-a70a-ee45b4bccd3a", "comment": "Malware payload (Dridex)", "value": "34e4c0c6bf2ee5b77cca348b0b29e031bb060c9615a0663777d1c7058fb87140", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778440, "uuid": "b42c5d77-388e-4c68-b030-afd2a0d3c358", "comment": "Malware payload (Dridex)", "value": "06b0f718887bdc776cd2b044cff0d285042a403b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778440, "uuid": "ece717ee-736d-4f1d-be32-721abc020e46", "comment": "Malware payload (Dridex)", "value": "e59f805652e2c260e7cee6af80c768a0acc7ca08561b019fe4a9995688877859c7d7e74288ca231fa35e703bdcb64f82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778440, "uuid": "9d7e12f6-d0c0-48f4-8b08-7d99da797788", "value": "92F3DF08D1CFCA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778440, "uuid": "e2d0ea21-8fe6-4720-b6a0-5c31c4cbf94a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778440, "uuid": "f15a8e2b-9f06-43bf-95ec-86e690bcef62", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778440, "uuid": "103de6ad-0404-4b47-bce5-c00e667234ab", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778440, "uuid": "c85b0286-7a81-4583-805f-d835fbb8614a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778440, "uuid": "618aaa28-cb2b-4d36-a194-2ab54e383b3c", "value": "c49aee87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9535f50-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735234, "uuid": "534566e8-3b5d-4e2c-ab9b-fcbf3b9c9264", "comment": "Malware payload (Dridex)", "value": "a2554146daa9550d43f6b2f13652f290", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735234, "uuid": "b26596ca-1fa3-44d3-8a5c-eef2dea98258", "comment": "Malware payload (Dridex)", "value": "353074af9d860d54d71a597cfea603df398b051809aedaa16faf303a04045ae0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735234, "uuid": "75c56099-1654-4fae-a4fc-a7f427bb2c84", "comment": "Malware payload (Dridex)", "value": "6bc9099034ca79f41b2869dc1a756ce769f6c857", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735234, "uuid": "242900d4-eb2c-4fa9-967d-956da5704999", "comment": "Malware payload (Dridex)", "value": "42516512c575d5178a2d51aef05f99e2a8a44889f04e9e9adb59a6dc82394d8d0c75ca761de121cbc4a2cc3355912154", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735234, "uuid": "a6076e53-b6d8-4be1-b57d-4bb7692fd2f1", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735234, "uuid": "685c4d1b-caea-4120-9947-b6483f3e9d27", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735234, "uuid": "58255722-b2d8-4d5c-ac1c-988e55153ce3", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735234, "uuid": "da8d9458-afb2-4e11-b3ea-9807dfba356f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735234, "uuid": "ffe029ad-2ff4-4ac6-8e87-ee7ad2973619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735234, "uuid": "e9c54770-5ab6-4629-9b2e-69281913db91", "value": "a2554146_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8144a314-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731731, "uuid": "e5b8ecab-b2e2-454c-bb06-e5f15930141d", "comment": "Malware payload (Dridex)", "value": "40524b4849228b98bb7e8f6ab2f7a917", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731731, "uuid": "f2054a2b-be8d-4100-9650-196b5a72dd8a", "comment": "Malware payload (Dridex)", "value": "353f83da783f5366eb332a669a8cbef0f6af621c7fdee1821691a0c27dd0c040", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731731, "uuid": "da24400f-9320-43e3-9539-a5cb47023a90", "comment": "Malware payload (Dridex)", "value": "779c2a5ab53e1d78179d5286b3cd9a36b6976327", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731731, "uuid": "5bfee2dd-c335-40d7-8d93-a2e9c5f24d67", "comment": "Malware payload (Dridex)", "value": "9284d742f3b4d15a19eda28e57b252bdd2037fbe9fd134cafac1288f63466745d1606fbcb3ede0fa6b4a86206f9851ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731731, "uuid": "1e5ca370-08b7-4afb-bb2c-280ea3e74a91", "value": "11F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731731, "uuid": "e52fa1ae-58ab-42bf-b1c5-10f4dbcf4d46", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731731, "uuid": "52bbd045-ead5-4435-bfa5-c6660205ff89", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731731, "uuid": "2613c46b-8d00-472c-8ea2-92acd2c9f0fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731731, "uuid": "f4120690-5772-425f-a0b9-b87f31f61b61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731731, "uuid": "1f293e13-556c-4c24-8776-1907279d2496", "value": "40524b48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d204500-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778512, "uuid": "d43c7a7f-f75d-4261-915d-d93fdebbe06c", "comment": "Malware payload (Dridex)", "value": "dbbaa6cca37fa040e24b0dbd1df43fe2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778512, "uuid": "4c296115-2486-48a2-a064-eefd3fc9e74a", "comment": "Malware payload (Dridex)", "value": "3590d50f36f020602c6fdf2de5426aa208a274bae4b9ac695fe79147a97a37f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778512, "uuid": "d5528016-02fd-47a8-830c-98f8d6981410", "comment": "Malware payload (Dridex)", "value": "f8aa47135aacabf55f2c8130c9632e3a932c1228", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778512, "uuid": "2108ba60-fb7b-4812-a0ca-0a67b7e03a2e", "comment": "Malware payload (Dridex)", "value": "4ec0524520cd2f62a78da2c4d0ed60cb6ed94323742841c558cc94b09863aa6d7417c9adf527cd10cf5e133ad1bb755a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778512, "uuid": "163f22e9-1d6f-41c9-8293-09115996fcc9", "value": "B3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778512, "uuid": "6bd784d2-7cc3-45a8-bccc-0a06b03a5631", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778512, "uuid": "720d3bd9-4b97-4a69-82b9-ecd004722c33", "value": "3072:RiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ieAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778512, "uuid": "d2f2cd7d-a15c-45a6-a993-52454d57ae03", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778512, "uuid": "d78e1568-0756-4473-9293-d0c07a61d372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778512, "uuid": "8aa6926e-33f2-4459-b036-cd35883741f0", "value": "dbbaa6cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0f45a7-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756871, "uuid": "50ab45a6-9230-4efe-a30b-dc5fd18b2455", "comment": "Malware payload (Dridex)", "value": "4d0a176dbab12ba0932d24965c38a7c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756871, "uuid": "b4ac04ae-0298-4525-9bdb-f156bad3b50a", "comment": "Malware payload (Dridex)", "value": "35e6c0653f199fade09183e6d97b2781efa08f7923fb62e993702fa5ebc6ae79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756871, "uuid": "dd1fd4c7-4e6c-4d58-a803-02ef073babca", "comment": "Malware payload (Dridex)", "value": "81f6c76018eb11cafe4093617231d2184b9fde00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756871, "uuid": "347bed20-4b86-4328-99c8-17511e1b65c7", "comment": "Malware payload (Dridex)", "value": "91709e79b960468ede3b4fe5f88853dd5e77781a5d15967c0713f9fa7015b996da7d78fd50e41043351d9b8951df12b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756871, "uuid": "63480087-0c3f-42dc-9ed9-985795ad2ce4", "value": "34F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756871, "uuid": "06dba9b5-daf0-4be5-b5a5-163173c3cc0e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756871, "uuid": "805dd172-cee4-4774-8c15-b1ee18212777", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756871, "uuid": "911e3a2f-65fd-4664-9fab-19532aa789be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756871, "uuid": "c1ab0a14-3120-4f12-8924-16acbe24f31c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756871, "uuid": "ebc992a9-b24f-4867-80e1-759e3847cbfb", "value": "4d0a176d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d678241a-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810901, "uuid": "3e8f0d0e-9d6e-4f17-a94a-3efa01eaa698", "comment": "Malware payload", "value": "de0b888aed40ec2474ef05a3d639bf99", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810901, "uuid": "690ce650-b331-4be5-9720-e58632616bb4", "comment": "Malware payload", "value": "361d298eadfcb36243c40cadbe9bf791642b9663ff20e2656bc518945856dbef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810901, "uuid": "a3a5482f-ee1c-46a1-aa85-1c1c33706c88", "comment": "Malware payload", "value": "0049e2f2ccd16a9c564ac39de23414b73487b3dd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810901, "uuid": "ab256dca-4c09-4e9b-84f6-b2e5c7fcde73", "comment": "Malware payload", "value": "dc49c1281064e0d695d54651d846aa5a6c17072a64fbdf8a6df6b16c712a0d2e67676ac8343e564dab8049200e6dd101", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810901, "uuid": "3f8db035-faaa-4f93-9571-a195558f4a6e", "value": "84F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810901, "uuid": "7adb6a8f-0ecd-462e-8dfc-a22b26ba1f65", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810901, "uuid": "3ba7f30a-2142-40a0-bb1a-f149186a4589", "value": "3072:d9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:d9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810901, "uuid": "99f4db26-15bf-4303-b572-2ed1dd1b33c5", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810901, "uuid": "00bfc317-cabf-46fa-8333-3ffd3df2a8e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810901, "uuid": "90a4de90-27d3-4c21-87bb-9cb2efd1682a", "value": "de0b888a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fb2bdc-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621774895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774895, "uuid": "dd32b64b-f63f-415d-b236-1e42cbb937d4", "comment": "Malware payload", "value": "b8c68e1a85e294edf8795865cfb078c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774895, "uuid": "691739f0-de82-465c-a81c-90ca5658b071", "comment": "Malware payload", "value": "365fff206bff69a37fa25cbbcb64e1f98cdf1d411ca9bc78662d184b7d1e8cdf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774895, "uuid": "47a9096b-8be1-4dbf-a8d4-02e0c7031f1e", "comment": "Malware payload", "value": "58ba9c12418404eb6495061316e324b9d27d2c5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774895, "uuid": "861e4d4b-bb33-4b20-a21f-e3a3b4ce96bc", "comment": "Malware payload", "value": "cd46a83c0bf36c6897dcd5f741d82c0cd4b4b335887f10bd509fb9b0f738678f4dc7f1c8da4ff84abe17613981c895c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774895, "uuid": "bb8b5782-3ad7-494c-b5d2-c5976055300b", "value": "B4F48364949B82D1F147C884392CFAA2417378A3E9C64D36235D2B06DFAED253F89F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774895, "uuid": "fc2b8a25-ccc8-44c5-a92b-123606d5b317", "value": "6144:K1eRn+mzUa8UjQtKYRlQV4f0AHhMr3Ap0UjQtKYRlQV4z:K1eR+4jQtKUlQe8MjQtKUlQez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774895, "uuid": "094841ad-c0a6-4913-ba7b-d4f2a1f94c8a", "value": 791206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774895, "uuid": "3d7c12a0-1de7-4fe6-a004-57666b49b015", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774895, "uuid": "a2ff538f-6b19-41e3-b788-1a6ab39274a7", "value": "b8c68e1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140746a1-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785664, "uuid": "0478afe1-0622-47e4-a02e-a7a6dfb739be", "comment": "Malware payload (Dridex)", "value": "05d473962830e7e6741b053c6c31bdd0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785664, "uuid": "7c6f829c-85af-4c90-9d16-1b5d83fa9239", "comment": "Malware payload (Dridex)", "value": "368a80d9683fdd23d02c6a051ef7b526e55c1c7f8eb3169bb3098af66972f10a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785664, "uuid": "d7092346-75d7-4a2e-bbd7-50f25389403c", "comment": "Malware payload (Dridex)", "value": "254e48bd5acc75f998ccadcd426b81387ac40bdd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785664, "uuid": "f859b83e-31f1-4ded-888f-652c6a4abe91", "comment": "Malware payload (Dridex)", "value": "ebb858ecac0f3e0a0f5c7823c3a1227286f4c04e0faa1cde9298613c2a7bece6f2cd85ab796eb8306e8647ba15bab5e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785664, "uuid": "4daa8373-20a4-4971-83ab-8f25a494a15e", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785664, "uuid": "a726044b-30d6-42ef-b728-817796cb8e10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785664, "uuid": "a608dc35-964c-4c5d-b2dc-53f726679b39", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785664, "uuid": "839f691e-afc1-48ca-8c3b-456a5c2322e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785664, "uuid": "1f3dbd30-e929-49ea-b8ec-0f28c6ff06f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785664, "uuid": "e1e35c0a-45bb-4fbd-ac82-6f3ff08db88f", "value": "05d47396_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894ec45d-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742482, "uuid": "05625bdd-3836-4bbb-82e0-1470e6c9dd6e", "comment": "Malware payload (Dridex)", "value": "370a12c4e6a790d0dc0ade4641ebf801", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742482, "uuid": "1f3f0e1a-36b7-4176-812a-cf4f88ed18bf", "comment": "Malware payload (Dridex)", "value": "3761fdbc6256053210464b8359f9fd0f10974803ac4490ccf7cf5dbd4a81aef0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742482, "uuid": "cd29dced-3693-4ef7-a4fb-6ef64876465c", "comment": "Malware payload (Dridex)", "value": "20039b5f116e21a0bdb451e55209d9114a7d3158", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742482, "uuid": "82f77f2e-8116-4f92-be93-4c09ec2d4a17", "comment": "Malware payload (Dridex)", "value": "b01e413f541bc3ca672abc13014db2c68de18b5dbae6e4d80102d8608df67a8c57c99e7219b2e9531141cbe6f53174e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742482, "uuid": "f2000451-f3f5-43d8-ba26-7cca693b6b44", "value": "E2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742482, "uuid": "549aa785-7414-41f7-9556-535bcaa12669", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742482, "uuid": "5ddf3b0a-725d-4687-869a-07d63ee1f9fa", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742482, "uuid": "5c1e5f59-5427-412d-aed4-79018ff9d383", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742482, "uuid": "3f3d0433-1aef-4e3b-a559-515d12460cd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742482, "uuid": "99e107ea-d114-4432-94b9-a554477db217", "value": "370a12c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3c4f3d-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760469, "uuid": "176482f9-524e-426b-9983-29280594094f", "comment": "Malware payload (Dridex)", "value": "1a34feac23502613d56c7d4d5061556f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760469, "uuid": "b2b68ddc-5c43-4bbf-af35-daa095806dc4", "comment": "Malware payload (Dridex)", "value": "38bd64205a9049f6e3435192eecb2f523e22480bcfa57133c6e05f42cef283c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760469, "uuid": "55f331a1-1999-40d6-a256-c5d2a7102b66", "comment": "Malware payload (Dridex)", "value": "390e61ccca54152d8c0799d481d468bc56d61969", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760469, "uuid": "1a71ce14-7680-416b-b6c5-db0813a79ca0", "comment": "Malware payload (Dridex)", "value": "005c9d8cba2cdf5c3a293fbfcba8830b98e35371c8e404f21cc74970abab064a3565ec9872d63947704883b832a0191c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760469, "uuid": "73e870a3-4412-48f6-8a2e-72627a1bb0b7", "value": "B2F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760469, "uuid": "e12faedd-fb1b-46f6-be2e-87e5890e34f0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760469, "uuid": "bdd71513-6a74-438a-bbec-e15982d5328f", "value": "3072:2A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:23J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760469, "uuid": "36e7f4f5-ac2c-4cbb-a920-742408cdf753", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760469, "uuid": "9b54f1b9-0cb8-4f91-b3c8-226f511522e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760469, "uuid": "76dcb084-9932-4d76-9f8b-d54c3f7cef30", "value": "1a34feac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9827b69d-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800059, "uuid": "648008d4-ff7f-49b6-9d8b-37269d440eea", "comment": "Malware payload", "value": "091056548700b2dcd63d982f5272791f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800059, "uuid": "2a12ec2c-5060-4b2a-8c36-393c703af157", "comment": "Malware payload", "value": "3946a588a2c65d42ad9c12d881c6720caad098f0c52ad1bf6fcabb0f1a1bf245", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800059, "uuid": "e2e2231a-5670-414c-b034-fdf305029a80", "comment": "Malware payload", "value": "ae7c2211783d4c705342a6f065efa0827ec7de2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800059, "uuid": "a35f58df-d6bc-4615-96fb-c5811d52e9f8", "comment": "Malware payload", "value": "86ac4bbab509bfd0aa401820bb2205149f87e9b20642e4a897d24dcd099a89ad1cefae521e694ecdf46fb0c8c80d9037", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800059, "uuid": "458b17f9-07e1-4a33-82f0-b75f063e70f6", "value": "05F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800059, "uuid": "7b79e468-59a8-44c1-912a-7e6658acb79b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800059, "uuid": "a8ba7ce7-fd4c-4ab2-abc6-4ad38f10ac06", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800059, "uuid": "4d5fe016-c87e-4809-ab3c-f6999ecbc39b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800059, "uuid": "56a03ee1-0c00-40ba-9ae9-76dd373e8685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800059, "uuid": "db1db7ef-2e6a-430c-9879-aa2afe5a5d45", "value": "09105654_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1c8033-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785760, "uuid": "1b4ca46b-465e-4a68-aecf-d12324a64295", "comment": "Malware payload (Dridex)", "value": "dcdc680505617d709a6dbd5b3b1dbb48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785760, "uuid": "eb7d3e63-5932-4f38-89b2-716c5499ceb3", "comment": "Malware payload (Dridex)", "value": "39cc438652c8ab0b194df9d5c017d52216d12639c86d89a146d201ef117c2ba3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785760, "uuid": "70b2a646-f9a6-479c-9141-79b93f34f0b9", "comment": "Malware payload (Dridex)", "value": "4ae0f01db20023fda21cc66def155919d7785a6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785760, "uuid": "8932b7ce-7672-4e7f-b2ff-08331bc02069", "comment": "Malware payload (Dridex)", "value": "1a6ee50286a56a1bb8b40edbe61344e516ed1ef306190737d6f5ed01d2165ec04f18403e916b328529bebfa12330418e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785760, "uuid": "4238b1c8-9bf6-46a8-ad1a-7ed3a59c722a", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785760, "uuid": "dce5f30f-3c64-4d00-a4cd-92f9ca22bf01", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785760, "uuid": "517c92cc-5820-4359-a768-733350fdd7f9", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785760, "uuid": "5040f849-2179-4c83-8a08-8b6252e5741e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785760, "uuid": "8ed810de-0d1b-4e42-b31f-bac2eb352b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785760, "uuid": "d60a5916-84bd-4500-a0f5-ab5fc195ad7b", "value": "dcdc6805_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc870378-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1621751587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751587, "uuid": "bee53206-11b3-4511-b45d-aaacd792bf06", "comment": "Malware payload (ServHelper)", "value": "4d4cb53955f998f339000039ebd0685b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751587, "uuid": "49f23764-16a5-4b06-b830-d717a280395a", "comment": "Malware payload (ServHelper)", "value": "39f4d59b94d2b39408e4dc962fbf2e65a79b234b46a42c6b05856e60acf7f95b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751587, "uuid": "4bcb423d-0630-4b87-af43-35a268f8b633", "comment": "Malware payload (ServHelper)", "value": "49218231e8ce8358683bca89a28e3f533bd25700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751587, "uuid": "1c01e482-2725-4b85-b862-bfb535fd0243", "comment": "Malware payload (ServHelper)", "value": "61151a51af15e0f493b7142ed74c53dfdad6aecd4e33a7bdbbac9d4ae3a707fc0829cdfe2f5891a9adb081935396a2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751587, "uuid": "140a3742-943a-47d9-a86c-2f4b1ce72de2", "value": "7456E012BCE218FAC57AE170845697A27A713C6483317BD32E94B6AD1E75FD02E3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751587, "uuid": "649b9515-e2a4-4d4e-afa1-25964595ba17", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751587, "uuid": "0bf2f256-0bb4-4076-ad97-c805b6f953c7", "value": "49152:Wo9aFkx5YmyX5w8xdgQG5ccrUndjHDnf1UqTGFyCH+udvHwiOHmg7cyFVACJKWcz:WjFkxhyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751587, "uuid": "1fc0bfbb-a058-4a05-8808-e8e6ab699f51", "value": 6321152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751587, "uuid": "1ee7a56a-c336-4bda-bd72-3aa8feafff3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751587, "uuid": "7de4eeb0-e3f4-4f70-9a40-a59c0b9df5f8", "value": "4d4cb53955f998f339000039ebd0685b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f36f3e4-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760531, "uuid": "d10559b1-79f1-4642-8b9c-f11155cdd291", "comment": "Malware payload (Dridex)", "value": "294bb42f890727b50051b8f09fbec3dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760531, "uuid": "b50bee07-71a1-4006-b48f-ff61d578a834", "comment": "Malware payload (Dridex)", "value": "3a1fa7d16d800be7f097dd9dafcbb4802222b8c638d0036a17a9d554db96804d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760531, "uuid": "4bf37baa-44c8-49fc-a767-bde1bb03d193", "comment": "Malware payload (Dridex)", "value": "ffe48a883cd5f29a0179d40f8f0a24daf00adb2e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760531, "uuid": "1ef85483-a1a7-4462-8eb8-765b140c41a0", "comment": "Malware payload (Dridex)", "value": "c541408fb1ac11a4332c88509c10db0cf7cd514621437b2b52bd95af6ce118db43ecc1eeb9bfa72a11095715adf5fb14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760531, "uuid": "434d8da7-73be-460e-b29e-3505f4f79d87", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760531, "uuid": "00da4c1b-8172-4a32-a2c6-42ff569676e0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760531, "uuid": "9dce0882-f636-4735-8256-6a18178e61b3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760531, "uuid": "64f8ce8a-3d31-4267-8824-86e4f9a429e8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760531, "uuid": "5d98aadd-8b43-4375-b9f7-c99fc626605c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760531, "uuid": "bf12fa5b-a302-4b19-989c-ddb09fd0b347", "value": "294bb42f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac8cade-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735290, "uuid": "7db99bcb-9354-4a79-9ce2-d34b567ebe51", "comment": "Malware payload (Dridex)", "value": "0626a81d436b3a98eab120d109e0ade9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735290, "uuid": "0dcd08cd-ca6f-4638-aae7-9236607102ee", "comment": "Malware payload (Dridex)", "value": "3a8ab5634c7f171257e67fd366e51551c7b3ff6e712e78b207932bb3cf253a94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735290, "uuid": "d5393f40-1f80-4e69-866b-4e58cfbc495e", "comment": "Malware payload (Dridex)", "value": "ba4b3c7c0c2949d6e4da760167587c81da889c4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735290, "uuid": "49ca808d-c310-4ec5-8e63-54136fb8398f", "comment": "Malware payload (Dridex)", "value": "71d12224bfd2ce42afa8771f234301b94409eee1ab81bc04f55e6b78d443927bb2621cceb7c4425c40bc384a69e091a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735290, "uuid": "51f05f24-30c6-4d38-923b-1cb8b14fb89d", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735290, "uuid": "b1f4a5b3-547e-4327-96dc-05e70d772d8c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735290, "uuid": "6f381bbe-7e07-4772-84f0-4aee558621cc", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735290, "uuid": "7e66f7e2-674c-4f21-ab4a-34d0d6a84d83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735290, "uuid": "e833d658-62fa-4b0a-ae1e-6c4a86cb260f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735290, "uuid": "fc3a96cb-4101-4ff7-9d85-0372a92d0611", "value": "0626a81d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1db748-bc04-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621801521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621801521, "uuid": "c150e1f1-f6d7-4301-91d2-1f0d0495227d", "comment": "Malware payload (ArkeiStealer)", "value": "5c1fe1825804bb057b1cb6c0ca1e6958", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621801521, "uuid": "7401d544-71ae-4916-b0a4-9c39c2efb5a6", "comment": "Malware payload (ArkeiStealer)", "value": "3b36f51b91f67c01015777197970e7ea37e291ff8b6401a853e9582b0a1d90cb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621801521, "uuid": "b017ac07-2bd6-4f88-bca1-e108429d147d", "comment": "Malware payload (ArkeiStealer)", "value": "cb85669b4f1eb49bb4d4bf7f837fd249644f7824", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621801521, "uuid": "1a98948a-9613-45a6-aa8a-9d09aa71dd2a", "comment": "Malware payload (ArkeiStealer)", "value": "e3ed62ffd57acc1181239a268682924796b425c45d6d16928652c61b8e4839aab99150263888020009c8c24c044a1072", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621801521, "uuid": "8f54f497-8176-4d62-8bd8-1dfc9a80c6fa", "value": "CE7633BEA592D43AC12328351DABC1F2F174B7085F384DCF5ADA4C494CB36984B3AA53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621801521, "uuid": "98cd5db9-37f6-4c52-bbda-01f2a0f9dff0", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621801521, "uuid": "881463fd-27bf-490b-96a3-910fcd60e8b4", "value": "196608:itjocoSzMfJbTIiDOVcYtdkzsA2LNXUpgoAftyNcF8cPHZ:ooSiJbTIiDOVcYtdCs1YCftyNcFJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621801521, "uuid": "5452998c-1516-4187-b877-24d8a0fbabaa", "value": 7454792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621801521, "uuid": "59b6303c-4961-4726-8062-048e04088ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621801521, "uuid": "8803d2a0-942b-4a30-9a72-ef726a7d521c", "value": "5C1FE1825804BB057B1CB6C0CA1E6958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a79310-bbd0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621778924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778924, "uuid": "ec4bd4a8-5c98-45da-abfd-ff3a0ea98dc4", "comment": "Malware payload (AgentTesla)", "value": "a1a0f6735ba2efb8626a61c8c8f64f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778924, "uuid": "e334e8e1-975c-420b-9103-6f32498e6dcd", "comment": "Malware payload (AgentTesla)", "value": "3b6d4700781af29d950456e2140c483323e38fb0346dccc92a2b377ef91d149d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778924, "uuid": "336cfd35-b3d9-4421-a1a7-130e282a1f6f", "comment": "Malware payload (AgentTesla)", "value": "206335c6a0cf404659b075113a19080c77eb35d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778924, "uuid": "ba912f58-e9a1-4554-af2c-0c8a7d8a9bc7", "comment": "Malware payload (AgentTesla)", "value": "3a30679fac5661950cc0602fdb218f8bed0078c2fd383403b15a29eeb5d9de1a63fba97634c9cc285b0b6c1adfeed536", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778924, "uuid": "31670e13-36e7-4688-84e1-b2a5fbffa743", "value": "96157B1223E86B4DF5FB6738AAB5102847F1BC46DB35D60DAD96118D082AB81CDB7733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778924, "uuid": "e69c290b-8e52-47cc-9f90-ae876bcc3bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778924, "uuid": "84bf6855-4be5-4d56-9f00-a1330ec57f7e", "value": "12288:EC7/GEI/Xh9vbmURzR2+32kRBKnokbrCOeguYvOyEERsd6a/ou2lebx7ZuY8F2EC:cEEh9vaURUCilbrCOeRYvOw+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778924, "uuid": "b0d1670b-9459-4334-a852-42ad5dccab2e", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778924, "uuid": "507e2c23-c322-4456-b2ba-157f64fcf163", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778924, "uuid": "56f1a128-5314-4676-8506-36a13a673692", "value": "scan-0086475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3bb9a7-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764096, "uuid": "26d94b54-be13-4885-bb5a-043cf88c1616", "comment": "Malware payload (Dridex)", "value": "b7548541a04f85865271873ac667b08f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764096, "uuid": "96e80162-de5e-47c4-914a-4a03096521fb", "comment": "Malware payload (Dridex)", "value": "3bdc7ffcf74cef1da1f92ba381490a0ff3b2f6ca31488432a01ccadd0f0d3916", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764096, "uuid": "d149727b-ce52-4346-bf05-c2e0d34bb2f6", "comment": "Malware payload (Dridex)", "value": "d39446aa21d0e55189a715db7a8b64ddf2a80620", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764096, "uuid": "1a7ac970-53d3-4075-9f68-2bbcd6b3fd22", "comment": "Malware payload (Dridex)", "value": "2b225ef91a78e7d3372584af37359357faeb1b53e1f1ce40f2a38508ed7780ba55a81d1635307519c79bc4018bbef2d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764096, "uuid": "8ba9d510-cbea-4c7a-8792-dca9dbdf7d7e", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764096, "uuid": "6dea6bce-c04e-4b94-b685-4db0b17a2f0d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764096, "uuid": "9869d0e6-53a2-40c1-b987-aa5d5c35ce4a", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764096, "uuid": "41cb8878-ceb9-450c-a949-6d15ca03c347", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764096, "uuid": "1ed6a4db-6f4b-46b1-9f33-67705079dcad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764096, "uuid": "5b1143ca-7d4e-4808-84a3-393fc47c481f", "value": "b7548541_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb35c149-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782160, "uuid": "47209b24-16c7-460b-8584-f30a4d5e2631", "comment": "Malware payload (Dridex)", "value": "3a65dd6f6208fced961c09f929599a69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782160, "uuid": "0c03fbb2-38e9-4f42-92c8-0adc3dce5aaa", "comment": "Malware payload (Dridex)", "value": "3c2e1b8bffdf6f0597971afdb18b33184c2ed3cb52cfd52d7e3cf1d3f60c30a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782160, "uuid": "497cdd38-62b1-47f0-b97f-d383a47b1639", "comment": "Malware payload (Dridex)", "value": "6cbe60fcaaaacbcf263e57d24d7a82dbf19daeb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782160, "uuid": "10737eb2-4a53-40e8-beb7-131346f31663", "comment": "Malware payload (Dridex)", "value": "879cfcf1d8d0d61bb383799ade87d7d7581c5c993531178029c1e3296314f0b4afa73b1ac81a91a72f38fd11acde329f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782160, "uuid": "e8d9c2cc-f5cb-4fb1-b229-4ff1ccf73091", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782160, "uuid": "95ae29ae-ee11-4405-b05e-710905ee1bf8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782160, "uuid": "78a703d5-1933-423e-9585-1f5109784d76", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782160, "uuid": "8242dbea-24d1-4c2d-b94d-bbb3a16a2a52", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782160, "uuid": "2ec46455-c1b5-4f8b-aa64-b6e7484fcd3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782160, "uuid": "77590d91-33a7-4c74-a7a1-c76164e9d489", "value": "3a65dd6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0506e508-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774902, "uuid": "734ec003-f7cd-4665-9ed8-4c757df768de", "comment": "Malware payload (Dridex)", "value": "584d7304d16e96e1ae30f5f6a1180fa8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774902, "uuid": "39f09429-3ed2-495c-ba14-cdca40c085ae", "comment": "Malware payload (Dridex)", "value": "3c44e162a977cac31078655b2e34cda8b7b1d9a8c0cff2e40aad86bc561f8ffa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774902, "uuid": "2b03d611-178e-4949-b4d4-b7a319b4728a", "comment": "Malware payload (Dridex)", "value": "634d444e05d7fd53e0fb2f39bb5c921030b6ab68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774902, "uuid": "c5fa5863-40bc-4066-8fc3-a64112927f97", "comment": "Malware payload (Dridex)", "value": "055e1e48a8255e485395cbf5ca7d629730bb673e81e1a6e4a53ed58dba4c00f3ef51ffe8871eceb5bdbb57070045778c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774902, "uuid": "8c773deb-5d8b-4d48-89c5-f02797f47275", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774902, "uuid": "a500864d-ae71-4708-a8f0-cca6caeb50d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774902, "uuid": "e94a229c-9d9e-4278-b4aa-50cae0497d92", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774902, "uuid": "1075b55a-775f-4575-85ce-9e5024011145", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774902, "uuid": "8389db8b-7164-4268-aee9-138f6321a9f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774902, "uuid": "832df1e2-f4e7-4f37-90f5-cd62e2eaeeb0", "value": "584d7304_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270ee6b9-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796434, "uuid": "73a9adf5-3a30-4381-b623-57851e459bc1", "comment": "Malware payload", "value": "822b92c7c27cf6c02a326a3fb3b2f305", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796434, "uuid": "42eff55c-1ff0-40c8-aaaf-a4f080b4b84c", "comment": "Malware payload", "value": "3d89da72189ce9fb4b2f07eeea38de07a1839242d0a2f01a7b4e769aba234381", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796434, "uuid": "b6aaed94-5a4e-49a7-97d2-f6ce39cbccbb", "comment": "Malware payload", "value": "11a9fc3acbf367fb4e546cded22e49581c95e391", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796434, "uuid": "7a5e015b-a6d7-4e26-88e1-df6e95098aa6", "comment": "Malware payload", "value": "4e4021036802affbe57a0e7109859e184ff657b920e955ced7b50d3cbccfa780dbab3d4c9d94a2d9a534b9cc9989aa21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796434, "uuid": "7f7552c7-e05e-497a-a3eb-8d76fac213a3", "value": "C4530274193BC2FBFE13273326E4EFD78D554C7160A301F09AA5093236161A9BB33956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796434, "uuid": "c4578758-4b85-4c14-9f90-43ed5ec0c010", "value": "1536:FmI+OR2xmyJa2rlMVK3+/5uT4M2V6dSDUpz:II+OR2xXJakWKu/K4MSTUpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796434, "uuid": "e06eb8e0-7fba-407c-a78f-7c1f71515369", "value": 64593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796434, "uuid": "4941e02f-9b13-4b3d-a369-e8c313613697", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796434, "uuid": "4bab1a38-3e0d-42f8-aeea-effcd15b9f90", "value": "822b92c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac78ee32-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753278, "uuid": "02808a38-fd7d-4e51-951d-f09d15daf894", "comment": "Malware payload (Dridex)", "value": "d3b03b0b3d5cd595b25bce8f7922cf42", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753278, "uuid": "6bbe2ede-a548-4662-ba56-995b5f7cce27", "comment": "Malware payload (Dridex)", "value": "3e13c0cba556ed54620b4572a95bd532ed5e4ecf66a0dae3359405bfb940e4df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753278, "uuid": "f323cd0d-0a42-439c-808a-c5b038509913", "comment": "Malware payload (Dridex)", "value": "e82dabdc4f4a5c55917026c29a1bcff4b8b6985d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753278, "uuid": "4d97f984-6ab9-4db5-9d6d-288966eef3c8", "comment": "Malware payload (Dridex)", "value": "b873cc25567d6c77d0618267f3096123ee3e58aee747bc20107cf6689a3b39605d4479b1cac2ce3aed404a9fd30f7197", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753278, "uuid": "ea6fc96e-bfec-4e7f-a939-21f719e6bea0", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753278, "uuid": "856bd6e4-6a38-4938-aca2-6f30f24a2d4d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753278, "uuid": "8bb4ed9e-f97d-4c38-9de3-626b5c6cca4e", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753278, "uuid": "fd3c8302-17a8-4dd3-8068-8e9b834c14fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753278, "uuid": "0e1f8619-1f1e-4d89-8a70-0a1ef87c9f86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753278, "uuid": "704e23f9-ef1f-43ab-b3e7-bc7a1b96180d", "value": "d3b03b0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd8f985-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738835, "uuid": "323f6d49-121f-4d0c-b68d-c7633ae36a6e", "comment": "Malware payload (Dridex)", "value": "b1e37926ccce01748afb19f13b8e1d41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738835, "uuid": "d51a65ef-2c08-4587-b6d7-017ab055081f", "comment": "Malware payload (Dridex)", "value": "3e4af1253a4db5622d212b60313577ec1f50f4de5432a0cc086be6b6ed2645ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738835, "uuid": "365fe329-3f8d-4547-aa35-23a96b254597", "comment": "Malware payload (Dridex)", "value": "4959b0d593101501906f607e61c6c34ce36d148f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738835, "uuid": "7b4785e1-fe40-4194-b5ca-7a25506b6a82", "comment": "Malware payload (Dridex)", "value": "7a205ab83b8f23d61921803509bcdff8092ee84ecc9dde12401138b3a74bac8fb78f15c1a1c83c4d57a0d89dbf2be454", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738835, "uuid": "ebf711e6-705f-4676-909c-caf0641f00bc", "value": "B2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738835, "uuid": "77cf0bc4-034b-460c-9618-dbeeb60f9598", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738835, "uuid": "1814fca6-2169-46e4-9d97-fe5fc8a81c21", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738835, "uuid": "b4bdf4bd-0ea2-40d6-a804-eea0e971813e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738835, "uuid": "a690e89f-52af-4628-ba24-f4342fba673c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738835, "uuid": "2fa1b532-3e5f-4e62-9635-c444ed54b71f", "value": "b1e37926_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d3aecf-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731708, "uuid": "cc00ff90-4995-4ccf-aed5-4df6770b6a97", "comment": "Malware payload (Dridex)", "value": "d3412654343974ada7f6920906abe3ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731708, "uuid": "87ba48c2-748a-45f6-a13e-c23e07b61c64", "comment": "Malware payload (Dridex)", "value": "3e9f045d426cc7ea522aee554a7f8a094089cec5443118c0164730b99dceeda7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731708, "uuid": "98f299cd-8b21-4964-b86c-77153a5f2bdc", "comment": "Malware payload (Dridex)", "value": "c18f711b46caac52366ad010d34d7e916de021ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731708, "uuid": "a8b613be-c126-410e-acd7-ede2c1e024f1", "comment": "Malware payload (Dridex)", "value": "dd1688fa10ff0287196b51113925feb7e6322ba1d17596974c613bd39e8bf28af764eeafcff685f46adb98f671b600fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731708, "uuid": "7179bfb9-2f19-4338-a7ad-12e37565a231", "value": "16F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731708, "uuid": "307a64a9-d23e-4148-92d5-db88ce119a82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731708, "uuid": "10a3a79f-0374-49c2-aae1-99648f2f6108", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731708, "uuid": "d7669c09-4feb-4496-92cd-f51710481ae7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731708, "uuid": "2a161201-3001-4a06-ba52-8f4f11a3e9c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731708, "uuid": "4b674a23-4f65-4861-b585-7b2249f8f540", "value": "d3412654_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24345fd8-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738876, "uuid": "85185dfc-a0f0-4fcd-9ecc-de263a9960f8", "comment": "Malware payload (Dridex)", "value": "d85004e396fc047116ffe43f884b9a03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738876, "uuid": "b60de2a8-1265-4d29-b89c-0f5be5e5cae8", "comment": "Malware payload (Dridex)", "value": "3ec226639f7c48cbb199d43a032b9c9350f3e962e920f56780cb9bcaac7257cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738876, "uuid": "b448a17d-b2aa-4184-8165-2bceebe67f94", "comment": "Malware payload (Dridex)", "value": "c77daf5cafbfe78b84ede6c659ed08be88f99918", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738876, "uuid": "f0609360-b289-47e0-aff5-d327b59c6de3", "comment": "Malware payload (Dridex)", "value": "861d26cf90d2097fa672f29d8253a23cb6f055343df7cf2d80e7f36d80b41dcd22f1dd867ea5be9361528b77214c5fea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738876, "uuid": "db8d0e56-70c6-4210-b291-4f37481a3512", "value": "A9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738876, "uuid": "a0522ff8-2dfd-4a19-9011-bcfc862e891a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738876, "uuid": "18281a77-b3d5-496c-a318-46d204be8570", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738876, "uuid": "b36965b1-5601-4752-8aa0-9337f3e81729", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738876, "uuid": "0547f10e-fc22-47bb-9e8c-5e5413900c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738876, "uuid": "28195c87-c1c8-43eb-aa0a-bb18fa8f0e60", "value": "d85004e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0587b426-bbd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782204, "uuid": "bea60428-9273-4f6c-8d24-d0ecccd93394", "comment": "Malware payload (Dridex)", "value": "dcef51c6df5b35b51420fb9055e6716f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782204, "uuid": "d13fc089-c79f-4619-99cf-3efc50f851ed", "comment": "Malware payload (Dridex)", "value": "3fb77481cfa4af531587faa340b1da96ffd73d288290934103e98e078ffa264d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782204, "uuid": "4b0f869e-bf8e-4bdb-9f17-2ac465128d5c", "comment": "Malware payload (Dridex)", "value": "be0c8f5f9e2e8d9b7ffd89c685d7d83781e626a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782204, "uuid": "29b2eb9b-60ef-469d-92fc-aee6a1586c40", "comment": "Malware payload (Dridex)", "value": "1c9ba288287c0128a132dbbb529fbbe1f337dcc5349db7fe81ecac47b355e82f0752dd550cd7d2403589af1628f230a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782204, "uuid": "cc68c597-7114-4fb1-8936-eabcdf1fde7e", "value": "67F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782204, "uuid": "391492d8-fa71-4ddc-94ea-b40f7f70cc15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782204, "uuid": "aaa54b7e-d848-498d-8c59-18c9c61c0638", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782204, "uuid": "783d46d7-84e3-42b7-ab72-1d7ee77d8e78", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782204, "uuid": "ebaf562c-d5c9-4632-8ca0-5186944b4e18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782204, "uuid": "f3416e97-e960-4641-a88f-fbebf42f134c", "value": "dcef51c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271b14f3-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738881, "uuid": "056fbe25-ea26-4ae5-8218-4f49d8793cdf", "comment": "Malware payload (Dridex)", "value": "516fa2c6091e54d4ee184ae63a7591d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738881, "uuid": "6adb4737-0b45-4683-8fe9-346e0039c7ea", "comment": "Malware payload (Dridex)", "value": "400b2b823af31e6c7fbcb9c1813a0f79e2051c6c255292e83493cb6f3111f1e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738881, "uuid": "fb2b964c-a5e2-4466-86b5-f0ffabe3b980", "comment": "Malware payload (Dridex)", "value": "c3bbc5a6800f286c9403d58d924cd0aee9782266", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738881, "uuid": "b8d6a081-5e5d-4535-a0ea-987de5495095", "comment": "Malware payload (Dridex)", "value": "2ee499d62c0b9ce38f2f72d2d2666247b65a03af40a94ec6d2d8f9c3fcdfe7ca3f2ad78d12dfd1ce646244e2603b86a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738881, "uuid": "76220b53-21f6-4265-9e25-6c75b4526569", "value": "A9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738881, "uuid": "5ba9c4dd-fdba-4de5-acf1-1491512942f3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738881, "uuid": "0dfe36f9-34dc-40d8-8b97-3f9ce18f8754", "value": "3072:BA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:B3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738881, "uuid": "f960f2c4-85f3-4f1a-bd15-f9bd301fe72a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738881, "uuid": "bdf20ff4-75a8-4ea0-811a-fba0085210e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738881, "uuid": "4b9559ca-b975-4dd9-9b62-a7196e61f237", "value": "516fa2c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0ecd41-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810912, "uuid": "52fa0855-70e5-4b6b-8a65-2d9c6e990f15", "comment": "Malware payload", "value": "60cca845ae1ba5e5d30a4bc6a1df73ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810912, "uuid": "500a6022-9b8f-4800-98a8-82728165ca8f", "comment": "Malware payload", "value": "400b6edceadf7bddb6daa209ef92b98efe127324f5294fcf0fb5b015e8269481", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810912, "uuid": "a1acad31-5771-432e-b090-8c0c811278bf", "comment": "Malware payload", "value": "ed20cc868cf847f43cff01584bd5f8f2cbac9a44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810912, "uuid": "567e2425-0cc0-4aaa-8f05-13135707911e", "comment": "Malware payload", "value": "ca5eea6fa51a8ebe494b8c7989360e517f846fd5ed8e4ef287b23d6973fe3f291dd2a7ce6c6888af6f9a1d70f8f68001", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810912, "uuid": "2da15d48-220b-468f-ae4b-6e4899b749ba", "value": "B3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810912, "uuid": "07c1342d-fa28-4e36-9d4e-9cbe6f679785", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810912, "uuid": "2948509b-834e-4c1d-9091-0fa72390f420", "value": "3072:SA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:S3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810912, "uuid": "1d91c8d1-8cd3-4315-a9ca-3c6d5da097cb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810912, "uuid": "3521bb5d-ca0a-4348-904e-c255d407c04e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810912, "uuid": "12bfe89a-bf1a-4d52-ab43-50b06f79ee13", "value": "60cca845_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0c0224-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800069, "uuid": "3da3176f-2ea4-4d43-abc0-61234d83b84c", "comment": "Malware payload", "value": "d973135626e1a52b7dbc0c8845bfbcff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800069, "uuid": "bf2fd6c1-ee28-4c0a-8a27-0d38fdcd1b2e", "comment": "Malware payload", "value": "41ad617c31969061e0a3d8c3c769a45cbe989912344606a8ebea4cdc03483634", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800069, "uuid": "ec5d8a2b-e3a2-44a4-bbea-62ef83731d8d", "comment": "Malware payload", "value": "2516d36fa9451bb60bce0e85bd30b99b44621ea9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800069, "uuid": "4285d732-8af9-4db7-b2f4-b118fe083879", "comment": "Malware payload", "value": "fee0a2cc041733561779e3645810ec34802c55054959f529c47a541e7b108db00b67a747bbcaac04c5eb5e3c2647791d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800069, "uuid": "31aab21f-1784-4ef4-ae88-1d9c23ff28a4", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800069, "uuid": "490f04e1-f4db-40c4-b867-63752f31ec06", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800069, "uuid": "3854c678-3c17-469b-b0be-3d1545290775", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800069, "uuid": "e22ea3bd-bba4-4bc1-8fbd-678d0d18a239", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800069, "uuid": "24d381c3-7a2b-4c7a-8a46-6021601fbd7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800069, "uuid": "76b9bc18-3dfd-42e1-8004-fa4c4cc81bed", "value": "d9731356_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7bb001-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771238, "uuid": "58946a8d-040d-4334-b302-af372b9caed0", "comment": "Malware payload (Dridex)", "value": "f39c3957f8097555a09ca08f456ce840", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771238, "uuid": "9c77734f-4a17-4627-a208-060a53e6cf88", "comment": "Malware payload (Dridex)", "value": "439e8639f34113c8d062a4ef38e0d1ee9b02e0ebd7e9d630ca523743f7b9b56e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771238, "uuid": "33bafc8e-5e53-480e-8cc4-996f6a454386", "comment": "Malware payload (Dridex)", "value": "98ba223b49886b306e6f3233a36c70246ba98599", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771238, "uuid": "a4154f45-b7e7-4e66-9f28-1831c1b9c751", "comment": "Malware payload (Dridex)", "value": "d4f719923b99574e192e9eb9e1facb5a7090f29dce7c67e1e27d7d8fd555e07c43293e10519008669258f2f2b61e7fc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771238, "uuid": "d9c8ec52-e1b8-4af7-9e83-d644c124acbe", "value": "D8F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771238, "uuid": "8e61a6b6-518c-4408-b8cb-6bfb85223919", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771238, "uuid": "ad77358f-6258-4413-ad5e-f6cba5e6cb77", "value": "3072:R9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:R9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771238, "uuid": "79f0ae10-d138-4ecb-a88b-6cfc1e19c252", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771238, "uuid": "126cbe4a-f273-4acc-89f5-69e21192a792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771238, "uuid": "9cae0a92-51fe-47a9-8299-5e249da3d85c", "value": "f39c3957_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f66019f-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767698, "uuid": "a2d31707-d83d-420b-8e75-1904efdb6842", "comment": "Malware payload (Dridex)", "value": "24e69b919901495e0da3a822b7c63bdd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767698, "uuid": "e8720f47-a1ef-41bc-b4ad-f01184c3bdf7", "comment": "Malware payload (Dridex)", "value": "446ab7f5ea79d92494d85dc39e6a0fcca4ad72b4005268d0033fad2e76d83abc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767698, "uuid": "6ef9d3e0-6db4-407d-9904-8900e3a2a992", "comment": "Malware payload (Dridex)", "value": "a434c5d64d4189e2a317252fdc5ea6caffd01957", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767698, "uuid": "c71da568-89b2-4bb0-ac91-7b48ed8ceda0", "comment": "Malware payload (Dridex)", "value": "c38360ddb800f7bb089a1073fbc26329724e9df32ce1947075a0b8bcec87a84ee6c2d6a017244c422deb84f5e5b73232", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767698, "uuid": "0dacb267-2cb8-487b-a58a-3f7b1734955e", "value": "7904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767698, "uuid": "ecb37555-481c-49b6-846d-30918ed07f74", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767698, "uuid": "6b23ffa3-2063-47ae-9a17-a96b2979f8de", "value": "3072:PWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:PWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767698, "uuid": "2b29fa23-c8dc-4c61-a12c-5977b35dc46a", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767698, "uuid": "e041a44f-c443-4ee3-b975-34397865bdad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767698, "uuid": "b7ba6c40-0927-4b8d-a701-e718fed8a2d7", "value": "24e69b91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83612fb0-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760511, "uuid": "6e80de10-caf8-4dbc-bb5f-87410ee34b37", "comment": "Malware payload (Dridex)", "value": "6ef8b940ca39a0b14942aae6886aa65d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760511, "uuid": "1c0742d1-a7d4-4a00-9b6e-ee7a94c74854", "comment": "Malware payload (Dridex)", "value": "45395470981b5fb09e70ec701aba0fab522a188d8583cc37c6a3d9fe8e29f8da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760511, "uuid": "16b33de2-3eed-45b1-8003-ffa3e4f7df25", "comment": "Malware payload (Dridex)", "value": "f4ededbc27e620061e06e5e70601683915e6cf0a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760511, "uuid": "ef2c4e2e-57b3-487f-a59a-1f9b54a54aa7", "comment": "Malware payload (Dridex)", "value": "2785c5de6c17c67cb913c72571c0b282da0ee0fa28a41261406b20770596a26019c61641e9171b8325bcc4ae58d8db86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760511, "uuid": "627ca93f-10d0-4d43-9d60-615acb1a180e", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760511, "uuid": "70745319-ff82-4dbd-b5a0-9eb58b9c40cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760511, "uuid": "c48bb165-fe1a-4014-8cfa-d9a490876387", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760511, "uuid": "f0937794-4f82-49b3-bc2b-45759d5e32a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760511, "uuid": "60b85918-7905-4649-a0b6-76da02d5a249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760511, "uuid": "870f9a38-3d61-4e46-b16e-c59d6cc32a32", "value": "6ef8b940_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b9e1dc-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621789236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789236, "uuid": "da238b0f-d40e-49dd-a949-51394f347627", "comment": "Malware payload", "value": "faebcfcafccf09f292f257b5b5f2b625", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789236, "uuid": "86e564ec-79ff-448e-aa06-d34dcc814ca7", "comment": "Malware payload", "value": "47c0e3903d0ebf293d8a02b379763ffdb206116df8976d9b8881d844a8a2928b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789236, "uuid": "9829b01d-f2d3-40c0-b5de-5046325eff39", "comment": "Malware payload", "value": "13f8835f3eaae65068498a75aa4c883365e6cf3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789236, "uuid": "8f9b1d34-671c-4b85-b685-863342820f01", "comment": "Malware payload", "value": "c1714b1e9ca5c4937cfd55db5ae8c02020b4a95283f7be6326c8c6a71da36dce3e19637b8bb66dbdcd10d7dca8063a6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789236, "uuid": "6f6818a8-12a1-42d3-8415-de8d9761201e", "value": "5E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789236, "uuid": "abdf2427-260e-45e6-bc8b-7ea9eed87af9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789236, "uuid": "ef2c518c-6266-48d0-8ea4-9e35998b0888", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789236, "uuid": "c3faec8b-840a-41be-a82c-5f72928ea099", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789236, "uuid": "65b7ee03-ec06-4a04-b6e2-77244b953fec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789236, "uuid": "584098a7-ecee-42a7-974a-f60e56d16f41", "value": "faebcfca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac9d538-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792870, "uuid": "99a9e57e-d719-4e42-9f58-8571851cd654", "comment": "Malware payload", "value": "c3e7fe526d3e45b3b9d817295910bdc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792870, "uuid": "42f05918-7b46-49af-8fc5-531a749a3c0c", "comment": "Malware payload", "value": "47e3e6d83221965b7066d3d820b986b91b10e697470e059fc3b069e272f7bd4e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792870, "uuid": "f8a30cd7-ed5f-40a4-aa90-e565e9f135ee", "comment": "Malware payload", "value": "5e480054afc3543055d73ebf492b61c2086373b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792870, "uuid": "71c61d53-9c42-4013-8f97-ecd76b4e354e", "comment": "Malware payload", "value": "41728e3208f86a4f5250df2b9ee43cb65c058d4ce6706ce30af74a56b315bdd650a66cc2ca40d1d95b53b9c5c6978f4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792870, "uuid": "a15c419e-d89a-44ad-8956-18b504cbdbdd", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792870, "uuid": "0d9d4de9-f9c9-4ffd-aa83-1b6c7370aa06", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792870, "uuid": "db51e0a9-139d-47bc-a57a-a18ee7b64d92", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792870, "uuid": "28d980c0-d4f2-490b-b064-1182e64e4c3b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792870, "uuid": "210283e7-32cc-4f26-a255-3f032597d198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792870, "uuid": "b1917e4d-dc5f-4205-8b12-0b1811177347", "value": "c3e7fe52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccfb9ca-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749709, "uuid": "002df6b4-cc13-4973-af92-5b7fc1eaaf7d", "comment": "Malware payload (Dridex)", "value": "5deb7060d283d586fd1b8b5949b9b3d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749709, "uuid": "a1484b58-2734-4d6f-bb3a-46b876e0b4a0", "comment": "Malware payload (Dridex)", "value": "486672e2d0ef50402bc77caafff2f3746d38e0ef203888ae80e34e0b60cc6e65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749709, "uuid": "96784cc2-f964-4124-89bf-a0a073464bcd", "comment": "Malware payload (Dridex)", "value": "2b398cdf311dd5293a10f5f6fef6bd1d2ce5ff3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749709, "uuid": "a9fb90fd-3d38-4997-adfa-f46afb4b7b4e", "comment": "Malware payload (Dridex)", "value": "4bfebaa1af867a8a7094e8aa8d624e427405f4814eee58090ebf4e35b5995e2615fb92204b8b0a8a0ce03f4b4c3f67fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749709, "uuid": "8aa68740-0c6e-4628-bc86-514e7f88b58d", "value": "9B04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749709, "uuid": "e99ebe80-1224-4a84-95d5-822d76b6dc30", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749709, "uuid": "3c28f35d-c055-4cd4-ad2d-4e5d4aa553f6", "value": "3072:3WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:3WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749709, "uuid": "9596f836-0c96-4b64-aa45-ff9796010587", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749709, "uuid": "c9165824-7fd5-48c7-9128-176e71eaaf75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749709, "uuid": "0bbfe2b5-1a50-4927-b3d0-9f9319c1b044", "value": "5deb7060_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0195a6-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800098, "uuid": "3da274da-2cdb-4251-8a21-88f8d465fe2f", "comment": "Malware payload", "value": "dcec2fdf7bf6c48dfae55aa1d974c2e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800098, "uuid": "96373f1f-9bcc-4bcb-b645-8a31266aad29", "comment": "Malware payload", "value": "487ed0a95ee50a2bee2d174619ed8c6938da44b15287d2c1c9bb02cf84bffa03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800098, "uuid": "3739d98e-2470-45e9-aeb0-6676f342015e", "comment": "Malware payload", "value": "d6a21fab8e9eaa8e713aa570c146c1210929d3d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800098, "uuid": "cafbb87b-fe69-43fa-91a6-8fc95a81d216", "comment": "Malware payload", "value": "6e0cf8e2d3bdba03204da168cd35c8da7cdf3a6b4f6afea8b1e024b75efed9666246a9001720833d02f3d2473dd2b55c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800098, "uuid": "591f5840-815b-4723-a885-d8b0e0df61b8", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800098, "uuid": "095c0c49-1aae-4eb8-88f3-1e7b1dbb10ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800098, "uuid": "43519499-52ec-42f8-9d2e-a7d20358403e", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800098, "uuid": "d7ea4162-3098-4a4a-aa1e-6ce132e491fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800098, "uuid": "f48d4899-251f-4ccd-8e41-75c4a2b16a69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800098, "uuid": "8d07fd03-78e6-44fe-aa3b-b7edc743a37f", "value": "dcec2fdf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753f7522-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760487, "uuid": "627df4db-a12b-471e-9a09-2bf3bb8dcbe7", "comment": "Malware payload (Dridex)", "value": "12f984016c39aa79530371c47c3f63f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760487, "uuid": "b8e50b13-d89f-48e2-8227-b4e78bcb52e2", "comment": "Malware payload (Dridex)", "value": "48a9e233ee1a8bf5453fe09a320d7b961ef8cb760b1dece2170f7f7baddc1359", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760487, "uuid": "144e53db-145f-462f-a08f-c0a9f5e17629", "comment": "Malware payload (Dridex)", "value": "8efbb5615312466bd3655ffc71efe618e55957f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760487, "uuid": "2e78b7ac-9fdd-4c74-9ef2-b3462d532e86", "comment": "Malware payload (Dridex)", "value": "0dbcebf336587e7be87661547cfaf8ddef946631b9bdfe6b68712793ae184ce1ef68a2fc1447f5df42bb04e871b3890d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760487, "uuid": "efae6a1b-4dc4-4530-828e-c05786600622", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760487, "uuid": "109c23e5-d598-4f8e-ba72-2fc33ab50cbc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760487, "uuid": "a9db30e5-c554-4da3-bad2-b6a8dc20d06f", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760487, "uuid": "ea3e1904-a56f-4715-8558-4a6ae4ee7449", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760487, "uuid": "63302dd7-8585-4f04-aa0b-f2a369f6a9f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760487, "uuid": "d7ade51f-48f6-4116-8a09-f732721df183", "value": "12f98401_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b71f02-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621735262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735262, "uuid": "1ecbe40c-4495-4d4c-bb3e-0ff11a9f0fdb", "comment": "Malware payload (njrat)", "value": "870715f8b879f255e37b1d99186f205e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735262, "uuid": "977b115a-4c45-4d15-ac90-5048f8deb75f", "comment": "Malware payload (njrat)", "value": "48e7da4ca66669d1fb0e820565dc6261b5413940ca64e019498536900bab09be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735262, "uuid": "a240f8e7-79b8-4878-aac4-b60dbc7ab164", "comment": "Malware payload (njrat)", "value": "32300b69fed88d0cfa2bb9fa7c2e0d18874995ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735262, "uuid": "34241ed9-01ae-4800-a5ad-cb71935357ce", "comment": "Malware payload (njrat)", "value": "5a75f834a99f03fca6ca360fa4b997f7e8d2e410e23789d3834d38377027d9c5718e934a1f205f5c3593a4171487da16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735262, "uuid": "8c2f4053-f762-4534-8c07-1b3cf6bdc3ca", "value": "B694C0430AE59D51F81C953515E25AC19B33A2524D3B8B3A393B7090CA7EF943FD22EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735262, "uuid": "d5259a6b-5fd3-46da-a94d-11e9d3af7d10", "value": "cd74c16e19de02339ba1d593de4c426e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735262, "uuid": "c21cb83d-2693-4a5b-8e82-545cf7395c5a", "value": "12288:g2HVhkEupQi6slARubCWVLwzwxjNfLdY88zQ7Yc0pTdp7VwKp:PHVhkSWVYcFz7m37Pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735262, "uuid": "22f68fb1-9669-4992-8db9-c4fc25c26feb", "value": 414175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735262, "uuid": "9b871f15-61aa-4b72-a092-967a2182169f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735262, "uuid": "fd92c67f-d644-47ef-baf2-4f3862909971", "value": "48E7DA4CA66669D1FB0E820565DC6261B5413940CA64E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c3472a-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749662, "uuid": "c64f27b7-8ce9-4d97-814b-6cddf38043d1", "comment": "Malware payload (Dridex)", "value": "c4b00be8f799d8387e280652232edde7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749662, "uuid": "2b4a187d-2717-4e7e-bf2c-857fe091a409", "comment": "Malware payload (Dridex)", "value": "49cc1e2f39ca09b9556318a679d8ab6f35066d16bccfd904f311ba52499dc226", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749662, "uuid": "93ad340c-cd8f-47e9-8619-456cfb3ae43b", "comment": "Malware payload (Dridex)", "value": "1a6a04e001c97725901ac949ee92efc4a3d3a19f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749662, "uuid": "1e07d647-ec11-4f70-ab2b-0388266ed071", "comment": "Malware payload (Dridex)", "value": "6858cd2dcec9e663d0b26e9b2430969d3a93536dacf2d77e4b9a33424e5af56da1cd3aac2a460d8081201b5a0286bb8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749662, "uuid": "ef41583d-6a9b-44f1-b010-1ee336e423af", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749662, "uuid": "6cfd42c0-f8e9-4dc1-a8cc-bc4d04b0bc43", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749662, "uuid": "5aeb0778-015d-4969-a3e3-dbfc7d0b9aaa", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749662, "uuid": "d4dad8c6-5cce-4764-8a54-c494fcf82fe9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749662, "uuid": "eababb91-a9fe-4002-a06c-663a6df45ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749662, "uuid": "3e198d51-4ebf-4c3d-af3a-ba1d7fa7dd44", "value": "c4b00be8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196a9444-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738858, "uuid": "6a9684cf-2458-4446-99e1-16fad370e495", "comment": "Malware payload (Dridex)", "value": "b5a3e05d5516dfeae8b958aca464d784", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738858, "uuid": "f7aae50e-9ec1-4028-88c9-7c02d4c9792f", "comment": "Malware payload (Dridex)", "value": "4a08a8326cd80bdc2cef912680e3a85aa731b0a56a1ea91afd49ee9476903272", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738858, "uuid": "3c1a1cab-5a35-4b44-a2b7-fc9d378225d7", "comment": "Malware payload (Dridex)", "value": "74a5ac07711f7731ea77571b3c862e28dbafadc3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738858, "uuid": "940cba29-dcf3-4fdf-8e23-6a58f5cc93ad", "comment": "Malware payload (Dridex)", "value": "cfb19b1342de3c8e39188ceb45239da0419b1fe5c419902cb35aa9858edda23c759003eb2e70dfd215491d0bc6ef8120", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738858, "uuid": "9e41603c-ab93-40a0-9b8c-b92ad8c8eb08", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738858, "uuid": "f3c649ff-9724-498a-91f7-575fd44f868b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738858, "uuid": "24fae549-c21b-4f37-9086-c57b810dba61", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738858, "uuid": "d010375e-fd1f-46fa-8fa6-c9b0104dde64", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738858, "uuid": "ca5e792d-a8c4-4281-a379-ce0465bb8288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738858, "uuid": "6d3568d7-ed58-48d9-bd04-27797ceba4f9", "value": "b5a3e05d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d151da-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782099, "uuid": "4fadffd8-4d14-4ce1-9435-be0f6271045b", "comment": "Malware payload (Dridex)", "value": "86de1e986c2a790985fc19a232766d47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782099, "uuid": "9acfe19d-0587-498e-869a-06d10c8e53d9", "comment": "Malware payload (Dridex)", "value": "4a16627ab45d1a5750e680acf48df77fcacdcdacf18104236ca56eb592e6ac65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782099, "uuid": "fc395435-2525-4544-9dcf-126a101b43e0", "comment": "Malware payload (Dridex)", "value": "d2bb5c18495e2d5b0226c8b6cdc5378c70658fd4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782099, "uuid": "95782797-b1b0-4a33-8f32-284b6ecc6735", "comment": "Malware payload (Dridex)", "value": "170f64769f545580c0b29dc4135ab87d86fdb2e6cc4f6e8c9f461f23d936276c7f18b4ee605ffb5970661c023b1a6722", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782099, "uuid": "91489250-bed8-48d9-8e69-09b355163640", "value": "3BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782099, "uuid": "156b9182-c4ed-4f15-9bc3-be0b72e87ed1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782099, "uuid": "2ecda26c-e9d1-42e4-aed8-9588dbed28d3", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782099, "uuid": "f8410828-55ca-467c-8d29-1b0f6f587333", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782099, "uuid": "a277d14a-2969-439f-9db7-f4f33e2de0a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782099, "uuid": "3899e942-02b4-4716-84c8-bbb0a1e3df27", "value": "86de1e98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e5909a-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771309, "uuid": "1c8afb56-ca2a-4eb7-bd50-7058a3ecb6a5", "comment": "Malware payload (Dridex)", "value": "82b97cc84e5176decd5f8d6ba20934fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771309, "uuid": "ed459603-037d-44cd-ae74-7a545b5de7b4", "comment": "Malware payload (Dridex)", "value": "4a16c62d3dd0ecc3f4bbd6e19af292c041fe07a3c7ddf149fea79d1f37c3962d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771309, "uuid": "12658852-48bb-48fe-a280-ba9c13e78a28", "comment": "Malware payload (Dridex)", "value": "7c6e688a99bf5adb912d6bf20f4bdc1fa853a58f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771309, "uuid": "3e47ba06-8b09-471e-838b-99d0680ddc8f", "comment": "Malware payload (Dridex)", "value": "b9ec0da2b86657887faceb5863db9de89d9a32c2d444f4b133dbdf41ecd455cebac51ab82768747df43de68259a3fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771309, "uuid": "977937d6-17bd-4596-9395-c668966c1ac6", "value": "AEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771309, "uuid": "2e2f4803-9ebb-4161-81ad-9582c7f947fe", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771309, "uuid": "cdb73498-e0ef-4efd-bdb4-8829d5c5e08b", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771309, "uuid": "3e0c4d75-9a81-432d-85e7-646e3b19967e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771309, "uuid": "bda25dfb-74d6-4c00-afcc-4cffdf63ad65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771309, "uuid": "e4c13359-72c7-4565-87bd-a1a65a4c454d", "value": "82b97cc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7a7668-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749656, "uuid": "ff72b564-8a73-493f-b834-5dcf5838766b", "comment": "Malware payload (Dridex)", "value": "afea2f2e4704ba05c046e6cdd2996c23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749656, "uuid": "eccd8c4e-53ea-41e9-ac7c-28799d85203b", "comment": "Malware payload (Dridex)", "value": "4b50ceddd345ab4832346ae27c6cfad8943df79fd54dba9d0fb6e376665b3755", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749656, "uuid": "2d23f855-2a40-4c6e-8b75-3c6cb5fe3c01", "comment": "Malware payload (Dridex)", "value": "cfeec6918d9511fb00e7f6500bc8ba9fd4e552d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749656, "uuid": "1f6caaea-89d4-4d29-84a3-d23cf1c6ab5a", "comment": "Malware payload (Dridex)", "value": "ca55eae23f744e516b71ea65ff1130a24a540a8719086ce5a93552b2804a421f7a770cc410dfe5f39a0cbc929e813691", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749656, "uuid": "66762d99-a0d2-4d3e-a36e-b90fb3bea770", "value": "65F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749656, "uuid": "c07d4507-dc82-496e-9f8d-e27c91554feb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749656, "uuid": "783eb221-6a3d-4aba-83b6-0a61229185e6", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749656, "uuid": "0e055f67-1795-4e54-bf88-353c4a3caecf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749656, "uuid": "80bc3f85-8526-4dfd-af37-69e0fa94b9a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749656, "uuid": "289f85a7-05a6-4b80-83b3-3243d378b0d9", "value": "afea2f2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52e7aae-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792860, "uuid": "75cf2381-50c4-41b2-bd80-5da6fa90024f", "comment": "Malware payload", "value": "e2140bf63c3183ba50f3cff78e5fd8fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792860, "uuid": "384f52c2-e7a4-4747-8446-413fced5a24b", "comment": "Malware payload", "value": "4b82661ccb344bbc803e354702950d32f379b8593751507927ef18fcc13a68bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792860, "uuid": "ceeec896-7ac8-4a97-af2a-581401bb44e4", "comment": "Malware payload", "value": "67590cadd901b9fb3f967e6ec3249751f75f6051", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792860, "uuid": "e8a145ea-2cf9-4568-a206-3387cd4a2bbc", "comment": "Malware payload", "value": "fd3ed0bd16f1a610e23ca20cfaa1e826b7ab2218552035b141da3a96bf1088e646d57b0d88c330c4e02b768f9d4c05d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792860, "uuid": "3e8f8aef-5741-403a-ae16-ba97762a4f08", "value": "3CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792860, "uuid": "e9b3e989-b8f7-4d05-b1da-5ab2a34425a5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792860, "uuid": "4c3f2455-eedf-466f-b99a-f62bc737c103", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792860, "uuid": "23374d59-41f1-4aed-a980-a44845e5c846", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792860, "uuid": "8bbb464a-fcd1-4497-a84f-3e273b5a5488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792860, "uuid": "519222d0-b6ac-4bc9-8325-07c0b1b50951", "value": "e2140bf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5030b1-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771260, "uuid": "b9f5ad2a-1cb7-4d12-8038-68aeb826ceef", "comment": "Malware payload (Dridex)", "value": "ca597356437ac975dc0246cf8f7a8ffb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771260, "uuid": "d48aeffd-1a8c-4810-8bac-ecffabd93b41", "comment": "Malware payload (Dridex)", "value": "4bd2eb055b62d82e3b4d742824d817060c5bfce46644e2b951b5b4094a41e6b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771260, "uuid": "47a428a1-351f-4d04-9d23-51b6bf8805ed", "comment": "Malware payload (Dridex)", "value": "c5dd71603a3e9f3ad5cbfc9eab720591906dbef8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771260, "uuid": "17460201-9338-4609-bb3f-c61ed44e30dd", "comment": "Malware payload (Dridex)", "value": "d73234c7a5c92e1f21ea4b2853cf0fc97ce836e8c1d62eef179ff768c83154abd36461c51d9f006e5721ae95a9a2a89f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771260, "uuid": "dff4df29-e2e1-4621-a727-6b5dd9c8593e", "value": "CEF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771260, "uuid": "1b03e0fd-5d3f-48d4-8fd8-aa28ae447838", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771260, "uuid": "db836ee7-0aa7-4e3b-813f-c48ee056cb69", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771260, "uuid": "2e3b5070-7405-4ce7-9e06-cf1756bf5556", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771260, "uuid": "40ce29e0-97b0-4786-aae1-2dac3b7b4c25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771260, "uuid": "50fd7f2d-5bcb-4d30-988c-d6f74ee95992", "value": "ca597356_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c49fa64-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807234, "uuid": "088419e6-7e46-43da-beb1-e31bcac2fa2f", "comment": "Malware payload", "value": "367d4de715380db4d3a54f7c95d46105", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807234, "uuid": "fd25097f-03c8-48ba-95ac-926331d8437f", "comment": "Malware payload", "value": "4c44746675af2a8814c4bf12c21f23f3d89b2e1ba27af5c6ecf3aab5f3fd858b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807234, "uuid": "ca5c2a1c-e483-4573-b56c-c0e913c14f96", "comment": "Malware payload", "value": "5b777bb2cd50c7bfcd39160e88648c562e3972f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807234, "uuid": "758c73fb-b15c-4a3c-9829-3c3e064350e6", "comment": "Malware payload", "value": "57471ec7bf7cb77401e4cb224187e868c5abaae97c165ac3bedc8290df476c9e3553aa57deaa25581305e9df1d5947b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807234, "uuid": "02c363a2-2557-44c3-9ade-a52048c8ec10", "value": "81F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807234, "uuid": "12dde599-ab0f-4fa1-a850-51cb56e61dd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807234, "uuid": "28fd3c4f-71f4-4a67-884b-af17123a5aad", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807234, "uuid": "f48fc4c7-9430-4417-bb88-230bf2000884", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807234, "uuid": "86dae960-1cff-4d82-abb8-56b2d795f696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807234, "uuid": "89baec30-8c0d-4bc3-843e-562f54544da6", "value": "367d4de7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff3aed9-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749714, "uuid": "8a0952d1-726e-4d69-932f-3ab412c42948", "comment": "Malware payload (Dridex)", "value": "092334210df55921fa1f0eb73c1b52b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749714, "uuid": "076c3f1c-0441-4689-8ad9-9a811e395f24", "comment": "Malware payload (Dridex)", "value": "4d4878e78fa275195e0982683cea180a1a7a9345826ba2ddd37421720bd33a12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749714, "uuid": "62bcc380-a410-44d1-ace7-74f72f4ded2c", "comment": "Malware payload (Dridex)", "value": "cd5d8c2f029caf40c667669a46ea8e04b508a68d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749714, "uuid": "684ca3f1-f30c-4449-9f16-3f23c31630c4", "comment": "Malware payload (Dridex)", "value": "8904f291da1bdf50df285f07b64c2c939796979129da68e82abbd3ee280759d8e5490c6a8b0226fafeffb6811cc6b4e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749714, "uuid": "4d6e6531-4698-4265-a2e7-bf64b8c45e7c", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749714, "uuid": "0bdc9633-c853-43a9-bb3d-43ae812ece64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749714, "uuid": "fe01fc1d-9faa-4454-8bda-f05f271cb62f", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749714, "uuid": "c61d9815-5412-432e-a255-6d3b13bb2e19", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749714, "uuid": "3b87c98f-9adf-4a30-92e0-055b8ae10111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749714, "uuid": "9677fc96-c329-4843-b80e-94e602cc47d2", "value": "09233421_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdad365-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756935, "uuid": "36f1c80e-ff60-4bcc-88d8-a3bf7509fb87", "comment": "Malware payload (Dridex)", "value": "fcf15655760186534b89da988917a6ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756935, "uuid": "2094259b-5ea4-46ba-91f0-534506bc306c", "comment": "Malware payload (Dridex)", "value": "4d7fc7abb618353660b7ae66fcbaf71284de4fd3d30392cd7179f27a5ffc3a5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756935, "uuid": "081c6283-e3da-4f27-9902-2c7c63ab0649", "comment": "Malware payload (Dridex)", "value": "5c5d75e7c2ecb49045cb8948363dc5be97a4de6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756935, "uuid": "3f8a52d9-12c0-4bf9-9f90-69f9c864a16e", "comment": "Malware payload (Dridex)", "value": "4676f86c9b2efc886081e961c85693f0e591eea37467472e8c7cb762506c95b97949037955d914b0ff120ba4ee71c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756935, "uuid": "ac83aafe-e183-4fb6-a362-1da72fd33c86", "value": "D1F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756935, "uuid": "38bec613-fc64-483d-b7a9-f6260b84a94f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756935, "uuid": "63e053c2-f165-4881-92ed-0720882507a5", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756935, "uuid": "add8092c-10c5-422a-922f-17cbeb286b42", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756935, "uuid": "88b5b3b5-0566-48eb-95e2-1c649e0d095a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756935, "uuid": "9fcd7977-fb81-4176-bd13-4340559a4fef", "value": "fcf15655_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ef6b15-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749645, "uuid": "0c5d3e34-1c0f-43c3-818c-3a45960d2fbd", "comment": "Malware payload (Dridex)", "value": "556c17b9e5116ffa14f00f0f9391cca7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749645, "uuid": "aad2c328-8040-47db-bfaa-1e724986f012", "comment": "Malware payload (Dridex)", "value": "4df55ec6f3377d7fc3879d3468c44544422676598fd45b7597e17913933a790e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749645, "uuid": "b7fa6c16-a600-4514-bc27-3835fb1d64b9", "comment": "Malware payload (Dridex)", "value": "2828b47d9fd1e95dd3b2055fd9843e24967d0325", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749645, "uuid": "898111e3-a2e3-4538-934f-1f37361e1e69", "comment": "Malware payload (Dridex)", "value": "f93810498daf01028acc5c8cb618fac5c0a73343514f372ba462fcaf78143ee7ced1fb13f71a21dcc8fea760b231bd39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749645, "uuid": "92dc8bff-6fc6-4935-9990-b5536c202740", "value": "88F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749645, "uuid": "52f9aa46-77dd-4ecf-b246-f822f9b7e4b2", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749645, "uuid": "1dfcc254-a259-41df-bbc7-3a5988135886", "value": "3072:F9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:F9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749645, "uuid": "a9fe4401-dd18-4f2a-aa3d-8c146ea7fa4b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749645, "uuid": "6103612e-19c5-44c3-890a-8c4f0ab860de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749645, "uuid": "999b75bf-6ca7-4ac9-9d15-b96f4c677097", "value": "556c17b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1c52ca-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760527, "uuid": "c58159ea-8cf8-4c85-8f1d-83f93ed3baf6", "comment": "Malware payload (Dridex)", "value": "2df4dc560a40a3f47e3c02ed4f31c0ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760527, "uuid": "d26aa50e-d6cb-4819-ba7f-b10dfc0cec9f", "comment": "Malware payload (Dridex)", "value": "4eb23bf3304bc299f189734e9ce0537c540d0d6a5573eb2d1452cd489ee2f988", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760527, "uuid": "0c12fc2b-7ea7-4632-87b8-66a592c7338b", "comment": "Malware payload (Dridex)", "value": "58f01e45f25c04bd4f974ea0ddcb661bb81db7cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760527, "uuid": "fbdd1fe0-4b4c-420a-aa96-96e805202efd", "comment": "Malware payload (Dridex)", "value": "f1936f2d44e09fba438263afd0b30a3112ab8c10fdce163737790626234868a9670376138ae5ebd1bf7269d9a9f68d2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760527, "uuid": "20cd6ded-fe2a-4178-8f90-e0d1c99ebf1c", "value": "FFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760527, "uuid": "bb0af693-dcb2-44d4-924c-93b7b87704b0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760527, "uuid": "93e198a7-37ff-4066-9ec6-25ce963d1766", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760527, "uuid": "0a55f205-d8b2-49e0-9283-9cc3863adfb7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760527, "uuid": "6a51d2ca-dc42-48c8-8f2a-ca5519026882", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760527, "uuid": "1f509293-309d-48a5-ba47-4f2156d57336", "value": "2df4dc56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a2645d-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778506, "uuid": "f0e6e0bc-3db8-4fab-a8ff-bdb51440fec6", "comment": "Malware payload (Dridex)", "value": "457b4881a1c4d31a706a133a78531e05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778506, "uuid": "1f5c8b28-3802-45ed-b7a3-0d4dd2eebc99", "comment": "Malware payload (Dridex)", "value": "4f5bf7d828b5a617f485f587b131af32928992ea3d5ab7ddf274bd8410e505fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778506, "uuid": "3edcfeb9-a381-4062-a468-dce8148ef07d", "comment": "Malware payload (Dridex)", "value": "2455fab4176bbe54349e5f2d94e86b2d60b0dd3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778506, "uuid": "fedd7ebd-ddd8-4d11-a6c6-ea2c46eb1436", "comment": "Malware payload (Dridex)", "value": "82e6873c3303f54690dab258e112aa5475e5fa6f9b8eda8db46e066addbfa64abe6f8238e5962dd8a91d4198f4eac925", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778506, "uuid": "a0221218-54ed-4201-9a6c-034a4ec5ecff", "value": "E2F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778506, "uuid": "b7027e12-071d-4f39-928b-8e83f0d6ed8e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778506, "uuid": "c36c17f9-fc81-4bc1-a0ac-2a10e6ac2a5b", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778506, "uuid": "cbf2401f-9c7f-4ce1-861f-3afdd2ba78f0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778506, "uuid": "515032d1-75fc-41ae-8e75-9bca567c4573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778506, "uuid": "d5b2918b-273d-40c6-a37d-e90848b321b4", "value": "457b4881_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e23aa2-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749719, "uuid": "8b9e6ec8-a79c-4358-82b8-4fcf64d700d5", "comment": "Malware payload (Dridex)", "value": "36b9fbf827140332d13fcce729fb8b59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749719, "uuid": "00887bc9-bb3c-425e-b7f8-485a0fdc0a29", "comment": "Malware payload (Dridex)", "value": "4fcbffd77a5616854c6a58d455d017bf84c94fee1d045b8475be1c034928a2c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749719, "uuid": "b3e281a0-c60f-420d-a58f-c310b75ede19", "comment": "Malware payload (Dridex)", "value": "60e8f20076f5d9394cecf25245c8d89c4f859d2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749719, "uuid": "62b4a3db-e0a9-4dcb-b860-56654c455e7c", "comment": "Malware payload (Dridex)", "value": "0ad62c9bbaa30ed5295ec1a0b17871284186efacb3c1547da02ff76b88a459501a1e612f3f1351aff36a18df152b68f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749719, "uuid": "ee8e0624-04ab-4025-81f7-10d3e9eb998e", "value": "D6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749719, "uuid": "c4ef60d7-9101-4330-9f7d-cc2f44b45ce8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749719, "uuid": "281b7424-a819-42d0-a85e-249549bc62dd", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749719, "uuid": "6f869765-ef4f-481f-88c6-8fc069eda4d6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749719, "uuid": "fc90f59c-fdf5-4e65-bee8-fbb7ef1425d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749719, "uuid": "8bc2aefc-4704-480f-882b-dff9c4d6bad6", "value": "36b9fbf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b07927-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796465, "uuid": "34ccde9c-f0da-4a03-bd17-f403c9d7b1c9", "comment": "Malware payload", "value": "9f5ec729b633134d36b52f59306ebfb4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796465, "uuid": "65863d5f-a725-48ac-924d-0a00b285a9eb", "comment": "Malware payload", "value": "4ffbe7e521d1bb417cb22f6913f705ac88a2ce07080d73af02920dfabf8bd3b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796465, "uuid": "f1975833-4e02-4c43-aa4d-41a5d62684f4", "comment": "Malware payload", "value": "071346e2c5dc1a3d078228a184494dd9e7da505a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796465, "uuid": "d565061a-2d3b-4cc2-9c1b-31d3de805aae", "comment": "Malware payload", "value": "581b035b9efefae1c9f5cb348b2fa3e82f6becd878027715ec819513470534151530c2d77dbfeb67204234bc48cd5b04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796465, "uuid": "4a44b86a-72f8-48f7-941c-b7b061e22169", "value": "1604B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796465, "uuid": "10eedca0-c7a2-495b-a014-f5ce697c8121", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796465, "uuid": "a9968b00-12a9-4c29-b9d1-4bc446348e56", "value": "3072:WWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:WWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796465, "uuid": "3791233e-fd54-4f3e-8672-b3e03bbb50aa", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796465, "uuid": "b12e0d3a-492e-486a-b987-7ffdcd82f430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796465, "uuid": "e9da2fbc-0c89-420b-ad35-1a1a26ab6940", "value": "9f5ec729_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015fd2e8-bb95-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753421, "uuid": "a53bb736-d2ec-42da-a096-ac987b492911", "comment": "Malware payload (Dridex)", "value": "310e0d9ed96a35f3deaf4ded29c65cb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753421, "uuid": "ca4b99e9-ed2c-4959-ab78-8c20b8f15927", "comment": "Malware payload (Dridex)", "value": "502b646ceb82a19e5855dd79c23d019546fd313ba950f615c704914b65b2abc2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753421, "uuid": "2a6480b0-e493-43ce-967e-bda85b6d0960", "comment": "Malware payload (Dridex)", "value": "e0055606a86073ac2b142093256ddb9a6816773f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753421, "uuid": "e648036c-8eb5-41d2-8e90-6d0f3b1d3508", "comment": "Malware payload (Dridex)", "value": "df75734f034c767f9fcbe1c2fb97e086c546f4aa6611743e6338c59f88554bd0901a689ff276288bcec247d53a4e6f25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753421, "uuid": "678df680-8f4b-4eab-a07b-02fb89a88d87", "value": "36F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753421, "uuid": "a8c18ffa-8886-4078-98b2-1204a218a26c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753421, "uuid": "a75fab89-5a2e-43f4-9274-a94e4be6d676", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753421, "uuid": "0a7c5b40-00f9-4741-b4f4-9af206020c5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753421, "uuid": "0e1eb8bd-39f5-4f79-b716-424a67506067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753421, "uuid": "63cd66b7-8821-4a04-820c-88b234dbc7e8", "value": "310e0d9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f831a2-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785716, "uuid": "e3147c98-78c8-48f3-aa1a-94104c2f0257", "comment": "Malware payload (Dridex)", "value": "c5c9fa9a3091ef6a697a9e7abe9ef2c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785716, "uuid": "8411c29a-d751-40d0-a95a-fa4de41d7d86", "comment": "Malware payload (Dridex)", "value": "5037d789b69e0ffb0d99b25bead543519ec4c5c87b46d30b8fec09d42342440c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785716, "uuid": "0cbc3527-4a10-4e2e-ae02-e87cadc7ab0d", "comment": "Malware payload (Dridex)", "value": "84b6da89904ce1cd2b713c1e06f80ca45faf2ec2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785716, "uuid": "a1e510b6-5420-44f7-92de-342caf324500", "comment": "Malware payload (Dridex)", "value": "669a55bdeee6a2eea7b140d9047277916516eea1df34fda25b84310df6ab7e5672ca9df8580442cfeb983cbaa0c4c42f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785716, "uuid": "50b40090-17eb-48c0-bebc-7bc48a8e7544", "value": "3B04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785716, "uuid": "b7f78181-3d3f-4a71-8e23-ed992a8621dd", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785716, "uuid": "42135d7b-9a2d-4569-bdb0-ccde44899ac4", "value": "3072:AWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:AWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785716, "uuid": "6ab29675-1b93-41c1-85a0-3205a6e9f028", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785716, "uuid": "edec8826-0116-4afb-a008-ed6d2f324bc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785716, "uuid": "d8180a20-a236-4c06-90c4-f2daf3088bcd", "value": "c5c9fa9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543f859b-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760432, "uuid": "c59df0f9-8cad-4ea7-8539-fae6659b8430", "comment": "Malware payload (Dridex)", "value": "aa7aef6cfaa00783c89f21ca67cf882c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760432, "uuid": "0778b2db-9a5d-4086-bf03-f2d29874f067", "comment": "Malware payload (Dridex)", "value": "503e0ace9fcdf82fae283b7a3333bdaf08d2be5c098bad101dff5e6b69d9d116", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760432, "uuid": "c6d891c0-4b26-4a92-b170-da5206541468", "comment": "Malware payload (Dridex)", "value": "deb2727e32471fbed2168048a6cdf3c328cba006", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760432, "uuid": "320d1fc7-7131-4679-bfd2-2e838bb23a35", "comment": "Malware payload (Dridex)", "value": "22e6832e3dea16cc442da1237c64bcc6c4474a3257b067abb03d55ac0f0403a45de4acedc6b69c264a927277e8cf7177", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760432, "uuid": "538564d3-c649-4a16-8f5b-94933f8e8ae9", "value": "2AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760432, "uuid": "331f899b-84f4-4f9d-bfb0-3fc34cb60bf3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760432, "uuid": "b2d44239-864e-4852-9af0-f0eb615e39f4", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760432, "uuid": "fd4724dd-3f13-40d4-a156-7f583df8b5ac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760432, "uuid": "e6dd1011-2fdc-4d5c-ae79-943bb64f08f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760432, "uuid": "bd6ee688-b713-4169-83ce-62eb88f04480", "value": "aa7aef6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f702deb3-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764141, "uuid": "0e16d473-0f1c-4a86-8804-ae8bc6ab2675", "comment": "Malware payload (Dridex)", "value": "2c424c686284609c3dc73f7f6ed7e2eb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764141, "uuid": "7bd38c83-dab6-4108-984c-b65bf497805a", "comment": "Malware payload (Dridex)", "value": "503eba888f1d26423da1ee178c27b9b95059614cbd292d355d087a5ae82732a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764141, "uuid": "cfce5027-3ec0-41a6-b0c6-f7b34dae93e4", "comment": "Malware payload (Dridex)", "value": "ef955ea627901936380084ae4169f0df0ad210d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764141, "uuid": "c77725a8-8138-498e-b5a3-673f731cd6bb", "comment": "Malware payload (Dridex)", "value": "fc1845ca2dd2c8f4c65d457db53191970a608983e872b7189886d8a4d15abf854ad1e5d50f6bebbe93f987915bd4ef25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764141, "uuid": "14048eff-5e4f-434f-a9a2-1398f8bce0c5", "value": "2EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764141, "uuid": "fb73c4df-7935-4e69-9fbd-1982b85ca994", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764141, "uuid": "5560319d-7cd5-48a3-a29d-d3246271a5c5", "value": "3072:rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764141, "uuid": "1c063d5d-6f8b-4e2f-91fb-a5e966836e9a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764141, "uuid": "77d82b74-0179-4411-97d5-f4c7188e8486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764141, "uuid": "6eeb99c1-0800-4ae1-a0c1-89f5716ed763", "value": "2c424c68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdf58b6-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731648, "uuid": "9a9fb750-f6c4-4cf3-97e9-642e005b5b45", "comment": "Malware payload (Dridex)", "value": "1e27d2106d0b67a20964a67d46f9fa6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731648, "uuid": "8107c322-f2fe-4122-b25a-9efd82aff11d", "comment": "Malware payload (Dridex)", "value": "5117f6f75f8b1b6242b9354984c298541386754fd85d4f6dc6171e6248bb8a4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731648, "uuid": "4be70cf3-ab15-4772-a7cb-d532c49b1bdd", "comment": "Malware payload (Dridex)", "value": "0fa80a39aa8f32940bda54b83eceb0315d2f2ba5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731648, "uuid": "74154fd8-ba7d-444a-9e9c-70e48fd0dcc3", "comment": "Malware payload (Dridex)", "value": "51173a6d777c6e1f1356a60495d47e14903de39f98ce1210df184e20cfce536ab9ae429dc7fc629d60c8088d8f1cf7f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731648, "uuid": "538f8085-6b16-4d65-831b-6fa8bd04f227", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731648, "uuid": "b755b948-2d8e-4612-a488-ba46a925293e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731648, "uuid": "152a5021-b557-4d7d-ad8a-88028a6741ac", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731648, "uuid": "7a75c0e5-62dc-4315-8e8d-c59c3df5bf81", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731648, "uuid": "3a986cbd-c43c-4566-b3ba-42c858e611dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731648, "uuid": "d8017f2f-3091-4d2f-b23b-846b7466a7a5", "value": "1e27d210_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3580054f-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621785720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785720, "uuid": "ef73301e-4cc6-4953-9cc9-0c6fd24d6f38", "comment": "Malware payload", "value": "47cde7eb78709b1d3dc9ddb8ea603e69", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785720, "uuid": "397afef1-b432-450a-86d1-23bc281258ba", "comment": "Malware payload", "value": "511e5b237869453ce6fba54270ab272fca61d2bf13e08563b70c47f217a9e417", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785720, "uuid": "502b2cf1-fd09-44d0-a8b7-229b2b416e94", "comment": "Malware payload", "value": "9baf563da8e83d5d4870b9be5494a3ff60a8beac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785720, "uuid": "51ebb26f-97fa-451b-b15e-8ee810747580", "comment": "Malware payload", "value": "3a888619d1212ec634849a546a249f01aebcfd324d3b490739196e0829af305853e8001174c32dd4bd8d70d1b15c76ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785720, "uuid": "12bacd4d-7c7a-4f3d-a159-1492dd36a947", "value": "1EF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785720, "uuid": "e175cc0c-618a-43d4-8ccd-430e6432b5a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785720, "uuid": "5f0ddd26-3e55-4ccb-b164-499ab7cecf93", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785720, "uuid": "d5788da2-599b-466c-9a85-c4100d63b3da", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785720, "uuid": "85320edb-5fd9-4c6d-9219-129908a10428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785720, "uuid": "d19de81e-33ae-44f0-b572-13c39752d348", "value": "47cde7eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf25a52-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753413, "uuid": "414ca182-59be-4314-b5bd-005739c07b7e", "comment": "Malware payload (Dridex)", "value": "bbb45f01c64592612a502bf15f1a481b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753413, "uuid": "324fabfc-377e-4a15-a74d-f10ba8690789", "comment": "Malware payload (Dridex)", "value": "51f4bf7876c8ed8456f96a28485d1d82c7b560e4c21807774b9d42b1bbd36295", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753413, "uuid": "77013b75-a080-4d88-98ef-d36e225fcf27", "comment": "Malware payload (Dridex)", "value": "8c65afd0dd60f98e57116a7462fbb1929599652e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753413, "uuid": "3df40a57-091c-44aa-840c-84c774e579d6", "comment": "Malware payload (Dridex)", "value": "d71cdf28cc87d8f5b5b2aec0cd01b4e7f7ea0582138cb213f7e2e5c8265a6e8c742b6d962d4467a1d730d614d040606b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753413, "uuid": "3ebbbaaf-a24f-4252-b66a-b80766d3de0b", "value": "7404B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753413, "uuid": "6e76818e-908e-4126-a267-145a79255b99", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753413, "uuid": "f161783d-2335-409b-bc66-3d922b174c6b", "value": "3072:oWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:oWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753413, "uuid": "7529075f-421c-4999-b893-f49b0f302ba5", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753413, "uuid": "9c38f4a0-6ee6-4171-9de0-8ec62b5bc4b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753413, "uuid": "4ab60a2b-2098-4f6f-948d-ff8fbf07fa48", "value": "bbb45f01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405a0b72-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796476, "uuid": "0a1d832c-2584-4d74-8abc-d5aac876358e", "comment": "Malware payload", "value": "4db2e1fdce246ad30ecf2d5529261a11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796476, "uuid": "0adb539c-2e66-48df-ad01-9e2fd142e607", "comment": "Malware payload", "value": "5239134817922061ebb034bcfe9d65c4d95d21391e5337d92f2f29ecda33e00e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796476, "uuid": "6ad93a81-05a7-43c7-95c3-d40ffee6eddc", "comment": "Malware payload", "value": "cba3816a7a95e10a01f6da97669fbe5209c1393f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796476, "uuid": "66edf5fd-1160-4556-a828-531d18453d1e", "comment": "Malware payload", "value": "7090caf19292e67b195511731d282e0a07ad7a8a9e2d393dd2566945c2ce3b5afec16a529312082fc226c3fb9137a25e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796476, "uuid": "d2806f3b-6b48-494a-974e-ee43266aeb68", "value": "DDF3E00AED9FE988E85C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796476, "uuid": "54f9d9e1-5390-40ed-864f-dd4c47ce3f22", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796476, "uuid": "5982406e-a077-4a43-9c3b-5522f3fb47c0", "value": "3072:GiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:9eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796476, "uuid": "d109fc37-852d-4d20-a58b-c305c40a9963", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796476, "uuid": "c43a8f88-34d9-4b80-a2a6-9a3756a3098b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796476, "uuid": "6d5dc383-5eda-45c9-804d-d00bdb2256d1", "value": "4db2e1fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50519b60-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749688, "uuid": "2763fbce-742f-49b6-8fd5-e47f3b5eea6c", "comment": "Malware payload (Dridex)", "value": "1ce57bf0ee36cb8146314dd35b2fb572", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749688, "uuid": "75c2cdc1-de31-42f5-aed1-723e4a001f74", "comment": "Malware payload (Dridex)", "value": "535afa2b5003e4f54ef18c1aad20211f1bb7dd84b914e984c94d5c4810f65c7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749688, "uuid": "213875eb-f33c-4fb3-b92d-ea64c25a05f0", "comment": "Malware payload (Dridex)", "value": "96cbbd64eca14fe77c216066aec9bb11d5188d70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749688, "uuid": "3938e6d5-1aa7-4ca1-992c-bc3ef9cf2fa1", "comment": "Malware payload (Dridex)", "value": "5ad740199bfc411c5f7892709aebcd3f385706f65430754adb40f19057df5f408eb26ebb376f2df0c58504c81c7760e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749688, "uuid": "8f55cf3c-e65f-417e-a834-e0a30fce3381", "value": "45F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749688, "uuid": "0ce9c80b-1b64-4889-a916-7a9500e1697b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749688, "uuid": "2d957bb3-87d0-48c6-8c94-9587f6a056cd", "value": "3072:kIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749688, "uuid": "25270456-f7b5-4580-ae28-8cde510d73e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749688, "uuid": "733053d2-b550-4d07-a553-8d2c9082ed63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749688, "uuid": "be0f4056-37c7-43a8-8770-fefec3499a7c", "value": "1ce57bf0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8543a0f0-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807329, "uuid": "e8bb5c53-1d02-4f87-88db-3faca07b58f7", "comment": "Malware payload", "value": "47138f2e4c9c2cea20cdea4ef154a918", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807329, "uuid": "a1150418-75ea-486c-88f8-d0072607e2d5", "comment": "Malware payload", "value": "542e8a83e281165a3f9b1f9449d02ef1c6b479ed999467d2c71ef669065bb192", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807329, "uuid": "25aa561e-c427-4a85-ae1d-258e9bc8e732", "comment": "Malware payload", "value": "62bf9f903995a565797340ad0a120297036b15d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807329, "uuid": "6169288e-9604-4aa8-ac63-23ee7ec7af4e", "comment": "Malware payload", "value": "9567f8eae4da5485b34472800ae3d3e93b82eb42418279e6ef1166682dbe7233604ad596d1e23bbea2b0e198607f88b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807329, "uuid": "3abd8a35-fe1f-4a78-8201-8f28cef6f242", "value": "2BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807329, "uuid": "e88dbbea-2f10-4b10-8c28-4097d94711bc", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807329, "uuid": "9e09bda2-67a1-461f-b0db-f5c132559ada", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807329, "uuid": "f80d841f-d850-4508-8082-8e00d1e503e9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807329, "uuid": "9bac1316-7ca0-4890-8e08-28ef8fe5c26c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807329, "uuid": "7d8cba46-0b5f-4f8a-a38c-5a3a5f8fe45b", "value": "47138f2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea576157-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774857, "uuid": "efe9ce5a-153f-4a8d-88df-e15469507ff9", "comment": "Malware payload (Dridex)", "value": "e4e42eed2a1add75cbe39e8c709016e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774857, "uuid": "b7daba28-3ee6-43bd-851f-06c289708785", "comment": "Malware payload (Dridex)", "value": "5442b5ee1a5c5a4cadb3dd9b9544b24344c9cdda65fd04dee05befc0b754378e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774857, "uuid": "6a0a59bd-5953-4e3c-b08c-1881b2ccd4ca", "comment": "Malware payload (Dridex)", "value": "ff8a02df006f1e2ddf77177a64616ccd8320db70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774857, "uuid": "f2f74c25-0c8f-469f-9b93-6293fbfa04cd", "comment": "Malware payload (Dridex)", "value": "8a7023e10b0a34f3f0700f6e1557b08bac3a61f48bdc8760150eac6ad8cdaf158db023bc73fa60f6b42b664cee87f8fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774857, "uuid": "68bd9faa-28c6-4b38-8d9c-267171ece088", "value": "F204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774857, "uuid": "e3989e5a-6804-4da7-b3ca-ed0034449c93", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774857, "uuid": "bf6e5503-6f00-4b9c-b9c9-60e5ff1b49ea", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774857, "uuid": "75ce726b-fb8c-4ea7-9579-4cf6df25386b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774857, "uuid": "cc7053a7-b798-4da8-98ff-e24e98e3fe09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774857, "uuid": "7c03a857-3988-4265-905b-02df8a7628e7", "value": "e4e42eed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c330b26a-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810869, "uuid": "27fc55ae-2972-4f20-8032-210c7c409a56", "comment": "Malware payload", "value": "3d461955f860c9ab91b3fc6e9467fd83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810869, "uuid": "39b65851-029d-43a5-876f-8bd99ea974a4", "comment": "Malware payload", "value": "549ef42fab0f3b2f85d1bb520533965b02212c5716ed5164a91e767f7811bc26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810869, "uuid": "2a686060-e290-436d-b464-c3ab5b73ec16", "comment": "Malware payload", "value": "eea979d0de1e25a85aec1080fb911352cbfdd3a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810869, "uuid": "0de40937-2084-4784-87b2-ce0539ffe4f3", "comment": "Malware payload", "value": "dc510e162f80f8a0756f9b0089edf3b9799b8a6a15dcba9e521feb1485805bad9139f8f18efd94c763f8f409897e0cbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810869, "uuid": "5b6d3e4e-0fb6-445e-8574-528ad7415b84", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810869, "uuid": "f11555d9-d291-441b-bdeb-5c304a9b126a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810869, "uuid": "74e5f9ba-21db-4b06-b1e4-86dafdcf169d", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810869, "uuid": "197cf9c5-62ad-4074-8409-d96e72433d33", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810869, "uuid": "6b2644f5-8720-41dc-93a7-83606fc92221", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810869, "uuid": "05eef0b7-1423-4c0b-a9f7-ea5b7ee4b521", "value": "3d461955_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64398c12-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760459, "uuid": "078f58a2-4ceb-4935-ad70-57ae7851e34d", "comment": "Malware payload (Dridex)", "value": "01cfbd4a4a7882fa8387021e958d0c87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760459, "uuid": "78398125-b44b-44ad-ac5b-4a74a633c29e", "comment": "Malware payload (Dridex)", "value": "54c3e9f0063f340d82ff35eef04498d56bedb7f96419b1a4aea279e394ce5b66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760459, "uuid": "df8cf7cd-9a15-4ce0-8273-29faf13ef571", "comment": "Malware payload (Dridex)", "value": "1cb22d40350d043376e61ada67e541013e1253f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760459, "uuid": "cd5581e5-fdbf-47c7-bd90-c12796eebc15", "comment": "Malware payload (Dridex)", "value": "28cc2841a8783ec4f1908c636ee08d0392ab22bd5ec376b39416e0283f33ca4a850907393c423c90d5ab5911e0f48f14", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760459, "uuid": "01ba3ed5-b5cb-4fdb-a5cc-92b1632acf50", "value": "D6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760459, "uuid": "24a2a9ce-55a5-4342-8263-614a5630087f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760459, "uuid": "549cfb82-5484-4437-a3e8-82420c886454", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760459, "uuid": "16c33599-18ff-4b4b-b152-b100cf3f6ea3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760459, "uuid": "c7cbd96b-b324-4849-9d1a-225780940823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760459, "uuid": "36ab09dd-c5de-49f0-b1a0-62ce38df8dbe", "value": "01cfbd4a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc44b22-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796442, "uuid": "a6e60e57-311f-4802-b127-fb1db40bda9f", "comment": "Malware payload", "value": "bcf6afa69a6329aca8a0ba0dc8b1f619", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796442, "uuid": "4191a979-bb06-4d03-a703-2661ad40e76a", "comment": "Malware payload", "value": "55181b564f1747bd1f18841cece4363ff3d51aed2d3ef1b27b9be70c9dd326c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796442, "uuid": "8b911aab-2f9e-4ab2-9186-427c5683aa82", "comment": "Malware payload", "value": "df4e7c6dd7b443d6c8b04d50fa2c0885da156865", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796442, "uuid": "8bdd5128-5fbc-4ccc-97e8-e7807ef65aa5", "comment": "Malware payload", "value": "43823d6101a09d9a2323763a0490af1bb10e53484b1316d8ba441967cfe1d26ad06ea1a9f649cf185c796ce64f48a5bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796442, "uuid": "2856dee8-ddbd-49af-ae94-c4a343a33e4a", "value": "7BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796442, "uuid": "bf3564ec-f88e-4d4d-83ee-2451310f2945", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796442, "uuid": "618027e2-65b3-4135-a04f-e2b2346f89bb", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796442, "uuid": "60a5e7e3-bd03-4f04-9541-6d9327906f6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796442, "uuid": "7a4cf8c4-6de8-44f5-8642-11cc4a49970a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796442, "uuid": "45ca0d2b-bcb3-4978-b9d0-0dad7c8fe2ae", "value": "bcf6afa6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c4dc6a-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792856, "uuid": "7e9d6b1f-dce0-490b-81df-9a511c4b6ab2", "comment": "Malware payload", "value": "23ecbe265f6cbebad5e14ff2eee6c673", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792856, "uuid": "92899de5-f591-4ef1-873e-da84d428f7fc", "comment": "Malware payload", "value": "55b77aad79ed61bb6e417f23f12e4ea2f14408724994372183a41f4ef59f3d61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792856, "uuid": "6195a113-c3c8-4dab-8e95-f78665ce6219", "comment": "Malware payload", "value": "f54f0c7770d563e2bccc6f4cd1f80a1a64d63b90", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792856, "uuid": "edca538d-1cb8-403c-8a7a-7251d2322144", "comment": "Malware payload", "value": "27ca6610d2df7a8168fe05ce48e3f45f0a8280fb602604e80ddf9ba9772d601141e588ff7fb86dd7d7316de8b73c5e93", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792856, "uuid": "6315ecce-5df2-41a4-b3db-3f4471d01978", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792856, "uuid": "5651b7f9-5ad5-4b66-bae7-e292a938d953", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792856, "uuid": "12218e2e-5d7d-40ac-960a-4319e9418748", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792856, "uuid": "8f439dce-c9fb-4dba-8ad4-3eb3d7efe0d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792856, "uuid": "f88e3ce8-28c9-4d1e-8ffc-807c534b8e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792856, "uuid": "74b79b79-2c50-4d89-b4d1-8582e4935a3e", "value": "23ecbe26_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b99a20e-bbd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782214, "uuid": "852ff330-6e9e-43f7-9328-fe9be8685412", "comment": "Malware payload (Dridex)", "value": "68d8d6285be46b2bcc107edaed7903f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782214, "uuid": "a31a7be0-14db-4a55-957a-2a49b49e9360", "comment": "Malware payload (Dridex)", "value": "5711832a4afd3742e6428d95c3d224f604525497fa163f04702afe62dd5d96e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782214, "uuid": "ac257d56-cb01-40ed-81ec-76d60c3643e1", "comment": "Malware payload (Dridex)", "value": "4fbe02d99285366359b041185387118677409018", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782214, "uuid": "a88569eb-4642-4a0e-a936-ec97330a8164", "comment": "Malware payload (Dridex)", "value": "f7496db2d3f578ca93c191f0d329113149e6b7e396a19cf472b2c23621af651bb912d90c7ef3560c4ed2add630f7e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782214, "uuid": "107be7be-38eb-4362-811c-9d2e805ed6a6", "value": "77F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782214, "uuid": "ab907375-1f49-483e-bf2c-affec5d7f135", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782214, "uuid": "07f98893-cb27-4b27-a0b0-ab179303642d", "value": "3072:s9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:s9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782214, "uuid": "497e7dc8-209c-44fe-84c8-3489838fb727", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782214, "uuid": "d4c08819-7706-49b7-8034-0c50281f0354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782214, "uuid": "c8d61ee9-824f-4c36-b2dd-398877d19f45", "value": "68d8d628_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ac667f-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764076, "uuid": "75f96c28-5933-4e07-99be-f20d9693cbe4", "comment": "Malware payload (Dridex)", "value": "c176ffe81c7005c144ad7fb4357b89b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764076, "uuid": "08c7349a-e41b-44f9-8eed-8067ef01db46", "comment": "Malware payload (Dridex)", "value": "57bb581afcb80a48673350c41ade9fad204f607f0472fdfa8e98b53343dd3818", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764076, "uuid": "7a7af272-752a-4d67-b84c-b9ef63886143", "comment": "Malware payload (Dridex)", "value": "2b93cd291ee6fdf8a02365bf977394e92b9c5b8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764076, "uuid": "a291b419-6c70-4efd-850e-b45650e6773b", "comment": "Malware payload (Dridex)", "value": "995cc313ffc0fd969064abb4432e04cdc1d5ff9833909730f55e0342d699953351924fa0e47753ea75a0fa764bc7ecfb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764076, "uuid": "b7946c3d-c0ad-4990-acfa-adac670eb403", "value": "80F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764076, "uuid": "acf93db3-bcc1-4f32-b6ae-dbc296f3d996", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764076, "uuid": "cdc0a56f-4b8f-428f-a479-98b3a3832b12", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764076, "uuid": "61ed2d17-0dd3-44b8-9b45-e7d9d47c1fc4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764076, "uuid": "61f8a9dd-cabf-4b94-baa9-ed25da62b168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764076, "uuid": "0ae6a55a-dee0-4ef6-b56d-ae53ec75ac10", "value": "c176ffe8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8435a428-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731736, "uuid": "7dc9b6b7-5e75-41e1-9970-4ca6b221e21b", "comment": "Malware payload (Dridex)", "value": "7362f1619ca1c2d87d7fd483913a14c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731736, "uuid": "163e5a6c-0a2d-4168-b5b5-c0cda00a5140", "comment": "Malware payload (Dridex)", "value": "58855c0b5258b6cde031bf975ed2f3271eff507c052ef862edb119241c2ac3a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731736, "uuid": "6151783e-0094-40f1-8e28-3db4954fe38a", "comment": "Malware payload (Dridex)", "value": "44cc9926bd4d6237874a7613829d1e294719cb2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731736, "uuid": "206b1837-8fa4-4a7e-a5d9-1477a8d08d23", "comment": "Malware payload (Dridex)", "value": "aa42c199914c4d52650f6a94499da572b6b5921278513850bbfc81e6e38995eb08b737411ac0693742ecf785a1b9137c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731736, "uuid": "383ed5b9-f55a-4bbc-bd88-dbb3f61981ec", "value": "B7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731736, "uuid": "e5cfd5d7-05f6-4b27-ab47-99cbb2072951", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731736, "uuid": "30c86e58-2280-4604-a69f-7905bee054c0", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731736, "uuid": "ec136f4a-f354-4f9e-a88f-05f0ff04145a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731736, "uuid": "7a333208-938a-433f-a612-b03fd7047848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731736, "uuid": "ab96b221-2bb2-4308-a93d-4ebb3f3fb670", "value": "7362f161_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15982df0-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756891, "uuid": "35e97dd9-fb08-49f9-a6be-295adbf00804", "comment": "Malware payload (Dridex)", "value": "272ef129cab555ac939281219a3dc7aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756891, "uuid": "18b7b9f5-703e-408c-b169-9be37b7de1b0", "comment": "Malware payload (Dridex)", "value": "58fcb1c054b07451833a5d3a99d330f5ee9b1029c46aabe4f9ebbaaf23f246ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756891, "uuid": "0e93844f-c416-46c6-a867-49b89aead2f6", "comment": "Malware payload (Dridex)", "value": "52ddc39bffc05ba1f36ea4003d0848d51448d8bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756891, "uuid": "753afcb4-4d50-40e4-b688-95eab6095a3a", "comment": "Malware payload (Dridex)", "value": "a9ee5a6b17a321258435c44ab711131457f1d372c3f7d8515b284a9f2d34cf4f16deba9afa05a9b798926c723a9d16ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756891, "uuid": "3a349be7-d358-40e2-9712-101cd58d17d6", "value": "03F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756891, "uuid": "7942b67c-7fe4-40f2-95a7-4749170c16e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756891, "uuid": "5d834d08-b97f-439e-8ac0-7acdac91b2d2", "value": "3072:wIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756891, "uuid": "a0f1a9ba-15a2-4c79-bba0-e7f0af7bd9ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756891, "uuid": "896eff6b-d8eb-4be9-b50c-728587bfc026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756891, "uuid": "fa9871b7-bfab-4798-8604-d2d5fc2e77dc", "value": "272ef129_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21ccb93-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753261, "uuid": "1078c867-e2ef-4632-b8c6-57fd6633e90e", "comment": "Malware payload (Dridex)", "value": "0b451647592032b0c9a3d58851c99621", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753261, "uuid": "4608fa2e-bec1-43b1-aafa-03253fa7dd1f", "comment": "Malware payload (Dridex)", "value": "59377f8f119e36ad32ef9d836497d9fca7ae2627d505c8e515ca3e2e4d6d7eb0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753261, "uuid": "dc890c1e-151e-49cb-a845-6994846579c0", "comment": "Malware payload (Dridex)", "value": "e5ff54de2a2667cdc175ea85947e41cef8382bce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753261, "uuid": "b532cab8-b5b1-45ce-9965-066a9028807a", "comment": "Malware payload (Dridex)", "value": "25c919cea6913f6c4411673b5a445ee22b23a7d2e37c80f46c4734e408de130d40cd6bef947883d7aa741f10ebc6498d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753261, "uuid": "27e9cc8a-eeca-4834-bba4-374ae307ae19", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753261, "uuid": "b7efea31-9dc1-4188-945c-ebf09ae94749", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753261, "uuid": "062f77a0-2d0d-4438-a8d1-739d43bedaa0", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753261, "uuid": "e88d678e-05c8-4b2c-8f35-fa57c2ab6b92", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753261, "uuid": "73e1a372-4abd-47e7-bc91-554b63b08b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753261, "uuid": "a69022b1-9c91-4822-b213-e5953293fa31", "value": "0b451647_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49bab09-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774874, "uuid": "a2ce7215-9a99-472b-8619-7cfd28452240", "comment": "Malware payload (Dridex)", "value": "1c3ca855e10f42ac0638e7fef7d27143", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774874, "uuid": "23e1b06c-682e-45da-9c5c-579a11a0c06f", "comment": "Malware payload (Dridex)", "value": "59d33c24e7e7d36922e0b729aee0afed9141dd99b0638518ee59c7552558c5c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774874, "uuid": "0d386bc5-2d89-4f94-93cc-66cff2af75a7", "comment": "Malware payload (Dridex)", "value": "7f1a25ec13cdd32486d0387c6c8ead2b74311f83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774874, "uuid": "c59870f9-d26d-4d3b-b882-ded9d98c4a33", "comment": "Malware payload (Dridex)", "value": "d4c66bc9762f5928729911cfa06db0b7e74e0ddb2a0f19320e53e4d23c47d1eea29f963e96e57475d469b00fcc9ddab8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774874, "uuid": "cd21432e-c810-42db-b83f-d90421f3927e", "value": "9CF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774874, "uuid": "400384ca-1fea-4c02-a33b-378aa1501a74", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774874, "uuid": "1979087c-c849-465b-91bf-63f6979c1b65", "value": "3072:9IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Wc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774874, "uuid": "14d96656-cc43-4f5a-b27d-38ac7020241a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774874, "uuid": "1eea9a51-898e-45f1-8608-5eeab4461ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774874, "uuid": "782df9a7-192a-44e5-9e46-3f77140f805d", "value": "1c3ca855_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0f0f7a-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731695, "uuid": "63dd428c-a201-4699-b1e4-797ad351a3f3", "comment": "Malware payload (Dridex)", "value": "775135556a21e5c07e55d2f82e9f8475", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731695, "uuid": "93b81d70-80d6-4a66-bd43-b1d328958898", "comment": "Malware payload (Dridex)", "value": "5ae418d04f9f3dba1dfdd935ab25e3466b781adfde455ab556195c372bc8bb03", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731695, "uuid": "eaacace7-5829-41b0-b35f-18222bea5a22", "comment": "Malware payload (Dridex)", "value": "91e249cdc007f9d5835960b7f0a46b53122287f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731695, "uuid": "cfa93505-fffb-4dd6-af9b-3390af4056e5", "comment": "Malware payload (Dridex)", "value": "e28722e721dd46ce13aa722fc16346b74d912f85d4f2b22dbcc2cc182bafba53c999cc0b6b02f4dd83adbdf79c83cfdc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731695, "uuid": "e4834957-e7d2-494c-be70-20a43deec73b", "value": "28F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731695, "uuid": "f8b74888-6cf1-43d3-8bd6-9ed041800b96", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731695, "uuid": "d6255666-abe3-4464-b045-9068482a3568", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731695, "uuid": "1017ab0e-2301-460e-95bc-645707f51560", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731695, "uuid": "82ebf318-62a3-4222-889d-505158f91ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731695, "uuid": "8324d7ff-3768-4a10-babe-7fab0d8e3e89", "value": "77513555_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2368c722-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803729, "uuid": "d5769310-3847-45eb-9e4e-6b12cf7468f6", "comment": "Malware payload", "value": "72d76fed755ac13c2d03d636935d1c37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803729, "uuid": "fbde5985-5916-47ae-ba23-a5e31efda03e", "comment": "Malware payload", "value": "5b18b7faf227435246ce85d171a186a4afce79b0c1ccba1105d2af6342051bbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803729, "uuid": "93eb7148-26da-4b24-8087-ab28ee9235be", "comment": "Malware payload", "value": "6f69db0b31d64dac49e84d363da166292658f570", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803729, "uuid": "06f22531-afaa-4322-8c16-9bc192ecdb70", "comment": "Malware payload", "value": "e95c39879742aa12edd330a6a1cbabc09712d03f7de450ac7c8efb17c6fee404e87f9b13fc922fffbeed76ce7d36169a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803729, "uuid": "d7e75935-caf4-4f18-be16-f6a090a29a9f", "value": "39F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803729, "uuid": "a272d5d5-7bcb-4084-bc20-3a2942124616", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803729, "uuid": "2eb0ad7c-914a-47fa-b578-d8136c8065f1", "value": "3072:iA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:i3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803729, "uuid": "e8754248-64c7-4e11-82f9-9cc788aaf83a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803729, "uuid": "6245c700-d668-4810-bf52-07249871581f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803729, "uuid": "3d79f1cc-38fa-4023-966f-8cd595143569", "value": "72d76fed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79121072-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807309, "uuid": "a675136d-7a2f-488a-a7d5-d9487963d9bd", "comment": "Malware payload", "value": "01bac60a83828a9495c665bb47760a54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807309, "uuid": "95b9b094-42ff-4302-9402-ef98648cc0c4", "comment": "Malware payload", "value": "5b2be8ee37e528998b7df7293dc6144660c411d5496c2f6575cf11f12c8e4001", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807309, "uuid": "c874da2f-47c5-46f7-a5f0-fcaab38f2a3e", "comment": "Malware payload", "value": "fa9cce12a5005fb3a30a1601335fdcb672e32d06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807309, "uuid": "6e3e93d7-abc3-4300-8d5b-d1c35a246f3d", "comment": "Malware payload", "value": "3d2a4a823fc694915ffd598706670174afcd94cbf20f34cb83c696f7dd9d59bf259ef6dbc5e2ed02f1e21c76c322b90a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807309, "uuid": "b5e9a588-b71b-4068-af1a-9fb65c5250bb", "value": "A7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807309, "uuid": "4795a37b-23c5-4454-8fb7-77fe310f6aee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807309, "uuid": "eae078f5-53c0-44d4-b1e3-f67205927bcf", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807309, "uuid": "88efddfc-f663-446a-bb86-5a48a18731f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807309, "uuid": "45774fd8-31bb-4ed4-9e0b-1d7a00d8224c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807309, "uuid": "724cd158-f8b6-4ce5-8f4f-125ffbc4a3b4", "value": "01bac60a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b9f58f-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738849, "uuid": "2605be6f-aa15-4f9d-930b-936ab58711c4", "comment": "Malware payload (Dridex)", "value": "5e5a905be81915a0dfd407000d9bc20b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738849, "uuid": "17f32de5-8b6c-41f4-b0c7-60fdd72c6578", "comment": "Malware payload (Dridex)", "value": "5b4f13a078a98ce92975edb4410fa78269da1cedd6b471022cdbfb72c8067a67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738849, "uuid": "f75320ec-4189-4961-9131-506b8cdf5cea", "comment": "Malware payload (Dridex)", "value": "03565f5894ffa8b9ad9b913cc32483a10e8161b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738849, "uuid": "3f2a6878-bb3e-4353-98fc-bb348a26dbaa", "comment": "Malware payload (Dridex)", "value": "773f76c44494cb986d249bae2c8dbfcecfa41a2a24c159f9d5714670dd692852a7bcf5c8abec8bfd649d793402cdc353", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738849, "uuid": "ae717f5f-c2fb-40c1-8d57-b1a2ef9945ec", "value": "8F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738849, "uuid": "14335b20-d12b-4de1-a67b-57cb7ed9b9fd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738849, "uuid": "b25d705b-d5bd-4808-8c8f-fd46b14c8411", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738849, "uuid": "a0c412f1-e81e-4520-9646-c2e25dce177c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738849, "uuid": "7e56ebc9-3600-4ab4-a359-210a208d305e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738849, "uuid": "aeacfb7b-44b7-42f1-9f09-e3c6587c1b58", "value": "5e5a905b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d68486-bbae-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621764327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764327, "uuid": "93c020ac-3aa8-4de8-8236-de6e4a1ff7a2", "comment": "Malware payload (RedLineStealer)", "value": "ba26d05b1bb924732cba513830a4d15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764327, "uuid": "c9e1001e-3272-4a43-9b45-ec661b9f6909", "comment": "Malware payload (RedLineStealer)", "value": "5bc92bb6694e2a6677e454d7801c7f2d7d5dbeff2ea0e2389cb459d4f47ffdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764327, "uuid": "59e1ea4b-e645-4b6d-85a7-c75f678a7cda", "comment": "Malware payload (RedLineStealer)", "value": "a8f7c0e807436da9f76dee7b1e41875d8f263731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764327, "uuid": "49c6a859-d8b6-4a33-9375-2fec27bbda93", "comment": "Malware payload (RedLineStealer)", "value": "604cd95d9aef8ab4a92b529d6e0fb3693b325fc8b67ab09fa7fd21155a6405f47b5e576f683fa551f2d8e48053498605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764327, "uuid": "edb5e0e0-aff1-414b-9fb4-1b1c9924c66a", "value": "57F4CF417A158513E1341532F1A60448F7E27CD0FBA2F60AEDA4F29914F339EE8976AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764327, "uuid": "222a9f0f-d696-4b1d-ab72-f10f13d7aff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764327, "uuid": "08355d82-5783-4e82-9e18-816300894da0", "value": "12288:de5m6tkM5CCKISsEyUkChw7J1fZhJaNsdoNDTj25:ym6tLCZIqysGJ1fCcoN/j25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764327, "uuid": "e920a149-c5c8-4ed4-8eba-6e14a07434be", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764327, "uuid": "c82679ed-9f81-440a-81c7-ac5be7fa6bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764327, "uuid": "6ae2ee10-c91b-492a-84fa-1ddbd75632d3", "value": "ba26d05b1bb924732cba513830a4d15d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048ea68a-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756862, "uuid": "2376ade7-1a38-44e4-b522-74092bf76fcc", "comment": "Malware payload (Dridex)", "value": "8b6496cb6a88025a8ddf594ba5a2f197", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756862, "uuid": "adb3e643-a8bb-4fbb-a333-9cedc1fc90cc", "comment": "Malware payload (Dridex)", "value": "5c17930e1200e20053deb41035ba3768baad5a93fb1eaf03724fcbf1a1e4f985", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756862, "uuid": "1055e41c-7ea4-4bcd-a3bf-1ae8300c39cd", "comment": "Malware payload (Dridex)", "value": "5ca075e844dddcd1982d604aa96475068e61066d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756862, "uuid": "b530553c-f57a-4a82-8455-c2b5a8dd62f1", "comment": "Malware payload (Dridex)", "value": "40e7729ed95b7d0a9a1f4169e962968fb214d61b90ab670057c159bee18548a911771f462069cbdbeb672564cfaac08d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756862, "uuid": "375aced8-b7b6-4547-83ee-a86f041578bf", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756862, "uuid": "be23fcaa-35f9-4c0b-9aea-26e3ea2d875d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756862, "uuid": "86eeaa40-78eb-476f-9a73-9dc6e73e1cb9", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756862, "uuid": "5367bfec-3c5a-4c3e-9583-9ccf95960376", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756862, "uuid": "a4f55336-07be-4daf-9ceb-e055eb383187", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756862, "uuid": "3fb53b51-1896-4ee1-b112-098bb956c33c", "value": "8b6496cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db25750-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789304, "uuid": "5a093a48-bc6e-44d2-9d37-3700c934832a", "comment": "Malware payload (Dridex)", "value": "b992339fd189d9b57f7d37e5dd2edfa9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789304, "uuid": "f4570718-8b2f-45b6-9dbe-bf08f26413fb", "comment": "Malware payload (Dridex)", "value": "5c6d6163f7500e8d2f5da0c686fd8d9dee74dd23b4261fe913357319093e189d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789304, "uuid": "4cf3cf3b-aab6-4a00-b93b-828c0064b7b3", "comment": "Malware payload (Dridex)", "value": "9e7724368588990ac6b50efc4ddf27aa01ae292a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789304, "uuid": "b286c019-5d67-461e-8f72-032df257de4a", "comment": "Malware payload (Dridex)", "value": "672ac15a89444a3831f4484fd5567f8d4f6903aab28eb81e4c799233a4e294025cce5256ce132f7a121866df64ace014", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789304, "uuid": "da747ccf-eeca-4b74-8078-3f4b8ec3871e", "value": "41F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789304, "uuid": "daa4f98a-4246-4617-a5bc-f0b69f954aee", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789304, "uuid": "f7efa57d-7c42-4628-9936-5fc6be051f40", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789304, "uuid": "ce53baab-4146-476e-aa07-ce1317e572cb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789304, "uuid": "00a3de02-7bfc-45a0-b5b0-6891a41d1967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789304, "uuid": "d6975178-7ec6-49ad-bf74-dbdac92981a8", "value": "b992339f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db13dcc-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789331, "uuid": "af53cdeb-99ed-47be-9208-12a4b46e50be", "comment": "Malware payload (Dridex)", "value": "3aa8452952ea1f0296a97cb02345aa3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789331, "uuid": "b586c3e2-29e9-439b-8427-b7e5268bba69", "comment": "Malware payload (Dridex)", "value": "5d2d098468603cfdbfa0628f6f188136ddc30b2d40e573bb527638c630502788", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789331, "uuid": "b4afae13-a202-4dd8-8596-7a8ea98a141c", "comment": "Malware payload (Dridex)", "value": "fefde8f6fd11348b585b55404c9f92a02e54ff19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789331, "uuid": "ff6489de-2cad-43b1-b488-dbfa97251e05", "comment": "Malware payload (Dridex)", "value": "599f9504cd4eccba624587bc99dd022b6d73d2a3803ab0b9f4d4c92fe478582ce7b3ab3073e8999f61cc1c7eaded60d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789331, "uuid": "d716fc51-9298-4091-a70b-51653c970370", "value": "84F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789331, "uuid": "bbf0546f-ebde-48b4-9e4b-0d459f6921b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789331, "uuid": "cb662a1e-d415-46d5-a858-5a469915d04e", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789331, "uuid": "ed64e70d-f394-4d4f-8207-678d7dfe90da", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789331, "uuid": "f3f87216-194a-41fa-8786-89b07b00f990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789331, "uuid": "56e35096-1ed8-45cf-b033-23493d7ba725", "value": "3aa84529_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bed0df-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785766, "uuid": "c82fe9ec-7a0d-4d78-a8dc-3fbea4577ea3", "comment": "Malware payload (Dridex)", "value": "7255e0005e2e5ee2e68f03165eca4690", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785766, "uuid": "9a4e851b-81b4-4eb6-9bc3-150657546d17", "comment": "Malware payload (Dridex)", "value": "5d4b70eb2771559199f1ebe30bae7e5383e75b7a95b7bd6651d35425f2c92273", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785766, "uuid": "50031525-ad7e-4561-a6fd-9b9ad97cc80b", "comment": "Malware payload (Dridex)", "value": "07ceee46390df339df07126143af4bd7cc1ca3fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785766, "uuid": "a7058097-8c17-4157-8daa-dc37b1ccbc5b", "comment": "Malware payload (Dridex)", "value": "fb84569be0c2152a821b726e1cce8e45a289341812cf0394c26c6f2af2dd6f78f7c493f6f494ef56ff35b43cf58013a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785766, "uuid": "8c0c7a01-44b7-4f0e-9170-a92272b9fe96", "value": "5EF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785766, "uuid": "1c93b733-f0dd-4e9a-a686-41e936d5c019", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785766, "uuid": "70771a53-9cfd-467b-969a-fdd471c441ba", "value": "3072:F9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:F9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785766, "uuid": "48418211-d0da-4dca-9ac5-7edd35c0b8a4", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785766, "uuid": "2ebde12b-6fc7-40cd-b6c6-cb67c6f90951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785766, "uuid": "f710e7d0-d2f5-42e9-b4d3-ffb0cfad1238", "value": "7255e000_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1e2299-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796445, "uuid": "5de51cfa-42e4-4cfe-a0a5-58e48085fc17", "comment": "Malware payload", "value": "6cf4314b4a7b91d82a0ad3aebb516b3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796445, "uuid": "4df0b1e4-2a44-4844-9356-752179025a0f", "comment": "Malware payload", "value": "5db1a5ac309e1f5b5bb983692777f3393351cac5e797008f72da96c3ad0e80bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796445, "uuid": "ceda8890-79a4-4684-b932-b820853c300e", "comment": "Malware payload", "value": "8ed25fca22136777fcb375ee4e163e81e20151ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796445, "uuid": "d5e56694-78a8-43df-bccb-79262fe16fa2", "comment": "Malware payload", "value": "54fc3d2d2e7ae59bedaa2be3ea3a81650355ba859bcb9acc8fcadd6126054a11339e9e4e94882eeef87a2bb882a40ec9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796445, "uuid": "0f667c85-cbe2-4783-ac91-7a60def33450", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796445, "uuid": "404598e6-adc1-48fd-932d-32c0046da325", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796445, "uuid": "658cc8de-2ecf-42cc-a51e-48d3496db01b", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796445, "uuid": "45930c65-8819-4236-8739-58ba3dfd1ced", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796445, "uuid": "e1a6703a-b9e8-4fa7-beb2-ba901b28ad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796445, "uuid": "ac43132e-39d6-43a0-a398-9b36f9df9667", "value": "6cf4314b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89c2904-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810878, "uuid": "f14322f0-7bd7-4178-873b-d58348c7d030", "comment": "Malware payload", "value": "a8f151c5ded471c2350df843b66778df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810878, "uuid": "bfd1474f-7764-4acb-84a9-844090c1d5e6", "comment": "Malware payload", "value": "5dceb244906b60fe6fa3b9129573bd6972675c899e503ea1da0ee34f98c6e5d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810878, "uuid": "e23d79d6-8b6a-4937-92c7-76918f677de3", "comment": "Malware payload", "value": "39b8251d5d4a6a23bace03b1c621a617fc5b3e3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810878, "uuid": "f4d55e72-739a-44b5-9586-ed73c165c562", "comment": "Malware payload", "value": "063155dadbca9faa067af00136717660f4283444dccb23f49bff9803ea7598c5b8b87a854d17b9b57243894f8a8df8ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810878, "uuid": "bbb3d484-0609-4b07-921b-ed1cf28db324", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810878, "uuid": "f6aa1b27-f315-49e9-b8ee-3702135e5c0d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810878, "uuid": "9cd16918-1f13-4fee-a136-fcb635b02692", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810878, "uuid": "e4680e95-8d44-4431-84b0-85b482dbc280", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810878, "uuid": "44aa0d83-bf79-4862-a997-809749e9fad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810878, "uuid": "04108e2b-36d3-4eff-b358-fc6718ecbffe", "value": "a8f151c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5ec06d-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753330, "uuid": "7374fc1a-f0fe-49b5-ae64-946069425f7e", "comment": "Malware payload (Dridex)", "value": "37f687b4f7d354a763236dd550fc7d0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753330, "uuid": "d0d39596-54ec-491e-826f-8e9c7fb90fb2", "comment": "Malware payload (Dridex)", "value": "5e6c2ecd2d204746960df56578eeb6694e778312ac080d2b764e43b4592428fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753330, "uuid": "e53b61dc-5cef-42e0-8186-e10eaf301ece", "comment": "Malware payload (Dridex)", "value": "daf6dd338f7637c5c8ee39fc1ce880901942b3e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753330, "uuid": "1ac3fc74-bdb9-43ae-8ed1-0bc713879ae7", "comment": "Malware payload (Dridex)", "value": "3f0dbb7824747bcf6878b9cc7d11b4ad9363c75d131d89b32b4f9e0724a9ae950849987d9a5f0cee20f61cc128a1cb15", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753330, "uuid": "a12a64da-b580-48ab-bfa7-26ae7375e494", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753330, "uuid": "9925b327-524c-4494-8529-cfb37f8cf745", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753330, "uuid": "a69258b4-cbf8-4338-80a4-fe595a611738", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753330, "uuid": "fbb31bb7-c52c-4210-b301-145668f735fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753330, "uuid": "aea37835-9da0-4c46-9f2e-609b841ffe9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753330, "uuid": "8a5b1596-dbe9-4da5-888a-3e665369fe6d", "value": "37f687b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62512e7-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764059, "uuid": "4ab2df3b-4adb-47d1-8ff5-cb3caff5a00a", "comment": "Malware payload (Dridex)", "value": "672501509075d6fe3156a9e6c86ae743", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764059, "uuid": "23f4136e-fa5e-4b65-84e3-bd6ba5ccdabd", "comment": "Malware payload (Dridex)", "value": "5f199d689d016ccf16d94afa004b7b65e7d1b74b7e01d9a4e920b641d6f27b62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764059, "uuid": "00c07b21-3fe5-4466-b179-6bff80f6b72d", "comment": "Malware payload (Dridex)", "value": "a613f7f839dbd48987aa522280aeefa3b520abf6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764059, "uuid": "3d4b6634-ac80-4aba-89af-a54745b736db", "comment": "Malware payload (Dridex)", "value": "c2dbdefa2bc8ef83003294f7ea0e884fb04e76750ced11e370f3dfd70d6aadb0b3bbc9faf97ed5f68ab8ef6a500c0313", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764059, "uuid": "805276e0-cdf8-4fda-b4d4-221e820d5089", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764059, "uuid": "3d5f2a0f-1368-48e2-bfeb-a30b980f0397", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764059, "uuid": "355f1c48-ef19-446f-8e90-e4371a61e53e", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764059, "uuid": "756dc00f-0ff8-42ae-b3cf-a51e34eb3834", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764059, "uuid": "d111d73d-e782-4b2d-b05f-2b2a4840b477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764059, "uuid": "824f6c61-fcc8-403b-929d-0627a590c1f3", "value": "67250150_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea71087-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810888, "uuid": "679963c6-1b8c-40b0-8e66-0b7311639b44", "comment": "Malware payload", "value": "c2cd1fc3c26c0344cb5ecb0def054333", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810888, "uuid": "ca21cc4c-a289-4f4e-814a-8c19867c4c18", "comment": "Malware payload", "value": "5fd602dde2835d9d18caad4ae165501ea741d4406facf31391f440062bfb573c", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810888, "uuid": "2bb5806c-6ea2-4907-a27c-c8c5e318554e", "comment": "Malware payload", "value": "2dfb97ddc58e83a656e30b66b8cbf1b8867e1796", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810888, "uuid": "c8ed3aff-3c70-470d-ae29-1b6ce4dc8693", "comment": "Malware payload", "value": "68c31519982cf2e508e5cd5b61b40f80f9c8f0a325af8eae98d2ffff8c9158d250b0ce2083b742f50fd87ae237667e37", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810888, "uuid": "85ef6fb1-6e82-4d10-8f39-c301208baac6", "value": "7951971AF947D14C9BB9232BDD978562FF1B411B9DA2104C71DCC2495F2080996ACF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810888, "uuid": "7903de72-96d1-4e57-aabb-4a31fe1be85d", "value": "48:kxL48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:2GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810888, "uuid": "732db4fc-dc17-4df9-ade4-9e71c10cff89", "value": 3119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810888, "uuid": "284e300f-ecbb-43e1-8bf5-d42abcaaf083", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810888, "uuid": "2177b4bd-3aa6-4717-b1f9-aa25d6262a7b", "value": "PxSQ90Ns.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d248291-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803718, "uuid": "e828a26f-ca22-4d98-874a-e54d1b7cbbfa", "comment": "Malware payload", "value": "7a667f2e613a4b7bb894c2d050ae1840", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803718, "uuid": "72d2caf4-ff84-4d06-9489-ed9fa4edbbd9", "comment": "Malware payload", "value": "5fdf3548976332e57f4248aff9b93772a1d597389f22f2b48d9c881c81f8ca37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803718, "uuid": "a4351cfb-f53a-4ec6-ba75-b1889de5d472", "comment": "Malware payload", "value": "d8b41f8d7336fa33781dc5b2941903636602a71b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803718, "uuid": "390dd1f5-24a9-4561-a553-c939004263e7", "comment": "Malware payload", "value": "adaee9634eacde17fa187032fc585ff91173937b48cd8c875131f7f5b7d85c79b7280e73c82f69d8c196fc1e2fb07a43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803718, "uuid": "8993a60e-06ef-4f6e-95e6-d43a6e8e738b", "value": "BEF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803718, "uuid": "d86a6228-3359-44f4-abaa-1394adffaaa1", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803718, "uuid": "eecc0c0e-d70b-4cc4-bc62-ac944fe55b63", "value": "3072:J9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:J9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803718, "uuid": "e37f9ba4-c1f4-4c28-8dd3-2cbcc34bbfbe", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803718, "uuid": "37b23179-166d-4d6d-9a2b-4a15ea0501f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803718, "uuid": "49121301-ef97-47b9-a7af-817f27f492b3", "value": "7a667f2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f13fbb-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771362, "uuid": "fdbae4e9-fa9b-4d90-beac-4024be09542c", "comment": "Malware payload (Dridex)", "value": "7310e8b5d8da15b68b788aebdf7abb56", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771362, "uuid": "4909e7b6-137b-40d3-8525-e5d24ac4b074", "comment": "Malware payload (Dridex)", "value": "5ff3b95f1d74137154dc0dcb3daa43d860299673b40b90f9331362d541463ebd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771362, "uuid": "d7305582-7f4c-4207-9263-225a6a79d01b", "comment": "Malware payload (Dridex)", "value": "a5729f8acba144f9e67a3c951b55015a4bbf6fe3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771362, "uuid": "4fa09062-caa5-47fe-8a1c-2f7bfb0806ea", "comment": "Malware payload (Dridex)", "value": "e74a46bc33bbb8a1a8bcf05a26f02531ba5a87da247f12cbfc1f8ba0686fca74780fa7cf76ab485400e50f51691a3f4d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771362, "uuid": "fe191cb8-ebda-4960-9772-5f88ba6735fe", "value": "A3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771362, "uuid": "94ae7eff-f4ef-4645-92bb-e3e250fcd7e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771362, "uuid": "68760eb4-016a-4329-a4f1-00643d7219d7", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771362, "uuid": "cb3194d4-c8ee-446e-accf-407f0019af55", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771362, "uuid": "2c91ba20-6eb5-42ea-b22f-84c2378ef699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771362, "uuid": "40dccbdd-d3d0-452e-8c93-ec9867d62603", "value": "7310e8b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0501b6e1-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728087, "uuid": "6acc89cf-9137-4dae-a804-2455e9472939", "comment": "Malware payload (Dridex)", "value": "3504d0a36f63b8ce52d6f282e7c0a59f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728087, "uuid": "b2ddca9f-8e33-4972-8c1b-277330940be1", "comment": "Malware payload (Dridex)", "value": "606d12f9e0381f5b824efc58ad194286bf407a78822d76073629151e689f86f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728087, "uuid": "3a62c644-0365-48fd-883d-ff870bb09a71", "comment": "Malware payload (Dridex)", "value": "f9245298c1465117c1085f1547205d07d598e230", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728087, "uuid": "46bc99df-e9d3-42cf-bf82-496fb27fabcb", "comment": "Malware payload (Dridex)", "value": "f94e2cce96951f58f0a87b374e6e86c7185374435a2066fdcb2edecebcaf24f514fe623c53ae5dc8fe654afe9b91b641", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728087, "uuid": "a0b65dfc-e10a-4fdf-9a7d-289da5fb4c01", "value": "82F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728087, "uuid": "f06b26e4-b09a-433e-af00-90d76847185d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728087, "uuid": "d56051c7-09d2-4975-9203-4e89c2d16c47", "value": "3072:ZA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728087, "uuid": "b9872da3-a661-45cc-923d-c6990224c391", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728087, "uuid": "5da0bb84-9c8b-4014-8002-569e2767a6b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728087, "uuid": "18366c69-1c5c-4ea9-a575-3a65fd348f08", "value": "3504d0a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4732736-bc1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621813099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813099, "uuid": "7e109751-1e8d-4211-bc4a-d7144a39bf38", "comment": "Malware payload", "value": "84aff2197a91bd546023ae412878e20c", "object_relation": "md5", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813099, "uuid": "95b1c9fc-be10-4c47-be1b-38e044098028", "comment": "Malware payload", "value": "60c8bdd0f3a8a6b6093f36dce7d68acf4b642d6c8990374b879b60257edfd4e6", "object_relation": "sha256", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813099, "uuid": "d4e49fe8-8296-4876-8b2e-836633b7129c", "comment": "Malware payload", "value": "1d73387f80a07348018f77d5668b1e312ff90e23", "object_relation": "sha1", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813099, "uuid": "fbf2f14d-a323-45e9-88ee-c728c2b73646", "comment": "Malware payload", "value": "8d64ee3afc0dc35aee2c023c71bc802ec8ae7f5af965b6c4addf395cdc92830f72e3cec348097bb3ae4c88c5b4346f91", "object_relation": "sha3-384", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813099, "uuid": "b034bcad-b055-4cf6-94e0-17578511036f", "value": "1512085A4E6A57F8DB4F4C8400CD3E46DFEED012281E69C6B9DA5D4F2496C2A78F20F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813099, "uuid": "04c16a7b-8529-4be7-908c-5ec966b79a97", "value": "192:qChk43ZZTOiYHsMUMrbf5U84JMOe5OEQwNOv5u:V3Ttk8esEQwNOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621813099, "uuid": "e3b41da7-79e3-4162-be4e-a627668d90e8", "value": 9516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621813099, "uuid": "9ae75de3-be1b-49ff-8b07-590956c46a59", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813099, "uuid": "349e335c-c81f-4220-8492-7b4051c37e23", "value": "h6qfcT9n.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506289e5-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621778464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778464, "uuid": "016de636-e862-4361-9307-c93986dd43d8", "comment": "Malware payload", "value": "64b2ce1f14471f35af5a5843080ff18f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778464, "uuid": "93b946e0-71a2-4ae6-88ed-10f7d45816d0", "comment": "Malware payload", "value": "60fb96555247e1b4c94938c18486a20077adb45a76d231a8a94385e0c337b606", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778464, "uuid": "5f625a86-601e-4581-80d7-717ca72e3b2c", "comment": "Malware payload", "value": "038d4c6a7d065f8be5245ee560a3d3e187a75be7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778464, "uuid": "3c8998a6-b85b-4701-a86d-346124b589c8", "comment": "Malware payload", "value": "7bf5bec6d0c6b97dbdd0fb49f8801c5dc4b74be0236d1d5706d1edb8498ee0ce04d4a9dc9e14beef62d32b573e86fc37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778464, "uuid": "f344b98b-8e14-476a-b38b-0386b2aa7e2d", "value": "0DF2F1129CB08EA1C57A17D1935E7F7CC68134278D3E1254C896E7A02ED6778789D12B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778464, "uuid": "da487735-a151-4d38-9206-52ad71c60ac6", "value": "768:cqtRDNtz10P6bFwwpJiJ/R4yEkIPI7HrR+am:cMa6bGwziJ/KU4am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778464, "uuid": "c1093ef4-0c1f-43fb-b549-71f6bdd3ee20", "value": 35937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778464, "uuid": "4b4b562a-7e39-4ca6-a7bd-71d378eb74b6", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778464, "uuid": "ca0498ff-c369-40ee-9647-74dff9bde4fa", "value": "64b2ce1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02f084d-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810918, "uuid": "1e3cf010-c3de-4909-bfd4-67f06fdfa9cb", "comment": "Malware payload", "value": "be6a92c98a159978899d11dccff657f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810918, "uuid": "1ace0106-2311-4609-ad5e-98f683701566", "comment": "Malware payload", "value": "60fcd211bc29de9d3f779161f50a1705e53c8253110dc0ab1996b35dae607b87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810918, "uuid": "d6a00986-7080-478a-bec3-d5cc7597201b", "comment": "Malware payload", "value": "af1e88f6c9d052e0d22afb05631a4ae4f87c6410", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810918, "uuid": "a30f5f3d-154d-4a8b-9c58-b6db3ab80836", "comment": "Malware payload", "value": "d4595ab70b43977bea8cb7a83d4435544902b2a221606552493cd3b149fe4709446dd7b7effd4a1f5923af2b24bb47da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810918, "uuid": "d188037f-6853-4555-a895-6f7b5fe2b3db", "value": "C904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810918, "uuid": "c3bc41ab-d47b-4902-9acf-3fc84afdae2a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810918, "uuid": "df11a03c-3323-4cd7-8870-36bcb0ab67e5", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810918, "uuid": "9c6dc5d9-cebd-499f-a7e5-2b161571164e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810918, "uuid": "6c9f12e3-37b4-4e92-bba6-499eb9c0cc90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810918, "uuid": "ac851e78-ec1c-4150-911c-d112b86d32e1", "value": "be6a92c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cce0df-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774927, "uuid": "54126939-3f9e-4498-b3d0-26d3b9c63dd8", "comment": "Malware payload (Dridex)", "value": "d061aa2ab61af9fba5152691f3f1c8f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774927, "uuid": "1f08df3b-b09f-4e8b-9bce-cd25cc53a9bb", "comment": "Malware payload (Dridex)", "value": "612a1cbaab7efc8b40349b297609a640ef8d50eac2add1da5972179fb8de82c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774927, "uuid": "c1a0b920-b9da-4fab-99d0-f8e96d8ea221", "comment": "Malware payload (Dridex)", "value": "1c64166d425dbc0b47e32fb0ea610ca1d03e81c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774927, "uuid": "35bd14ae-4237-4772-9edc-be47c6843652", "comment": "Malware payload (Dridex)", "value": "c6e340405db7e28cc0674119121ad3ef5550a3d1e98986a96212e3378e5a178a8ac9307ba60a74824fcea8198ceeb83c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774927, "uuid": "8d590fa2-e962-4879-ae33-ea4825b7fdaa", "value": "3204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774927, "uuid": "4739ecc6-f910-45c9-8cea-13703b937452", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774927, "uuid": "f97acc85-c18b-4a83-9e20-f89cab445934", "value": "3072:OWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:OWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774927, "uuid": "1c4f6d73-36d0-49c1-a432-5be0b6580195", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774927, "uuid": "1705044e-c422-4da4-abaf-0e12d90a3e3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774927, "uuid": "150a6251-16e4-4a74-8fbe-4e3ea49b66bc", "value": "d061aa2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c7adae-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789289, "uuid": "9ee6ac61-7f83-46d0-b1e3-c19adf10011d", "comment": "Malware payload (Dridex)", "value": "24b159b1e375cdf2fed20c4f20675c04", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789289, "uuid": "fac1efc9-a30e-4c92-bd91-3aa945c6556a", "comment": "Malware payload (Dridex)", "value": "61d2db2806f7a594694fc53442363c955fb5dd7227b7c5675e97ea5246344d81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789289, "uuid": "7472dfcc-9c55-431f-ba1e-3d315df9cd84", "comment": "Malware payload (Dridex)", "value": "018a710ba05b1986be9f00434b65199a79724ebe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789289, "uuid": "db370bd2-48e9-4626-be3e-55f8d68489ac", "comment": "Malware payload (Dridex)", "value": "4328707c4ac42dfdbddd9b3b8f22072d819d2c67271d7438b893646abee1be133eb9d42b81ef245119689e37b38bbb5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789289, "uuid": "7cb8b26c-37cd-4300-977b-9ccd8e3b6c4b", "value": "DFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789289, "uuid": "d7831122-1f92-429f-a263-726ddcfdac25", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789289, "uuid": "9707936d-3fdf-4212-b634-6e3e1d3586c4", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789289, "uuid": "64c33af3-f36b-4c12-9dfa-de090986af56", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789289, "uuid": "3311782c-c43b-473a-a4c8-350421ec9ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789289, "uuid": "8e1bba26-037e-43b5-9075-0f46d776fea2", "value": "24b159b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6656a9be-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767764, "uuid": "965dfe90-0ecb-4b47-a529-6f5fdfb3eea2", "comment": "Malware payload (Dridex)", "value": "c33aa5728e1749248ea1de4652ab01ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767764, "uuid": "2abfcf1a-9fff-47cf-9230-1c8dd0ba8a5d", "comment": "Malware payload (Dridex)", "value": "6229a8cd7977825495064f4c125d45d2aa5485145c4d0709198a02bf68a1b86f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767764, "uuid": "2e437641-1d2a-413e-8527-bfb5a2545b92", "comment": "Malware payload (Dridex)", "value": "8a800a1b2763dbf51e5b7d00289562694cc0a387", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767764, "uuid": "bc366d22-bc50-420e-8c40-a7075bb224a9", "comment": "Malware payload (Dridex)", "value": "5b516ac062eba1e37a3779b9c9775f16b76b058d9ef053fc94907a00b5e696c80992bacb2108a404ea6b041a7e91fc0e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767764, "uuid": "8725b75f-6e31-4475-90bb-237324e06c83", "value": "2FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767764, "uuid": "35831af5-2a55-4e98-843c-4d6f69477cba", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767764, "uuid": "ef6e8659-a71a-45d6-a30c-eb9ec0903b16", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767764, "uuid": "5933b3ee-5e2b-4d94-8e31-a1f4c7937179", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767764, "uuid": "d3f1fcd1-881c-4711-9cad-bff3edd36ef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767764, "uuid": "f874c4f2-6fea-4e93-9465-eee8f0a3aa98", "value": "c33aa572_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04535f26-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621785638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785638, "uuid": "ab314fb7-492c-4b7c-9dac-63221a13b93c", "comment": "Malware payload", "value": "aaf93aa7d3e8acf6d2c571310f1be4c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785638, "uuid": "d99c6c8e-6a98-4e02-b9dd-be0b0a690a02", "comment": "Malware payload", "value": "63b59a569d641889c2595e9eff34ab1943a0c1d704fc9fddafb7e4c5f20ed510", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785638, "uuid": "bb177595-62c3-4c4b-995e-5ffe3f727858", "comment": "Malware payload", "value": "97de27979f50a47a43eafa8502ade559ca202d31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785638, "uuid": "b9b1c6ce-341d-4a34-8af3-f1a62ea30a44", "comment": "Malware payload", "value": "58ceef6178a950977d7b86c79a76a4ea56a8dedb09f2cb14055b1deec8d43105ce3d7a6b0735dacf0cdf5d19fc3b47b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785638, "uuid": "9b78bb62-d688-4ab4-a18f-7f026610d6e1", "value": "D1F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785638, "uuid": "a4fd5b9b-23ae-44c6-9870-fac97660099a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785638, "uuid": "f56acc7e-0a9e-4141-9938-dc51fb6db683", "value": "3072:AIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Zc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785638, "uuid": "5fc3e070-2204-4f62-b088-3ad13540d92e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785638, "uuid": "6aadf88a-90d0-4ea6-97bc-e20a3a40aa36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785638, "uuid": "e08be0ab-6181-42b0-a581-cb8010862cc8", "value": "aaf93aa7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41ce3bf-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800079, "uuid": "dc9f5e37-01ff-4566-a8be-e07ea8f93bdc", "comment": "Malware payload", "value": "e02377fefefa9ec216ff28ec3ca663ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800079, "uuid": "b2ff4b3a-4ec9-4df6-91fa-7cac3d1d3762", "comment": "Malware payload", "value": "63e93bd91fcda37303fb79cd7ec4cb45b472e1ff1c8b56973a4c7cbd953f56d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800079, "uuid": "6999e73f-71b6-4e86-9f72-99af9b21448e", "comment": "Malware payload", "value": "ab524d5fce1247057490d920ba3b0b43f6258213", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800079, "uuid": "de17c5a2-6494-46b4-aa0d-6823edc926ed", "comment": "Malware payload", "value": "51b585e61f247fd56091b973f4d5decb3faf7c961020958e8d264d5a0b9396847903cba4f0f61fa082a803c89b538f1c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800079, "uuid": "d80efb7b-81e7-484d-8807-bdad4f6bb4c0", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800079, "uuid": "ef95d8a8-5924-4fb0-bd36-ed2ef16fc726", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800079, "uuid": "94407f82-726a-44b0-87c4-4ba76a756e28", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800079, "uuid": "8b0f5c07-c479-452c-9a4f-17673b643afd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800079, "uuid": "e9697fe2-83b9-4e16-8c11-b7fef6046102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800079, "uuid": "09da7262-af8c-42dd-b9cd-52b5e4d9340d", "value": "e02377fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8df836-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810886, "uuid": "97ac2027-7fd5-4af2-b6bd-654940e600be", "comment": "Malware payload", "value": "813c0af88ee2cfa471b83f9fc849436d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810886, "uuid": "85543501-22f3-44dc-bec4-939b1395099f", "comment": "Malware payload", "value": "6570764cdcb647b75df0a04aedc92c5ca0eca82d5fa3d1b2efd760e2dfff2689", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810886, "uuid": "13726173-2db0-47bc-a7f2-b79096d9813d", "comment": "Malware payload", "value": "8319fee530f464d85f4164d6d12158df34249daa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810886, "uuid": "3a62d769-cbf2-4126-8c4d-6d0153bbbf91", "comment": "Malware payload", "value": "ed532708353593abfada10fc329927cfa15cae673f8c0814c9adddd5e1241ef254c2d3acff9b78b77f9917800b58bf4c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810886, "uuid": "152c1c7f-ef4e-4ff4-9eac-1375922946d5", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810886, "uuid": "7ba50b75-4f92-4a05-9049-4335d445e06d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810886, "uuid": "14321b52-d7d4-4941-af2f-0bf805c33a74", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810886, "uuid": "1d1ac0d0-4178-4d2e-896e-cb6cc8d69ba6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810886, "uuid": "e61e2853-d3e5-4268-b8c2-4dd5245bb738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810886, "uuid": "71acde37-f444-4670-ade7-a2523b2cd365", "value": "813c0af8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e4186b-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735302, "uuid": "1563a6e1-6807-4e40-a35b-a3aa2ba94aa2", "comment": "Malware payload (Dridex)", "value": "40cb9bf27dc521591e9d667c83b0a951", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735302, "uuid": "5cd6cd3b-a50a-4357-b653-b98ad1861a70", "comment": "Malware payload (Dridex)", "value": "65d9d45b59b5641281cd5f49bd8e61446a48d74435e899e4e5dc20995dbc1c45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735302, "uuid": "01bcafb4-e667-4656-a4eb-f563bbc3e7aa", "comment": "Malware payload (Dridex)", "value": "0c1382cc4df6422812e9a7e410b17036d08f9283", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735302, "uuid": "7d3982a1-5634-4ba1-84f1-4fa3c626ce6c", "comment": "Malware payload (Dridex)", "value": "dde8bd8b9942dd085ac8f0ca4c997b2652a6077c284772ccdae749c82876b6bb4821715ed60d1706c0af680df5910897", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735302, "uuid": "fb23e8e0-6532-4df4-86cf-c379147852e4", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735302, "uuid": "ed58dbbb-ec73-4582-8570-534da6dcec1a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735302, "uuid": "fca84b35-7bef-4012-9de3-31ec8b14a581", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735302, "uuid": "a3778b85-4c00-407f-b044-14c29d465525", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735302, "uuid": "a87778bd-824b-40b2-8f61-08d50710841d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735302, "uuid": "6494775f-8c4a-4625-b4e1-eeea27e21774", "value": "40cb9bf2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d49b07-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810873, "uuid": "3ab9c09d-1056-4ccd-9407-d17680a0c40f", "comment": "Malware payload", "value": "53b7be8f79c1f12e6fdae8819bac9281", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810873, "uuid": "ce36e3c3-f379-4db4-ad8c-291f53e27d0c", "comment": "Malware payload", "value": "65daf240ea76f83b202356809af948b4aa5b4a4dc99520acc07bb0ac32e669f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810873, "uuid": "14d5f09f-958c-4177-8a3b-f3c9f24ff586", "comment": "Malware payload", "value": "060bf7066b02bf6f1ecb10cd4e3b7176069a799f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810873, "uuid": "136266b3-ebc1-4d2e-8980-39b78f669e24", "comment": "Malware payload", "value": "de7c87d4d9a5c615275c57f2ad27509c74001be3195a358a781d2a4cf61fe8ee85a1af0cadc3b00470565d63707720a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810873, "uuid": "d9f6c74a-5031-407a-ad49-0e32b4a6defb", "value": "DCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810873, "uuid": "836193f2-568b-4176-a77f-23a0070a6294", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810873, "uuid": "710243e1-fa10-43d5-8bdc-2f057b5259bc", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810873, "uuid": "19c5db70-34f0-4b45-b51e-d900751371d2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810873, "uuid": "94ca2f2b-28f4-4441-bbd9-a1fcd04b4c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810873, "uuid": "a9f70923-de72-4e03-9a24-188c827f58fd", "value": "53b7be8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f34c15a-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742438, "uuid": "9c11e863-c811-4f72-8f59-5b99dbe2928f", "comment": "Malware payload (Dridex)", "value": "7fa8511ad78021bab86f4e225afd768d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742438, "uuid": "8dfae3be-a022-4aee-87cb-31afe50145a7", "comment": "Malware payload (Dridex)", "value": "65edfdc5944dd78e8db9a947c054cd45a72b571dbad4daac14981e48ad25d3ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742438, "uuid": "02c667c1-2037-45d3-b15c-6f016978f3c0", "comment": "Malware payload (Dridex)", "value": "27b44a3760d9ad2f6073f2517ef4f48a37388b45", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742438, "uuid": "6c327e5d-7b4a-4536-987a-0bb6aeb07e76", "comment": "Malware payload (Dridex)", "value": "6dfd2ee585908806fd3ba435486424466e7f1bbd6a2ac37389a6b7512dfd0a7398526de8db3fbb5cd6b0decda75dc96c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742438, "uuid": "a37b1354-19a3-4516-b0b8-567935223675", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742438, "uuid": "a8b410b5-19d8-4306-9d74-5a7c656b8b32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742438, "uuid": "18fb6e48-de6e-44d0-b857-32d5273729ec", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742438, "uuid": "07328dae-6753-4eb1-9e3b-dde7c24774b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742438, "uuid": "17b1b8e3-5c90-42c2-bcfe-9375a0762aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742438, "uuid": "5ad7e07d-425a-479b-a33b-454005cd947a", "value": "7fa8511a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95539ed-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810906, "uuid": "aa46864b-3396-4b16-bb08-a343a8f61c02", "comment": "Malware payload", "value": "2dfd3de52c3933a1006993511cd4ee27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810906, "uuid": "064ec4e8-8232-4cde-a2cc-bf4049d6dae3", "comment": "Malware payload", "value": "66be4cd0a517a3be0fdeee58716b1e4e9bcef2975780affc3dd93e0ef0cdf26e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810906, "uuid": "065c9392-36ec-47f2-9d8f-5b15e5891b92", "comment": "Malware payload", "value": "210584368426a015c6b110a331140d30a9e6bafd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810906, "uuid": "e9b71b6e-87eb-4c24-ab5d-d650bbcb8fc6", "comment": "Malware payload", "value": "9897d15940ce6041bf4e9783c9b555aad9d3e5f6687a08a57680cae2f523e3bd2d0cfcb66af9c79711283df9a830d74b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810906, "uuid": "97a8d477-9bfb-49a2-916f-65ec14e08e7c", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810906, "uuid": "bbfcf90f-b737-461d-abf4-0bab5f805b13", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810906, "uuid": "96b8de91-45d3-4698-a9ff-46d41393710e", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810906, "uuid": "aecc0ca6-d869-4bd3-842b-ee329473615c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810906, "uuid": "aeb14fab-8cbe-448e-a637-08bde7a61f4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810906, "uuid": "2165fb76-8b06-476c-85a3-ff1f4537d2d0", "value": "2dfd3de5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a48519-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800028, "uuid": "b72d3b13-0172-4655-880a-0d85716f407d", "comment": "Malware payload", "value": "cda6082e3939035ab0796116bd4b4348", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800028, "uuid": "7ccfd8e9-8239-429e-af8f-ec5c4e3bc03f", "comment": "Malware payload", "value": "67217787b69e365aed9ffb5f49d1ff3301be6fc026e0a741dd1ade8dfdb6c3f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800028, "uuid": "7cb607ff-f778-44a6-bae0-1fa92f41132c", "comment": "Malware payload", "value": "e7d801a654536d7709557cd4d27e98341ecefde6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800028, "uuid": "f4a4e10d-9cf8-4224-a333-96d4de360b9e", "comment": "Malware payload", "value": "d379069c90fc1d7534654a645d781847ec86a695a30e80915eaff0075215ceacae9bbcb79324a0d10ea36673299060b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800028, "uuid": "3e3c8edf-40a3-4f4c-8ac7-1c363760694a", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800028, "uuid": "d2042bfe-d1d9-45bd-9b29-df8537659471", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800028, "uuid": "ad4778d9-7418-4e78-a957-256f9b3d758d", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800028, "uuid": "220aa8d7-9a38-45fb-828f-e2c4bb2b2fd7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800028, "uuid": "97cd9824-138d-4d0a-900b-840264dc4644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800028, "uuid": "bab6c8ac-1675-4af6-a195-a4621a473c5d", "value": "cda6082e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173a4a7-bbf1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792935, "uuid": "bd99e81c-9d47-4ec7-b973-66cb11f48f7f", "comment": "Malware payload", "value": "358ba52ee23ae06535b065f24bfeca80", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792935, "uuid": "9ed02963-e4fe-4ef9-b9dd-15ee91c925de", "comment": "Malware payload", "value": "681a52291d3c130393a838523a48e6bfa070f5c857cc99e1d49aacbc6198419a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792935, "uuid": "a19dead8-9d4f-46f3-9198-dacd0f233d02", "comment": "Malware payload", "value": "6462d823d915da4f447cbf2d65711c52612724cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792935, "uuid": "5c5009a3-bea0-48aa-9257-07b17b00c64f", "comment": "Malware payload", "value": "6a65affc5ad503497e64cf64c315151a66fd13cb02b3c198ab745548808a59df3fa2b4a2640599e87bd3d27bf637f06c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792935, "uuid": "b390dfdc-f67c-49d1-bd7b-d7c6eca4f8bb", "value": "04F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792935, "uuid": "28af7398-862d-496d-bded-f6acf57ec724", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792935, "uuid": "61d7ebea-9235-4183-944b-a63082a7de00", "value": "3072:R9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:R9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792935, "uuid": "5363821e-5f14-4ffc-a78f-8c8fe80e229e", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792935, "uuid": "93e28b8b-8d9d-4f81-8ec4-b9d0d73aa08c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792935, "uuid": "7f697e01-2171-4886-a40d-ac7dad6e9b27", "value": "358ba52e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96067e49-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789318, "uuid": "fe124949-bd9a-4d7b-bb49-133ffe89f587", "comment": "Malware payload (Dridex)", "value": "e39a71230bd2177bd4271368a752bffe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789318, "uuid": "c5a52efb-f909-42ae-8eae-5a1f009cd802", "comment": "Malware payload (Dridex)", "value": "6851e6308714db3ebda816ae2542c5d585f04bef9ae504e667c26b899aa393cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789318, "uuid": "93470448-7ad3-48ad-a8a2-394c7730f312", "comment": "Malware payload (Dridex)", "value": "116dff2ed27d6b47a56af53752a72eeb5336f607", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789318, "uuid": "a5266fbb-f2ad-4eb8-b77e-292790393e8d", "comment": "Malware payload (Dridex)", "value": "5936c87303c4be67846da29e0965d4ece17c5f29308a33037dcae39fc532f0ec5af5c1f26a934d7011d800e897173c03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789318, "uuid": "d5294eb7-a8e3-4289-9d10-e22fa032bf5a", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789318, "uuid": "8fba65c4-2415-468c-a1f3-a344cc83fe50", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789318, "uuid": "70dc81bd-0d87-4086-bbcd-29fc3f487e9b", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789318, "uuid": "c2f86016-b615-4465-88b2-038061cc30d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789318, "uuid": "f4da826c-c87a-461d-a214-14d7b12672d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789318, "uuid": "bb808e48-045f-4ea6-b7f8-9e66f1cafdba", "value": "e39a7123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6d7c13-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621756551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756551, "uuid": "dd1e5cc4-474d-4fc6-9437-2b72fdbae39c", "comment": "Malware payload (Formbook)", "value": "55c4259949b8613e5e762341c226397d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756551, "uuid": "8acd0d81-4aae-42b8-b21a-4d3689c5ecaf", "comment": "Malware payload (Formbook)", "value": "68fd922afd4b980e00af527f2e2d6bbeed59ec1508c089370d64081a5532f3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756551, "uuid": "ddb17de2-8509-4718-a4fd-436eac19db09", "comment": "Malware payload (Formbook)", "value": "ba5ab9c7bd889c2675e92238ed8062dd64425706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756551, "uuid": "3f44ee66-300e-4cd7-829a-e0ae750e3e7a", "comment": "Malware payload (Formbook)", "value": "47c69a6c6905da3f189cd56d2d3a4395655435d2d01a1388bfbc3f16156f130849956206a979b30b09416a1d3adc804f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756551, "uuid": "70f198a6-9ea5-47b5-a6a9-0af22d6437cb", "value": "2B34121673D1CCBFE59749311A33CF3DDBBA5BC02526122F9BB16FAF29610034966286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756551, "uuid": "ff35102b-8036-4b66-bc4f-1960e6c293e5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756551, "uuid": "9dd181fd-6abf-4056-8fd8-bb277e572795", "value": "6144:Ds9DtnTzN/Z5Bvu6kLO18OYtVLh3FNVLuuE1:yn7B+LtOUX7VLjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756551, "uuid": "43380935-662d-4900-a6eb-5ce16c0a8b1f", "value": 235318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756551, "uuid": "e9cba7b5-9b75-4401-b477-69ddd22ad9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756551, "uuid": "3dabacf8-1793-4f8c-8037-3cc245a5e260", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45127f5-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764029, "uuid": "16c30775-b67b-4509-aac3-f88cd79820a7", "comment": "Malware payload (Dridex)", "value": "246a429ddbf403d04fb4174977a92f34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764029, "uuid": "6766fe91-92ec-4d32-af66-bfc7d525c346", "comment": "Malware payload (Dridex)", "value": "6948e9c3fd8ae60c5b7211ba54a7373d818e63600bc699a85fb9b10551c9a342", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764029, "uuid": "904be2e5-7441-42ef-882c-5e7d5b3e91d7", "comment": "Malware payload (Dridex)", "value": "1c94e4a8073eceee513584d05f3b7e379b06b284", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764029, "uuid": "8db87fad-933c-40ae-be5a-a049c45e22ea", "comment": "Malware payload (Dridex)", "value": "e7abb2a2feb6616269e82566e3d2ad20ef3c3a0e0aceeb73e21d64aad418313b67c137287c291f3ae4b452ffbd3c2dce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764029, "uuid": "f3c17d9f-050d-4934-b928-677e7fb7946d", "value": "0EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764029, "uuid": "a3b12933-5185-40f6-8a41-fe9914d90497", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764029, "uuid": "787a66e7-c70d-447f-a8b0-cba4341b1b43", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764029, "uuid": "89f34cd3-f148-40a5-8010-78b54825d737", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764029, "uuid": "756cbc80-61aa-4b4e-bbc9-bdc039b29a49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764029, "uuid": "7cacbf69-9572-4200-94ea-73e1ab67e0e0", "value": "246a429d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9509deeb-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760540, "uuid": "cb3ae2fd-b12e-4c86-8b46-23c3d4ee9856", "comment": "Malware payload (Dridex)", "value": "96e3cdb16413d207fd94907d39fbfcae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760540, "uuid": "325dd073-5b10-4697-afa1-9ba2c1f836f0", "comment": "Malware payload (Dridex)", "value": "6a26fd5da8dccb696983a1385934e43a37b352211f8938da8e38af3f442c410c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760540, "uuid": "cec2fbf3-75c3-4bbc-af8d-a0b9122f4430", "comment": "Malware payload (Dridex)", "value": "b54c72238c3c8abf07b1f19bc12b65e0bbdaa489", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760540, "uuid": "9e3f892c-8b26-40fe-8feb-4128c0482c86", "comment": "Malware payload (Dridex)", "value": "a2ca69d3470660fe8b6c17092474203fabb0d6287912d4cbd2f19a22402260175cd9d27b63fe85c42cfa6067ee5b2f09", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760540, "uuid": "a166a1cd-2ce1-40d2-9912-80240244c03a", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760540, "uuid": "8912e4b0-05fa-4603-9357-961c32832d99", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760540, "uuid": "5d6983bd-2d9a-4188-ab03-2d026b5f725d", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760540, "uuid": "7f54e4f6-b0a2-4daa-a5d3-c9e9b3bd3e8b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760540, "uuid": "d8314bb7-d635-4b6a-9b77-b89e62e3f1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760540, "uuid": "f79fa8ac-967f-4b7c-99d3-af60b5600d3b", "value": "96e3cdb1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9109c9-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792874, "uuid": "d29c0f1f-2bd2-4404-83ee-ed4784552448", "comment": "Malware payload", "value": "425184ee51003a69ec5c077c8cc3cccf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792874, "uuid": "d4e0d1f2-9d33-4c89-bca7-ed22317344a2", "comment": "Malware payload", "value": "6a372bdb5faee4dc450f47ef87bba294d904d185f871cfba451874f4fd5fd655", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792874, "uuid": "bdefe6b5-3e4d-445d-84a9-6416abb9e74a", "comment": "Malware payload", "value": "b4ea1f0e8847bb31c85d542fdb260c57b3f61536", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792874, "uuid": "5d0af0d7-103d-48c3-a0e2-2470911bf43e", "comment": "Malware payload", "value": "dfa7716a43bc5725fbf27173f7beabdbbb918cda487eb32d02c8c43cf9fe0278a4e03737b9c29b6b46aec36c752628d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792874, "uuid": "ff6f78e5-8997-4216-bdde-e9f52586016c", "value": "43F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792874, "uuid": "b6364601-ab40-4e6f-af7a-8e2edacfea73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792874, "uuid": "abf8b258-3f5a-4fe9-ac21-523d20b4b6ca", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792874, "uuid": "7cd87a9e-0272-46e7-8306-0b1e85782f85", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792874, "uuid": "76f5d7ca-0719-4b29-9bff-fd83c8d9fefa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792874, "uuid": "ecb951e8-1b5c-4a01-abbb-e1da05dd01dc", "value": "425184ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0f3c3d-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782081, "uuid": "a58c3228-d5fd-44d0-9c2c-74bfc75f66ce", "comment": "Malware payload (Dridex)", "value": "baae5a40ba59586f85fcc57558040ddc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782081, "uuid": "85843164-ae00-4c0e-b66b-5a03c4b9f18c", "comment": "Malware payload (Dridex)", "value": "6a8dce9e6f0149931c5c657a5f5e727be71feffd682360f7a618f8f8c5c8faf0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782081, "uuid": "d1faffb2-695e-4f73-93ee-a1f4641a150f", "comment": "Malware payload (Dridex)", "value": "3c623d2ea1f6c0f87c1b7df5b7e0b71985d7c9ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782081, "uuid": "3926ad55-0ddb-4e88-8dd8-02a1cbbaa0e8", "comment": "Malware payload (Dridex)", "value": "ef72f7f7db61b73d83acaef8e013a50b7314d7436f6d6417f8f4e9ed81211dcb928954ff7afa8813f6dc79915e559306", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782081, "uuid": "a040ef9b-2ce8-4bde-8a0b-29ed3082fe2a", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782081, "uuid": "1b06c077-d584-4339-87c0-70792b147d43", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782081, "uuid": "dabf011a-3065-4a85-a00d-1f8ef0ba421d", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782081, "uuid": "fc32c612-f8aa-4166-8f85-48b34340d8df", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782081, "uuid": "b9a63fdb-0845-4573-8c5f-74408f42ae43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782081, "uuid": "c4969b2a-4116-4d50-b170-c364d96557a8", "value": "baae5a40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139b179d-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756887, "uuid": "3d4f7fec-ab49-4f34-afe8-de178dbf8fd0", "comment": "Malware payload (Dridex)", "value": "b0db99741e42c24e1e5221fc64baa42e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756887, "uuid": "57047923-0b40-4bbe-80aa-ca8864c8a975", "comment": "Malware payload (Dridex)", "value": "6ac22160ddb34d17ec55b3e5fe7389bc2602e94bc32ba41676e97a9af7a68ee3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756887, "uuid": "cb1d4da9-6112-4c9d-bc19-500da7ea2341", "comment": "Malware payload (Dridex)", "value": "d9158347910fb12d643cba72a7b1edffe1695063", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756887, "uuid": "7d32c91e-786e-43b9-8477-b3e33881bc7f", "comment": "Malware payload (Dridex)", "value": "9b2538747e101636bf5e6fd56a23ff62a523bc114e931c9e8f1c24f19321dd935c43833f19da3cb35775057fd8b62016", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756887, "uuid": "655a9cd8-575a-4466-8d86-e85e0573047d", "value": "50F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756887, "uuid": "878379c9-063b-45ce-894b-4e8489e267b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756887, "uuid": "6e5dcf3f-5f9f-452c-8cb4-c9c3f802827c", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756887, "uuid": "cf773aa2-965a-48f6-bed5-c91d3f9855e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756887, "uuid": "11579b25-4e7a-4f28-bc55-67e39d644a50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756887, "uuid": "003eef08-d03b-4472-8bb7-7af9bf139f52", "value": "b0db9974_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f934e999-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792921, "uuid": "29d9865d-88b3-4009-b004-43a0bb2b671b", "comment": "Malware payload", "value": "83c8fb159b9deb5720750486ba3627fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792921, "uuid": "5aabbb8e-c320-4fb6-87fb-9b5fa12ad6a6", "comment": "Malware payload", "value": "6affdb52fc3a3c7545d117e3794a9f7ab63517c468c5c9efc43f26b3f97cb5a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792921, "uuid": "3cc2b2ba-23fc-41d9-ab60-e9ee23301687", "comment": "Malware payload", "value": "17d5ab1aac878aaf9e5b1af3bed10c43090c2187", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792921, "uuid": "385c3827-056b-473d-a27e-35c9e53bee01", "comment": "Malware payload", "value": "267f577aea8519828b1105a51cce5dd64ea31d782bc715b94331b74c3c0db4a509a8b1ce298afeec74fba9659edf7765", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792921, "uuid": "0b9b710c-a2a7-4720-a93a-b31326d59773", "value": "5CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792921, "uuid": "417bbc02-6b01-440c-b396-efe2c361d8cf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792921, "uuid": "292ac1e4-ad3b-4e17-8bf2-49a1b412ccc0", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792921, "uuid": "c489793c-ed46-4e9e-b1f4-388dd05b81fd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792921, "uuid": "010e7d15-c744-4e24-9e3a-17daedfac183", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792921, "uuid": "298d7286-d9bc-4b4d-ad5e-a750399615fc", "value": "83c8fb15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2842c843-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756922, "uuid": "6cedc48c-7de6-4b89-98df-ae35fed83058", "comment": "Malware payload (Dridex)", "value": "2dc4879d8c27df60e386f108697837aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756922, "uuid": "0929e987-9283-4bc8-9c44-9a34c34c4b69", "comment": "Malware payload (Dridex)", "value": "6c050076ad01e6c6c6553e5711efc699fc5f0b461101e4815ce086a9fcc40d5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756922, "uuid": "b63da045-4628-4047-9248-ba80ebb7017b", "comment": "Malware payload (Dridex)", "value": "f0a4cd0471681c998d6de4aecb1d8f2298fe7632", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756922, "uuid": "96c74943-6111-4f2e-ac4e-0788cc490263", "comment": "Malware payload (Dridex)", "value": "88468a82b164b80a19c6976530eddcc11d316374729e3c14bf49bf11855a02b82c934e2fe22d45419e4a3ccdfd4761c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756922, "uuid": "b4311be0-3460-47e0-8505-802707e62710", "value": "4B04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756922, "uuid": "106627c9-0feb-4c8e-b717-2cf503b77b52", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756922, "uuid": "9ae3c820-dbf7-4a0f-bc58-6c5222abacf8", "value": "3072:DWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:DWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756922, "uuid": "ef4adb1e-1e54-48f2-a128-ecd1e9caddce", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756922, "uuid": "7950753e-f1e9-4382-aa0a-bec1d12b3277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756922, "uuid": "e01db86a-bda9-4c43-946b-8b2eec5bac3b", "value": "2dc4879d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd47d97d-bc0c-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1621804846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621804846, "uuid": "e87f03be-0cbc-45b9-bb96-c4fefafd7e23", "comment": "Malware payload (DiamondFox)", "value": "9ace608fe2722dcf13d85037965a4f93", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621804846, "uuid": "173d1130-6676-42bb-bd17-b4991814c959", "comment": "Malware payload (DiamondFox)", "value": "6c87ee8c273d7e533a1d98524f9668526c3193c67d583519c8fe147979b4af30", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621804846, "uuid": "244c5e6f-49a6-4d0e-81d2-dbbb27e16632", "comment": "Malware payload (DiamondFox)", "value": "137983884e16671ddc80d30711aa5379302787ea", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621804846, "uuid": "d81ae15b-dc02-46d9-9acd-8dc9918143be", "comment": "Malware payload (DiamondFox)", "value": "140e3c4fff08562fdcf9b722e6980a4dd1e1b3655de9937314a01983121812e465aa316bf655209ea8fbcca08bb0b1dc", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621804846, "uuid": "daefbe4d-3c64-4a6a-b31a-de873fed576e", "value": "C414024D6F5CDFE3D9064AFE9882ABA5037881B1EF03E3575C4691AB48063F592127D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621804846, "uuid": "4afa4ce7-f996-4e31-9e3f-36cc7e5e079d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621804846, "uuid": "f64e1c3d-7628-4f76-b9f4-ff9ce14b3f1c", "value": "3072:DkDkOLDON4V8SvQfUDI3AZt0rZYii/979ofZkZXC8Og2GuhhEgO4wU2tU437L8:DkDkOLDONqvQmkAz0rZMF72CZIg6h/Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621804846, "uuid": "bd4a04a7-9136-4365-93df-38c75ac4a0f2", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621804846, "uuid": "c0fcc62b-3bdc-468f-8b5d-f3ec6bb4b9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621804846, "uuid": "316f0982-1ee2-4dcd-85e1-73da7d38b41e", "value": "9ACE608FE2722DCF13D85037965A4F93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724e70de-bb6d-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621736430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621736430, "uuid": "9973f66e-e0e2-45dc-abf3-fe2f1182155c", "comment": "Malware payload (AsyncRAT)", "value": "8ff498ff70578bbb1ead7bfdc14b1709", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621736430, "uuid": "bba38b29-05e9-4820-ab51-e5f67a2f0c48", "comment": "Malware payload (AsyncRAT)", "value": "6c9d0328b0b0aef965bd38b57e5971cc2f2a7952e662e589ea2f8e20fbf99f4b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621736430, "uuid": "2b97c60d-ebc4-4dec-be1d-633b02f51643", "comment": "Malware payload (AsyncRAT)", "value": "4f7242337abc207717a563f359d184f4eb6bc39c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621736430, "uuid": "4776bfed-7174-422b-a8fa-89f00afa3e4f", "comment": "Malware payload (AsyncRAT)", "value": "278f9aca358a24bf491bc7cd130d4fca3377edaef687298c8515c8e43089e6bc8d8da7c6dd921763078a6f73c6c3e2fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621736430, "uuid": "23322b53-a535-4cd1-8d33-f49e14d9ca75", "value": "DDD47D0A2F21A111D44228B51D23E367A4E23D2D3A47BF326FD37EDAE7A5BB17D05106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621736430, "uuid": "10d5fad7-fd29-40eb-851f-4fdbe3aaabc2", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621736430, "uuid": "7dd0dfda-4e79-4e73-89ed-d7aa3cd60e27", "value": "12288:if57HKrR5C+1q0OvRhcCuoQkIDHdrUncju:ccDHVUncC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621736430, "uuid": "649ec541-2868-44d6-b294-14eda06cdaec", "value": 602135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621736430, "uuid": "4b3006b7-9752-4369-bb7c-31722a1a9f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621736430, "uuid": "145e2404-29ee-4639-820f-1ac45bdaf878", "value": "8FF498FF70578BBB1EAD7BFDC14B1709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c031a2-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767659, "uuid": "94ad2134-fc28-49f8-96db-d32dae20348b", "comment": "Malware payload (Dridex)", "value": "fb3057200822fac51299f65a8f5a77d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767659, "uuid": "9cbe7ab0-00ec-47bb-8fe6-6dfb3dae988e", "comment": "Malware payload (Dridex)", "value": "6cf74ae1e9252bec1333448d2c1d0850770763649d1bdd0b0162a397b5e07c4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767659, "uuid": "a47fa621-2d94-4228-b6b2-170ad34f0d8d", "comment": "Malware payload (Dridex)", "value": "264b863a2e3146455d9f165d24b21c0e3eb936ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767659, "uuid": "2948a33b-1e15-400f-a304-9eb0f12dc3d7", "comment": "Malware payload (Dridex)", "value": "b6615d4f5a605991f860a4afb33f8c40f936e8ce4f6f33e9fff96b954071ad6947fe0c8114ae7f5fec92f80ee47789b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767659, "uuid": "5ced4d21-554c-4945-bcf4-0376b54374b5", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767659, "uuid": "33ccd07a-3a70-4fd3-aaa7-492ca0456175", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767659, "uuid": "1e164d5e-7276-4000-8081-01e66412444b", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767659, "uuid": "cb6129ce-46d3-4a6d-bf8d-1e1362b821fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767659, "uuid": "d41deab8-1c5a-412f-b3c9-742f0817df76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767659, "uuid": "3271773a-48a4-4e6a-8543-53f027b5d8a3", "value": "fb305720_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d9326-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760464, "uuid": "36f1e109-be80-4344-b9d0-ebee8ff06beb", "comment": "Malware payload (Dridex)", "value": "5f6d266bf59805893a5e349eaefe195a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760464, "uuid": "ff6c09b9-338e-44cd-adf8-1cc8dd21ffd6", "comment": "Malware payload (Dridex)", "value": "6dec8041baecad455c56b3fdb0580756bd23716a00d357000f49ef67b7cc0c3a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760464, "uuid": "32e2596a-e55c-4e1a-8849-f0fcbe77b1fb", "comment": "Malware payload (Dridex)", "value": "57eb031ce78b6bca262ee76e3b942178ff21bae0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760464, "uuid": "e6dbb8e3-6fd6-41cc-9d49-f590f7255e90", "comment": "Malware payload (Dridex)", "value": "5a23041100a4f34314f7aca8fbf5bf68516b709e22781b56f408cb3f96758ca5e874d37e21124694b253fbacdd06c892", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760464, "uuid": "174fbae8-be86-4854-90ae-69b4bab68106", "value": "8904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760464, "uuid": "4aaacfa5-e5d7-4da9-916e-47c4c4ab1f6d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760464, "uuid": "8150bc5f-a884-47df-9fab-f4d4180a84a4", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760464, "uuid": "67d3f317-adfc-4585-8014-9714dd977b0c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760464, "uuid": "00487471-b96e-459b-838a-0d36d468a3c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760464, "uuid": "768c0dbb-de61-4f45-aadb-c5ed27f50f48", "value": "5f6d266b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c58ab05-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778430, "uuid": "f8fed97e-de78-4d50-8bcd-aa25201ff9de", "comment": "Malware payload (Dridex)", "value": "01a6bc1ece4e343ab1e804319e7c7735", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778430, "uuid": "dc667a43-3f94-4a84-8cbe-162ac8a0081d", "comment": "Malware payload (Dridex)", "value": "6e327c78ca0f782078eb87ddf6fe101431a10a464b6d06bb07f87a78577395c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778430, "uuid": "ff19d90a-9344-4c86-94ba-35fb59f477a3", "comment": "Malware payload (Dridex)", "value": "45a6608f8005a0c83430aaeee68a0e1dfcd37c16", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778430, "uuid": "46814858-a381-474e-8147-f85d61ce05cb", "comment": "Malware payload (Dridex)", "value": "7f0c5f61a972bde7a97592ccbff0659219a27c3f501179acf79e8a0bcc8fb3943f243d5cb72ccf05c192d843640f3a08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778430, "uuid": "ca6f1c1b-0c31-4999-a89a-4d80dc10cbea", "value": "79F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778430, "uuid": "f7659b8e-dbaa-4b6b-9b62-bcf05768d14c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778430, "uuid": "8e9a95b3-73b7-40f6-bf0c-eaffa4b87adb", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778430, "uuid": "de372509-51c6-4c2d-9adc-e5b0f10b07bd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778430, "uuid": "8508e5b1-cb09-4ac9-89c6-39947fa77636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778430, "uuid": "da64af3c-1b1a-412b-bd51-94d50804f754", "value": "01a6bc1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d24cbc-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771299, "uuid": "716259dc-75b6-4255-bd94-e55656800725", "comment": "Malware payload (Dridex)", "value": "b7b72fe9ee3e4f2999c9c8e484c99925", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771299, "uuid": "0af70d44-c84e-482b-83a0-4035a1cc17a7", "comment": "Malware payload (Dridex)", "value": "6e756a18ec75d25fe7dc29b6230ade1b4a5fed01d777279d343e8e72f50adf30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771299, "uuid": "957999d1-9fbc-45b7-b037-ba83a11d091e", "comment": "Malware payload (Dridex)", "value": "ca24cd662c9ce817b20a644868fdf16dea4aaaab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771299, "uuid": "e7d44a5e-fe0e-44bf-b6ef-069492fb868c", "comment": "Malware payload (Dridex)", "value": "65d35bfcde3968daf2540301b960c935854a513e16a5a2682b9ecd109359380e897151d3efef442212d89d9ee0f900b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771299, "uuid": "3bf3ec7c-9aa8-4e7f-a5c7-0eeeb3568550", "value": "50F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771299, "uuid": "dee9e5f7-7cca-4786-8213-c335d8d61ea0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771299, "uuid": "dd015fe1-bdba-4ee4-8a83-b10619f7fb95", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771299, "uuid": "46d45394-c0c9-49c6-b865-158c759a395a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771299, "uuid": "3e8ee6fe-6b11-47c0-adee-a6a070e75e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771299, "uuid": "8213b689-7782-4533-9fc8-253ccf1d66f6", "value": "b7b72fe9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27f6e55-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735250, "uuid": "14971112-cd42-4062-bc60-2acb5f541464", "comment": "Malware payload (Dridex)", "value": "dec949663b8644f030e9b822d30fd819", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735250, "uuid": "366cd2e6-73b5-47a1-8296-badef918d5f0", "comment": "Malware payload (Dridex)", "value": "6ea915ddba73f0a284ce7938203ac6e9d9cd3e1d144ed152ebe9409a362fe64a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735250, "uuid": "9d676d3f-968f-40c8-b5bd-6f852c099dbc", "comment": "Malware payload (Dridex)", "value": "775390823c1fc1438bcd5bf67639c73bf1584058", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735250, "uuid": "62503a3f-4bc3-4784-bcb6-7cacf7392383", "comment": "Malware payload (Dridex)", "value": "b19dff1daecffaa38d7e1ad3eb787cdc165c10c43645f64143e3a430e35189f51bc07593f57f2000b94053404504217b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735250, "uuid": "4e891ca6-8d91-4a54-a602-02a6631b96cb", "value": "27F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735250, "uuid": "c701aa2f-6289-4f30-84b9-9638a09909f2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735250, "uuid": "ff99a830-cef9-4fab-ac5d-26903b8e680e", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735250, "uuid": "a1d309cc-1d3d-4e6b-8627-540b53031f41", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735250, "uuid": "0fb1f4ba-96f6-4bd7-842c-110281e40855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735250, "uuid": "b1df3f21-387c-4ff5-b2a4-58ff5e72d13d", "value": "dec94966_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecffa81-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753416, "uuid": "65b54c60-1f03-433b-b9fe-2cc61910befb", "comment": "Malware payload (Dridex)", "value": "2762e089453d09f5f4c45e4201ed7103", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753416, "uuid": "696ce604-a9e0-4c05-ae1b-450799eda0b0", "comment": "Malware payload (Dridex)", "value": "6ee8cbd8922627c8f4c5dff46e0bd06f49111bdf2f343d0e502d83dc64811218", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753416, "uuid": "e2b16d2c-907c-4c5c-a50b-38a21947820d", "comment": "Malware payload (Dridex)", "value": "95a081686904b150bd49307d7519e17d20003f85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753416, "uuid": "c4feaf07-b0b6-43de-92a1-d7487bed076d", "comment": "Malware payload (Dridex)", "value": "8c7b7a1f395f5f6892cdb0812b881ef0a8c2050ad68905b29aebea254cfaa4d312519721192efa3d90b6950cb2fd6c54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753416, "uuid": "081c5174-db36-4149-b47b-79dc6faca409", "value": "9EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753416, "uuid": "f7fc9205-e26e-4c50-9eff-f6cb14b9d4fe", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753416, "uuid": "106e8d65-eae1-4b32-8c32-4653ab686553", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753416, "uuid": "79475d10-056e-44fe-ace1-11bbeea425fa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753416, "uuid": "cb61c0fa-a4b8-488c-bb22-be0dab2d4339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753416, "uuid": "d734164d-0861-43e8-96f4-b0b761960095", "value": "2762e089_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581a0e1f-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760438, "uuid": "1dbe6587-d291-4104-b4f8-6f69565b9501", "comment": "Malware payload (Dridex)", "value": "29a4b3ba25de587982105b56215792c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760438, "uuid": "bff6488a-d73e-410d-afbb-9a9ada61857a", "comment": "Malware payload (Dridex)", "value": "6ff8502fb5d8c03c972ef68b9d1751e2e49b20707f4ad8fe1c792a6077fb2065", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760438, "uuid": "b75bd803-9e40-4683-8d90-40b14f741059", "comment": "Malware payload (Dridex)", "value": "e209f5bec24cddaf3fd41089aaea28b816de7285", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760438, "uuid": "f0e1e984-4cf4-4052-8d14-8a9fc59a2a42", "comment": "Malware payload (Dridex)", "value": "ba1c563b7f3a4d2085aee9ecab008d949b82be96e6d15690251b19aa2df3fcf7bfcb3bae2fbd4436116a18ab83382a43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760438, "uuid": "1a0484df-82d5-49e4-bee0-329743d2f257", "value": "B1F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760438, "uuid": "9d78fb3d-b715-4c4a-bafb-dfb2acac2b84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760438, "uuid": "ab89f95f-5efa-4f37-8ab7-15c335ce4c6b", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760438, "uuid": "52dd29fc-c532-4af9-8b9c-9e58f554f621", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760438, "uuid": "2649c1af-fe6d-4d81-8113-d976f75ab9ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760438, "uuid": "b7a7d174-aa8e-48f8-8b2a-b3064e6f52ae", "value": "29a4b3ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e61fac-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764112, "uuid": "1d56b5e0-8911-4359-b2be-fd6997bbba8e", "comment": "Malware payload (Dridex)", "value": "bc7a7b37b2cf06f90e88783564b9e0dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764112, "uuid": "12c5e453-6cbc-4843-9e09-cbd558728671", "comment": "Malware payload (Dridex)", "value": "701e9a4567e92ab0b659a61d3d839a56872ee73ffcd726247fb3a85738f6f564", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764112, "uuid": "0b2fef22-1511-4832-9ea6-f6b69a81a406", "comment": "Malware payload (Dridex)", "value": "4e5379856b7dbaf29185c082f4a4d2e8f8e85c35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764112, "uuid": "a3d880bb-a33e-4722-85dd-eb978768842e", "comment": "Malware payload (Dridex)", "value": "e3e552849767cc16d73a36f398a7d4fed8c843128fd5a258e42402a471e2b2b9e99e6f339790a6dee17760114449fdad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764112, "uuid": "6860480b-52e3-4ceb-a129-d79f6edb3a3e", "value": "A8F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764112, "uuid": "22878bd2-6df1-45b3-959a-71e8df56a2d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764112, "uuid": "654a4163-245d-416b-88c0-1d9918a22159", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764112, "uuid": "c5e44f09-8f61-4f71-ad72-c0a56f1ef9b4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764112, "uuid": "c5f2dda6-8f40-4a34-9ddd-b59458b114d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764112, "uuid": "60da816d-4517-468f-8fce-9352cb1bc23e", "value": "bc7a7b37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f1aad3-bb95-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753428, "uuid": "54093a1f-4512-4c78-9060-cdd9669475ce", "comment": "Malware payload (Dridex)", "value": "f117d073b566c7cfb544e99ecac58e95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753428, "uuid": "8941460f-408a-459b-aaea-ad2d17420d18", "comment": "Malware payload (Dridex)", "value": "7062f4fd578b3b84534356e987f469cfcee56a39dc033dcac99d9bd3651c9f3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753428, "uuid": "e370d42d-50cb-4675-b4a0-28d9228b75de", "comment": "Malware payload (Dridex)", "value": "d887c3120b3e42c5196afde6701eaf8b5e1c78c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753428, "uuid": "17883cf7-b667-40ed-8ad8-5bf9da6c057d", "comment": "Malware payload (Dridex)", "value": "f8261650d722d3776ad52827ea9c2c1af347d52a7c7ef69b9d69ddbecef0bde40cf965a9f75bc3c0fa090bb940667c9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753428, "uuid": "a3cac653-d0d7-4b12-8b92-2f46f8758d3b", "value": "18F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753428, "uuid": "2940b177-47ab-474e-8a0d-636e240d24ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753428, "uuid": "970801d2-466d-4de4-9591-66645507813f", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753428, "uuid": "e2e2d9fb-bca9-48d5-9a2b-a31a98bff9e4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753428, "uuid": "ca4cb09f-8346-4176-b29d-2174e43e38e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753428, "uuid": "c4688c33-c3ae-449c-82aa-033de0618858", "value": "f117d073_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c13eb51-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760499, "uuid": "141abda0-b691-4ff5-af7c-7cc849122f7a", "comment": "Malware payload (Dridex)", "value": "9385bc134ea9edb9fec38917a800e430", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760499, "uuid": "797a5e41-89ac-4121-9002-c3f39614c34a", "comment": "Malware payload (Dridex)", "value": "708e6a5098e5715a5a011e9e71e88333fc24d94317e9d29c81f9b3bcb6e55a00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760499, "uuid": "a97d0b54-7afa-47eb-8133-b2df116a71b9", "comment": "Malware payload (Dridex)", "value": "c67359fa53bd09b45483f921d921f03f39c5c674", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760499, "uuid": "edc0b4d5-6545-4b83-8363-0c740f6ffb63", "comment": "Malware payload (Dridex)", "value": "96f7aa28862f53c0af29c14fdea9adee4731a920438d83cbd74a3d4d3d367ad73f9548cc873856718117d283f2df7b58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760499, "uuid": "29a90f31-8e7f-431f-b0a4-48e484d3cf46", "value": "F3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760499, "uuid": "3bb033c1-4f6f-4827-9adc-c55589960211", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760499, "uuid": "b3ff0f46-b937-4610-a068-124601432125", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760499, "uuid": "badfcc37-e607-4e26-a816-54288da3ec5f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760499, "uuid": "fea7c0b8-1c73-4142-9375-deb3d1430524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760499, "uuid": "17c782fc-1b4d-4edd-9ea2-b8dee1214ca5", "value": "9385bc13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d5d3d9-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778525, "uuid": "3736002a-c159-4e3f-8c82-1cc328654362", "comment": "Malware payload (Dridex)", "value": "82890a6afa1c9e8ede08d111fd31815e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778525, "uuid": "27dc077a-3b25-4cd2-8609-5d09ab651b79", "comment": "Malware payload (Dridex)", "value": "70a27bd98ad11d43fa7d1f35867f5b82e1402befa474cedf6ecf4b40c8d1d9e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778525, "uuid": "cc60acb5-7d62-41d0-a0c1-a266dbf65f62", "comment": "Malware payload (Dridex)", "value": "6fc2d63c75195f2eb6b010d8632655be56b2a37e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778525, "uuid": "b5a5cfc2-8629-4d1b-b738-745cf6d3fc0a", "comment": "Malware payload (Dridex)", "value": "86e05dc7d4d0480cf96cccac64300afa7865eddfb4879f866e3574cb1d8ebbdcf9751b33d24f555096845573eb420436", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778525, "uuid": "731ed0d6-ca15-4dc9-a27c-d632203e4fae", "value": "F0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778525, "uuid": "cde895dd-15e3-47bd-9061-4088df29bdf0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778525, "uuid": "8c33ad14-32ba-4d0d-8622-a12551940aec", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778525, "uuid": "f62109f6-5003-4e99-b95a-b1ffe1f6bdc9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778525, "uuid": "ac2d5f5d-d9d5-4fd6-afb8-d8796d90acab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778525, "uuid": "e6729204-63f3-4d32-9604-c3f91c922f69", "value": "82890a6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc6680a-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778458, "uuid": "37175120-1107-4f32-820b-da71d718d79e", "comment": "Malware payload (Dridex)", "value": "b83cdb72764681673479ead8da1e6279", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778458, "uuid": "3c52dfb6-c189-4545-b6c7-cb767e89003c", "comment": "Malware payload (Dridex)", "value": "716d31c4ebe45fc6d54236798d2244b979b32947aa583f4f8c084b162bd6ee32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778458, "uuid": "b178f5dd-8eea-49f6-b28d-d920e75faca0", "comment": "Malware payload (Dridex)", "value": "b59759559cf24d19d8c39f5b8e3c01cb71fdec6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778458, "uuid": "64bcf492-af03-4e64-972b-316f835c09a6", "comment": "Malware payload (Dridex)", "value": "383c7b18e6f199e41d4968924342e5dc9dfa54da1d585ac6dfc72c54649f78b1f7236838a9ef8827c2f767e5f39de5b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778458, "uuid": "0b04fd47-b7a0-4c87-9d75-4e05f6753ab3", "value": "1AF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778458, "uuid": "9d8c05bc-9cad-4076-a8f2-0966951f338d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778458, "uuid": "65b7581d-93bd-41cc-a9f1-25d7a30bf707", "value": "3072:9IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Wc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778458, "uuid": "4f968108-8343-4053-a5de-5002bfa69a66", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778458, "uuid": "51ad0000-8117-4a59-9bc6-2618cbcbc63e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778458, "uuid": "69d02b78-3bf6-4055-b289-f2123a9a37c4", "value": "b83cdb72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f5afa0-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807277, "uuid": "ad27e753-e281-4906-8c2f-cdd2eb5535b9", "comment": "Malware payload", "value": "ebb2303ea3cf0587e39a8ddee213996a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807277, "uuid": "ed70e361-4d85-475e-8f74-6b25c6f7447e", "comment": "Malware payload", "value": "71a30127e34022551167fcccee87fa13da79798e2a6bbbdb1685f481b4792639", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807277, "uuid": "11c59e07-d114-483c-a0b7-0ad544f5c212", "comment": "Malware payload", "value": "27ec8c2c45f7bd2392d3585c6284e8af4fb7744e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807277, "uuid": "54c85961-e37b-4254-9748-ea6ec3ee56a9", "comment": "Malware payload", "value": "495ec6011a95d06f01f3dd5f1033f4a18318f319cc3331328e7eb529bb77581dd485662db3a59339f7b91e9a84e04da6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807277, "uuid": "7b540409-2dcb-4389-9af5-b6227ac9f1d2", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807277, "uuid": "4c9cf76c-2504-475f-b5ed-cd2203763a4a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807277, "uuid": "5c4eb616-6850-4c0f-8ed4-dfce1527bd7d", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807277, "uuid": "84c65d39-db99-4bed-bca8-bf2c540e996a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807277, "uuid": "16e7f3eb-1703-489f-bc7b-fb31e1e6dde8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807277, "uuid": "59a13e70-b954-4b64-aaa1-0e07ecd56ced", "value": "ebb2303e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398c4c4a-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621756521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756521, "uuid": "c9b19123-d813-462b-926c-eab38a33ff8e", "comment": "Malware payload", "value": "a1cd848333bea59bf7d1a8a63be2a53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756521, "uuid": "d4699f24-dc9a-4ab6-a8fd-8c85f0ec950a", "comment": "Malware payload", "value": "727f7d4b16d3dccfb2ae9ba763f13622b78b8b2960f6210a183b56deebe18777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756521, "uuid": "2c6be6a6-66e8-4ccb-be9f-f70b4034ab65", "comment": "Malware payload", "value": "bf18d32b917f1a82c808603d8f1d249aafa2f02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756521, "uuid": "a800ada6-5bef-4065-a697-1c812bebd5b8", "comment": "Malware payload", "value": "0ff5057dc802adf21d9b9d2a56559edf5a3e34472ae93bf1d01c6b24a2023c015913064dbb4adafca978641f1e56276f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756521, "uuid": "44967ac5-0bc9-4b74-80a5-3fe0daa49290", "value": "E9359E1D2BA6C0A3C00A6279EE6ECA3464267D7CAFD7D77271C1BACB39613D0D542934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756521, "uuid": "46e16960-98a2-4bec-b43f-62fcf0ef8b9c", "value": "fda96c3a1f41c51b4561efbd00bd37cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756521, "uuid": "4334c04c-c8d0-4c84-8873-c6b24d577ad2", "value": "24576:TO1mwcP2NvwUfNxUYzhFQ8fTya/ZSpa/JX:TOhr9qYzVTygyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756521, "uuid": "9dd0b3da-a678-4a95-b083-7b9d03ef28dd", "value": 1064961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756521, "uuid": "5922873d-98e1-4c0f-8013-39913b39974f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756521, "uuid": "81e8ee3e-7994-4302-bb88-d7d74fd58610", "value": "a1cd848333bea59bf7d1a8a63be2a53a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfb2ee3-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738839, "uuid": "60148bfb-1a33-4429-ad4a-5a11a7bd6229", "comment": "Malware payload (Dridex)", "value": "e7f4a52349463be27e420d9d5d5c5f52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738839, "uuid": "c242b3c2-0f1c-4642-8405-60502d5e2da7", "comment": "Malware payload (Dridex)", "value": "731e1c7e2d923ef2b745eafbab153ac472a5c84560ab79f4644057dd87cbb3e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738839, "uuid": "e111ff17-9df3-4f3d-ad4a-20d4176995f7", "comment": "Malware payload (Dridex)", "value": "b7889cc5b3679752ae52ed1b7f531acd55720ab9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738839, "uuid": "cf9aaa6e-808b-4441-854f-4d3fc2ac2f33", "comment": "Malware payload (Dridex)", "value": "4a4228baeec16775c0ff4458f1f2ed0df1e043308c3e727dd57e8718cf9dc716f0c31f008a735f3bf9e018a41c2e22d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738839, "uuid": "6e0bca27-05bd-4179-8b9a-5a391c0fe439", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738839, "uuid": "c17a6a15-06dc-4782-8b54-58dd75869844", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738839, "uuid": "cef1e0c4-dfcc-4ee7-86b3-7f2f404c4384", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738839, "uuid": "53a68a1f-8668-4c5a-9532-f34a19b81ced", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738839, "uuid": "6f7d82e6-38b2-4ee0-a2cd-11e798c4ba7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738839, "uuid": "71dc9e11-ec04-4a37-a251-15de88e30053", "value": "e7f4a523_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae41fc39-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810834, "uuid": "de7289a3-5899-4d49-8d16-47f1e9ee7836", "comment": "Malware payload", "value": "f86c1d51a67abe74f5238adf6d50320d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810834, "uuid": "2e4dcafe-9839-46d5-80a2-a4d9628e6dc5", "comment": "Malware payload", "value": "732d3e75cdba6acf3c2e4b903638bb4211890264ead14165b8a0f011fae7ebe5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810834, "uuid": "c24cba8d-a792-445e-9dbb-105a60afea06", "comment": "Malware payload", "value": "62ba31a0eb4548310fa6079f2f2251b091e68d8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810834, "uuid": "3a162a16-466e-478b-b14c-61c1ec1dc046", "comment": "Malware payload", "value": "00a8c0aab1fe38970d62386b3f47e0078cbaa180ce01857f1485cdf1e2e0376646d6dbcca40631c283790645dd0f56ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810834, "uuid": "209ad9b2-2747-4d3c-841f-3cc86a8857cf", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810834, "uuid": "c7308b9a-899c-4681-8ec4-c66e98c3f8e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810834, "uuid": "93c62396-e66d-4442-8cfa-4f4679471c81", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810834, "uuid": "2484af34-2766-4f7e-88e7-54f2b759dda0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810834, "uuid": "71930582-2229-4304-9fad-8d5d1cb8f488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810834, "uuid": "8d811f68-5633-4adf-89c8-9e04b71516cb", "value": "f86c1d51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80b1bc2-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792865, "uuid": "792a7e6d-c2b4-4cdb-9bb4-484bb4ed8dad", "comment": "Malware payload", "value": "57666e3f863b7490bd04ab2d9dcd0f81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792865, "uuid": "6a0172c8-108d-4165-ba0a-2a0c4d65be34", "comment": "Malware payload", "value": "736ebc5cccab9cab3b80993df2b0aa84a6eedc34b9afd9b3306fc1bb243e3e82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792865, "uuid": "172c2378-114a-48c6-bfff-e7f0fe8b289e", "comment": "Malware payload", "value": "957f46eb295fc87214f4778b79a0daadbb504370", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792865, "uuid": "6a6f20e5-19d9-44d1-b54b-cb0b4144aa23", "comment": "Malware payload", "value": "78facf8bf110d4e4739c59069383110a2adfc42d197e250850d02afa94321305050ac378809c5adbb1dde7b3536fa888", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792865, "uuid": "6fbb782c-3594-4a9b-9275-654e4a7e4f33", "value": "8CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792865, "uuid": "43d5dff8-f990-4031-8f89-193233d9f637", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792865, "uuid": "52f71655-4c47-4b45-a925-e5d8d5cbf494", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792865, "uuid": "d57d3920-0b66-416e-89c8-ac0f59c778eb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792865, "uuid": "259b5ca9-d76f-492f-bae4-bee7060693cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792865, "uuid": "0e729b0c-2abd-4d6f-a6d6-a35426995645", "value": "57666e3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28d1aba-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792883, "uuid": "7c3c4a27-a0a6-4591-9efb-acdf6d75804a", "comment": "Malware payload", "value": "5351bf741f89685755f9ae7af1dc4973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792883, "uuid": "215a0702-2b21-4981-8017-a20997114014", "comment": "Malware payload", "value": "73c2004af8290b66a3c04d034283efed072549ad34ce32f04770ee83430f506d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792883, "uuid": "83829b51-6079-4abe-bd13-74cd5fc57775", "comment": "Malware payload", "value": "ad6355fe3898ce86ff3746bf09fadb6cd515e26b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792883, "uuid": "337743da-e5bf-4095-bedf-3db4469b3a38", "comment": "Malware payload", "value": "0cd317792aab00fb0e6ed5fc47010e051b4af3c166d03cc53d0c4e400e1022f893dc0cd513a8145f0124a40a830dcb5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792883, "uuid": "08b31950-fb43-4f95-8933-5fe5eba9d561", "value": "6BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792883, "uuid": "dd9f0514-4626-4060-85dd-6001e23a39fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792883, "uuid": "691aa265-b6d9-4093-9a91-1f29a5bb1602", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792883, "uuid": "54c47545-fbdb-4a62-9f71-62b8dca261ec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792883, "uuid": "22452792-fa8d-4caa-aecb-7f0882a99787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792883, "uuid": "5c1f5454-914c-4ea8-ae66-efcefa14119a", "value": "5351bf74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d6ca21-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749726, "uuid": "69c6751a-3f27-4ed3-bb25-a0904fb9b78c", "comment": "Malware payload (Dridex)", "value": "c90f338132e25689c4e9706b49d1d839", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749726, "uuid": "1458d256-e5ed-4553-bf3d-798f3b9bb668", "comment": "Malware payload (Dridex)", "value": "742990af038eb56e423360dbf544384a820f55ed5ddd86c2107936b8a1743a4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749726, "uuid": "894b811c-771e-4214-8ffe-268bf261c424", "comment": "Malware payload (Dridex)", "value": "f7894bd3fccce2faa5973b9c205aab6fb4c95534", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749726, "uuid": "89fd8657-62b1-4ab9-a047-5dd4c5f37717", "comment": "Malware payload (Dridex)", "value": "13cbe500421b6bacb50f17c1ae58ed7273aa8fe10323f3c3ac6bd390c7c37e881476fc9042c8828479d1677db960e617", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749726, "uuid": "a99608c7-7629-41ad-bc8c-30d933dd33df", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749726, "uuid": "324a87ac-8b85-4a1d-902f-14a34fe828ed", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749726, "uuid": "8a6577d4-5b28-4490-9062-2ba4b500287a", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749726, "uuid": "d071abb6-735b-42de-a316-cbafb1ee2ea6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749726, "uuid": "baa9413f-0b7e-4b79-8517-19811024402c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749726, "uuid": "3415a501-253c-4054-bb79-2cbaf61cf371", "value": "c90f3381_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b907eb9-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807313, "uuid": "31c7644b-4693-4f1f-90d4-67b941f3337b", "comment": "Malware payload", "value": "1851911d0e83bbe77d806a1c645f8148", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807313, "uuid": "92929815-e61e-45c4-b499-edaa9a5cca5d", "comment": "Malware payload", "value": "7435dca0d62fd96d223a8ed970e90de2a7706f4202a309a90883358fda62c2c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807313, "uuid": "273a8b29-a21e-4d6b-9596-d558bcc97b2e", "comment": "Malware payload", "value": "922df7db24cc0610b8f82a3c8c774782ac30b744", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807313, "uuid": "852a2510-a8c2-4c50-b0ba-7e99f9656b96", "comment": "Malware payload", "value": "5c7ad0dac2e27c3c1559b2fb6230b6b0d4ac4f55427ac93d0eea47a9fcc57e4ed8b9ec4dbacecc72c7e7d8075b0aef3f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807313, "uuid": "22a5a73c-4884-498d-b8ad-973e1fbf8eb9", "value": "92F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807313, "uuid": "80fc04af-c4f6-47bb-9ac7-6255efe88b00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807313, "uuid": "17f790bf-4963-485a-8d65-ab509a011dcc", "value": "3072:QIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Jc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807313, "uuid": "b0a293af-2825-4ab4-bde0-edeae1fc882a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807313, "uuid": "53e7a6d5-b84d-44ef-97f3-114f0d1c6f91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807313, "uuid": "b241f62d-64f3-48fa-b843-c5cee8a3b71c", "value": "1851911d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4347d397-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796481, "uuid": "aa6bbc62-08fa-45eb-8583-63faae48bfaf", "comment": "Malware payload", "value": "246c12a195aae2c7a69243449712d36f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796481, "uuid": "3a5c69f9-e094-4aa3-a39e-91ac6cbed1b9", "comment": "Malware payload", "value": "7447c1a32ab25ef6ee0fdcd9d4d920d5854b07106aaac2fed40f2ad1f7e7eb32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796481, "uuid": "4c6ba34d-82b5-4f73-a3e0-41efaf6f06d2", "comment": "Malware payload", "value": "165da1036ec45ab52908cdf7bf11832b07c89524", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796481, "uuid": "e53596cd-f841-4338-b74b-010241937ef3", "comment": "Malware payload", "value": "e7dcc5d4b69253751698fd24a6fda89e3d50ab5611da720b3dcbfd2a5c9a04f3e3b942de50ff5199d019ce48049308fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796481, "uuid": "eb0d2ac2-c211-4e49-8b50-96c69220a004", "value": "CFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796481, "uuid": "a70f7f47-b0a9-4a4c-8994-af24ec956154", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796481, "uuid": "0724347a-1aa9-43e9-b433-c6ece478dae4", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796481, "uuid": "e2295e37-7435-4eec-8e25-a12b7da07332", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796481, "uuid": "a25b783f-0755-45bc-9a7b-cf94b9bf317b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796481, "uuid": "34b770df-22c4-4ccf-b7ba-a76ea7fbd795", "value": "246c12a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069f2b2b-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738827, "uuid": "c81f27f0-5095-4297-ab75-357a56a5024c", "comment": "Malware payload (Dridex)", "value": "b23a2290075ce27ae3e91d6ac3a483ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738827, "uuid": "e8b6fc6a-caa8-478a-84d1-2b4856cb2922", "comment": "Malware payload (Dridex)", "value": "747666452e1f33b4a120c925eb9ca0dbdcccc98090871eb031f0e55ff8ad2bbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738827, "uuid": "ee6d1574-84e0-4a02-b784-d1c589eafdcd", "comment": "Malware payload (Dridex)", "value": "ad424f9a361c00f196f39ab726e2395a76137cb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738827, "uuid": "013b3ead-b070-4f39-a430-e98cce7383db", "comment": "Malware payload (Dridex)", "value": "52634843a25aeb7eee63021ed8af514fa576bc9d2bfb178f9c7d861bbdbc7ad79bb3a598c1b494570181a5b7157fe53a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738827, "uuid": "95bb8354-1fc9-4dde-a7f5-006aca8a3f94", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738827, "uuid": "fbd06a07-ab6d-4800-bf2f-ab3033ee695a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738827, "uuid": "20d722a0-5e98-48f5-812d-eb969297940b", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738827, "uuid": "f099cbac-d51f-40b8-a885-6e42d53a51a2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738827, "uuid": "06bcaa8b-a464-4d5c-bfea-e2744d913494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738827, "uuid": "89bb01c8-d189-46ea-8dca-8fceb7bee364", "value": "b23a2290_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a6ab95-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764108, "uuid": "233a7309-5318-44a9-aa91-f33aa4aa2301", "comment": "Malware payload (Dridex)", "value": "e1acdaff3e8278746a8b3e3fbbcd68dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764108, "uuid": "45bb0377-8538-4832-bbbe-ed9bdac67822", "comment": "Malware payload (Dridex)", "value": "759528fd933fa7ee3867f7fd9dedf2b93ba95c9de01810135563a13ff72b40b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764108, "uuid": "08ccb423-0aef-4931-bb9a-3fb45cca5757", "comment": "Malware payload (Dridex)", "value": "f88f2685172a2125e88a599732f53a26f1b74388", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764108, "uuid": "58ba320b-e8ad-47de-84dd-cbd8b6b17efb", "comment": "Malware payload (Dridex)", "value": "0b3498c8e0a90e71b3728d593123345b71ccdbbaaa1a9f930d99a2d3ced3402e4ee8c283bce156c71197c3d529bdf8ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764108, "uuid": "9e0ebc2b-49f1-4c9a-9c92-e268338cb94f", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764108, "uuid": "ec9f245b-01d9-426d-8ad0-79ea597e6cd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764108, "uuid": "f296658a-581d-4020-8eaf-fa471f6e6142", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764108, "uuid": "12349d1a-d608-4698-ac64-cbf54a0aa8a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764108, "uuid": "cf3fea66-c700-41c4-95d1-f3bcfb3cdd6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764108, "uuid": "d5cf0704-43b7-4d10-9be7-7e071050aacc", "value": "e1acdaff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6114c162-bbd0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621778922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778922, "uuid": "afeedf23-b619-4500-8ea9-bc7565c86747", "comment": "Malware payload (SnakeKeylogger)", "value": "6dc0e18ad13bb7594d97b8bc211fd21a", "object_relation": "md5", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778922, "uuid": "77cf40c6-d8c4-4297-8ab8-5221fdd5cfe6", "comment": "Malware payload (SnakeKeylogger)", "value": "76a87746bb86bf603920cef513aba1bdfad8aa53fed3fcae216a7019b5804751", "object_relation": "sha256", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778922, "uuid": "869a7e00-3bb2-4cfe-a99a-efe3917d0437", "comment": "Malware payload (SnakeKeylogger)", "value": "3fcee5eb538ac4f9d389bba6dcd28693107c381d", "object_relation": "sha1", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778922, "uuid": "2d015b7b-18e7-458d-812c-b5c6df43cd7a", "comment": "Malware payload (SnakeKeylogger)", "value": "099c70ceff6d8110df93a5b3d200dedb0c5246751a5d0b37313563f3c4da798523f9b45592450a837b9304b0faf984cc", "object_relation": "sha3-384", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778922, "uuid": "609e8aeb-9ed0-4e7b-bd1d-e31ffbd6c2dd", "value": "79056B0123E86B4DF9FB6734A9BA141887F1BC06DB35D60D6D95618D082AF81CEA7733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778922, "uuid": "c02ee3d8-ecfd-4cf8-882f-8c432a0b3dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778922, "uuid": "de040258-79c0-4080-931a-b6438a68e4b3", "value": "12288:eKOsDvXWSu5mZkmb+esSK9WPZPKhGveGX22NWUp8fmmtUmPE/ou23Wbx7ZuY8F2v:eHsNwukmbhzK2NKhGGGX22kffm0Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778922, "uuid": "6443a58c-e0e0-4f2e-ba1a-a71196abca8f", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778922, "uuid": "61d3c368-a1c0-4684-b80b-d9d8f3582c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778922, "uuid": "c9907900-4cb3-45c7-85f9-eebc97444d53", "value": "fyi.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d268eb0-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756930, "uuid": "9812e1fa-0144-4ca3-8cf2-1867e7e87173", "comment": "Malware payload (Dridex)", "value": "f0a2ca8bfbf3a47781e56b9f320ffe10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756930, "uuid": "67ef84ce-ea46-4dfc-9c8c-b1dda56ac527", "comment": "Malware payload (Dridex)", "value": "76f811277adfe147e273453e8d8b99c7a5dccda3d231386f4abc4abecb75e6d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756930, "uuid": "96d56058-68e8-4d71-900f-db78199e512a", "comment": "Malware payload (Dridex)", "value": "20212a86337c72d54471aa5d2414bede4d666289", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756930, "uuid": "83dd951d-4527-4564-9fcd-2f29bb7b79f8", "comment": "Malware payload (Dridex)", "value": "44719fe8908d34a42b604e025e448b94b6e90d6601b8ce1f407fd8dabb9118639a3fe814f16498c4339752dffe3438ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756930, "uuid": "2ec9c04b-01f9-4211-8921-f80a6dcf6d25", "value": "DDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756930, "uuid": "9f42c5f3-8b23-46d6-924a-6b4c0e88f912", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756930, "uuid": "0f2b244f-6220-4a7d-91a1-1f52330dcb58", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756930, "uuid": "ca106245-ad30-4654-afbb-2fcfe4a90e3c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756930, "uuid": "2a126974-095b-44c0-a9ca-d4cd9f179dd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756930, "uuid": "c955409a-ecd5-4a42-8e1b-5561c17cd89f", "value": "f0a2ca8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c378152-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807341, "uuid": "94d616cc-bfb4-4846-a162-3fe0cdd34f69", "comment": "Malware payload", "value": "6425a2666bd29cc599b470b328bd44c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807341, "uuid": "558068b7-ff3d-4e26-b31c-12f937614b90", "comment": "Malware payload", "value": "774ee5bffc5285f42e50f7cf02042252d374c0663f683bb2a3a0588191413a1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807341, "uuid": "f42853f2-24a2-4382-8558-42f68827adfc", "comment": "Malware payload", "value": "4adc100179d2b80e738c33936958123af7e3f066", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807341, "uuid": "ba93e2c1-14e6-4700-8f36-912883224a14", "comment": "Malware payload", "value": "89ed57bf96433150b1dfbb2403e35963693ca99536f998cd0b987570202fccb381f7f122f735ba35bf9654a5693fc05b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807341, "uuid": "4e671731-9103-4ac4-ad01-e2db7442bcc7", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807341, "uuid": "35044b6c-ec21-4755-965a-1bd73e06f2c3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807341, "uuid": "635261d6-281d-4411-a1b7-bb300ee21e16", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807341, "uuid": "fa311e99-742b-4223-b27c-b0ca42003739", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807341, "uuid": "8af5e790-01fc-4025-bad5-a0694a7a5994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807341, "uuid": "96ecff28-8e7b-4500-bcea-fa7e25d4625c", "value": "6425a266_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f9fc2d-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753241, "uuid": "37e32773-34a3-4dc6-abd8-92bbf7f03542", "comment": "Malware payload (Dridex)", "value": "fa452b7370e474129e61933d6c91fdd1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753241, "uuid": "26941a05-c031-4fd1-bc86-ebe20f08af07", "comment": "Malware payload (Dridex)", "value": "78096812d12a8395a65ab6c84b05f17905998cb968961dd6b9911cec66b6aaf3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753241, "uuid": "0139b228-2797-4848-8a2f-40bf8b6e8a9b", "comment": "Malware payload (Dridex)", "value": "d18d24995fbe08b46a752f1bf7ade8b66cd290ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753241, "uuid": "75004c12-9085-43a2-b663-6abf80b1f525", "comment": "Malware payload (Dridex)", "value": "beaa0e91bea81f68558af69a68714abdc5fc9c0f96f0e8223df458b45d630261b8581c29933751279b3802828fe899d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753241, "uuid": "5c82046e-94dd-4968-a2d4-a90ec423d2d0", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753241, "uuid": "d6bcf7f0-cec8-4e5e-bfdf-1b9d874a171a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753241, "uuid": "8dc1c4a4-90d2-4446-a75f-40eb5c77cd15", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753241, "uuid": "bfd711af-fbeb-41eb-85b3-a517cd3b685f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753241, "uuid": "60e2436f-d8ef-4fe8-b8ac-94beee943ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753241, "uuid": "15d1a4fe-4b55-4075-b3e1-5fffc28a2ce7", "value": "fa452b73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfa2f9a-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785735, "uuid": "243ce702-ade8-4cc8-b486-f596a31150d8", "comment": "Malware payload (Dridex)", "value": "d19df9f66ade7f33f58ce9618714b8fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785735, "uuid": "6e0a730c-8494-4ae2-9d71-6974018556e5", "comment": "Malware payload (Dridex)", "value": "787403aa0f61d577ccb2ad4263911cfb257240ee24cf6a9def0720b25a59f191", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785735, "uuid": "1dbe799f-c73d-4283-92b2-6b11f055ccb0", "comment": "Malware payload (Dridex)", "value": "9fb132bda15be440c46a77b26eb136d7be2b8c0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785735, "uuid": "e2f2d221-9cdf-4ab6-84e4-3b80f1199c49", "comment": "Malware payload (Dridex)", "value": "ff2fba6ee64af7f60eb6d94e37bb9e48308b9e162ae5c06757510d267bd9635f0a055b889e55e67c0890ce41b000a32d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785735, "uuid": "5e332642-ed3d-4010-88a9-64719425b5f5", "value": "BFF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785735, "uuid": "240068a7-6639-4b07-941f-a3c308317e3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785735, "uuid": "2eb8c36a-c3d0-457b-bd7a-2633c8c8fa70", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785735, "uuid": "1e2a818e-9c0d-44df-a565-8698a620920e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785735, "uuid": "2b724f0a-9939-489a-87ca-4464d591db91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785735, "uuid": "78077511-8b6f-4751-bc09-ffd6e2e12b9d", "value": "d19df9f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c98266e-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796550, "uuid": "c028ba71-065c-4106-82fb-86af6f0403c6", "comment": "Malware payload", "value": "99f6f4abdc2dc8cd5531e5032b467f57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796550, "uuid": "06af46dc-5471-49f5-bedb-79cd565e4837", "comment": "Malware payload", "value": "7889f77826e9be422230848aaf4371f4abc099d46fbe4673f8876ed724f393b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796550, "uuid": "4f8b3bb2-5032-447d-95d0-92f1e7854348", "comment": "Malware payload", "value": "b56c8a9215ab07383f3466a181274e365e7ff969", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796550, "uuid": "e0a0543b-aaab-4dc0-bfd9-2141b1b1b5dc", "comment": "Malware payload", "value": "3b565d36ea0cfbe131dc07dc93282fc74ae8b546325807ecc96fe2bd71bb9fdce748e459e50609b0f285ae60633f02d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796550, "uuid": "9bf2ef9c-5f3a-4fee-b5dd-08150d4f8dc3", "value": "7104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796550, "uuid": "6fe2572a-0486-4651-acaa-4a6ee3664068", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796550, "uuid": "53b2c947-7e6e-4203-8ea6-ab9c970e2be8", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796550, "uuid": "cc541e19-b1cf-49e2-b2cf-54bdcebfcb59", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796550, "uuid": "714d0a83-61dc-478a-bc7e-8a94dc208541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796550, "uuid": "d8d9e795-5421-4aeb-9f74-9082e7552ed5", "value": "99f6f4ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8d6fd2-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1621742434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742434, "uuid": "54fb5289-55d7-48a6-aa0c-2267ad2e333d", "comment": "Malware payload (BitRAT)", "value": "a61aace92c32f971e927fe60ac0d248e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742434, "uuid": "c1026e92-d648-4eb6-963b-ac64ada84269", "comment": "Malware payload (BitRAT)", "value": "78a1688728ccace1eda8d78df4b738e98ab92ad43135b14d86627995a8be1f5a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742434, "uuid": "8d0f8ecb-1960-4a81-ab0b-48ee3cb3ff02", "comment": "Malware payload (BitRAT)", "value": "1fe65870647ba3864fd96e07c3f8fe451b91935c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742434, "uuid": "dd258e4b-5a44-4eab-9b75-e4c266d60b93", "comment": "Malware payload (BitRAT)", "value": "ea94b4c28088326309919f233538dd87afeacee061b29b47e497f8d43c9f08bb616bddda08b6ef0cd3aab2af2eea7ee3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742434, "uuid": "ad00cb69-d98d-4623-93d6-d33feee71db7", "value": "A106CF02FA41C562D2670230E9AE77BE057CF5344B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742434, "uuid": "a387b432-5505-4316-b29b-e2d5fb1c66ab", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742434, "uuid": "9c7e443d-7b9b-436e-ac01-89f2fd3a1888", "value": "49152:gXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIS:gXrEeZzdhjuV/gd1VzsGUqNKTHvQecR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742434, "uuid": "3d3e6deb-a74d-4f24-9d1b-a8f82376d287", "value": 3941888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742434, "uuid": "96dc63c4-aa42-4dbe-96db-c852627f2717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742434, "uuid": "32512ea2-a803-4c97-8435-ba26879c1fa7", "value": "a61aace92c32f971e927fe60ac0d248e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6658cf0a-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778501, "uuid": "95b7c96d-d4ff-4dc2-b4fd-5f27b61a136d", "comment": "Malware payload (Dridex)", "value": "4b043c344761776b9280593db6c8405f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778501, "uuid": "a1bd194c-86f2-4700-a56b-04606f90a84f", "comment": "Malware payload (Dridex)", "value": "792bee09c81bd123c377c430f3c95a4124ad2a43e53c489c4a2f338b34105896", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778501, "uuid": "f0923f8a-dd97-42f2-8229-547082d99b81", "comment": "Malware payload (Dridex)", "value": "55fea4326ef089ab3ecf5b9c348395f7ec4fb983", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778501, "uuid": "547b8c48-41aa-43dc-a3f5-f8ea05d3ac16", "comment": "Malware payload (Dridex)", "value": "84680d695de9a98a9769a0e118a6d5c7fdff8175b91c2301ad31cfc413de648b0010ce280c47b07db444d678b0a7b39f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778501, "uuid": "e9eeaeba-2e6d-4a28-8576-a7381e0cb7bb", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778501, "uuid": "708d683e-a59b-4c38-85f8-f726f0aa92dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778501, "uuid": "14fdc0a1-c276-4a10-8281-80483427b811", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778501, "uuid": "3b01c3ed-2eb6-4ad4-8965-7dbc80d9834c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778501, "uuid": "e61aaeff-fb80-4fa1-9c38-53b836a58ea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778501, "uuid": "0b308d90-2b33-4355-b228-305585103275", "value": "4b043c34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6260adcf-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767757, "uuid": "cae5ea24-813d-4a45-8909-c8e03bb52dca", "comment": "Malware payload (Dridex)", "value": "e403b43e6953b46ee9ace4c34abd5114", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767757, "uuid": "6b145d5a-39ff-4d0a-8435-1b8336212be1", "comment": "Malware payload (Dridex)", "value": "7945bc0ec72fc8a4fb794d031c00c4c74ca7c68530872280197fff164b94cad0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767757, "uuid": "425f0c24-f6f7-47e6-9a76-c9de223a0bde", "comment": "Malware payload (Dridex)", "value": "0bb80a8b8f6c47e8663170dd33dcc755a722dfb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767757, "uuid": "e06518c9-3318-4b6d-8ae6-1017641bc465", "comment": "Malware payload (Dridex)", "value": "110a3bf9694545e5ac8a723ecd4b91cbdada42aba4925beb91fc39614e9519466c21a2e5a34a115faf764688bcacf2b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767757, "uuid": "ed95b9ab-e9ff-44fe-b781-ee973121857a", "value": "4FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767757, "uuid": "d12396e7-213e-499c-9c46-086b31d7591c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767757, "uuid": "c1136d70-269e-4eaf-bb1b-9d5e8680a8b6", "value": "3072:oiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:zeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767757, "uuid": "4636202a-f59f-4381-b591-5742fd6205dc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767757, "uuid": "bd29fad9-964e-4330-b33b-77e3d8b5951f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767757, "uuid": "0cd2e0c8-19c5-46cd-85bd-1565c3c6fee3", "value": "e403b43e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fa235b-bbae-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621764329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764329, "uuid": "48f4144b-8130-4756-90f9-38e18045ef6c", "comment": "Malware payload (CryptBot)", "value": "6f930cb7301ef7d15c432c1cbbc0ba44", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764329, "uuid": "8d82f1a1-0fef-4751-b647-5550d3c74efd", "comment": "Malware payload (CryptBot)", "value": "79a2018e882db101500e8f932582227c1b4ba49b8f85bb303b77a749d9647ad4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764329, "uuid": "80b8c44f-0507-403a-87a0-89e7b6fdfb7e", "comment": "Malware payload (CryptBot)", "value": "c5702a6c7a1a935fbf0ae4e5746de559e10e70bf", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764329, "uuid": "a5d72762-d6bd-4078-a24c-35661929b24d", "comment": "Malware payload (CryptBot)", "value": "af6d036afdf4df331ecd3a5e9d3b102c5463cedf2103b7a3ba51a5f631378977b225cf7bfdf8e5d368790af3f418c90a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764329, "uuid": "4b991a98-2fec-4eaa-a517-bbeddf8ed2a6", "value": "54F4F138B6A9D034F1BF20B44AB992F9652E7DA16B3440FF12D226EE56305E49C3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764329, "uuid": "b1922e82-3963-483b-adaf-33ded5ef0095", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764329, "uuid": "8a8f56c3-02bf-4e79-93ac-ca43bbce7e30", "value": "12288:mx+MDBMFwZZH8/IVEJh6U51UxzAn0S6Hs2M4d4yUjxf3uRIOQEjVg+qLU4tXsL:fMDBnPYCIZKSYn94ycf+XjjuAmXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764329, "uuid": "b244c7ff-113d-4d5b-b3c0-d4491be8d5ec", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764329, "uuid": "5726ac4b-e29e-4be5-8600-c1759c609f61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764329, "uuid": "48161022-6076-4be4-9532-a0986338c1e4", "value": "6f930cb7301ef7d15c432c1cbbc0ba44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608ac72d-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621789229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789229, "uuid": "385ec0ac-f1f9-4612-a842-504d272c0312", "comment": "Malware payload (ArkeiStealer)", "value": "1ceb51cfd72f59d9035ab2a78627d4f5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789229, "uuid": "1229bd05-5e58-423f-8954-6b895bcc4343", "comment": "Malware payload (ArkeiStealer)", "value": "7a63dfdb3c679b747aadbd3855f97e9fb00a7cffdca72a937f63bb167dd52f20", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789229, "uuid": "b6140a48-8a67-4db5-a224-a994bdb8e153", "comment": "Malware payload (ArkeiStealer)", "value": "812808c718c8aa14775893ac9571e0f0dba04e66", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789229, "uuid": "778836db-2a84-4bb2-b580-f9c9f74bfbe8", "comment": "Malware payload (ArkeiStealer)", "value": "17ce66501d26b62b709ddacb61eae374bb76101bf8637e75e1dd054e703a4d3de50883119d850cfc34428fd3a22ff412", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789229, "uuid": "0d9da21a-c6c3-4e2b-b502-aca1a4991d36", "value": "ABF533A072E280F6DA815031DE4CBF7694BCC3852B5D9D7B3BE2850E4D3E664D36B606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789229, "uuid": "451fedaf-6b09-46d8-87ca-fcdd9ef07f33", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789229, "uuid": "015ff1a3-9633-4cd2-a703-4c787b95cff2", "value": "98304:xICvLUBsg3quuv/XLiW+fHOgldl+jUVj1yuDEdu+zF:xVLUCganvvLB+fHRzl+gVj1ymkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789229, "uuid": "897c1eba-a3e3-4b14-bde4-0bacabbbc1a5", "value": 3384263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789229, "uuid": "df9e4e8b-fe67-4b96-8a18-0ec22994f3b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789229, "uuid": "49752945-75d3-4820-9d6a-f5ea86e4862d", "value": "1CEB51CFD72F59D9035AB2A78627D4F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82076b29-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807324, "uuid": "45775bfe-6d93-467a-abea-568b282d759d", "comment": "Malware payload", "value": "9df36026c66643c02bccf860d3db4327", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807324, "uuid": "de3a3db2-2654-4142-b0c5-6b3313a914d2", "comment": "Malware payload", "value": "7ace03965a9515f23ec16958c19a05df6889ccfc5b7a3d0bc2ec5a9d62b6c8d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807324, "uuid": "abe77da1-9217-40ab-b80f-59ec235fe956", "comment": "Malware payload", "value": "68c0aebff83d2fb600688b7d7541efd533f3a36b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807324, "uuid": "9cab40c2-f4aa-4cc5-8280-f98805cee0aa", "comment": "Malware payload", "value": "7d0e58ef8a68b633741bda63d063b9a520ff1007e461e07309ebafab78251e898a7c2cccb4b6ac18f458b58ca1a274b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807324, "uuid": "7d308fc0-64fa-4a3e-a992-066c92aa554e", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807324, "uuid": "b3e4c344-e767-4887-8285-3655b037f64e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807324, "uuid": "366661d3-3814-47d0-8f51-f8c8370154da", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807324, "uuid": "bd54fad2-59b1-4dd7-9daf-b20d82a050eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807324, "uuid": "72c1a292-8167-44ba-ad12-45c4b041ac6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807324, "uuid": "172dce6f-71f7-4d8c-a41c-2b914798fbc7", "value": "9df36026_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca2fe3f-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731723, "uuid": "10b4c981-3f70-4aae-9285-378a07c5a984", "comment": "Malware payload (Dridex)", "value": "af190052192a37b032bf677b74c75e83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731723, "uuid": "a7659b0b-6951-4eae-a8b1-9afc0819aa73", "comment": "Malware payload (Dridex)", "value": "7b2189111b76812ccb960b1ce995e0470185a6b69e14b9cde6848d33699c1210", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731723, "uuid": "842f4b98-47e8-43d7-9737-b10e57cd5ef1", "comment": "Malware payload (Dridex)", "value": "ce0e6282a7a34cada77a9c4b304b55e7af23ec7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731723, "uuid": "b6215688-7fd5-4c82-99d3-c07320cd6064", "comment": "Malware payload (Dridex)", "value": "528e713b11f60ce392d3a87a442f8c7eee9f10d69fb0a21accd692ffc836ed48723172bf682aa6bcd8cd4eadfcd5d94b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731723, "uuid": "2a53df5a-5650-4c9f-9db0-ca305fbc36f2", "value": "E3F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731723, "uuid": "60f7c30d-e08d-4f00-901f-6c23797d643d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731723, "uuid": "1cee87b6-f190-4b11-996b-583a4cc6fe30", "value": "3072:JIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731723, "uuid": "f2de3c74-7c3e-471f-bee8-498c2a2ca65d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731723, "uuid": "c93d8504-c5bd-4ff5-9157-d1b15241431d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731723, "uuid": "93ca0f91-8288-4428-86d0-bc23e4e65858", "value": "af190052_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f47b14-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728026, "uuid": "99e1690e-6ac7-43b0-bf6e-8517eaffb490", "comment": "Malware payload (Dridex)", "value": "0775e159d2a99e851585a9442e91abe8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728026, "uuid": "9df88104-6d0f-4ee9-9a24-b3436873b17c", "comment": "Malware payload (Dridex)", "value": "7bc70378ecd2862f6f4e37a80c2d3e08792b78fb82c26cf9851655490f24ebc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728026, "uuid": "82f338e0-a2e1-45e0-afb9-312780463405", "comment": "Malware payload (Dridex)", "value": "5495a4fcf105d109fb16971044189a872f0dedee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728026, "uuid": "667d69d3-2b73-4e1a-84a0-6a6aa04ec557", "comment": "Malware payload (Dridex)", "value": "c63860950c4a8481730d55badbd074187c1952c4bc9197d319e13de50be18ef1a63fdf2571a086b7163eddbb28cca3f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728026, "uuid": "58c5e63f-d514-4310-be96-eb11547ce825", "value": "0BF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728026, "uuid": "6dd9ec3c-41fb-4c8b-97a5-b15b7e467576", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728026, "uuid": "420e8bda-5ffd-44d7-8da8-f51e5c7f0bfa", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728026, "uuid": "dd360a0e-2979-4ceb-b810-9677b50203ad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728026, "uuid": "ba196757-82e4-44ed-b940-cf1878fe1d67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728026, "uuid": "cc2f5161-6b0d-4c13-a998-f1d1596b6c51", "value": "0775e159_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dd8396-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796514, "uuid": "ae7a1063-d102-4a34-8e22-a592ddb3191c", "comment": "Malware payload", "value": "4d9b6ca03c8af8dd44765f40384f7404", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796514, "uuid": "d0a2b638-2bf2-4bbb-8666-038014bff9b2", "comment": "Malware payload", "value": "7c47d878b02593b5a1a1be34ae3fa8ea03e04512425c6fee0e51183bb5782e61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796514, "uuid": "60edcbda-2619-4af7-b858-4d3f76a506f5", "comment": "Malware payload", "value": "52e4223e878ad84c94c49ee7dc82e67bf2aad777", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796514, "uuid": "abbe96d7-59b5-42ab-aac4-a98c5f0c24d5", "comment": "Malware payload", "value": "dcc8bc41d3a4620087bf63c299b8ec11e94fd21c974af3c4f21d12253ae4dd9dec4853c0b404161d06d4e93b50edf5d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796514, "uuid": "4e1c7eb4-0e56-4c25-a304-3a643edf7c64", "value": "BAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796514, "uuid": "b954cf46-aa60-40df-92c0-26a741f0ad2e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796514, "uuid": "f61f9264-a7f0-4655-90a3-0fc1dec24c1d", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796514, "uuid": "daf6d3cd-dafc-4443-9a98-6e5fef7e3f89", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796514, "uuid": "4c1da414-59c4-4d9e-ae3d-28c5bbdd1233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796514, "uuid": "80c363e9-2cad-406c-9cba-2e044141673d", "value": "4d9b6ca0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3665c611-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738907, "uuid": "085ac9ac-35c8-4a5d-857a-7b71a992bf1c", "comment": "Malware payload (Dridex)", "value": "d0a0d7ff57dce5e0be4afed7942b7450", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738907, "uuid": "f7725b2e-e425-49bb-83e6-57c24c9c9760", "comment": "Malware payload (Dridex)", "value": "7c56049978f42b22f649499ebd8f3e7b228c3f37134806cb518685c21bffecaa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738907, "uuid": "f4bd0426-00e8-458f-9e1e-9e7de18a66b7", "comment": "Malware payload (Dridex)", "value": "7d648276f546f3540cbfaa54e32049609034f565", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738907, "uuid": "ed6b1c6f-820a-4bcf-bc0e-cf28d8e3bc73", "comment": "Malware payload (Dridex)", "value": "04fb59bc1eb506e2da6f8943d65049609500bc773b15c5b0fe9a055daf54cc300c1cb58d76aa2c02cc18076c67e9fcfd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738907, "uuid": "e7db7588-6de1-40c4-bc0b-c81ca0fae619", "value": "04F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738907, "uuid": "06a0a33e-ecc0-4e3d-b197-e663dbea67f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738907, "uuid": "54b9f90b-220d-41ca-94c5-1684bb261a59", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738907, "uuid": "0bf0e8ea-8d30-488c-b91c-6beb1c913a6f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738907, "uuid": "c7218c42-9b79-42de-9ba1-5cc979e2b059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738907, "uuid": "814632be-4e7c-431d-a16f-826adfadbcb0", "value": "d0a0d7ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93aea39-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742535, "uuid": "052fbd92-f53e-49c5-b654-b147f10bad77", "comment": "Malware payload (Dridex)", "value": "03efa7d49a6db92731e22ef88ee38bde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742535, "uuid": "89a7d55f-216c-42fc-8a69-18d2d1b8afe0", "comment": "Malware payload (Dridex)", "value": "7c6f24a29419d9d4980838b794ed37b860c9c15ae21d464f0eb32afa1f13277d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742535, "uuid": "6cdf183f-5e5c-45b2-af0d-4d4f6c6d2c84", "comment": "Malware payload (Dridex)", "value": "fadd60d374be031d07b0931942440a2e7805dca5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742535, "uuid": "b1681345-ab18-4604-b560-490f8f7af4e3", "comment": "Malware payload (Dridex)", "value": "60203056f49fe2ca1595efacf74642bd7ece7872fbf5c8c58bd809d3bc3a2b9e4581dbb81c9ea749875408e461a74470", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742535, "uuid": "629e8ae3-2137-4d15-be4e-9198627a7fa5", "value": "36F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742535, "uuid": "9577ac47-3611-4632-a977-dba4635e299e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742535, "uuid": "2a8d9040-8be2-40d4-81db-153b05c4f3c8", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742535, "uuid": "314c0761-2cba-4d8f-afab-546315e4277d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742535, "uuid": "97860b22-e2e9-409b-a47f-6e97cafa8cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742535, "uuid": "b3998a21-bfc8-459c-abbb-5466e54f9045", "value": "03efa7d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b9b6aa-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742454, "uuid": "4b448da1-6bf9-449a-b01e-c548938a6f36", "comment": "Malware payload (Dridex)", "value": "e51afc1d41bc5e29ee993adcca20f7e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742454, "uuid": "bdc9d846-d35a-4d32-9edd-d54d71df2bda", "comment": "Malware payload (Dridex)", "value": "7ce91401d9d0648ae59cc0ebe4d26bcfa67574cab2380a437448e735a8490bc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742454, "uuid": "5e8bcd99-a6be-4502-9173-76aaa4bff1c5", "comment": "Malware payload (Dridex)", "value": "4b05b16bbdcc9dad2c8746236e0f19e6b40429f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742454, "uuid": "481a832a-9fe8-4ca9-ac55-c65fc2f9dc68", "comment": "Malware payload (Dridex)", "value": "2d2348ec55dfa01089277d226da0b7a4a3098bea3a7ec01d89d2faaf660e356bc5599c5c1334dd446ea67f5d67a3f7ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742454, "uuid": "40fc3ecd-e95f-47e8-82a5-41274a1e130f", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742454, "uuid": "0f7df8b5-67eb-4d8f-bc4e-41dee08928bd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742454, "uuid": "369590d3-2249-4899-964d-2b49a050bdb7", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742454, "uuid": "df1f8203-921e-48b0-ad48-f2365ff408ae", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742454, "uuid": "68135cd8-7dde-45c8-ae70-85057d304886", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742454, "uuid": "3bc616ec-adb6-40eb-baa8-b49677645266", "value": "e51afc1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6650f7-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803690, "uuid": "1e7fa93a-64dc-4b2f-a78b-3309b90af04a", "comment": "Malware payload", "value": "d6a2b661fa89c7f3d841e5931bd257cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803690, "uuid": "480c462c-b647-47ec-9791-4190d5e4003a", "comment": "Malware payload", "value": "7d49796cd5fecb8b939a8f32821256df2260e6c4e6c0bce80081fbae2b0b07af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803690, "uuid": "436ffe7c-10c7-41c9-9385-8ffc0d89be20", "comment": "Malware payload", "value": "e0dbc4ab24d6418a73868f9bedc274b0472647fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803690, "uuid": "cb116bb7-d086-4f5f-911c-25823c79817c", "comment": "Malware payload", "value": "e8197f753c30ed54f160cd835154e46f0be5f5cf9904c3320795259af127446adfd7c89e3aeda8a93b122ca24bb1455c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803690, "uuid": "a0e61bf5-51af-4b17-bb0f-04e04e81c159", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803690, "uuid": "c1cc2eb4-1ad5-422a-8e55-1c743156e344", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803690, "uuid": "9938b805-df6c-4e73-89bc-b1e23179f19e", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803690, "uuid": "d82fbb09-79d2-442b-9d32-c31674301d2a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803690, "uuid": "fe44fdf1-cc88-4b12-9428-78ae947d30b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803690, "uuid": "3da7d0e1-7cf8-4b41-9943-7d0a0706990c", "value": "d6a2b661_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba745794-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800117, "uuid": "015651a7-fb59-44df-92fc-75df95cd2e05", "comment": "Malware payload", "value": "276a0435da102727c81a74a8a2d5ed9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800117, "uuid": "b1893333-7616-4a29-9c1e-9e9b1b45cb84", "comment": "Malware payload", "value": "7d639f6ba2c708540f9f16e891f3a0ce9f582c36e3014440b26cf3b63a1bf09b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800117, "uuid": "ddfbd40d-11e1-44a6-aa04-0d4221ba6a9e", "comment": "Malware payload", "value": "2c2c58b02022be733195de046833aa28143e333a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800117, "uuid": "e6a68891-53ae-49dd-9f56-17a11bf0e2bd", "comment": "Malware payload", "value": "8f6fb6597d3f3a8524cb78ce1e0dd5dfb00506cafb379ef71ce714858f92411738e04e971f5b1a915775649baad14992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800117, "uuid": "c90d341a-8d33-478f-8296-1384c763cfdd", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800117, "uuid": "029280cb-8200-4c3b-a186-5f73c2ede5f2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800117, "uuid": "cbb52324-7186-4e67-9fb4-97a08728b9e9", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800117, "uuid": "3e97ac69-1584-4ff9-b259-b29c52926a13", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800117, "uuid": "d5f6a42c-ccc5-42d5-a4a6-b50ce2517911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800117, "uuid": "2b1822ab-0f87-4b82-9c5c-5b0ea47f987c", "value": "276a0435_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e83d1e-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731633, "uuid": "446456ef-1398-44a3-ba86-a8af24b88c7d", "comment": "Malware payload (Dridex)", "value": "6c3c9636cdaa149fc3bc9ddb5a0d7aa8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731633, "uuid": "4d014399-f785-4432-a98d-cfa367f9e7e7", "comment": "Malware payload (Dridex)", "value": "7d6efe130560a3d34a97df5107bc649b448a29052d190170796779cf48413e02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731633, "uuid": "83a38e2e-af91-48ca-880d-06cbec87f8f6", "comment": "Malware payload (Dridex)", "value": "ecf4b853e28ac382fbf3dde0b941377aa31e7e23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731633, "uuid": "7837c20c-104a-4aa8-87ba-326ea06eeec3", "comment": "Malware payload (Dridex)", "value": "51b34057fc72c17367a81631ad8704f1c4e4d6ecd7175c4126522e5c742364348186731d790b84cb1531367a00643845", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731633, "uuid": "3c582136-8e0b-493a-9d86-c0f3bb8bb5d8", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731633, "uuid": "75dd617f-240b-4027-a217-6e1f446e1375", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731633, "uuid": "bda40704-cb3a-437b-b294-8918767f2a45", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731633, "uuid": "f177f78d-e856-432f-ac68-74b112a197a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731633, "uuid": "7d93f84f-2736-40d1-96a6-8b64e11a3eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731633, "uuid": "d7a517bb-0ae1-4ebf-abd1-8e8fc56725ea", "value": "6c3c9636_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75e7b7f-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756840, "uuid": "9ee8714a-dd7e-435e-a1f7-34ee3525f87c", "comment": "Malware payload (Dridex)", "value": "bde3101389400172d3f4405a75a1985b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756840, "uuid": "9037c425-82b7-4719-9026-241d166c264b", "comment": "Malware payload (Dridex)", "value": "7dbaba3ab8b52c53f2eb14af44a494c874b08909fc9fad1c37caf2972b9b5df5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756840, "uuid": "d96509ca-afff-44a6-b797-886f208a3fc1", "comment": "Malware payload (Dridex)", "value": "6819b19242b2a0efa056e91cbb7bd28ad53b71a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756840, "uuid": "215ad6bf-c994-4450-a5c2-2a530b9bd233", "comment": "Malware payload (Dridex)", "value": "c9ccabdd5eb23706fa94591512632829e910d6e6641de109b533aee6954c2462616c4db3e09f182aad55829fc6480a3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756840, "uuid": "0e92efdb-f7f7-499c-bdfb-68e63b46a6e6", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756840, "uuid": "48ce650f-075c-4284-a2b4-f52c1869b93c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756840, "uuid": "b3afd372-ad6e-4aab-a7ec-3331270b38f0", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756840, "uuid": "4085dad9-2302-407f-8702-ad4e5609569e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756840, "uuid": "93dc07cb-9e8a-445c-82d3-4ec1f1eff861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756840, "uuid": "58d8ead4-3ac5-4f79-ae0c-37e3a0fd9377", "value": "bde31013_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fc7ba3-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738831, "uuid": "d77345e4-1016-4320-87fc-69e6614bfe04", "comment": "Malware payload (Dridex)", "value": "be3be52def3d1905aa97014a67140478", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738831, "uuid": "f2f6bd8a-c517-4d45-8333-30acbae0f901", "comment": "Malware payload (Dridex)", "value": "7dc4250c712f8131f47a30e0ca2e20cdb1e71e5f543a4b80fea9f6ba9de0717e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738831, "uuid": "9992e2f4-f012-4846-b765-5dd93c4474f6", "comment": "Malware payload (Dridex)", "value": "d21fdb6779bd8068ec6d12ed329be930b887af02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738831, "uuid": "ef7cda9e-d775-45cd-9a66-33b921b07443", "comment": "Malware payload (Dridex)", "value": "6f46d7c64c90bcbdac0098c9a3fd8f626c1b7103d5a4ca35f84ae443984f2c3a0657a20f753a10573876aa52634b7772", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738831, "uuid": "f60ab581-13e9-4f27-b283-89d517010854", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738831, "uuid": "b3df2143-4703-4a47-b1fa-d80a69a09652", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738831, "uuid": "89537437-be76-45db-a6ed-11a4ea36fb54", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738831, "uuid": "61d95291-e2a2-4eae-a430-a9b8b8c630be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738831, "uuid": "01335e9d-1af0-4ac9-8e6e-46d2c565f5df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738831, "uuid": "6f5129b7-f0f3-4db1-a58c-8b853ce92c02", "value": "be3be52d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7458fe0c-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807301, "uuid": "7e68c735-9ab5-4601-8a69-0dcaf5e7a3b7", "comment": "Malware payload", "value": "3e5b3f21d8209ceeebe36473b9bb00c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807301, "uuid": "38ac02b7-3ca9-47e6-9dfd-987845e48d80", "comment": "Malware payload", "value": "7de81b942c6300c6b7a4d10e8db1ecf9d5027df0c96fb38134ad99ac305a9481", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807301, "uuid": "4f280c04-d708-44b9-a985-6a6e96ad3d1c", "comment": "Malware payload", "value": "38ae391ba58486a78b6663267cbd86504d50e11a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807301, "uuid": "e742fbfd-6daa-4010-850f-486fb964ec42", "comment": "Malware payload", "value": "6a1b685aff72760e9284532787254dcc9c1acd0fd8963691f8b5b307e85b8dba16a582f5a539cc63406437c680a42a7d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807301, "uuid": "088f0192-39df-434e-a038-b90dbabf8618", "value": "CCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807301, "uuid": "a6a77e6e-8245-4356-9a44-fba675c0f2df", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807301, "uuid": "10965494-8dce-47e9-8733-05793ad780cb", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807301, "uuid": "18d37951-fe1b-47c7-80ad-19a4ec5162f2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807301, "uuid": "067ea95d-0f8e-41f0-afce-f6597167ca79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807301, "uuid": "1037e0ed-3d40-444f-9437-3902234cb49f", "value": "3e5b3f21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1260afda-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728109, "uuid": "b49cd1c2-ae8c-41f9-b75f-70841430f8c0", "comment": "Malware payload (Dridex)", "value": "523d556df0f93ec0f0bc3186a067f63e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728109, "uuid": "63604c55-da1c-4312-bf39-21b99efb4011", "comment": "Malware payload (Dridex)", "value": "7e473e392c5823ba5152c6e8e54fbe7f98bfc0dc5c49e39451ec95d0dfe37b93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728109, "uuid": "3b2cc983-476a-469c-a050-59058f37a836", "comment": "Malware payload (Dridex)", "value": "f56877c60466b7a62c300c8fd46851336f0ca750", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728109, "uuid": "2809c6c1-1401-456f-bfad-8f6b6bdc5e5e", "comment": "Malware payload (Dridex)", "value": "e18e14a568cbd4b16659e342575827f18995adea4b33cf5d9b480d854101fe01ca66e4b6dc5854a6b66beb5d6d7adc25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728109, "uuid": "b509dc05-9712-4310-bc69-b818b9b950e6", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728109, "uuid": "1f5138e8-21d8-40e3-93f5-0cde27675f3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728109, "uuid": "e7985dd7-89e5-49e5-a6a3-0e44dab43264", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728109, "uuid": "1e29a33e-b137-4335-9c55-8c77156f0597", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728109, "uuid": "a596cf34-505d-46f9-b44c-423ba8284497", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728109, "uuid": "b8b66daa-26cf-4598-87aa-f923415f7583", "value": "523d556d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa3d876-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767637, "uuid": "7441e329-b2ca-4bf2-9e34-b63ed2648ed4", "comment": "Malware payload (Dridex)", "value": "5daf45ac72aae577e0be8dccf7ed0007", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767637, "uuid": "be9dd311-20df-4598-bada-bc16ac3de7ca", "comment": "Malware payload (Dridex)", "value": "7eb86514cba07328bc042259af2f632428db941440f65e4f95c2605b2d11112e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767637, "uuid": "625ab914-0fcd-4561-a839-228c02b4e630", "comment": "Malware payload (Dridex)", "value": "3b7ca64518dfa16c3d708f6c1019ff2b0c465c2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767637, "uuid": "204c26f9-81d4-445a-adbd-08e217a6bfd1", "comment": "Malware payload (Dridex)", "value": "b3a414905cb0191ecc4d9651be36f516323278893ab058bd555462ac08dce6b34af46a1637ef43dd9f21d9b8a1acc6bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767637, "uuid": "2e451a3d-2f81-43e4-a2d8-a7eeeb6044c0", "value": "4FF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767637, "uuid": "408a9e40-af61-4dbb-9f1c-4a8155df2373", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767637, "uuid": "31b3e82a-6e59-4258-8e76-be75b03e64a6", "value": "3072:09F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:09F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767637, "uuid": "151d50ec-6586-4d3c-ab71-5393ec0bdcad", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767637, "uuid": "ca0f4df5-c91f-404a-85c9-431f423682a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767637, "uuid": "710d75bb-b709-4fc5-89e9-1b3106ac13d0", "value": "5daf45ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305f4ebf-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785712, "uuid": "9e1b0727-862d-4a82-9199-c2d34583511a", "comment": "Malware payload (Dridex)", "value": "fdbda91daeb156e7e22b4b63e53a0f45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785712, "uuid": "094cc298-85bc-416b-855c-d6399fb700c3", "comment": "Malware payload (Dridex)", "value": "7eff4464cdfe3943cb2760dc019f0fea4761d62f182d49e99cc4d7a56d25ed51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785712, "uuid": "d7a25389-20b7-4c5f-819c-745f9d604e54", "comment": "Malware payload (Dridex)", "value": "77cd486f0c0ef918796a679978dfa41212b13c68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785712, "uuid": "2b225793-a4a8-483c-9806-350d9d4779e3", "comment": "Malware payload (Dridex)", "value": "d75eaedff377bf11c26e62cf95dfe2fc98aea40912dd5a20f57acca61f99f3b75f7248efbd6cf782b2afe1cc7955d5aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785712, "uuid": "1bf8c551-d9e9-4151-8902-671fc6e32be9", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785712, "uuid": "8ca3e8f4-a099-4d91-a89f-4caf3ba49b79", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785712, "uuid": "e01e62f7-f72c-4495-acf4-b5f2d2813d8b", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785712, "uuid": "e11a2fb4-5850-4731-b2d7-be5d3d6e6ead", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785712, "uuid": "f0e3bfb1-69c7-4efe-b944-c8e0066545f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785712, "uuid": "7ffa02b8-6fbd-4712-bd21-52693be2ebc8", "value": "fdbda91d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85b6ebc-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792892, "uuid": "1dbf1948-9267-481c-8ab1-f3b166cba09b", "comment": "Malware payload", "value": "ce16e8501a1877d6d86127ddcb60579b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792892, "uuid": "94031313-289f-46f5-a916-0a47a2c60887", "comment": "Malware payload", "value": "7f5e6f1f66c0a8325c20b899d35427cb95efa0754439282961695aefb33a1815", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792892, "uuid": "2729e25a-396d-460d-ac01-809c49068599", "comment": "Malware payload", "value": "ceaf912ee881ee612f808f0b363718f4dd43b84c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792892, "uuid": "e6aa936b-6bb1-43ce-9883-1864f2602b75", "comment": "Malware payload", "value": "9ab23ab1c1589061fbe47ab8c3894f2ab514f732189ba65105cae5fb066999033abaeaea004ff8f3b24b8eca5f4532f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792892, "uuid": "60fc0dc6-c882-4622-b599-73de2d7a03ff", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792892, "uuid": "661267b3-344d-430e-98a5-ec33fff5b8ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792892, "uuid": "b09a3ba1-1319-4d37-bc1a-334b6ee64359", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792892, "uuid": "0717fb31-d895-4a08-8168-cdbb73baf682", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792892, "uuid": "829aa177-11c7-4543-8582-78cb25aa59cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792892, "uuid": "020df3a3-3c37-4512-87ad-15b64644e892", "value": "ce16e850_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5744b1b0-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807252, "uuid": "4fc32707-6367-44bc-9edc-9684b4bfa057", "comment": "Malware payload", "value": "771296cbbdcf23abe027eb87f2e7a2b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807252, "uuid": "c257e783-37bd-40f9-8564-c4a9aab1ab66", "comment": "Malware payload", "value": "8049f6d57b337a469d517620450a52cf534fd58c8fc49c93c9d94e0da28bc81c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807252, "uuid": "d9714473-2d07-4a62-a381-28c9845e86b1", "comment": "Malware payload", "value": "eaa33e2c1e32447b01f8e03999abd3f159cde74d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807252, "uuid": "766bc692-def0-4351-87c8-6203328438bf", "comment": "Malware payload", "value": "5c84ee72e4c97daf67413ebf26e4d474e8f5326ca2c36a978d324f686587462b1334280faa59b4497dd81749aaf866c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807252, "uuid": "fcc60e5e-a1c9-4e9a-9d8a-35ea71dbe1dc", "value": "20F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807252, "uuid": "b6a8f137-6b1a-4b34-8044-3e1e4f529325", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807252, "uuid": "b2406061-d2bd-46a7-a6a5-f9775a54bd4b", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807252, "uuid": "bf6a6a3e-4bbe-4d6b-b8e2-9e29a96775a3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807252, "uuid": "64b08db7-23d5-4a01-ae4f-dcc0199fc9e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807252, "uuid": "8c637d20-6b91-411b-94c7-6a286ec1059e", "value": "771296cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e431da-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756918, "uuid": "4b558718-6b00-40b5-8870-cc9d95ff2f51", "comment": "Malware payload (Dridex)", "value": "38a2c3ed9415d551519f4ddfa93c3c7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756918, "uuid": "9483e64f-72da-42be-abd1-b13cb16f27a9", "comment": "Malware payload (Dridex)", "value": "8177aee030b349e41514940e079ee47264ccb8986887f9e9bb53c31f06aa9c24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756918, "uuid": "86508901-bcac-4524-b27f-4dd413cc0c60", "comment": "Malware payload (Dridex)", "value": "1d04ae660ad13c59b2f126bcf209703b96679dfc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756918, "uuid": "0c788ed6-d5a8-4cbd-8c11-f255f4ddbd7b", "comment": "Malware payload (Dridex)", "value": "144e2b93f08b63cfd71787e26b118d8599f5b5916bfceea2545318bcdd7b8b59e5a79c27d740c8b7697739900d024763", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756918, "uuid": "6adcbcf7-b39a-48d8-a462-9ae581f4439a", "value": "E4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756918, "uuid": "fec00344-c28c-44bb-a513-80cac23b0ca6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756918, "uuid": "fd3c99b3-415a-49ad-9281-8e1275dfd595", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756918, "uuid": "d33c5e49-ae59-4cce-a080-1e81ec2e5e5b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756918, "uuid": "c1db6b84-418e-4a35-ab4b-78496fca0458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756918, "uuid": "d0a968f1-0ba6-435f-8a1c-8bbc87c74f85", "value": "38a2c3ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bd2934-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749744, "uuid": "88556e53-9d3d-4ae6-8e90-a675068002c7", "comment": "Malware payload (Dridex)", "value": "59e89b083840e6d2ebba46e5dc8fcb9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749744, "uuid": "4294fe06-c11c-4383-adae-8c64d0134044", "comment": "Malware payload (Dridex)", "value": "826da024351c3697a5e1e3605290bc07d1324263755fc637c39e801191833abd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749744, "uuid": "1985b5d6-19d9-400a-8619-7c0d099f572f", "comment": "Malware payload (Dridex)", "value": "e8f0b524daaf278914e9700f3f7edb7457882c42", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749744, "uuid": "62b7b48a-2acf-4181-87b0-6b966a326f3c", "comment": "Malware payload (Dridex)", "value": "f6c27c34e12126e19d47e6073510e7467b855db5b0e8e699635ce54cc94f1b83e17649a740f81e650679bab778cdec97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749744, "uuid": "078d22e1-6dfa-4523-b727-0cc42549990d", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749744, "uuid": "5daba72e-31c6-4bef-9b78-997983307b6e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749744, "uuid": "6b865b6b-b189-4049-a825-1b20e873ea3f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749744, "uuid": "601b8a2b-d2f8-4ddd-b85b-dfe7ed98aff3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749744, "uuid": "c63fe785-5239-484d-b33a-50d1de20f136", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749744, "uuid": "6b442929-094a-4772-b67b-4cbad3cb8d2b", "value": "59e89b08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9c5734-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756854, "uuid": "d167e846-5fc1-489a-9d1b-8f6b9723f254", "comment": "Malware payload (Dridex)", "value": "a7de13b31e0a7fb294f85baa8dc003a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756854, "uuid": "d065317d-a5b3-4e9d-9ff7-0e6c70142810", "comment": "Malware payload (Dridex)", "value": "82ecef56730e282dd6307202dab78e7964d26c8892f275e489583f9483feeed5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756854, "uuid": "41d5206f-718b-482d-bfad-87f74bff38dc", "comment": "Malware payload (Dridex)", "value": "61888a97cb5cc64c86c33d47e55323b076f0b1e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756854, "uuid": "764ecaba-71bb-41e2-b05b-1c50b260efea", "comment": "Malware payload (Dridex)", "value": "1c6b241a0c71a8fcb6e70b1b5162f5c3b6b707bcd0996c7b2c7dfe49eadcb0d744309828023583038f3542230526b814", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756854, "uuid": "47ddb4e5-8954-4437-ae04-22b627eef54b", "value": "03F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756854, "uuid": "d998c828-7a7f-4e69-9149-05d9a38dd778", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756854, "uuid": "111955b2-9dfc-4b45-acb0-56a98b5cc454", "value": "3072:K9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:K9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756854, "uuid": "3c630ee1-b790-42b0-a73f-27d6a0d7f4f3", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756854, "uuid": "f091bbc6-42b2-4860-a2e7-7b9df48e1525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756854, "uuid": "05b7d02d-996b-4afa-9faf-eb1720af042f", "value": "a7de13b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200f8aad-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738869, "uuid": "0a58b8e2-592a-4ca6-abb5-021977d95327", "comment": "Malware payload (Dridex)", "value": "d5e2f952cbb5f93ae1f761dfbffa428d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738869, "uuid": "bc2000c3-3248-4e97-a908-d8fb156a0a22", "comment": "Malware payload (Dridex)", "value": "834e1b06e74c47d4ae998a44bfc917b2caae7c5907419049a1e55d339cfd9653", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738869, "uuid": "d949af8f-ae7f-4c16-b030-bb02d38906f8", "comment": "Malware payload (Dridex)", "value": "ed4f57c7ff3784dc2bf66311976b356ef157bd50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738869, "uuid": "94b6df75-c19b-48eb-839a-640cc626d063", "comment": "Malware payload (Dridex)", "value": "a953c88d0f75b9309f062af63975d1e53b368ad4ebcb0e81976493ad62636154176d6866a2e72e8fb1f9c1515de63e85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738869, "uuid": "0c974be7-0d2c-4ac4-a0d2-e9580129d4a4", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738869, "uuid": "b567a774-a63c-4ac7-9892-4efeee4b35ab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738869, "uuid": "b00d5ba5-db78-49e2-9df7-23938d9e3123", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738869, "uuid": "97928eed-d7db-4795-b567-3aeccf389188", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738869, "uuid": "d5fead1a-33b0-4bc4-b78e-b4f675410715", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738869, "uuid": "d3c44fd7-3df5-42ae-9d84-6a0a038391b8", "value": "d5e2f952_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b21ce8-bbdd-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621784726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621784726, "uuid": "c18b0f04-a581-4ca4-adc6-cb0f91fa6e9d", "comment": "Malware payload (ArkeiStealer)", "value": "19e99f2ecabfedf0c976b0ea0d466714", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621784726, "uuid": "4822e055-d6c3-4d57-918c-609594fe9c2f", "comment": "Malware payload (ArkeiStealer)", "value": "8358e817e423f16dcdcd3f213229f7b7b63de4a1ccce5f7ab07997a57183f758", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621784726, "uuid": "6f2a31b7-0b6a-43fc-91eb-c471884ef202", "comment": "Malware payload (ArkeiStealer)", "value": "694491af8f5eb2e2b8eca7f401a83f4e9a5c298a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621784726, "uuid": "afc70d9d-81b9-47e2-aa69-2c060909a200", "comment": "Malware payload (ArkeiStealer)", "value": "ceec8571267a17f8649378772803e9398dc0492b047f3f19a06b105e4e92df80cff490af7a973f73ac2ce8bae41836e3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621784726, "uuid": "0ed9861e-1cf7-445a-a99c-afce2176f349", "value": "1BE40251B9D044B2E4322D795AF89735693CBD302F388ACB93947E6D0E305C1AA37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621784726, "uuid": "7d5484d3-0435-4c6e-9685-e24495cffe66", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621784726, "uuid": "913623a5-aefd-4aa3-ad63-b187de2a91e8", "value": "12288:VOOfN590uu6opX+t4sPIs0//hWnaw0QOSh/r1IYNx+HSd+gCR5pwbFTO:YOfNkuu6oLsUH4aKf1IY4SmqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621784726, "uuid": "dd9f68a2-59a0-4a39-907c-b4f64315de71", "value": 702118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621784726, "uuid": "c80b5a54-6128-4ea7-b407-d46dcfd7f085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621784726, "uuid": "8bba44f0-eeb0-4767-ae7f-a21f941f66e8", "value": "19E99F2ECABFEDF0C976B0EA0D466714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bb42b0-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621774906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774906, "uuid": "287e84e8-b5a1-4c58-94eb-7edee671b64b", "comment": "Malware payload", "value": "6ba32c9dadd2471594d70c27efa248b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774906, "uuid": "e041dc13-1d13-4554-a87f-9d250324f7d9", "comment": "Malware payload", "value": "837e3edfef405ce3b72cfd3d8f3b3abe64fd50a8c6eeacefa50074d0dc75fb52", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774906, "uuid": "e7b4142e-33ef-423e-8e52-fcb01381a57c", "comment": "Malware payload", "value": "e4fb4dcb352d9159650f9e35c84dcc45c03167ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774906, "uuid": "3f428c12-7165-4c19-bc81-1e98025e141f", "comment": "Malware payload", "value": "7ecfeae7f21ede0cdfc6ab7b037a5498ee819e68005f1076d68941808b3e2b3b705eff98df6d796ca4c67d64315fe8d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774906, "uuid": "457d8422-2657-4395-a463-1fabe40673ee", "value": "6C31ED81AC009CBBBF81ED9259965C3AD4F5200FEC6703F5121DC76D00A7179A88DED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774906, "uuid": "ed6aa0c4-0254-49c3-a7db-31cf8e4801ce", "value": "48:7z5F/88Tj280o1lsiFF3iKlT1CGK/CjdSuPxNZH5+NeRtn:7zH/88Tj280+lrFF3ieTpK/CzTZieD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774906, "uuid": "d20d4db9-eff3-434b-8a80-875571f4b5a8", "value": 1677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774906, "uuid": "2f30bfad-39f1-46a6-876b-d2b0f3eec9d7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774906, "uuid": "b9265fd9-225f-4eb1-bd51-1b1e25f91e43", "value": "6ba32c9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cc4ba8-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807305, "uuid": "81bd85ab-5a49-4cde-a20f-978344a19608", "comment": "Malware payload", "value": "74b8b50dfc6083957cf69534757ab271", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807305, "uuid": "cb6770f7-60a9-4356-a3b2-c1aad6097d45", "comment": "Malware payload", "value": "843ed1b2818c330211fc05039b44d142059cf4d06e48fc608ede275819a29a77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807305, "uuid": "4552636b-0777-470a-822a-50facdce6aeb", "comment": "Malware payload", "value": "5564b11708025d886c0328c5611ddcc799ffcbde", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807305, "uuid": "a1260081-cfe5-469b-9517-de7e78fb8363", "comment": "Malware payload", "value": "1e225de61576ad3583b6f64fea1b51a657b2593fe596c2d95a341740e9a11cf7264a46ef7455d12922501d9ebaf5c4d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807305, "uuid": "d9bf237b-661d-44d5-acb8-9ba1df1536f0", "value": "F7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807305, "uuid": "e6a6c7d5-f64b-49d0-b3eb-7d1978a85cb8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807305, "uuid": "879f3ff0-de75-4c97-9f75-b47a9404fcfc", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807305, "uuid": "609e4c7a-377c-4135-ac1c-11fc7640b16b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807305, "uuid": "2fe735de-6b65-480d-b7e3-cd989d93805a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807305, "uuid": "63f605a7-248f-490a-9d90-db815d24f426", "value": "74b8b50d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e3a881-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621749861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749861, "uuid": "7a2c8f24-d0e6-4259-b873-752c5251575e", "comment": "Malware payload", "value": "5270992912a8f00b1f8b699b19f76014", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749861, "uuid": "2d196781-f778-4c1b-bed4-48824ca5ac15", "comment": "Malware payload", "value": "85a7f650b4a1ed73e0167b50b73d47e76d078f9f6fe47a6370660cb6ad54b5cd", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749861, "uuid": "15f3f972-1e7d-4e44-ae1a-bf17121ea3ba", "comment": "Malware payload", "value": "c5837421429de827c5bdd5c7043d7c092e6d2009", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749861, "uuid": "cd6850a6-77fe-4764-b39f-ba4ba2177cff", "comment": "Malware payload", "value": "40319d6d6b7e33e271522cb29ab8198d0f0c2d0e7d3c3cec161285929943004fb9b6b0faf03f81f47012faa15ad603b3", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749861, "uuid": "3966e103-fd86-42e9-9dc5-f3bd4d707dee", "value": "F5414221B3ABCFA6747279B10222847C33C98DA6B89261484CC7C6F685B55DA87B1C63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749861, "uuid": "a3c82f69-6d74-422c-8553-af31b40b47d5", "value": "48:f+n9+mUBVECDUx4p2uAMMqoUn/VhClD+Rh:GnQm0qCD120/jC8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749861, "uuid": "c84a2863-6e78-4e76-bc4b-30c15e2de9b4", "value": 2353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749861, "uuid": "bb498e73-9615-49b9-a980-be788b394d41", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749861, "uuid": "04a30c1a-e4ac-4ce9-ae88-970b448f20c8", "value": "DRPCR216695.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d101e2f8-bbdb-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621783834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621783834, "uuid": "fc97bd97-a276-406d-b1ab-a8c72f22c897", "comment": "Malware payload (ArkeiStealer)", "value": "d272ba327929238ad200e364eef10b92", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621783834, "uuid": "d374cc69-74c0-40bf-8fa9-c39af7ee6abe", "comment": "Malware payload (ArkeiStealer)", "value": "864ef1321215c0dad7c8677e3c18942b111468c63358475baa71fb1679c25096", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621783834, "uuid": "31bdc863-df2b-45be-9f15-64909dca162a", "comment": "Malware payload (ArkeiStealer)", "value": "daa0566a8a97c19857c9b34b2686d3a32b8b0c6c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621783834, "uuid": "96838458-ace4-484b-ae19-06bb44c07b18", "comment": "Malware payload (ArkeiStealer)", "value": "c8b43251c649c2228f135ccb25999a71c8d6d9592d15bcf191206ee2391fc3b2cfa127fe0296bbab6b52c2b935effb3c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621783834, "uuid": "b430ec57-6f82-40e1-98f6-8cc67e3c78ce", "value": "D276336A214E4035D4A316784C5BD1A7F936AB94673819CF9FCE2B6D4CB23895E383C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621783834, "uuid": "e9bc6641-6e57-4919-9be1-0ad2d3f239ab", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621783834, "uuid": "a40772de-2032-4ff1-8f58-ee7f4fc0885d", "value": "196608:itXIm/Cm3k+a+o43aZnzDAPBZsX17nygvp8/aX:oD/CmTo43IDWiXlyaph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621783834, "uuid": "4dc869d2-70b6-4cfb-af36-b956ba7a850f", "value": 7594056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621783834, "uuid": "3ceec1a2-2e2c-4efe-84be-70a1c29480a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621783834, "uuid": "88c59cda-cbbf-49d5-bfbd-f3c270955f07", "value": "d272ba327929238ad200e364eef10b92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80111cc6-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760505, "uuid": "f365fdbf-02e3-44c4-bb03-edecfb95cb28", "comment": "Malware payload (Dridex)", "value": "472b622c2c6eca67e4900ccb7da50970", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760505, "uuid": "e727e099-7c42-43e5-ad0d-c1580715b9b2", "comment": "Malware payload (Dridex)", "value": "8665934f3aa398e084d81c8837758f55365fc258bc68b192a5bf6b359756b8a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760505, "uuid": "3ff80143-a218-4522-b63e-069bd199f2be", "comment": "Malware payload (Dridex)", "value": "d37411cf64004572b5ac3a3e89f6399b6fb60875", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760505, "uuid": "0eb744c4-6486-4459-a0d3-6bf7d6fe86a8", "comment": "Malware payload (Dridex)", "value": "dc2ceb74fd955118c69ec629ee3459d284f6699b2f9108919dd7a569c64ebdd845f67795734b79d82ce86d7d83121a76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760505, "uuid": "fa2aabf9-84bf-4c59-8be8-29b1a4b80c57", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760505, "uuid": "47d3ad61-bc00-4921-9403-ed180d55acd4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760505, "uuid": "3aece7e6-0271-4675-be43-0f276ff3ff7f", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760505, "uuid": "5ac5a7b4-93ee-4e7f-a14d-574eb1b81b28", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760505, "uuid": "e27f065f-1201-405d-9d54-a2a5ba629313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760505, "uuid": "5d8ea003-cb62-4667-970b-8e9fd5fc3f46", "value": "472b622c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59066471-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621751850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751850, "uuid": "1ef98d88-2130-4956-a704-c68863b44c4a", "comment": "Malware payload (Gozi)", "value": "f042b85a514165c73ba938bc4e96bde2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751850, "uuid": "7caacfae-74a0-4ca1-b8fe-f715974fb2d5", "comment": "Malware payload (Gozi)", "value": "86c9ed4ba9d0cb2127c38667dc7f4ec2a071649fa2f205dbc69a3ba855ec4a1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751850, "uuid": "542e852c-cf73-46ce-a2fe-9be08f04de35", "comment": "Malware payload (Gozi)", "value": "76b6917c0151321e12f31ca16c61145a0b91252e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751850, "uuid": "62e2b565-cdb6-4b77-afff-6b406982350d", "comment": "Malware payload (Gozi)", "value": "2f69e7ded966b2073c0d42b210785f4f551f3611e6b37a666069d4893527baecc6da8e3d3245975137080b053b357af2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751850, "uuid": "f244f5c1-42d4-4a9f-b7d5-6c3b3fec67cd", "value": "D215C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751850, "uuid": "878d77b6-22bc-4c5b-947c-94e03ce18bb1", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751850, "uuid": "d6aff5ed-f6df-4cce-988d-f4f4fa46c093", "value": "24576:HQfpzjXPgfW8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgSJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751850, "uuid": "f2fe3dcd-49d3-40e9-897d-ec5415f3049c", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751850, "uuid": "d28bb904-262c-428f-bc39-146807c5f762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751850, "uuid": "a1bc85a4-1434-410c-b789-f82617d63ccb", "value": "f042b85a514165c73ba938bc4e96bde2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0a4b72-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621749815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749815, "uuid": "69727c25-c70b-42fe-9456-cea67b1c7843", "comment": "Malware payload", "value": "c62049364d4e856b0117d7eec14b456c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749815, "uuid": "6a717562-383a-41d8-a6cd-3b3baefaff44", "comment": "Malware payload", "value": "8908a2f4262f1adfee662836128ca646e910e69de933ce94d650526c728e2d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749815, "uuid": "23d442c5-6644-4d5a-a9a9-709db2dd58e0", "comment": "Malware payload", "value": "25bd6fc4b43f3a2371544768f4e03b67cac12dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749815, "uuid": "dca3735c-e94b-47d2-92e5-05761ab4dd70", "comment": "Malware payload", "value": "bbc96c46f29e26e531ca90ca11ba67c10dae9cab6dd3d76554f520e7ecca6da4736b297abf385180fa5844ee7b93f903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749815, "uuid": "7dc5b729-07f3-447d-b7c5-3c0042943808", "value": "5F84E1487B50B1AFC85B89728AA41C54E614B937870BE393A84716BCAD4F7A7CF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749815, "uuid": "582923e2-7fc8-4e9d-99ff-f4a4f92fb309", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749815, "uuid": "2bcea3ce-b867-41f7-86be-6da52bc4f1d9", "value": "12288:5IjCuX0/YWk/KIFVqhBfUxZ2oZPqktMGQ6d:q3YpeFVuZUxZD/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749815, "uuid": "68aba472-2d6b-432b-92cd-243467228b2f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749815, "uuid": "ab872220-fba8-456a-b66a-03c3bfb26dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749815, "uuid": "903036dc-0dc3-49a8-a20b-caa34c6d6728", "value": "ITEM AMDPI 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1de1eb-bbb9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621769142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769142, "uuid": "1b2be7c3-848a-4cce-9ad4-26057cd74de4", "comment": "Malware payload (CryptBot)", "value": "eed09e3664d5b414dccb7180481135d4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769142, "uuid": "f5e54356-07ae-4660-a281-967c388df631", "comment": "Malware payload (CryptBot)", "value": "890cfa4c1baa1061d5f753c652262d07b81cf890b87cfcd15ad1c20eb1e6a28e", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769142, "uuid": "934c4f53-6c2f-49ad-8198-4bbd5c57cf7d", "comment": "Malware payload (CryptBot)", "value": "2858997eb66153116745d8e47bb36246aee5ae07", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769142, "uuid": "d545574a-3382-4c40-8288-5ee9ece9e30c", "comment": "Malware payload (CryptBot)", "value": "1938b39bc774c33d466999b4447e9b54e33acbc8416843e830016d8fc4e2087226393f7431e8fff863ba63ccea1033fa", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769142, "uuid": "e2a1b1e4-4985-49a4-b684-ab0c2c342398", "value": "E1F4E03066A0C035E4BF12B04ABA92B8A73B7DA16B3440FF12D536D955F4AE4AC3175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769142, "uuid": "4b14c0d1-2f8d-4cbf-998f-2fc5fb87d40b", "value": "b37d3fab91f8c78b5fe4ea0b668f6280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769142, "uuid": "4402aed1-390e-4427-a5b1-74c264d3cbe2", "value": "12288:yCyQ6X/Vv9IqBAP5FxI0JCHNRFlWYerB24VGPzkcaWjbUN/+c83Nz3Y8yXsL:hyRXIq65FxI0IHNRdQ8oOz1UdANM8yXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621769142, "uuid": "d64fefa8-1569-4e42-96a2-4ae7b20c7451", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621769142, "uuid": "d227852f-eb05-4d03-bcd1-3b2cf4c93a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769142, "uuid": "2eecc5a3-2e50-4ee6-880b-333c07ee9859", "value": "eed09e3664d5b414dccb7180481135d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341bb085-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756942, "uuid": "a14ac1a4-4c88-41f1-bdb1-1a7a7a976faa", "comment": "Malware payload (Dridex)", "value": "04add211ba0667cef76de068f6880d3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756942, "uuid": "9ce6f8e7-672f-4f08-a1e4-efc5fa29a75f", "comment": "Malware payload (Dridex)", "value": "8a003dd866ad0e1a5799130dc8bf917de9f17fe6417f3de22c5673ee0cc72ccc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756942, "uuid": "0571b7be-bc10-4e49-8606-420669362791", "comment": "Malware payload (Dridex)", "value": "607fc5b417718f5be0cbf6e36c08533b965f654c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756942, "uuid": "72a8894c-cb55-4ea4-a1db-463c7ec8bd39", "comment": "Malware payload (Dridex)", "value": "c24a1abbf3c7f00f334bee536c2634e0c4dde7486c3e9e3b9fae4cf6da7c75899ff1b928e59e0daea3a5b97c2044a817", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756942, "uuid": "b542835d-6b8a-4c40-a099-d70093299a16", "value": "CBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756942, "uuid": "eb34af9d-de13-4317-a1c0-570b7a753454", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756942, "uuid": "3b21aaa5-523c-4aae-bc95-c323e2b3be36", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756942, "uuid": "8fae8b8d-8cbf-4bd4-b17d-c56703b09917", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756942, "uuid": "39648041-5110-4b8e-a2cf-3064dc964760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756942, "uuid": "4a49809a-7f0e-4917-ab3a-851435affd7d", "value": "04add211_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc597e7-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771319, "uuid": "d0902003-c9ab-47ec-93a2-f7c5cd8fe20e", "comment": "Malware payload (Dridex)", "value": "dec215db9425bb92327784dfbe05a672", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771319, "uuid": "0378d297-f091-4019-b0e5-d6406ede59cc", "comment": "Malware payload (Dridex)", "value": "8b8e974b6f36c02fa0916b3a78970d43b20dccb4a617280428c985d566d2815a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771319, "uuid": "bec51175-e10a-476c-9fcd-091399a27c17", "comment": "Malware payload (Dridex)", "value": "4362a694272390c6ef62109c231d0ce2e1fbaca7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771319, "uuid": "51c947d3-b71b-41ac-bc61-008f74592dc0", "comment": "Malware payload (Dridex)", "value": "78abb6b3d74f3ae40cfcf9ec8baafb7d74f1193b797d17ab5cf9de9b5eb0ab1540772822fdc458234507d1db14e1d068", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771319, "uuid": "28eac85f-cec3-422b-8c06-c143d4ce370e", "value": "45F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771319, "uuid": "a9462318-2510-4bd3-b42b-c5874cc9b904", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771319, "uuid": "40835a2b-c172-46c6-bcdb-d2cfa8a97709", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771319, "uuid": "bb2aaa82-3b48-4584-9f4a-3be0726e292e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771319, "uuid": "b27e7dd5-e904-4f0d-87fc-df5528b0a2e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771319, "uuid": "3b610c78-b082-4c11-9315-36991fb1a1ab", "value": "dec215db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c86e4fa-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767693, "uuid": "8dbebb89-ec5f-416e-b88a-7096ee7f1ba9", "comment": "Malware payload (Dridex)", "value": "bf2cd8b5d5b508cdc79221fad528895e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767693, "uuid": "330da17f-55f8-456f-b846-a3e9885cdc12", "comment": "Malware payload (Dridex)", "value": "8ba493deccb81b7552e27119c1418f7fa8dd7af7c83b5e83541f1b677ffbe564", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767693, "uuid": "71df6eed-8588-4d5f-9502-2f3c6dca4429", "comment": "Malware payload (Dridex)", "value": "7729e93b81e72d4b1488cb510709beefde7987ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767693, "uuid": "57caffa8-90b4-43df-9d95-d73ec876ed0c", "comment": "Malware payload (Dridex)", "value": "0bf9aeb88c8ce676fa19462a43bd306baab5d71fcd4b70658bdeb226c087316d2de828117b1663d61d9a06c2fb92ce9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767693, "uuid": "982e95a3-cd7e-452b-b701-724392b0bc77", "value": "DDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767693, "uuid": "488e0a2d-ef26-400a-8743-3efeaaec3b0f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767693, "uuid": "3fc3b7aa-380a-479b-b051-2f4489ab8a19", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767693, "uuid": "5a37663c-562d-4367-a250-547a9c6b23a4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767693, "uuid": "dc928e98-994e-4bb0-ba11-f17039c84fe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767693, "uuid": "85bb7591-ddcb-4a91-a727-ab7a65417ac6", "value": "bf2cd8b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba777eb-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753384, "uuid": "a5170cde-2009-40d6-9567-4d10af06fc82", "comment": "Malware payload (Dridex)", "value": "d4cc5ea802a100fe9433be1f9397ede5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753384, "uuid": "cb921bf6-c6ef-43bb-a9f4-42a71fcb54de", "comment": "Malware payload (Dridex)", "value": "8be4a905754fdd426d6dc29aadf24fdbd491d1334755399a8ae9b59affbe2d52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753384, "uuid": "3488d3ba-2dca-427a-8022-31207f478804", "comment": "Malware payload (Dridex)", "value": "7596ef20569d8edf6aeeb0265543be6e7db99aa8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753384, "uuid": "d79f9041-8722-431b-9548-3793b178bc58", "comment": "Malware payload (Dridex)", "value": "b29af2478fb09b9048f0f20660b994426373077572eb8cb30d566ef76bc4bdf0fb644fc63e0b46f344cc478580ec9a02", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753384, "uuid": "63a10ff2-6c7f-4f31-9e11-734a55b7b51a", "value": "24F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753384, "uuid": "95f61d7f-fe0e-4b48-9f56-21295894d882", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753384, "uuid": "6a2267e2-f08f-45dc-8055-5ba1e62baec9", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753384, "uuid": "925734c8-498b-4415-a8b0-0c1e44a03730", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753384, "uuid": "92ddc060-c69d-458e-8f6a-a10a08ad2526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753384, "uuid": "58de2a57-9a46-4430-9877-2f43dd8c309b", "value": "d4cc5ea8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb59f80-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778483, "uuid": "6c2faa79-0650-4184-a1c6-120987533e7c", "comment": "Malware payload (Dridex)", "value": "03f69bc14dfa8edbd164fa7407e5b4af", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778483, "uuid": "17f1c4dd-988a-476a-9cfc-99074c40286c", "comment": "Malware payload (Dridex)", "value": "8d08b7d89ec06c3fd7635408ae24de3a8997d532b1c3545a08967386a7c641cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778483, "uuid": "1cf6a25e-8a71-4224-9ede-8dec33f13455", "comment": "Malware payload (Dridex)", "value": "91a77128298b73a314f2c201a472e31aa4c98d8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778483, "uuid": "15ae2cd2-115b-4633-b662-b94e6a0c9d7e", "comment": "Malware payload (Dridex)", "value": "b417e9eccb0d850ce558ef49c059aaa8c942eaa80c50e8325da9accca8875dd7a6e20cd2b9d839f8592e8462cf6e0b1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778483, "uuid": "765168e8-d520-46c2-978a-6ce91f79f4b9", "value": "B6F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778483, "uuid": "ab22cd9e-26d8-45fe-aa03-6e8c58da2874", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778483, "uuid": "f6dda813-ced3-4bc4-95ac-fe273e64d7e8", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778483, "uuid": "ef5455df-c2f2-4a9d-b137-f1f907ecba36", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778483, "uuid": "96f1bebc-c9c4-46b5-acfc-d7b1df21a8c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778483, "uuid": "d687b4c6-9766-4d95-be0e-c25bdc833b55", "value": "03f69bc1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e905837-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756906, "uuid": "d6cce0f9-ac2c-4a77-94f0-424bf7815e24", "comment": "Malware payload (Dridex)", "value": "c935fad6cffd1c4a3042ff2b46feb165", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756906, "uuid": "a7c09db2-c703-42ef-8b11-b101ad9370a7", "comment": "Malware payload (Dridex)", "value": "8d1702675789fbc6144089c8e9765dd7797c1b4c206f5bc35d7d174fca92a31d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756906, "uuid": "42800bfc-ac1b-4809-8208-df8cfa021b62", "comment": "Malware payload (Dridex)", "value": "77730a11f609f68b02af5c23e1f8878fce4a2df7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756906, "uuid": "e57f217f-c1d4-498d-bedb-14a4debd611e", "comment": "Malware payload (Dridex)", "value": "a48d4f2e75e7f1e22723e34a81fc7cae946f0eeadbc42ccd91cc7310f60661ba364cb7d964b04e91ca1bbeb54ada8a94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756906, "uuid": "783d8176-d5f4-4221-b005-17b4206ca6db", "value": "F8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756906, "uuid": "71384f64-fc70-4944-a574-8f5d752fb6fc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756906, "uuid": "24222d3f-fd07-47ed-8d8f-c434f9ab22bc", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756906, "uuid": "1bc0d095-8e75-4256-8427-c447f1b02d68", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756906, "uuid": "11288c2c-59c6-44a9-bd6e-841dedcbd71b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756906, "uuid": "01381b5d-e5af-404a-96b5-84d63aebaa97", "value": "c935fad6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208514a9-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774948, "uuid": "6e305aaa-cf8d-44e2-9be4-95b8e8980dad", "comment": "Malware payload (Dridex)", "value": "3dc2133129f502cd56adab33db8bd9f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774948, "uuid": "9688110a-90f6-41d4-97e2-7d742b002d46", "comment": "Malware payload (Dridex)", "value": "8d377d19c4ede4df182a139c538d94be063ae829a8f45fce82a44c7a3bff944d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774948, "uuid": "3566826c-d035-40f1-8182-a6d9ad8a1e93", "comment": "Malware payload (Dridex)", "value": "34ffc7990ab14870fd8147986c231fa8b577f09e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774948, "uuid": "80d079b2-52d9-41d1-9a4c-25c228ef069f", "comment": "Malware payload (Dridex)", "value": "5adbe2911ad3a14689a9b34dc8987100c3c5520c94500504a7170d2e8b5868f30f2f674aecbaf61cd53e4fe480e18332", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774948, "uuid": "9f1d3c20-d1ef-4fec-a403-4194fdeb42e9", "value": "F2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774948, "uuid": "ccf7c0e3-650a-4cb2-aa14-722f2c039c40", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774948, "uuid": "9a98c4b3-6fb9-4902-8085-8cb0da687daf", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774948, "uuid": "e7a22fdd-dfc5-4ea4-88dc-0b05a4229648", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774948, "uuid": "d9c94904-4dd9-4ef0-81ac-59ad3afd6e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774948, "uuid": "caaeab2e-6a23-4320-a202-36de02e8e537", "value": "3dc21331_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3164bf6f-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774976, "uuid": "924e9685-b215-446a-9988-4217a863e174", "comment": "Malware payload (Dridex)", "value": "88f4ba6ab4e582f5e80fa684fe2e5d12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774976, "uuid": "d682a5ba-58da-49cb-b004-cc358f320c09", "comment": "Malware payload (Dridex)", "value": "8d5850b01e226b4e997abe6ba4e1cd8c16557331efe1b521c1ca8c4a8daee425", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774976, "uuid": "87307476-e44d-4d8d-8e52-65922cf37c4e", "comment": "Malware payload (Dridex)", "value": "0d6bc58cc3b161823fa839fd174885701758dc45", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774976, "uuid": "5792cd5d-cabd-4117-abcb-68c1c257a615", "comment": "Malware payload (Dridex)", "value": "42f7306534db8b3cec7cf21ef47c83642d0b9b5808c4830b47d2e701ad242105123ee7cf8a4d5c4a31f0aca4b1f996a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774976, "uuid": "272b940e-1136-4d09-9c77-a9c1c94c7feb", "value": "C2F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774976, "uuid": "2e5dca33-2cbb-4b15-8c48-86aba936475e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774976, "uuid": "f5ef63c3-6974-4a0b-9385-624e87e7a9cc", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774976, "uuid": "1f8f841e-6601-4905-9c87-5b689f664fe5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774976, "uuid": "09cbeb37-40fe-4b8a-b1d5-d91ab32817b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774976, "uuid": "6f85c04b-619e-46a2-9bce-2ab9fe23ac77", "value": "88f4ba6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdc85e0-bb7f-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621744265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621744265, "uuid": "f7076458-4ae3-4ea4-84b3-be6c11d4bccf", "comment": "Malware payload (njrat)", "value": "a8d516c80393546e5b7ef4e1a43297f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621744265, "uuid": "0a8b9bc1-3734-4976-9cd1-a70383b4ce10", "comment": "Malware payload (njrat)", "value": "8d80f924088856760134a8dbb01aa535bbfb5e2db1b620683673ccfa209eebb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621744265, "uuid": "0021438d-a919-48bd-a697-2738d2726203", "comment": "Malware payload (njrat)", "value": "c4bcf714834c38e12fd46c0fda4f459a490f603e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621744265, "uuid": "cb088465-70a7-447c-8941-d0f60c3998af", "comment": "Malware payload (njrat)", "value": "b0a9c09fcb9fc67a541c180ae72b7683da4e8c7293b949bbbb89604da5f834c7a5295c7577d9e013da1d8d1d6e2e195e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621744265, "uuid": "c5aba83d-0edb-4473-b8e4-3ba0be986532", "value": "3A4492827B817B91E982FD71AB5248072667DCF8A3C60B7340D8D3502CE0AE5FE5DB56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621744265, "uuid": "9ee75666-d503-4b1e-89a0-77056f21adc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621744265, "uuid": "324a31cb-e219-4700-bebf-fcff8e561f97", "value": "6144:v3LH7S6nx24go3sw+Aq/bDe84wSQi0aDLZm2C7Y:vz7Sh4X3HVq/bDL4wSFnDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621744265, "uuid": "ad2de195-9d11-4ba9-bc90-669e758408f8", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621744265, "uuid": "d7904591-9945-4eed-998b-be9ed4e77799", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621744265, "uuid": "003bc27d-34e3-4878-aad7-6e6f6e8d4506", "value": "a8d516c80393546e5b7ef4e1a43297f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8019b7f-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764116, "uuid": "599a20c7-61aa-4090-89b9-7681249ded79", "comment": "Malware payload (Dridex)", "value": "0c2f0ae358d6d65dfbaed001b1749c69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764116, "uuid": "a9bdf427-ed93-40ad-9d68-b856e5288556", "comment": "Malware payload (Dridex)", "value": "8e421154a491105c26fb09cbc8dd5b7d338e33a6da65cc498ceff702b95f7ae8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764116, "uuid": "4f4e61d3-b710-4072-a2c6-e38d8378e1a4", "comment": "Malware payload (Dridex)", "value": "c0b108388801d112a425d76189d566052d23ec3b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764116, "uuid": "94352176-e970-4799-a360-183621caad6a", "comment": "Malware payload (Dridex)", "value": "300050f05ae1286e4abd7e6dcfac71c8325e735809cf251f942f353a80f27233530538bf42d63f264ec8b1ba5873d41a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764116, "uuid": "16169acb-80a4-4c9a-8cb7-31d2f9bb8cb2", "value": "30F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764116, "uuid": "187787e3-51a2-45ab-9a87-b5b45fd02751", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764116, "uuid": "9d713830-28b4-4a37-b4a6-6955f171c5c8", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764116, "uuid": "3312e3e0-d270-4f95-b66f-b9c3ab6f3f64", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764116, "uuid": "ac779087-b0ed-497e-90f6-2f2880bdcccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764116, "uuid": "9dd0dffc-40b6-495a-abbf-77f3db04fc87", "value": "0c2f0ae3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3697fec-bbb8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621768859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768859, "uuid": "6eccb037-53af-4bbb-9958-b02e57a94f17", "comment": "Malware payload (RedLineStealer)", "value": "b644f30dacdd7066907fd2807db5fb0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768859, "uuid": "77efca31-d81c-4464-9ecd-fbbc300a261a", "comment": "Malware payload (RedLineStealer)", "value": "8e4f30afa8d0ce48c46a39e2754d8f7adad90ae8ccaf0132b354be76076b20cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768859, "uuid": "2656973a-8d21-4df2-b341-599a055d76ee", "comment": "Malware payload (RedLineStealer)", "value": "fdf07cd26db17172165cd928437dcc44921c038e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768859, "uuid": "f87c3ba4-3156-4a29-bb89-83b32b871398", "comment": "Malware payload (RedLineStealer)", "value": "74f1d1cfe7a91bcd650239415415c4586727ca707acb66bfdf0b45fe5b86689c8f946b4b1813ef4b9018d09bf0869a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768859, "uuid": "0060fe50-b4d1-4f6b-8856-13ad98eac0cc", "value": "00136C4972EC03AEF4A752FF64F2E263C5BCDD3A5902965A147A63C544633C20B4235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768859, "uuid": "ce43676d-a2a2-4335-8b4d-44a444ace846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768859, "uuid": "59ab627c-6767-42e2-be04-8d894b9252a5", "value": "768:sbr1NQ03h7b3bNN8cT0000000000000Kr000000000000U00000000000000000k:sb5NQ03h7FNn0000000000000Kr00008", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621768859, "uuid": "4a868695-17e3-481f-ba72-daba063154f0", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621768859, "uuid": "d3052dab-dc59-4e11-a794-d3a6b12907b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768859, "uuid": "ca56e33c-45b2-47bd-be1f-334944bae726", "value": "B644F30DACDD7066907FD2807DB5FB0D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd724641-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735295, "uuid": "15306737-21a8-4fe0-8ecc-3984b7691dcb", "comment": "Malware payload (Dridex)", "value": "0261df907dd1386ce824048c19192e87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735295, "uuid": "8873876a-72fb-4012-9eb6-94fd1b9e3153", "comment": "Malware payload (Dridex)", "value": "8f83fec5e5b57dfa25e4b03addded95d34166c3dd7a0f926e8af56efcb16ffd7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735295, "uuid": "ebbf880d-cab9-498f-b959-9553821fdc3a", "comment": "Malware payload (Dridex)", "value": "0d416c0f6c7eeb9a5a840c26da75ff78aebab876", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735295, "uuid": "15fb7ed2-e610-46d9-af7a-f43b520be390", "comment": "Malware payload (Dridex)", "value": "eef29280939bca0c35b6e488d9ba26881b7b0cecb1ba86374ea27f168c84f0b79ff47a2d16da75075b3735fec55a46ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735295, "uuid": "68c21253-c377-44ab-9d70-b09b559fd710", "value": "FCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735295, "uuid": "7e7279d8-1c1a-4a60-8117-980d2ea8c701", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735295, "uuid": "96ae808c-60c1-4f02-b459-3af19e38846d", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735295, "uuid": "547f23b6-a38c-4b84-b220-7e30f5750058", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735295, "uuid": "4de79eb5-f51d-4355-8efa-debafed197d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735295, "uuid": "91c174f3-c3b0-4b40-825f-25bfac9d63de", "value": "0261df90_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60fba0e-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742530, "uuid": "6f88f929-542c-42ad-b892-a04afbf6e7fd", "comment": "Malware payload (Dridex)", "value": "733c225452d4fb4f38c51a81564e1fbe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742530, "uuid": "0392a5b9-a9b1-4037-8fb4-18548ab977c4", "comment": "Malware payload (Dridex)", "value": "8f84e96dea8bf9a2511f2864bee507a7f8df694a9d81ce8a22357f09b4657676", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742530, "uuid": "443970c2-dfff-4bfd-9ff4-1d2acc6eabe8", "comment": "Malware payload (Dridex)", "value": "00a230d2541519e7fdc3016a5adb222b093a997c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742530, "uuid": "dabbc39e-9952-43df-a005-40f27865163c", "comment": "Malware payload (Dridex)", "value": "210982192bfc040032b1b312d8baa6363d29eb2d13ff9097d943bddb039092c21c5ad667ccb03a1d64fad0404b77d4bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742530, "uuid": "2529263a-3e19-40ec-a114-1c5e2acae62d", "value": "92F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742530, "uuid": "39830094-1529-4ebf-954d-e3b2bbb5dea7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742530, "uuid": "3f23fd89-440b-471e-a846-710f87bec019", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742530, "uuid": "1262eafb-14e6-445d-8c6a-270ae0ee6bb2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742530, "uuid": "296fda8f-9090-4d0e-a7dd-e68bd7eadd96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742530, "uuid": "a2183cdd-542b-40fb-8e27-a2bbfdacce91", "value": "733c2254_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbccd534-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764041, "uuid": "8b6ec3e1-138f-4e1f-b785-a8496145393c", "comment": "Malware payload (Dridex)", "value": "fd6d677060be0ececd16316fc23ca232", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764041, "uuid": "bb62417d-e5d0-43fb-9074-9a87f564d462", "comment": "Malware payload (Dridex)", "value": "8fff4f96328df8651a8a13f155f393ee7b76e22dc3f76ee710d4eb71b57c1a36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764041, "uuid": "3382e8f8-19d6-484a-acd6-50bd7feec874", "comment": "Malware payload (Dridex)", "value": "a38bbe1e0d81a6d89045dc95957381936c423b22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764041, "uuid": "4b0485bd-e141-44db-9629-b7c1976b97e0", "comment": "Malware payload (Dridex)", "value": "c04df03deac585212e5d3274f9e6d2d637d9675ead69869ffcc79932447cd2aa6267008da809cf73da7ea49569376a91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764041, "uuid": "e9b4295a-88bf-4443-878f-ed9b2b326eda", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764041, "uuid": "e4cb0e95-c923-4bcb-b0ed-e187327090f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764041, "uuid": "bda24bfc-4b78-4e36-b99a-73af016a5dcd", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764041, "uuid": "d286eea2-2984-43fc-9588-f651803b22ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764041, "uuid": "e6a904aa-3be0-4925-b8ef-df3d2a56c0ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764041, "uuid": "b95f6d84-df31-4e63-aa88-2b07421225d2", "value": "fd6d6770_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb1d27a-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785684, "uuid": "138678a7-6d72-49ac-a2fa-c25ef41c8b46", "comment": "Malware payload (Dridex)", "value": "190878828db91aa7c0e88026ba42810c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785684, "uuid": "f3138b13-f150-4429-b989-9d37b507d9f8", "comment": "Malware payload (Dridex)", "value": "9004d588e3dd5667936b7c4f783a2ee02765298e08d309971333c98acfdcaa90", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785684, "uuid": "bb9b9612-3024-4d5b-8871-9dc28c36fdf6", "comment": "Malware payload (Dridex)", "value": "3d2c0c4c1b4baa19b6d93800f05dc654df12a3fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785684, "uuid": "05ac34ef-db60-4699-862a-3241af460024", "comment": "Malware payload (Dridex)", "value": "f8f0284db4d44f09c20b615465a7e7bb5d53e468a1a92bbe0f78a5e3336aacde17e85d6efcafcab2cc4ac610654ead73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785684, "uuid": "7f7ee463-ee7c-4d57-a557-9c207bba87ab", "value": "3AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785684, "uuid": "f6465e29-cf69-412e-b904-af8d6416875f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785684, "uuid": "4e7aafb5-6f80-4fb6-a6b4-27ba2310d96d", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785684, "uuid": "1c01b50c-0436-4b4b-a5e0-094975a8b7af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785684, "uuid": "1c4d9eb1-bb9c-4bbc-93e4-8200bbeec5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785684, "uuid": "0036d8c0-e5f4-4695-9773-150d9605378b", "value": "19087882_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048aca90-bbf1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792940, "uuid": "afd8805c-2cde-42b2-8b8b-3ae610ef56b1", "comment": "Malware payload", "value": "31f00993e3062a3a86be1e07dc1a7ab0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792940, "uuid": "b96b0a95-da7a-4f02-a27e-daa8498c2784", "comment": "Malware payload", "value": "904de7e5bb816e53de15d9323031f1c72b96f8f5ddd5db5a3e06131ce27b12ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792940, "uuid": "c60fa670-abe3-407f-aa05-40b723967ed3", "comment": "Malware payload", "value": "b60ef14a2c85ceb769362a5dd6235dd6728a7cb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792940, "uuid": "9e7e2504-e29a-4f1e-8667-f0c001d54c93", "comment": "Malware payload", "value": "cdaa6165f0d670bf8f9a8428f01c4aab65912333c3875500609e44cd177c91421f7ab8f82b650e21d11d87e21de82852", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792940, "uuid": "b3525259-69e6-48b1-bc0d-b1254348cc08", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792940, "uuid": "330d3330-4b9d-4e55-9c81-64dd95c4904c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792940, "uuid": "28e04c49-ad88-4708-a64e-c7e1466d449d", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792940, "uuid": "44b9c5ec-5120-4a90-91ec-e5bc79051926", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792940, "uuid": "e182cc2f-6782-4fec-b3ae-5cdbe1a72951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792940, "uuid": "b630d382-04ff-4cf6-8bb3-32af06232c91", "value": "31f00993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccacf4bd-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764070, "uuid": "c04a03a6-4a25-405e-a45f-9bdef99d8c18", "comment": "Malware payload (Dridex)", "value": "3f3e49a04e8862d9d2b9e5e54eaeaf06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764070, "uuid": "cf454c15-9a1c-4466-bf68-97cc711582b7", "comment": "Malware payload (Dridex)", "value": "909e3a1d64a757298937fc5d9716ae4b24ca5de884f419464dea9493488a7f71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764070, "uuid": "f4b80529-5001-4063-9fa5-8b3eff26b354", "comment": "Malware payload (Dridex)", "value": "df4364811b736b5021581bc0dca46601b5747e56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764070, "uuid": "d5d3085b-ef43-48bb-84ff-9f1624594452", "comment": "Malware payload (Dridex)", "value": "523307810ebb1dae05360099cc615eefd1ce3e9cf98a2ee315f33a766769750be4f267aee1eea27b31825d9fb2245896", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764070, "uuid": "ef12167e-efda-400d-931b-31ec4c202b5b", "value": "AFF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764070, "uuid": "5eb9c4c6-0198-4e13-9335-9b926d919e3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764070, "uuid": "61014d04-cfef-4a92-b69e-8d8270df7b49", "value": "3072:2IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764070, "uuid": "c1afb7b8-9b59-49b7-8a0e-859e6e17052d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764070, "uuid": "5c418095-5372-4e69-888f-aaa4ed50038e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764070, "uuid": "73c22c5e-b4c5-4aca-973e-ea895a175cd9", "value": "3f3e49a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e8374c-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753272, "uuid": "013ab868-dfdc-4dd4-9b34-b03131e7524b", "comment": "Malware payload (Dridex)", "value": "17383f1c030a5ba0f507989cf520ff67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753272, "uuid": "9d323f2b-a084-47bd-a4d6-bef7067d867f", "comment": "Malware payload (Dridex)", "value": "9132199e41a65bbb6fd5c59453c961a872451adef511707ba9a7baabbfda9b61", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753272, "uuid": "143ac062-3a8a-45d1-8cf2-75b9296558fe", "comment": "Malware payload (Dridex)", "value": "a7a65ec968a26a4eee3604e732a4433486be7867", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753272, "uuid": "9b0b6e8d-64c3-46e3-80a5-7cfc811f82b8", "comment": "Malware payload (Dridex)", "value": "3a85c9825e320d2855fe82cec434fc0db7ab62b0d80f3a54bbecd915b8366924a23f2028d8537b03b30aa46eafd89e5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753272, "uuid": "a7534db3-9580-4888-9ace-d9ed79244fbe", "value": "7D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753272, "uuid": "88f004d9-cb8f-4724-8dc6-54120cedd971", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753272, "uuid": "46ce5e0f-1158-4374-9c62-da071e0e1b59", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753272, "uuid": "e33aa0c2-ee2c-4ea9-becc-846144f34b8b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753272, "uuid": "a906aa81-34a3-449c-9767-47f12c515c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753272, "uuid": "6f44e1bb-9743-4f6e-8d38-d9bd76881aac", "value": "17383f1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0df931e-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810865, "uuid": "e373fb2e-f3b2-4beb-a3f3-108592950762", "comment": "Malware payload", "value": "962b3e8fa6ce85baf0dd963c3e453136", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810865, "uuid": "a3c391ca-1947-4f49-8051-25e5738624f3", "comment": "Malware payload", "value": "91624584ac78dec7ba257afca7b13cdec82c5154810c2e9e6de3cf9fd6d6f800", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810865, "uuid": "4529c121-b597-48e8-9df0-2b8c4d8aa6a3", "comment": "Malware payload", "value": "e3521a23f11609c7db242cc122fb80d4bb669781", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810865, "uuid": "f1ec0cd4-b6b5-4dc2-b86a-469d1da20432", "comment": "Malware payload", "value": "c9a3072d7eec399fc6bb908ac0e1a752aacb3d680454a15483165d6b5fee9738a5382887c2f513462eaae1a82dc24497", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810865, "uuid": "65782aee-8ac3-451e-831e-69469f7f8280", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810865, "uuid": "121744c5-690d-42ba-a524-948fe447137b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810865, "uuid": "f65b234b-7148-496e-803f-b965dffafb3b", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810865, "uuid": "37d803d5-d14a-48a9-920d-551da6972e07", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810865, "uuid": "87e5ed52-af63-4121-a818-fd06f4c058ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810865, "uuid": "4aba7f1e-4f11-4124-b029-2eb79ca7a0d1", "value": "962b3e8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07604e17-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756867, "uuid": "3255b417-a05f-47f3-b942-a69882019580", "comment": "Malware payload (Dridex)", "value": "2cbdc45b6a82eb5a9e106ddfe412448f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756867, "uuid": "409ce3ea-90fd-4b1f-b724-04b0f4e6b87b", "comment": "Malware payload (Dridex)", "value": "916c1b06a37eae894a76bf80fc55af045d2d95bd82b0231ef47676d56ae42a15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756867, "uuid": "cf8cda5e-b601-450c-bff3-fb802d5255bf", "comment": "Malware payload (Dridex)", "value": "8c8dea55dfe9ee0ddf866de7641302aa7bca5c5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756867, "uuid": "9bb1a094-1570-4a84-b00e-432eefb146e0", "comment": "Malware payload (Dridex)", "value": "7a38d05a8c53d3bffb816964e937184c1af23269eefed4b6463789cb2577671c56a2c045798de132f7c3a9f43845cb3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756867, "uuid": "691889cd-7c6c-4c48-a681-57cc00092c21", "value": "8A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756867, "uuid": "c95c44bc-594c-4142-8e69-ad795dbb434f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756867, "uuid": "6c8f9ec7-8001-4b9f-a279-2b807f6a4621", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756867, "uuid": "8468ba16-17f2-41a8-b8cf-7034e0bd5b15", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756867, "uuid": "e33c99ae-e5bc-4539-a172-0a4702a4ff23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756867, "uuid": "355aa061-5f3e-4bac-beba-c3287a9ec562", "value": "2cbdc45b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891136c1-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807335, "uuid": "9cdb5305-23ad-408a-830b-531021e94d9b", "comment": "Malware payload", "value": "0d58273d9f2808e9e49b3d20ac2e950a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807335, "uuid": "51875499-1042-477c-a73f-3593e8f42494", "comment": "Malware payload", "value": "9176f50111b1f12e7d095aea4046aceda705b6b0a208b0abb1a60422c12a9a39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807335, "uuid": "bfb633d3-b217-4e0a-bcef-5ef4f60ff282", "comment": "Malware payload", "value": "d6102be4e0e200b2d51543d2d75ea26656c1d350", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807335, "uuid": "12028f1c-8992-4da2-bb83-c20e4cfec3c5", "comment": "Malware payload", "value": "26fe78086dc3101f5cd52ea4c9c7e9be2f9c7a1ac6a27bcf7fbb78267039dfabd30fbde2548d11c2f5cc274f865dd7cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807335, "uuid": "2ddcf5bc-096c-4a70-9589-fddc94c403d2", "value": "9F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807335, "uuid": "bd5cbfc9-6e39-49e8-85f0-c9db6a0154c9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807335, "uuid": "d6169ad6-96de-4586-a0d2-31df83a5a989", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807335, "uuid": "5dcb6015-54d0-41fd-8a3c-a3b5ac51e3d1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807335, "uuid": "35ab8409-7333-4f19-990b-3cebc19ad985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807335, "uuid": "d5b33dd4-951a-4597-8268-6a14321b0dd7", "value": "0d58273d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ee1d6f-bbee-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621791835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621791835, "uuid": "2cbebda1-fdad-4419-9f62-89182267d517", "comment": "Malware payload", "value": "7a85a5a4542ab10ebf165aa13b329a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621791835, "uuid": "a0a58aba-0da2-4c9f-8cc8-ffd104a44ee1", "comment": "Malware payload", "value": "919a4877c1435674718c7ffd0c8c5ff7f5876be471fd8419875fb5dc1bdf3dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621791835, "uuid": "b8ab5cb8-fead-42f0-add7-8d376ac6a015", "comment": "Malware payload", "value": "24fe6bd49ca4c8ce497534a32f3ec9a998960e87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621791835, "uuid": "eef92b61-e94b-41ab-9bd2-fae2499cc2c2", "comment": "Malware payload", "value": "c0c468d0460251e3a5e8a12b81bbbf3cfbc6a5370a9d9cbccb97a118010c9837e3d99a8b49141cc75fdd7d717d6a1aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621791835, "uuid": "3d7af8bc-ca53-4d62-8375-16c74c71a0a1", "value": "892633206463C034F0BF12F08876416966267FA09B2784FBE2C576EEA93A5F56D3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621791835, "uuid": "5c813d41-44ec-42b7-9ad5-822013de1bd4", "value": "48d2401545bc23ddf9125d8d09f6c7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621791835, "uuid": "df804426-2257-415e-85ae-c77ebf21b283", "value": "98304:h1VWkzfEVIdBRj+Aq2gcyZ/D9jvTpNnk77c6ALzomKgTRlX:1MVIHMA5gVZ/hC3AJKWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621791835, "uuid": "78c02830-aa13-4c00-b8f1-d0fe4734760e", "value": 4656128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621791835, "uuid": "bf28aa15-47d3-446c-9568-3dff9fc1863b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621791835, "uuid": "48857ffe-b817-4d5a-92dd-25fb3b2a0890", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e1352a-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1621779329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779329, "uuid": "229ac03d-038d-4bee-bd33-d763f6c5137a", "comment": "Malware payload (TeamBot)", "value": "ad70462c8ff86b9dce4215dd1e6d5087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779329, "uuid": "c4262bc9-93ae-48d7-b4e1-8354a3a64ade", "comment": "Malware payload (TeamBot)", "value": "91ba59c27003543aae7d75591bc24af192510c7c7b8363bc850e84c1e6b71c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779329, "uuid": "9c782812-6caf-407f-9c28-72d0d9e0f6dd", "comment": "Malware payload (TeamBot)", "value": "9bbde2e3086785362f6b52f7e360a57bfe85e70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779329, "uuid": "d4dd430c-387b-4027-b999-f87f1532fc4c", "comment": "Malware payload (TeamBot)", "value": "95c4e59f7e3ddc428f90a7f98e728381ea3971adb969bcf8437ed9700b2de3a3412409905f1b2ff688855f8a17880618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779329, "uuid": "30d6c4ea-6eab-4c4c-b6ae-6e2a9a1f66db", "value": "3005F121A6B0C036E0BF12F049B9D2B9B53A7DA19BA440FF12C53AFA51345E5AD3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779329, "uuid": "ad9514e2-3404-4c32-bf85-0d74f2a693bf", "value": "504bef34255b8691aaec7482375c58bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779329, "uuid": "557bcb81-c09c-4af2-9d35-0bfbad861d17", "value": "12288:91yMk/kcS7MZYyMQMqbI+S0B5GXKRG9ARNFqtkggsUiw/ZBsD+VAt/pXsL:Dyhm7MPdMq0+SG5iORSMivD+V4/pXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779329, "uuid": "158c7ae6-e57c-49d4-b130-e060bb983996", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779329, "uuid": "221d09eb-ad78-4e27-9e75-76e384fb669d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779329, "uuid": "5c81c3c6-58ac-4c75-96c0-83253c507d02", "value": "ad70462c8ff86b9dce4215dd1e6d5087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1058fea7-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774921, "uuid": "c6f0aa29-eca5-4a80-abdc-6bcf666f2969", "comment": "Malware payload (Dridex)", "value": "7a2db7447019ee47241c1931709d9a99", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774921, "uuid": "591cf4f1-8485-4466-949f-aa4a73879c58", "comment": "Malware payload (Dridex)", "value": "91d7d3a4aa9b77896d8fc4b4ba10b14507957ab529d7865fa5359fbeca5129d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774921, "uuid": "f0a71122-2605-4dd1-836a-f5d5ce9102bb", "comment": "Malware payload (Dridex)", "value": "56135f8cc4a13f39a78ea6c72b4e6051aa2950b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774921, "uuid": "48cd3b06-4908-4d75-bf78-821d06d0c0ab", "comment": "Malware payload (Dridex)", "value": "1e1118ecc4155e704f92844c3788abaa380f7189acea5d2a2d29f5196711da1958664fbdd886f24bbcb8dab55d111d32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774921, "uuid": "4b81bef0-10e3-4cff-9312-79c651c1c72c", "value": "EAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774921, "uuid": "9bbc5083-2c35-4018-85ce-836b522f7d24", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774921, "uuid": "25a5138e-f2f2-4254-9d1d-219ec7053197", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774921, "uuid": "4cb091a3-e8bb-473a-8137-06997339e596", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774921, "uuid": "c84f8458-49ae-4cf0-8d85-ff16dbe07c19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774921, "uuid": "c2bab556-2748-42e4-94bf-93fe4be1619b", "value": "7a2db744_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9e96f1-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728044, "uuid": "c473671a-818c-4eb3-816f-969bcad6ed36", "comment": "Malware payload (Dridex)", "value": "e46d53b43b4f8bd1e88348a95d542339", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728044, "uuid": "d0a077cb-e7ec-474d-91c1-be9e7d113102", "comment": "Malware payload (Dridex)", "value": "92a8a8e0fcc686a23b3fd68feb6e47d9bd3c6d6aee3fd8bdf07c74727e91b8a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728044, "uuid": "967fd3e1-0334-4dd3-8648-80452182c0d2", "comment": "Malware payload (Dridex)", "value": "4aa3905d473d975dbf27f000f28d8da9468b5bec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728044, "uuid": "ef893331-6bcc-48cf-9f5b-e908268de28c", "comment": "Malware payload (Dridex)", "value": "3213fed16f15574e97e57cea3b343b44c134948fc4e2fac4902b61997f261d3a6a00de456f0018715f02aadeeaa6a679", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728044, "uuid": "68476662-f3a4-4008-b391-5290e116d49a", "value": "C2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728044, "uuid": "34fcde21-bd41-4326-9146-1d7d39fee3f7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728044, "uuid": "3e71011e-837a-4d1a-a634-373589dcbe1a", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728044, "uuid": "ca950c1b-ed26-46db-b6e0-c46990b8ef8d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728044, "uuid": "d9c8f6ec-66c0-41fb-b7a3-190d88083933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728044, "uuid": "da2f8278-558f-43be-849e-044d2dbe713d", "value": "e46d53b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d6fae6-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735259, "uuid": "e2ab3b2f-6437-4508-ae9e-78f68bca275c", "comment": "Malware payload (Dridex)", "value": "8272ce35b5c66387344f55335634d3f2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735259, "uuid": "2a16939b-0071-4f82-b3f6-388fa37823c4", "comment": "Malware payload (Dridex)", "value": "92f0bfe838dcd2b2939a57921db7aa3c7f4103e557d56d3761ca93bc0ec31006", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735259, "uuid": "1ce61a20-b952-452f-a15d-4cdf00a14423", "comment": "Malware payload (Dridex)", "value": "ce763e3e179e1ad9433b46932ca838a7b5bfd16d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735259, "uuid": "88f968b3-c729-476b-b201-ee02e93ab0e3", "comment": "Malware payload (Dridex)", "value": "08ec05c592f5fa22e6845d95db1124ff09a0105df58c9fe8aed09b63de00def7d7e57acc2a1198ae18f046b1e920a406", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735259, "uuid": "e5c00d64-0e61-41c0-a11e-1c5639900047", "value": "BB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735259, "uuid": "80fe5bde-b46e-4513-9bff-6ffc5c9a3f11", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735259, "uuid": "3898fb82-2905-427f-a909-b7eda7ea6ca1", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735259, "uuid": "0060d715-e74d-47d0-ac13-b49552a6b7bb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735259, "uuid": "7819a92c-55a3-4711-bda2-fa8b4b6cd499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735259, "uuid": "1dfcc080-88bc-4d99-9a2f-fd1c6f98f911", "value": "8272ce35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37beb7c5-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767685, "uuid": "88a22006-a7ba-4c38-b139-46a72c2c9561", "comment": "Malware payload (Dridex)", "value": "50ac02bd4997bb3fdbfece2de468a999", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767685, "uuid": "178a5dd4-4e97-44a6-874f-fff31daa5fe8", "comment": "Malware payload (Dridex)", "value": "930a280f3149e24b5b4a7646b6269e820c1ea204a636dbbe321f2fadf7948b98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767685, "uuid": "526d4cac-341c-4fcc-82e7-46b45548d24e", "comment": "Malware payload (Dridex)", "value": "23a7827ca3be1d89cc37631c455b06121603259b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767685, "uuid": "25711303-adc7-4393-92c5-5e2be6752b0f", "comment": "Malware payload (Dridex)", "value": "991b82c1272c96979b3e44a6355c4499c7b3609dce5ab68842dda1b7fcb94a0ff03af1744e4c9532b08b284363bfdf1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767685, "uuid": "b5aec9a7-6475-44f4-8ebe-7e3dd12fd691", "value": "E4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767685, "uuid": "3ce523f5-e7c6-4632-ba35-f9cfe003c609", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767685, "uuid": "76889edf-225c-4987-a206-c0ca08343d85", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767685, "uuid": "65d859f2-a340-4b77-8433-f413acdb01df", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767685, "uuid": "81f61184-bf0f-4b35-9a40-9503705b1b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767685, "uuid": "fcb68769-0239-4155-9d2a-80caa2e3371d", "value": "50ac02bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0701c955-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621785642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785642, "uuid": "813c241e-f42b-4f0c-a28c-3bd3f896e8cd", "comment": "Malware payload", "value": "312d04663717333663f7f9c91fa35858", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785642, "uuid": "b305d5a6-7bed-4f89-bc8d-fa2c3fae669b", "comment": "Malware payload", "value": "93cd8f3b28c8b495deaa637a7f6c2a638d4b267d87d5f16c3df22ee1f60c9201", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785642, "uuid": "c56920cf-1554-46d7-bdf9-ab1971c0380d", "comment": "Malware payload", "value": "6b341019aaff573ea35871d42ea05d27fb14d649", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785642, "uuid": "4ae96a22-820a-4235-aaf0-5f929ac2f1da", "comment": "Malware payload", "value": "d77075ae1a2b9fde3d52f3aaf6473763a3be87f0948eed26bee0e883d45a6eb22cbd5086a454bb11c9c812d8d200139c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785642, "uuid": "b5562bf9-7377-4245-bff2-4ae90009a404", "value": "C3F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785642, "uuid": "5aa57533-f6c4-47ef-8f65-897be5b7a45e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785642, "uuid": "7148233b-8ba9-482f-9f48-6aef63a7368c", "value": "3072:QIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Jc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785642, "uuid": "4fad6402-4b04-4f33-a5d2-02cde56dfc4e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785642, "uuid": "d945f74f-7445-4d7e-aab6-c65ba1b24df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785642, "uuid": "16da81b5-1378-4fc5-a92a-24973ed936b5", "value": "312d0466_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e7678f-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792908, "uuid": "973ec9e0-8bf9-4fc8-93aa-d2506b238604", "comment": "Malware payload", "value": "cd77883841ffe20cb1cff242afb53697", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792908, "uuid": "96c58905-a45b-4d06-9386-f2f6f867a1c0", "comment": "Malware payload", "value": "93e5431772935cd00ff72c31526ae8f0c9c828769c3217e8e06a8723531d855a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792908, "uuid": "0553b489-0f4e-4ddd-b4e3-70169631e46e", "comment": "Malware payload", "value": "7ebd35b9d36e6c4c03a3238c605e3c7e3b655041", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792908, "uuid": "6446bcad-2c67-4f77-9cee-62d0f2ae413b", "comment": "Malware payload", "value": "6b06fb57d609101a0ee39b28919cc87c2c0a6f9cb9479a172dcf2316479b6c848cd9d6c8bf42155209be8129ae9003c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792908, "uuid": "2ae77fc3-dde8-42c7-aab9-dee165e61485", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792908, "uuid": "b9a13a11-bfbf-4500-9be1-bb5479ffb2c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792908, "uuid": "9b981ae4-f347-42ae-bdd8-4a85fcb0366e", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792908, "uuid": "1023c104-b0f8-4691-8851-b9dcd9abd987", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792908, "uuid": "b21ee749-7e75-4ed8-ad5e-3c3eb5169470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792908, "uuid": "940874d3-f6e7-4d90-a719-88810905c408", "value": "cd778838_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5627057f-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749698, "uuid": "ca8a427b-118c-4ffc-b3b8-17990a0bd2af", "comment": "Malware payload (Dridex)", "value": "f8e6e0065c39e4cd995753d9d2579c2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749698, "uuid": "ad7b8cfe-9909-4a32-b117-e045b76d33d3", "comment": "Malware payload (Dridex)", "value": "9496e30129d87275f3d74248995ee009fabfcfa2259c4de66a8131bad0b70d76", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749698, "uuid": "bc8c5c09-24a0-4811-900d-398b490132a5", "comment": "Malware payload (Dridex)", "value": "93ade653d3ed88835f6af9f2c0f208ffdaf7b538", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749698, "uuid": "71fea83e-ef11-4030-840c-e6fcca6b2815", "comment": "Malware payload (Dridex)", "value": "f7ef0c6dbd2c2e4e696d73ed155002a61ae525d6119a00d9cbbc9f8f5405697126dd733eac10a33a9bcb33166d800e6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749698, "uuid": "b3f5dcfc-9d38-41e3-bfc3-ea7e6a4c3449", "value": "5AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749698, "uuid": "6d2a728c-6533-4446-b452-c431fec4e31c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749698, "uuid": "9776613c-c003-4f48-a74e-7bb0ae1230de", "value": "3072:yA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749698, "uuid": "f2e48740-470f-4175-b772-4f719acba330", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749698, "uuid": "6ec3c1bf-db95-4523-922f-4dbf039d03f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749698, "uuid": "c7577a6f-5ee5-44af-a4b1-eb33f5aa74e2", "value": "f8e6e006_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471f2365-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749672, "uuid": "a230e916-a9ae-47d1-b2e2-de5ae21f5e9c", "comment": "Malware payload (Dridex)", "value": "6143a53f50160b9f3ecfb9172ac9eef1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749672, "uuid": "721f9431-83b6-4492-8c39-e29d742de0a2", "comment": "Malware payload (Dridex)", "value": "958c4221baec9700b59f59e3db0fbebd9851d24f18d42f0914ae7cc75f6d49ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749672, "uuid": "13ba9a0b-25eb-485c-9a8c-b914d0ee3ef9", "comment": "Malware payload (Dridex)", "value": "2fb63834c5df6186d5bbdde41f17403897cac775", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749672, "uuid": "cffffbcd-440e-4e99-b7f7-0ccad4bc2082", "comment": "Malware payload (Dridex)", "value": "d88396220d180dc8a45721ce46e454dd93cf27271efc38d2824f58ea42f100695f4c3e1ef6bce60a35165c43c75ca2ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749672, "uuid": "43fd86ed-8d14-4775-aa4b-9b10d81dc963", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749672, "uuid": "0486b876-d761-4f52-83cb-14ac4745502b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749672, "uuid": "abf07718-0ae9-485e-baa8-200077f92bf6", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749672, "uuid": "d0b0ef2c-38ee-4012-ab49-940b91556fdf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749672, "uuid": "9977e3da-4425-4508-88e5-6eecb36438f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749672, "uuid": "7ce96b77-4873-48e5-bebe-9240530ddb7a", "value": "6143a53f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7048905-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800084, "uuid": "af6e1337-48cf-4418-a73b-38f8cf944435", "comment": "Malware payload", "value": "af3cf6ace203210d7c45a66498a93806", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800084, "uuid": "7ba4b19e-6792-46cb-a1a1-5719481788aa", "comment": "Malware payload", "value": "96b089b9ba8f6314bcabd16c5ee7d70a589f3f68fce186dccc8bfa5c2a44cce7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800084, "uuid": "7722bce7-a228-45ad-9dbf-3abda880db79", "comment": "Malware payload", "value": "a77681e1155733175c6e24cef9b71ba5ddaa261b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800084, "uuid": "4441bd3a-d48a-443b-a9cd-719ee3de9fde", "comment": "Malware payload", "value": "92ce7ef048dfc2def0d79acfd57cf9d5a3cce863b3639140ca7c28e27d5630b7dc99fdee5b24e4fbaf28aff7cf32d14e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800084, "uuid": "1c04c984-8129-42b0-afa9-d7890940870e", "value": "86F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800084, "uuid": "37994a4d-871b-4dcd-a5e0-dba86379056c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800084, "uuid": "50c66412-d4a9-4a98-b762-65dcf6d07638", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800084, "uuid": "f6185eb1-7132-46f9-8a56-ff9b423a3914", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800084, "uuid": "b25694b8-a2d7-405b-b322-86ea98dde161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800084, "uuid": "8a4e86ef-6da6-4606-982e-92ca54a670fe", "value": "af3cf6ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe0b336-bbb9-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621769149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769149, "uuid": "dfebde90-f30c-44ed-96c4-8a311388dbaf", "comment": "Malware payload (njrat)", "value": "b7272ab1d83a3cae498e513e0cff087f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769149, "uuid": "34e1cee2-4779-4ff5-b6b1-0edd7e9f7798", "comment": "Malware payload (njrat)", "value": "96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769149, "uuid": "d8522096-788f-40a5-9b11-3974e1d35abd", "comment": "Malware payload (njrat)", "value": "7729415361e73ac4730f2c53e33d65ad892efde7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621769149, "uuid": "e3f6b266-125a-4edf-8ced-7bbf362e1df2", "comment": "Malware payload (njrat)", "value": "e7764a97dcc8f3575d7cfef61adf3971e783fd8f832a137c28c8b6d9712739ff4e07b3460ffdf2f619ec31f0bbcc7208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769149, "uuid": "54c001f1-aee1-4cab-a7b1-d461277fdf80", "value": "2543BE8314BEC5FEFEE94B391667AA42123596414C1EC94E7ECD06CAE8C639C71612F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769149, "uuid": "8ebede7f-3df3-4e73-a12f-c801a8f82224", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769149, "uuid": "d7ff8b4c-0717-4176-9bf8-fd93b30e7385", "value": "1536:fcOKZ8oCUhhVNLK+uUVlJvvvvvvvvvvvvvvvvvvvvvvvvvvvdWX96zTPHOJDR:fcOw87UtVlH/vPsDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621769149, "uuid": "1a1dc22c-03d9-4602-b588-7a5e4d226709", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621769149, "uuid": "8a2d6d61-ade1-4bc2-b936-2e7bd6204bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621769149, "uuid": "ca907967-7ef0-4110-be8c-3c64a303fc04", "value": "B7272AB1D83A3CAE498E513E0CFF087F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90668d00-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789309, "uuid": "ef2a2a26-3b6c-4453-97d2-4aa023209e04", "comment": "Malware payload (Dridex)", "value": "a46bfbbb48b2177c14f95106419d135e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789309, "uuid": "c69468ff-1558-4e86-aacd-0d236f6fc27d", "comment": "Malware payload (Dridex)", "value": "97699913dc644503aad965e4b7415a4bcafd3fe128fce06ac67d3ec6271bd73a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789309, "uuid": "c2dc7fa2-ad0c-4c6e-bd9d-a147bf99f81f", "comment": "Malware payload (Dridex)", "value": "b2863793559effc473982191ba7ca50c6582dd0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789309, "uuid": "df4555bb-aa71-4b9f-acd5-ac8ddd0fa6a9", "comment": "Malware payload (Dridex)", "value": "db2f2ee129baa03bfc1825f43cf2591f4c754ee2273dddffdfb0be07af9227bf1fd29d8e605ee3682f7964562e1f54d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789309, "uuid": "7411c37d-2eeb-4667-83a6-785404413066", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789309, "uuid": "db289b2e-070d-4645-9f8f-bda525961ba7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789309, "uuid": "327de86d-26cb-450d-a129-f6b960287d4e", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789309, "uuid": "4f0baf7b-b255-4eb9-a09d-43bd63fe328a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789309, "uuid": "9dcafe7f-f52e-4abe-94d8-86aa975d02cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789309, "uuid": "36c08225-10d1-4b20-84b3-fcd041226b95", "value": "a46bfbbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e42cd-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760454, "uuid": "80be4df6-9951-43a9-9d71-5230174a32dc", "comment": "Malware payload (Dridex)", "value": "caeadea69f62d82a7a0e622d3e39e266", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760454, "uuid": "adcb148c-ccf2-444c-b3ae-078011624658", "comment": "Malware payload (Dridex)", "value": "97893df7995c19afb13315796451b6e56eb2303366a3cd3208f23a66dd2b902e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760454, "uuid": "0bd01dfe-8bea-406b-a8f8-f98f179ba4da", "comment": "Malware payload (Dridex)", "value": "37a7b30bda83af2594381a3a0284106e83eab94f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760454, "uuid": "a06f8300-7b8e-4e03-8d6b-9bd2b0884693", "comment": "Malware payload (Dridex)", "value": "303c222676b32607d259c3180fa0aa3065280101019ef6f927c95eeadf520f20a71ee8ba31f843a7cb8652bfd8c7afa1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760454, "uuid": "10379cd4-7c9f-4c64-bffc-024398e92e8c", "value": "92F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760454, "uuid": "a9d443c4-3db8-415a-abf8-037959529cb5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760454, "uuid": "4cab9123-80c3-4ec1-8d59-a79a78f0b170", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760454, "uuid": "b31c56e8-48ee-4f5a-9401-f265d1afb0c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760454, "uuid": "e468a3e2-af26-4baa-ada0-55136be55723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760454, "uuid": "efdb20d8-6558-40c9-8d8f-5c175219d624", "value": "caeadea6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ffa6fc-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771367, "uuid": "45e05e12-6c34-49d1-ac4a-38ac9c4b3f02", "comment": "Malware payload (Dridex)", "value": "fc33af1d570882e0edf492d8f186cb5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771367, "uuid": "65676f87-d344-44a5-b13a-08c9c4c72631", "comment": "Malware payload (Dridex)", "value": "98012e55017e1325df7a484de98ae2740d426fd1c953e9501ffb83f40a2f5dd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771367, "uuid": "2e4165c9-6d7e-4478-88c5-97f98e8e2ee3", "comment": "Malware payload (Dridex)", "value": "f82ddf88840cb852e13f275a50e43b8d195ddb86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771367, "uuid": "6b02a8de-b0a8-4c26-b5ea-ee67dd8f3152", "comment": "Malware payload (Dridex)", "value": "ebf144d0bf931d1bf8b294d9d5225ae2a4d980aa94ff9b3c796a8064e6283c2e8ad16a1f354cfafeed34fe8326369647", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771367, "uuid": "4782e4c8-5703-4004-a604-ffa6305510f2", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771367, "uuid": "6bfc889a-78b8-4448-8656-82f69cb5347f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771367, "uuid": "9320d3b0-249e-4df9-9ac5-10e34b508573", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771367, "uuid": "201feb8b-510b-4849-95dd-7c9d9d978907", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771367, "uuid": "4305ea55-d22f-44bd-9100-6d2b82f4ea0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771367, "uuid": "255a3770-8b03-4666-a414-938b8eef34e0", "value": "fc33af1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaacaf9f-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771314, "uuid": "21db02a2-ddba-46e5-98cf-cc48e9e77368", "comment": "Malware payload (Dridex)", "value": "6c910a6c0768de1b32c1b9c79b96df51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771314, "uuid": "7f2d53b7-d116-4edf-b6c4-693d6e464dfc", "comment": "Malware payload (Dridex)", "value": "984e13aa98082f0a296971ae0a9c22906bee03d9a0bbd8d202a2b5afffec1da1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771314, "uuid": "5574f874-66b6-448b-bbf2-c6802e0719c2", "comment": "Malware payload (Dridex)", "value": "907f49533b5fca7933dabbe9daf61b7c13acccea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771314, "uuid": "97f6197c-119e-4132-9a28-6cb3e2f248aa", "comment": "Malware payload (Dridex)", "value": "62facae7117f8cf628f807ccc094a5a96e94322d3bc0602db137a1b200c608dee7a6ebbd6c4bf79046ad579375b9000e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771314, "uuid": "085237d5-81de-41fb-a23d-82cfb03ee149", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771314, "uuid": "8234a66e-bf59-4c70-b0d5-794e15321f29", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771314, "uuid": "3fc85575-0e13-4a6c-a4c4-f19c84bee790", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771314, "uuid": "4fefe03f-528b-4de5-b8c1-4c83ad976921", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771314, "uuid": "2b8ab5c3-cc5c-490d-9cdc-bd75e54f3da4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771314, "uuid": "c2bbcc12-1ee6-4241-86c4-437c268f8cf7", "value": "6c910a6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24236c4b-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774954, "uuid": "306630db-6892-48f1-95cc-112692530378", "comment": "Malware payload (Dridex)", "value": "8f5eabe033cd77e10ea44b73fdb5b026", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774954, "uuid": "f02dbb5d-6cdf-4c6d-93c6-e6ecf3ecd3f1", "comment": "Malware payload (Dridex)", "value": "98a1696daff054f4082cc1f4ced1448d5af3a1aaa69c5725ca36e86dfbd9ee6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774954, "uuid": "15da1356-89a5-4f25-afc4-d1dc4781da40", "comment": "Malware payload (Dridex)", "value": "e897bfc91f63afd6209a642be407cda2265d8157", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774954, "uuid": "76503508-44c5-463a-a90f-bafbc66b7c95", "comment": "Malware payload (Dridex)", "value": "2af11f83f060fab07cf117ee0ba2714bb1bcfcdacb609088f12a0fbaf389f98925059c0653c78943422222fe8c6f4559", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774954, "uuid": "2dc09410-b07d-43ce-a91b-95dbf1eb7042", "value": "0FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774954, "uuid": "5da264e9-59ce-48be-998a-ad893ba0741f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774954, "uuid": "abb1884e-009b-4abc-ae48-a459bafc1414", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774954, "uuid": "e1e93a53-738e-4d62-8f8f-16b3fc129b5a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774954, "uuid": "794c1c62-0f5b-4fa5-88f1-35d362264bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774954, "uuid": "e9726798-0d99-478f-a7f8-e484e1174221", "value": "8f5eabe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ff18fa-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785770, "uuid": "2a907c69-0f83-480d-82f9-d4d1401be126", "comment": "Malware payload (Dridex)", "value": "4afc2f0fb7fa2cb8bf4f78e0aeb2f85c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785770, "uuid": "9eb6f70c-7727-4df3-b2c3-624ad4f00b46", "comment": "Malware payload (Dridex)", "value": "98c7a540fafdbb3012957e6672da09e86b1403510991c63d9b42372f7971eb40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785770, "uuid": "6052fe31-5c0b-41d8-9d62-504b607291fe", "comment": "Malware payload (Dridex)", "value": "f1b79f1a08c8798522704852a06c224cd80348da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785770, "uuid": "ffb74b4e-c6bc-4fb8-ac50-667fb08659f9", "comment": "Malware payload (Dridex)", "value": "df19f311e209ba32b2ff02e43db6acc9154a344ff28bd27417d5ba42ee99221164b075de7187cf53bfe90bfd1daac31f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785770, "uuid": "d7923b5e-5791-4a47-95c0-9097426f82d1", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785770, "uuid": "3d2d37df-73a5-4d5e-8394-375f1b7ccb24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785770, "uuid": "f5d564fa-3eb9-4f3d-b14c-963d964e8536", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785770, "uuid": "67d5f4ee-5b6b-4a97-aca4-64a1a889c8ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785770, "uuid": "f14c93ee-1fbc-4e09-aeef-4a563332fd02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785770, "uuid": "8ac69481-d185-476b-ac80-53af54a3dca4", "value": "4afc2f0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00342640-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728078, "uuid": "94425099-ed78-4f7a-b2e5-82a4f3b04e5f", "comment": "Malware payload (Dridex)", "value": "551ac766618b11f088d8b1b2fb4ea9fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728078, "uuid": "a4041e54-3e77-4ff7-91c6-3598baf2978f", "comment": "Malware payload (Dridex)", "value": "994cc8dd367cf4c1db2ad3afeb22de418f3cd3991b49269310bf1012365dd7de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728078, "uuid": "3862ce71-3ad4-43bf-b12e-f74d55087c0e", "comment": "Malware payload (Dridex)", "value": "244186ab193a125f1cb6f54f101873696320e1ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728078, "uuid": "0cbeca37-4df9-4ecb-b501-8d70974dbce6", "comment": "Malware payload (Dridex)", "value": "4db1b4c1a046477c4e663a3c3848b587b289a1b90ba5d0f02db6bb3356bc5b30ed66a03293a25a43d5ae0002ae4d51ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728078, "uuid": "e832905b-46ee-4bb4-9476-0912144dd259", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728078, "uuid": "e5e06e07-da47-45a6-be46-583b2896edcf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728078, "uuid": "ce06751b-dff2-43a4-ad21-815ad6fc4f83", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728078, "uuid": "216f31d6-27c8-456d-a666-074a80b463c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728078, "uuid": "903b2779-65e3-425a-b6e4-8899895c3c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728078, "uuid": "60df23d6-8fb1-4bce-a4a5-43c461ddf759", "value": "551ac766_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b8eca0-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731628, "uuid": "32a507bc-448c-4f25-b91e-82e14228790b", "comment": "Malware payload (Dridex)", "value": "9c86eb49072d53d605831a4885d3835d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731628, "uuid": "247dd9c1-5b3b-4ab7-906e-040d80363b01", "comment": "Malware payload (Dridex)", "value": "997514b3571926eb902d60cccefdb7a0142ac8b229f4f620498a5b2a9af779e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731628, "uuid": "ff9e503d-e64f-4479-8970-c37b14487212", "comment": "Malware payload (Dridex)", "value": "994dec2a3174733dd2e06b5d20188b412a81f3bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731628, "uuid": "ce3c747e-1ddb-4871-a07a-723d63ff48a6", "comment": "Malware payload (Dridex)", "value": "383505e2e721118e4467344d028cca6c4000927884f722036348b336f8ccc9bec8ffa451ea98cb86373f91ec2f08aa19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731628, "uuid": "6a07199e-5ab8-4c4f-aced-2868ebb2d3e6", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731628, "uuid": "68d8b076-45ed-459a-b3cd-9b36c5cdacc3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731628, "uuid": "0993df1d-3686-429d-b79c-77f509735c6f", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731628, "uuid": "05d2265c-0460-470f-9f2f-345e982f5afb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731628, "uuid": "2d791c0b-c12b-4eb8-b7bd-c8c470c94100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731628, "uuid": "50da06a2-8f99-4587-9ac5-fb89359d4ccd", "value": "9c86eb49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed515085-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774862, "uuid": "8b9dc465-6905-4728-95a9-769f861af044", "comment": "Malware payload (Dridex)", "value": "b5c8d57e938ea570fe6711a64b988c3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774862, "uuid": "a4ecac0f-c5da-47d9-a34b-d6ff28c05eba", "comment": "Malware payload (Dridex)", "value": "99cfbf408c2c771ef02151e863f9641767e21484ba18ee678a55f74ffe5b0d2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774862, "uuid": "4a985cc4-df13-46d8-9f57-6d224a1d12fc", "comment": "Malware payload (Dridex)", "value": "6cd82775bb892db7a3f8281108b88f4a828553e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774862, "uuid": "74098ec7-2b69-4182-a8d9-2a6e0d3f91dd", "comment": "Malware payload (Dridex)", "value": "75e88ebda1427fc38fc5c05b7db37042b996d6111100f5bf2328f1aa3251cb41efdd3bfa27d7e1ea1368914fa98246a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774862, "uuid": "f8b7b8e0-1fd9-4242-a834-f13af0314c72", "value": "43F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774862, "uuid": "5e374cab-9608-418f-b79d-310d674f89b0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774862, "uuid": "58914605-fa3c-449d-b466-b89339d732c6", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774862, "uuid": "6316c8e7-7b73-4343-9a18-58279adc754c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774862, "uuid": "9a2303a0-cc0a-4585-b082-f2ae052a4193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774862, "uuid": "a3df2c86-34f1-49e3-b3b4-b8282390f5ad", "value": "b5c8d57e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a61907a-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749678, "uuid": "46a14356-bc19-4387-be4a-c73b5341afd4", "comment": "Malware payload (Dridex)", "value": "3923122900b583797a159ab3f3255216", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749678, "uuid": "8a9151fc-fc33-468f-8c72-b7f68aef85ee", "comment": "Malware payload (Dridex)", "value": "9a792db84e82079649e849b9208a6bfe50da24c2488a09e1d3c55293348b9f96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749678, "uuid": "b07aaa60-66b7-4687-836e-e69574a06d56", "comment": "Malware payload (Dridex)", "value": "e0232a5cef41d93b6647719186c34a4f76e0d2aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749678, "uuid": "4084f09a-c7f1-4ca8-a181-fcdc199b55dd", "comment": "Malware payload (Dridex)", "value": "373bf9dc2ac2bd347e6bdca779664feeeac3b18fdb9ae8447faa8c35616af156589996326e2c946cda010b9b96c16791", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749678, "uuid": "2724e15f-b29e-4470-ae8a-3d1d4e372aa4", "value": "66F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749678, "uuid": "2758517b-8236-44c7-b468-c6dfcb6b40bf", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749678, "uuid": "fd374091-1563-47a4-9db2-9ba05347d88a", "value": "3072:qA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:q3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749678, "uuid": "efdd5b7a-a9d5-4f22-9a1f-c5fff2092813", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749678, "uuid": "edec50d0-7ebb-4a5e-89ea-856799c36036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749678, "uuid": "8554cd48-f9ee-4466-aeef-def830e839f5", "value": "39231229_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816c10c8-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742469, "uuid": "92c94f71-4357-4e51-a305-fa5f52323478", "comment": "Malware payload (Dridex)", "value": "36907911be4ce7096906d7edfd9659ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742469, "uuid": "2486a29b-bd03-46ef-b1a8-d7c8bfe978ad", "comment": "Malware payload (Dridex)", "value": "9ada2881dcf5b60109ad496b0947a63281aa0d114ed62c46c316429e20268fa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742469, "uuid": "938ba535-bf69-46d7-9d7e-c5c27d380d51", "comment": "Malware payload (Dridex)", "value": "6905669764c9b9d68b725909e03a08eb1322d90e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742469, "uuid": "5432022f-a7f4-49d8-8653-a88e9dd84939", "comment": "Malware payload (Dridex)", "value": "b5105d302096d5c3c7ab15257b29d9256f1b62de2e90726774521038682c1aaafdf2c1c3cb62bc4b028ceaed22144c4a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742469, "uuid": "5210b5db-5b0a-40e5-9dba-1fae210af6de", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742469, "uuid": "c85ce17b-7df1-45f8-9663-c3c8168fd8e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742469, "uuid": "ee69f6be-ed5b-41bf-899c-ea85a64646ff", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742469, "uuid": "4bc278e4-5cbd-4b6b-a4dc-d3e8ef621bde", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742469, "uuid": "5085d257-902e-4526-9a9a-cbcd96aed9bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742469, "uuid": "4db66c9a-d717-4781-892b-9cb124e881f2", "value": "36907911_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16f8cf9-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800102, "uuid": "39a2c1e3-aa05-4e62-874d-ace462e124d6", "comment": "Malware payload", "value": "1549363fc55c6534b1fdec1b36bf7038", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800102, "uuid": "8b221e7e-605c-4273-8cdb-656450559728", "comment": "Malware payload", "value": "9bbd09d00738820baa67c233779fb53f5c7d403ceae87e28f9bac5d8194aa039", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800102, "uuid": "debcef36-edad-4efc-92d0-f0a6d10846bb", "comment": "Malware payload", "value": "62e512ddc6260ce891c5efee31f7878366a53f53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800102, "uuid": "f2338a0e-74b8-472f-987a-d075e4ec1dcc", "comment": "Malware payload", "value": "6bf781e862fe9c28ffd9e039d4c363dedee77c128dd33fba022a431eab904eaea00287196570f6aa85f126f1af4a1db8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800102, "uuid": "f6a09df2-24b3-49d4-b60a-d0e27afb45c7", "value": "FCF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800102, "uuid": "adf9cef7-f054-434b-baa5-326fc201f5cb", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800102, "uuid": "171c42f5-0eda-45e1-a60a-a2c9d5fcd469", "value": "3072:o9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:o9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800102, "uuid": "26d121cd-2ed5-4fc4-a9bd-05fa680ef092", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800102, "uuid": "94cc4209-4f4c-401d-b9fc-42a70cf6d53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800102, "uuid": "beeecd13-b805-4cd7-9be1-7263479e7266", "value": "1549363f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee45177-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621760476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760476, "uuid": "41aacd9e-1fab-42e5-9025-9fe16439c625", "comment": "Malware payload (AgentTesla)", "value": "e6f8edebd3177110fd130c3cbdd7376e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760476, "uuid": "ca59c315-2f75-4ee4-a8ea-ba5653768ea3", "comment": "Malware payload (AgentTesla)", "value": "9c24d100e91e39ca2666e8bd5c486388b71a5265046682b105d9b32fefc43fb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760476, "uuid": "a6f5514a-7dd6-4cf1-ac19-1c5642a8d72a", "comment": "Malware payload (AgentTesla)", "value": "343a362eeee6d494de6f70989a29e93496a0092e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760476, "uuid": "2155e690-486c-4814-8037-5ce85bb6e32d", "comment": "Malware payload (AgentTesla)", "value": "22b3975d3092cd32facb7f1584d856dcc3ae585d3fd7d0e19cbf89c7b90a725de37f8d32e0edbabf180814fe348d3b81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760476, "uuid": "37d97982-9fae-497e-88de-0df9a4edc2bd", "value": "F1F4230A43487446E6783E7340C4AD388733BC9BF46684151ADEB51ED8FDB95EA6F832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760476, "uuid": "a14be547-e718-4cf3-8730-96a55a4ce8dc", "value": "12288://j/J1rhRty+njQJcJyDXUQHuBrrAzmUYv0yKiNlod2fsTlCoPypvtXOY://jB1rvTnIcJy4IqvAiUnyKgoEsNPyXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760476, "uuid": "311f9364-9def-4431-8085-7b9994d60662", "value": 736436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760476, "uuid": "3d9d39b7-ae15-409c-91f3-06310bc8e807", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760476, "uuid": "0326475f-db6b-4e2b-bb75-781901238e55", "value": "e6f8edeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67c9d3f-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803654, "uuid": "91120888-d808-4637-a914-3027cec68a9d", "comment": "Malware payload", "value": "1669cfa7bfe685b8b015261029d933e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803654, "uuid": "944236fa-3f99-49b1-a75e-e66c142634cc", "comment": "Malware payload", "value": "9c63c4c441e9875f59ce26a4545dd0fa6a366acdac593807acc13852e590755f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803654, "uuid": "0851c52c-136a-4372-acea-0c0859fa1465", "comment": "Malware payload", "value": "5cd47c5fc2ed4afbc83026c36ed4736f0ef3f723", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803654, "uuid": "1ec3bbc4-cb8e-4a1b-975b-48b3266bbad6", "comment": "Malware payload", "value": "db5f6f4858900f1dc5232015cbe0b08eac0cf52be1b11f9060f30c0d2728d6ae626b601253fdda477e9391c07a7711aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803654, "uuid": "5e2b78b8-6d5a-4afe-b075-91147d703d20", "value": "15F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803654, "uuid": "391b9bf3-2d1f-44bf-b1ca-b88f21de5f99", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803654, "uuid": "4931b54b-c6ee-4f79-8df9-c16517dbed5c", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803654, "uuid": "98cc9b29-9da1-4ee3-bb57-ae935369b5dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803654, "uuid": "7e67868b-222b-4128-9cc0-a9a413935b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803654, "uuid": "4d83e327-0cff-49f8-a3f4-868e88679ea7", "value": "1669cfa7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037bb12a-bb95-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753424, "uuid": "ac6228c3-7be9-4fa5-9319-e06826d0fd5e", "comment": "Malware payload (Dridex)", "value": "97f6c3580e19b9ad07eb87166400a4ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753424, "uuid": "221b96fa-a262-4ead-98b3-5363babd6b9d", "comment": "Malware payload (Dridex)", "value": "9c786670789694d34e15bd41db801490c919126538c7d28dde1534a21c8c9906", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753424, "uuid": "f497d9ce-24af-4c24-af36-cd6f8bebccd5", "comment": "Malware payload (Dridex)", "value": "9db1c31bbb24598c764b4db7719c305f5e5beb44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753424, "uuid": "2e695c57-5980-466a-870a-ed801d85bc2d", "comment": "Malware payload (Dridex)", "value": "f26ff403bad35766ceddbb03c3954b97d1647b700e98cf225e7b9d8d0634bdc170d57b005301b18d00ded49d9688bc26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753424, "uuid": "3832ef1e-f378-4dec-92e5-1425fd8e9121", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753424, "uuid": "675a854b-881a-4041-bdf6-94336fe327f7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753424, "uuid": "8325e241-1169-4cf8-a019-629e269b07dd", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753424, "uuid": "b087017d-d9c7-4ce0-9688-3fc5d7451f3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753424, "uuid": "1b22d20f-16db-45b3-9b9a-b4e327133489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753424, "uuid": "89b4455b-4e66-4d5a-93cb-a10cbcd425bc", "value": "97f6c358_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3a6351-bc0e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621805732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621805732, "uuid": "3faf9599-1ca7-40a9-b693-4c8bf0d4da08", "comment": "Malware payload (RedLineStealer)", "value": "9d9a8beecc8e6612d6bfb10d959af3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621805732, "uuid": "b4f413de-53f7-4834-9ecc-73a5100476de", "comment": "Malware payload (RedLineStealer)", "value": "9c8057521a53904ce86837434f6ca9075fea66d1c31914db6a6b49f68649191f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621805732, "uuid": "589e3aa9-ad8a-4d3f-9c14-5de702778480", "comment": "Malware payload (RedLineStealer)", "value": "400392722dd43993b8f4ba7b8bcd55aa8be58ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621805732, "uuid": "fcafd657-31de-4700-8998-2678cabb30f4", "comment": "Malware payload (RedLineStealer)", "value": "90243fdaf85099b0220d1ee74a462700e5fdef192ac72549bdd25bcd4cdf0ee9236bff3b3992d6a63e9187dfd1d338e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621805732, "uuid": "4f5e0f82-1873-49a2-9040-69f405a8c792", "value": "24522C15779C8737D57D0AF604B1A2400772FB0A5866FAEE6CC9318E5DE2B840791F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621805732, "uuid": "ddada623-e8e6-498d-b481-560c87c14527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621805732, "uuid": "24f74e79-6fb4-430b-bd69-3f58af34b89d", "value": "192:5sH4Vl3FNPQa2Epa9YucyGywURpSGr6+W878oPAuIEffcO2syPt:uG/GIpa9YDyDpSGr6+RRAuvffcO2syP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621805732, "uuid": "7e5b0f82-10df-4626-af4b-1563de4325b4", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621805732, "uuid": "eff8859e-51ef-4236-832b-a0893c68279e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621805732, "uuid": "d0810879-798b-4417-ab40-d0988bbd80fe", "value": "9D9A8BEECC8E6612D6BFB10D959AF3CE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606b4c2e-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796530, "uuid": "e8954756-9d81-4781-820a-624f7f1994b9", "comment": "Malware payload", "value": "3412729de19f96d38f787652439eeafb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796530, "uuid": "cc4f3b38-a900-49d4-8d7a-2b51e946ede4", "comment": "Malware payload", "value": "9ce9ce3ddc8cbbe5893613ea008aa7a099681091996e139fe6f02bd79ad02ee2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796530, "uuid": "526daa04-6090-49c8-982c-df0bea708117", "comment": "Malware payload", "value": "f29b7b0cd403abac8ad3f8e51019c078f10c407a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796530, "uuid": "35955b31-6d9f-4d54-8be0-fc7b2c11da54", "comment": "Malware payload", "value": "b920869dbae5c41b6957de22d89d96c321f65f350d422920cb1790ea6a52a80721d20d7a44c9317befb7bc6a053d929d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796530, "uuid": "3bbbb0a4-715c-4f84-8086-d14cf2c55cc5", "value": "DDF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796530, "uuid": "4ede826b-85c5-47e0-bcf7-d2b6dbb5acad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796530, "uuid": "d3e3ceaf-58ef-4bdc-aef7-a7b818ade7f5", "value": "3072:eIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796530, "uuid": "d1813410-5b30-4b3d-908a-25e7efdc5230", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796530, "uuid": "e9512654-b0f8-427c-84d4-4944184dfc76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796530, "uuid": "65dafd9e-d88e-4c60-9f54-515dc6fed1f1", "value": "3412729d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117e2e56-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756884, "uuid": "91b39caf-67b9-40a7-b372-142b49f10a09", "comment": "Malware payload (Dridex)", "value": "0b1bf976bca7d9dfffd1719804597dea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756884, "uuid": "df375efb-d1a5-4adc-92ed-b9adb11389a2", "comment": "Malware payload (Dridex)", "value": "9d082eb34957c26a7ac6f7a1a49d92eb3dea010f0ea55c944a6fcc5d8309afe5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756884, "uuid": "5caac812-e35e-4ed8-b6f3-3c4f52504cb1", "comment": "Malware payload (Dridex)", "value": "a5ae1bac22c7a2c853ee4bac1b0d74dedb1def00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756884, "uuid": "fb6f3941-7b6f-4c81-994b-79fa10cd1e91", "comment": "Malware payload (Dridex)", "value": "1dd99058e1491ded62a14b3ccca8111fdfeda0e5d3ab1fa74b6a167422b34d89060b6b222fb77ef1125376d8fd710a6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756884, "uuid": "20b2e036-b7e9-4950-a76a-663ef5191cce", "value": "D3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756884, "uuid": "c71f0783-b394-4b82-abd3-0ef454bbc44c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756884, "uuid": "a3e14543-d411-4e23-a841-c00be76884fa", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756884, "uuid": "3bc1699a-1a7c-484b-9783-dd673c1dd69c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756884, "uuid": "e5469d6f-8e93-4f5f-9fbe-ca4dd88d680c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756884, "uuid": "7b53cdf3-4bc0-4ca1-a8bd-f021c0636ea6", "value": "0b1bf976_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f535ad8e-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792914, "uuid": "9bf153f1-0569-419c-9096-88315b29f850", "comment": "Malware payload", "value": "3a85681a200e7d22d466c7223f70e4b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792914, "uuid": "ceaaf05a-a167-4427-a435-3ccc29c150cd", "comment": "Malware payload", "value": "9d2c24051a1d6c4f308557852180caafc65ce1dd18edbf7a5c3106d1af6416ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792914, "uuid": "41d55130-b7e9-4632-8eae-007517641428", "comment": "Malware payload", "value": "0e6c105d5b0b532502912469c219b87ecbae4992", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792914, "uuid": "20cce8f8-162a-4089-8491-36eff2a21244", "comment": "Malware payload", "value": "b2b8215b0e7597e969ad9d716de27dc35d6238c8486fbb0ccf2846ee98213256ae6a5ad3d2134ba433c7e469980c6d13", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792914, "uuid": "70546000-89d3-4bb0-ba64-e5a793586f60", "value": "BFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792914, "uuid": "9316e4d2-4703-42fd-94c6-5d2abc2712ec", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792914, "uuid": "937d2170-4fda-4443-afc9-ca8ea50dd120", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792914, "uuid": "60af7d22-8d2e-4dac-93bd-8e2c87f15abe", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792914, "uuid": "fa6ee446-1933-49f3-b33f-58379b8f49ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792914, "uuid": "1166830d-d4aa-4455-bde1-5aca83c4f3e1", "value": "3a85681a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e63d1a-bbd0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621778926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778926, "uuid": "d995697f-8ca2-4ebe-b44d-b95e331ddc9e", "comment": "Malware payload", "value": "e5993ec217978e43dad9596e537dedaf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778926, "uuid": "166ce67d-87da-4bfc-9077-5ac6832caabe", "comment": "Malware payload", "value": "9ecf72da44ba150f2a683c964acb80aa71697c331239be71db89aee388928056", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778926, "uuid": "2736c292-cb39-429c-82e9-72bb5fae793b", "comment": "Malware payload", "value": "6444f2123d33557cd47bfb69d3fd41abe12259b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778926, "uuid": "7bdc6391-b475-453b-8d83-c3f03d9b37c4", "comment": "Malware payload", "value": "b9fdcded48e4d1ad9fa56d326675bf060663f9a232f9c946c46dc8a2088add4b8ba7ce699e87d34dfbb6ccbb80af0f89", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778926, "uuid": "28849a55-c45a-49c4-8cac-92bd411b9ab1", "value": "9A23FF0F6F8660B05637B738CFAF4408F57A103B668985567DACA5E11F711208BB8FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778926, "uuid": "c8ac4b4e-d672-416c-bcad-e4ee2cdee798", "value": "384:UoT2jUYkN6a95ZQtOI3PP/TlDoyoLupcHY9HjXyTsoVBSJbWtoExzfNVQgiANOwZ:BT2j6uvyLupQbTMWtoExDQgiAgoXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778926, "uuid": "c2496bc9-7e6f-44d4-954e-209831a8d686", "value": 50084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778926, "uuid": "463c8adf-560c-43b5-bc98-8243cf9277e1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778926, "uuid": "68f6c0ae-8d8f-4f43-8cac-2ffbdd1d3489", "value": "daum.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0977c38e-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785647, "uuid": "f4cdf5c2-072e-4790-935c-d7f3432da51d", "comment": "Malware payload (Dridex)", "value": "242426e79ce8802a062f024e6cfea0a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785647, "uuid": "9c408fc9-b3fb-4cdb-8c56-e8a5e9b67ddd", "comment": "Malware payload (Dridex)", "value": "9eda1f6545ffd4a41ba1f2c2e5b7039e9d2bbb4e68f69421e89b8982fefe93c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785647, "uuid": "70fb0338-0dcb-4c56-b724-c4100b789b57", "comment": "Malware payload (Dridex)", "value": "4c29cab1100b289755b4c8c217abe42447de79d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785647, "uuid": "5f33152b-a0ed-45dd-be81-7d4781b21766", "comment": "Malware payload (Dridex)", "value": "36047c88f5e0c71eddee797da6de3c04a1e96c06444fb2b1b615b2e09fc289dcc53943043cc94da6849106e0efa67150", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785647, "uuid": "ec2769fc-a8d2-4c13-8ee8-96b196967cb8", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785647, "uuid": "58ef8a8c-1638-4482-a658-7fae2eedb17f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785647, "uuid": "ffbcb423-d5f0-45db-8fd7-08cb46289c6b", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785647, "uuid": "8ae2d3a3-674f-46d5-942d-779689011263", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785647, "uuid": "c8add9f9-ea19-43ba-a06f-e27c37644948", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785647, "uuid": "4ad7ad9a-51a6-4c3d-ad24-fd98b2ec3753", "value": "242426e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ddfffb-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774960, "uuid": "053e2899-2d26-4314-aadc-1d1fa246c819", "comment": "Malware payload (Dridex)", "value": "dca2695e35a170ee1f969383f5a70fae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774960, "uuid": "a8fff8a1-98c9-47fe-8d5b-14e443394fec", "comment": "Malware payload (Dridex)", "value": "9f3a1f14133614e82cef3a2cd85267ca1a96c47b49dc064884d5308595c6151b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774960, "uuid": "1cb62932-0e31-424d-8be7-9c2ac0298925", "comment": "Malware payload (Dridex)", "value": "76e4966c8e877a82a3e8839b7a7e53012d4fe3dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774960, "uuid": "85397108-04b3-4f6e-a601-56acd88a1000", "comment": "Malware payload (Dridex)", "value": "df508582d203573b40f6c698be160b689ef9bcdceb79600e117c6c901486cd6a34015a51b7358074f66748aa4e6418ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774960, "uuid": "35c1e88b-269f-40b4-8381-0af36e0d64c0", "value": "5AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774960, "uuid": "b66ec50e-4441-4b58-9bb0-9de1d4836166", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774960, "uuid": "0ab3a5f0-ff74-45ef-89ca-997cf9c46718", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774960, "uuid": "2c1a2ac1-f8f1-4eae-9504-a2cca493e640", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774960, "uuid": "02cd473c-fe24-4922-a9d4-8965a9b69a56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774960, "uuid": "8b08a2a6-cb4d-4d17-98eb-f5ac508e4127", "value": "dca2695e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1fb134-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764045, "uuid": "1d3cdfb3-c3a0-4de9-ace8-25630ae1d891", "comment": "Malware payload (Dridex)", "value": "2447ae6f2b9958c771ab4e5e7d20271b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764045, "uuid": "40147662-940e-4e77-88e8-4c372c0ccef6", "comment": "Malware payload (Dridex)", "value": "9fb76dd2f885e571d67ed6c4c7f8521917fb40272a72a4457c8b8baa58a497fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764045, "uuid": "2eb3b96e-b17e-47d4-8a57-1060cef60b6e", "comment": "Malware payload (Dridex)", "value": "6b19c69a2539c00ea10d129f2a259050f43c3b4b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764045, "uuid": "57355af0-d6d2-45cb-ab73-5115f0670b12", "comment": "Malware payload (Dridex)", "value": "b49a34e02aa82acee9ecf3c026bc2baa6d2782fa007d654896a006d0e0020fb8a937ad78435f3d779eb46cb56786fdec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764045, "uuid": "86a23733-7854-4a12-8613-15a0829d4ee1", "value": "A2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764045, "uuid": "469b88d8-a3f2-44b6-8aaf-cbbc92d7fc91", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764045, "uuid": "dfb26903-0265-45a0-9e92-0276e53f6d1f", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764045, "uuid": "20f2264a-af35-4c7e-b1a5-99935880c3c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764045, "uuid": "32017d06-8e6f-4e9e-bc9a-9166950fe748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764045, "uuid": "145ebe6f-d9fb-421d-ab25-096a4db0ce92", "value": "2447ae6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa31daae-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728068, "uuid": "d60e84da-0d6f-4ee5-8be1-ce8ac065d14c", "comment": "Malware payload (Dridex)", "value": "9b8cc07e7be7e44fff5b1c7ab2f7140b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728068, "uuid": "ce730330-ccca-43c4-9b3a-9f3a55c826b0", "comment": "Malware payload (Dridex)", "value": "a03f88f4a5596f2bb9fa6c9d1469e083113d2feb10b86ef92501f073d5a2ac3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728068, "uuid": "1b5535cf-758f-40d0-b3a9-226cc1ebe619", "comment": "Malware payload (Dridex)", "value": "86c6ca11fd3a64b7adef2ede722606aeb4e76f46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728068, "uuid": "9c1b7f2c-1db2-4c69-a0c7-33173410fc7d", "comment": "Malware payload (Dridex)", "value": "1b873d776846f5d76f70bf1b676cf065588af171a7835d98526187c559f3b176efabb4c67ae0554257d2d3a71e772ed6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728068, "uuid": "e41271d0-8351-4f78-b2ac-bddf6128448d", "value": "87F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728068, "uuid": "ef51199e-cfcd-4819-84a5-6ab958f0c0db", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728068, "uuid": "b14a9407-a56b-464d-bf3a-8c694105dc76", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728068, "uuid": "15e16804-3b3b-49c7-97b5-6526020e6b92", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728068, "uuid": "40b552ea-2bf3-410c-ae5d-e5e297cecb0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728068, "uuid": "ddd3e11b-1864-44ee-9c59-a872315525d2", "value": "9b8cc07e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21e7224-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (LockBit)", "timestamp": 1621756724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756724, "uuid": "09536243-96c8-4b35-a77c-d5810f403f1f", "comment": "Malware payload (LockBit)", "value": "abe13f69e9ce015269a1ae5f1458ac1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756724, "uuid": "40aef0e7-2cd8-46e8-8b1f-5e5a689a94bb", "comment": "Malware payload (LockBit)", "value": "a0ad4cc0041d5d8de8584b495d98ce46987ed8834d027c01d048da3aa7fb67fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756724, "uuid": "91549be8-c9f5-4bf6-9f4c-439e33bb89aa", "comment": "Malware payload (LockBit)", "value": "0504a836ce8944cc2105b36b4c036d0c013353f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756724, "uuid": "4383eb23-c17b-4230-b41a-0bccbfaec2da", "comment": "Malware payload (LockBit)", "value": "dc17d1552dd29b69517411f8aebaed59c4c10bc2614e3f67d57c3d40ae4f61da80bdf05c2e7b6838eb23781f9afe80e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756724, "uuid": "81c09eda-bffa-4d79-84f0-cd1782fab0c5", "value": "46F6AF61BA42C139D99101F09D7DABBE442DEE280B3941D7B3DC1F2D2B705D22B36B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756724, "uuid": "534628dc-07f6-4b67-885b-8c478590e9ae", "value": "e020c2cb73456af7dd92a6ed85518cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756724, "uuid": "b3fbf354-728c-41c9-a446-5287b67944ac", "value": "196608:+RwEYYTX4IC1ssG7cm24YaF5VlUaR2jbpWBd7ZWhLJTrqNu4q3dcJn+aK2RPslb:+RJoio4Y4Zep4tWhLJrqNIcB+isN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756724, "uuid": "5b081377-6eba-4759-8052-9e9a176d4dec", "value": 15904056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756724, "uuid": "0c4e65cf-ace4-4c0b-ba9a-29d73cd16fc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756724, "uuid": "6f98e24b-163d-417d-b8cb-f29de8ae635a", "value": "abe13f69e9ce015269a1ae5f1458ac1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a1e98a-bc1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621812705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812705, "uuid": "66e49f4e-851b-4c98-a755-6bad23803441", "comment": "Malware payload", "value": "9e2ebf224ef23e5d01a88e6bd06d6ad0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812705, "uuid": "785dfb2a-eb95-4e3f-baad-00b4269b022e", "comment": "Malware payload", "value": "a0eb4e0e7346422d18d3421d1f185fcb2b01ac3080ab3b3bc68d67aab1f4477d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812705, "uuid": "243e37dd-618d-47f0-9ee3-fa081d501e66", "comment": "Malware payload", "value": "defb1558ddc36fd10050f2cd65617dce7274dc01", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812705, "uuid": "3f076002-cfb2-486b-9168-7f11674b5905", "comment": "Malware payload", "value": "3c40fc771fd4ef73271c094ab314b1eec496b5656172b16e4d5d67040020fa6742082e993783e7f55620e7419cf126dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812705, "uuid": "73ccd623-8fdf-4782-9d51-efa4fd34485e", "value": "F2060148FBB4D940C012ADB691D65547E40B43582D8DF0BF2F9988C879A3C652A87EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812705, "uuid": "282ae804-ea89-4794-9964-2d57f7b2402f", "value": "98304:gjKQoLKJgAEofs1xqa7hMTNS+ZF0mM1/bZNRiho:gjKuSVW8+8JZNs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621812705, "uuid": "73eb298a-b55b-4f1b-a4b4-f9ed3cab1bae", "value": 3906984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621812705, "uuid": "0334a27a-df8c-418c-9ddb-b83e7721f37e", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812705, "uuid": "a70aed18-6c77-4636-af32-5b86827377a6", "value": "Her_Aileye_2000TL_Pandemi_Devlet_Destegi.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086f30d2-bb95-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753433, "uuid": "62e35e86-bf36-4c61-951e-48d51066ac45", "comment": "Malware payload (Dridex)", "value": "3d60136debde1156a8d3ff2509595d89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753433, "uuid": "a1340370-577c-4d19-a300-be05463784cd", "comment": "Malware payload (Dridex)", "value": "a176d0132133b39a87781e09abbc5c937f96584ed6da12f045890ca98a87663a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753433, "uuid": "04ca0500-f468-48e3-b471-22d210983eb9", "comment": "Malware payload (Dridex)", "value": "964704f050383028b1624e31c827d663795740dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753433, "uuid": "1c5e32c4-0b7f-47b8-9d25-435d08daa21b", "comment": "Malware payload (Dridex)", "value": "e27886b9f4bd079ffabdcd98dd1620bb5cd404900042774837c36830904caa1cdb6243843bd6bcf9c46b935bea2feded", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753433, "uuid": "498dc0e6-6c51-4833-aa43-a417288fb718", "value": "AAF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753433, "uuid": "aa0fe353-46ce-4782-8470-a54d97b4f077", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753433, "uuid": "d622b9af-577a-460f-8c75-32b54bf50837", "value": "3072:BiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:SeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753433, "uuid": "f6f6f9f6-5610-4694-862d-d2e0b5b7a0ac", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753433, "uuid": "0ab6f2c1-c148-4c3c-8ca8-e8764c25a8d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753433, "uuid": "a3e263f7-db07-427e-ba34-fc24b2281377", "value": "3d60136d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ed456b-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807245, "uuid": "149b17bd-e0c5-4af2-8f13-409b6ded9c1a", "comment": "Malware payload", "value": "1cb2286e8fe15b6e90a691891331d281", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807245, "uuid": "7433195d-34a2-4794-b0ce-fda4daef8c1a", "comment": "Malware payload", "value": "a229b0f0a1a170cb6d1c0eaab96da75a8adafba0a52b14ec5c67bd11d141ecbe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807245, "uuid": "c0225716-493b-4842-8efd-782e82d9f614", "comment": "Malware payload", "value": "b295742e42d9666acb9a289de62099c12813abb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807245, "uuid": "bab4ddf4-3868-4274-827e-ae3302b3b6a9", "comment": "Malware payload", "value": "a53c9d72f86f5c48958078765fdfc927239196d96c170f7717ab9377540381a47ae26208afc9253d13a71565a431006b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807245, "uuid": "c8b2c486-e02d-4d0e-b939-d5052cb5d61a", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807245, "uuid": "1503e6f3-9938-4350-9384-b3264438f531", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807245, "uuid": "e89f16cd-4d37-4192-9266-2d6657c8630b", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807245, "uuid": "f1f03c28-0e97-43cd-a6a6-6fe02f3bd295", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807245, "uuid": "f2349e6d-41ca-48bc-a4e4-ffa843db639c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807245, "uuid": "68638777-c153-4849-a869-ab2d745bd7f3", "value": "1cb2286e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5716909e-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778475, "uuid": "a995b9cb-0e99-47fb-a58f-0f75bd58d5cf", "comment": "Malware payload (Dridex)", "value": "f523d324fd6966f114f2502ff8583e54", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778475, "uuid": "55c5c79d-80ce-4530-aa17-380216bb8eab", "comment": "Malware payload (Dridex)", "value": "a2c609b756a295389917dbc386fe47ea09e28c08166adbfb8a8ae0bc991158cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778475, "uuid": "a4ab3b39-dca4-493d-b4c2-9d740ab16662", "comment": "Malware payload (Dridex)", "value": "d81460e15f30aa931d24664c383888393ec88666", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778475, "uuid": "2da5bda4-139d-44ca-ab14-b5da562f39a5", "comment": "Malware payload (Dridex)", "value": "2cad8e2a3b4fae98baa6680663b64b3766dbad360ef864badd9280b7f97e35d37c2a8077d9ff803b0101d1632e00c352", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778475, "uuid": "846a02fa-91b8-4bf5-80cb-540907b13a1e", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778475, "uuid": "028aedf5-d958-4c20-a451-d87aa054150d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778475, "uuid": "ce1c4fb8-b7a2-47d7-a8f9-99f5ceb159d4", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778475, "uuid": "98386890-b76c-43d0-971b-983c2883666f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778475, "uuid": "b643fdba-423b-41c2-909a-65dd89e9fe68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778475, "uuid": "96d79a96-3b2b-43cf-83f5-56e214d42ee2", "value": "f523d324_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a979241-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1621751477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751477, "uuid": "b1bbff7f-dfba-424c-a9c8-aaa332bec73a", "comment": "Malware payload (FickerStealer)", "value": "8ec4f56cb613d3b8b0891c6eaa7236d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751477, "uuid": "4f8a1e20-0954-4f9e-9f84-518534117416", "comment": "Malware payload (FickerStealer)", "value": "a2e4e400908d26e768edb6cfd2d3cfa7c7d53d0ad5743905943694fce55bc538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751477, "uuid": "8a1bdedc-92d1-4baf-9298-88637ab1c301", "comment": "Malware payload (FickerStealer)", "value": "ab6e09d069febb588eeb039362174a60fff15c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751477, "uuid": "486c13d8-5748-438a-94eb-150e451e49c9", "comment": "Malware payload (FickerStealer)", "value": "36099de9852850ad8c3f09f6d323aedf9cdbea81af592d8314bd227622cf66d637e5f3178aa41cf09f0fecc1aa01d3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751477, "uuid": "f642e6c8-c576-4177-8557-d527bb955992", "value": "6494AE30B6A0C034E0BFD6B449B592B8673A7DA1673450FF22D13AEA56346E1AD3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751477, "uuid": "c6bbbe46-5c9f-498e-bae3-01895da10776", "value": "7b130393ef6b1671401f8c46089b1ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751477, "uuid": "42ba6ec7-3502-4c44-84f9-3311ef3b1a84", "value": "12288:mA0QsDl4kxkIsB20qmMOgteFH+BdRUHTAZXsLS:OQyKy0qPOmwH8dWkZXsLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751477, "uuid": "91235aa4-00e6-4f9a-8465-01d098cd9b9d", "value": 419854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751477, "uuid": "d9d4ee8f-ce13-4dd7-b609-6b73c7f698de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751477, "uuid": "5fc66a69-b9a5-4f3a-94f3-f348fdd4fe01", "value": "8ec4f56cb613d3b8b0891c6eaa7236d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53800b55-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778469, "uuid": "543dcec2-5ea7-4fae-93e8-0aebd9153d5d", "comment": "Malware payload (Dridex)", "value": "57b6cb8c97575f46348c82a0a6ed0e4c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778469, "uuid": "3a67a438-d9b6-41ec-9a39-c803baffcbda", "comment": "Malware payload (Dridex)", "value": "a3195a9569de9141e7a526102c5dcfa427048e51dae450aaada2d6177c0bc036", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778469, "uuid": "38411b76-f438-4033-8050-550fc98b0bce", "comment": "Malware payload (Dridex)", "value": "df0e9d7abc9981dbc14ee67427c227ababfabc08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778469, "uuid": "aa9fda0e-6999-4bc0-8db3-e20533e034ac", "comment": "Malware payload (Dridex)", "value": "4e96053cb263dbf47d2c6fe2aaa8f807e5ef39f6cf93bffdf9f466f11c59d7f1d053c8bf03c07cdf7dbbdb0c2ca16d0e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778469, "uuid": "542d1179-4db0-4239-95df-fa0909d11145", "value": "FDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778469, "uuid": "63bc21f9-25b1-42c0-a2c9-1d4d76079f77", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778469, "uuid": "01605d40-3bbf-49d5-bfd9-7101c442364b", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778469, "uuid": "3e7c14ed-d84f-4ab9-8411-2dfeb71e7bfe", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778469, "uuid": "382c1acc-3bb6-4121-bc8b-fa51e7e65d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778469, "uuid": "708f3fb4-6dc4-4e6f-9848-0699a5839059", "value": "57b6cb8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a35828-bbf4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621794440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621794440, "uuid": "83037f54-d526-4d30-a31f-5ff57837c2e2", "comment": "Malware payload", "value": "bd0ee78cded55ff30a37c670cfa66236", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621794440, "uuid": "a45fbf6a-707a-4ae2-b6ae-66d9f32b6ad8", "comment": "Malware payload", "value": "a34c1e334e9d76e97b8e8ac6b88bbc45cbed7ab7fc3a62e2f348c940136778af", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621794440, "uuid": "497f2468-caf3-4821-97cf-e257baa57b78", "comment": "Malware payload", "value": "70d690a40fb7307280d2bebf77615e757c7f6513", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621794440, "uuid": "38a2d5a0-92f3-4da8-95ed-51df674af7e9", "comment": "Malware payload", "value": "0df5903f6455489e3e93c4314abe0ea1ce6bb3800cb15dd610bc8bd1c42920dfa629065db2b9fd7edf358ff8ebba53d7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621794440, "uuid": "10f9162b-dd01-4b9a-a4f1-7bacc48015bb", "value": "73160108FFA49841C016AFB1548A4987941B43592EBDF0BF2F6994CC78A7C581687EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621794440, "uuid": "bc34d681-aa48-4b27-b6f1-1e66b231dcff", "value": "98304:k5GKk+jrrhCMTMI+On1L0Mcuw4P4dhdJAiA0vd3iYZQl:SGa7lYRQh0McufP0AiLsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621794440, "uuid": "e344bcfc-2044-439c-99a6-668458850710", "value": 4247039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621794440, "uuid": "d0bcde5b-7cbf-458b-ae7d-e1866f8287d8", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621794440, "uuid": "1bf16149-9e2b-4f9d-8473-f41f785f9282", "value": "DHL663.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f845d07-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778436, "uuid": "2cac358f-d829-4920-8fad-e07c47dd8128", "comment": "Malware payload (Dridex)", "value": "b135cd61267daede090c0234d35a2317", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778436, "uuid": "6f2c0c75-311a-42fc-a68a-a9e103ec718c", "comment": "Malware payload (Dridex)", "value": "a38f6a2abe2b63edf4edf884e497d7a962d9cc6d7b3c51e9ce5b1e38c77c8615", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778436, "uuid": "99d61b19-d9f7-4849-9fd2-a6e96bec107f", "comment": "Malware payload (Dridex)", "value": "3e38eda32b0653bf5efc70a6fb728914457ffa2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778436, "uuid": "88ade251-8e26-494b-a1b0-036d1bc20a3e", "comment": "Malware payload (Dridex)", "value": "fab17c0a53c11cf4e2809482045074f478d5ceba1b35ccc860e0a325e1c2c2373ee5dbd4031737e029ddc69c42417a2e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778436, "uuid": "92f6516f-a816-4cca-8836-9d3c3157b972", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778436, "uuid": "810f1a29-0330-42ae-9e9d-5df9437689af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778436, "uuid": "a3b7f6e9-1b7a-4445-aeb7-43fb729fcdfc", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778436, "uuid": "1ea6adea-5fe9-4c27-8be0-589a894184f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778436, "uuid": "931981b6-7e0a-45b1-925e-48b9c7e0caf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778436, "uuid": "ca92a659-d5a6-41c6-9e56-a8b71266194c", "value": "b135cd61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a108cf23-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800074, "uuid": "cedaf5a1-ffa0-4208-90da-1b1645ebb183", "comment": "Malware payload", "value": "f9886ce6673109aa82df7ab1d61f02de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800074, "uuid": "2f9e78bb-b206-4d82-a360-cec17b38784b", "comment": "Malware payload", "value": "a3c8230cc41b9264326a0e22d81d2e1c33fb776ca959a41b2196d417c92269a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800074, "uuid": "cd9df7e3-875e-4956-96c6-f72f9d94a19a", "comment": "Malware payload", "value": "61d009aaa4d741907722a7830f8d9077903299a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800074, "uuid": "1e9a6f34-c464-4a05-81bc-35be186ca841", "comment": "Malware payload", "value": "55d32d489723c01e3eb01380e8f2e16a7cef308ac27e9a182c1908b112bb441b6437033d3232394eedb6e27d63ad65f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800074, "uuid": "12b641c7-187c-4289-a0cb-956045852610", "value": "CBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800074, "uuid": "1aec72a1-c9f8-4e54-af29-0a0382b8d00e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800074, "uuid": "ec5c56a0-77f4-47e9-9497-4be53afa527d", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800074, "uuid": "5d36efc2-afdf-434a-91b1-0abe44376fbc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800074, "uuid": "d219c147-4ebe-4664-8f94-588ba8a6d160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800074, "uuid": "c4e951e4-e51f-44cd-9e78-c72b0478778f", "value": "f9886ce6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ae24e3-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778446, "uuid": "de2699fe-5872-4b04-84df-a53f2ffb8db2", "comment": "Malware payload (Dridex)", "value": "afdfc5f059fd3fa6767e272783620e71", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778446, "uuid": "8764e60a-3305-4b36-8456-1a7aa65d9995", "comment": "Malware payload (Dridex)", "value": "a3f2c9a5a9cf6d501d6abae551db51e708b4f972457a41677b341e1e7b747db4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778446, "uuid": "7f455391-a7c1-47bf-a80b-b43c5086d642", "comment": "Malware payload (Dridex)", "value": "142a7bdfddae4d4f5658c740b8e44029d0adb5be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778446, "uuid": "1fea6541-b63c-45ad-9135-ea8004d0a064", "comment": "Malware payload (Dridex)", "value": "61a336889a75cc9168f3ed59f3f7c50e3aca0eb2bad68e11248bd5995f26a437790cfa9b7f61088ecd04cd0cb35aa2f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778446, "uuid": "7a5e7aab-0ae7-44f0-8436-60a13a50cee3", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778446, "uuid": "9e8a2323-b08f-42b1-8970-3a1d2c81f1a5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778446, "uuid": "943d2361-5d24-4381-80f6-1af3b64bb798", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778446, "uuid": "e7118887-aaba-4dfe-bcb4-f419ec6b78d9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778446, "uuid": "c52b706c-b8aa-4a10-93ee-d59fb927dc6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778446, "uuid": "17f09b68-9b5d-4cb1-8893-0294883fae58", "value": "afdfc5f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e3fc13-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771283, "uuid": "fdaacb3a-127f-423b-bea3-9e38484d19be", "comment": "Malware payload (Dridex)", "value": "a528e9dc6e2eb24cbe8ecf40cc8b65bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771283, "uuid": "dbd4dac2-42c7-432b-b5cd-e7da54cd3f83", "comment": "Malware payload (Dridex)", "value": "a4302b4a069f82919418c05267ad3fa46bb3e8c24b08144d15260a9d7e016c5b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771283, "uuid": "a2f2389c-bd99-4bfb-b0ab-7f87e4a8e787", "comment": "Malware payload (Dridex)", "value": "714d74d9d2e660f0889dda74513cc36ec38b96ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771283, "uuid": "7676c1cc-7c14-4ca3-b17a-3f3ef5e173d8", "comment": "Malware payload (Dridex)", "value": "08e8d1b6feacedd741b1542bfdf7e21b9db2ba1c7845557526f7789620c90c1429f166ed42e1b1926d3c80e140ba5460", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771283, "uuid": "a6ce0497-77a1-4c72-8be4-8932dc4ed441", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771283, "uuid": "3dd1437b-951c-4b18-9868-238602ae5db2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771283, "uuid": "30eebb5d-1556-4c91-b324-1083b6f79fc1", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771283, "uuid": "b14fdfe7-1632-45d8-baa7-194ee1c352db", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771283, "uuid": "3a19fd98-9e3a-49b7-8bb0-8d962aa19880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771283, "uuid": "0f6f739f-34f6-4b9b-b892-2d7272f38e90", "value": "a528e9dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0c9096-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800044, "uuid": "f47dfe73-43f2-4a9b-b55d-54279aee2f82", "comment": "Malware payload", "value": "f7db7fbca82514921127cf96fb5698ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800044, "uuid": "dad3c949-dd1c-471a-991f-822957d82ef2", "comment": "Malware payload", "value": "a452918281b975851eed945b479bf0d30d8b642ce83dfe090418649aaf1ecb90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800044, "uuid": "8660415c-935b-494e-926b-547e4489ac73", "comment": "Malware payload", "value": "bdb35b985d5af61099ad71b60505cac35179643e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800044, "uuid": "553f59d7-f49f-4ec7-976c-f5932a0a8535", "comment": "Malware payload", "value": "337c4441a2016ba4005f67043b7b58b598017bf4a182c261fb776ca4e325e951d81bd0bf4b7c2e9368d3581195aabfcb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800044, "uuid": "7bfb6a3f-1800-4e8b-9242-8ffd052f7d8a", "value": "32F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800044, "uuid": "953fccc7-4dbe-4bde-8736-d87043646e39", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800044, "uuid": "551f98f7-979b-4288-82ab-5e4d56cde088", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800044, "uuid": "cf0fbb07-d29c-4f39-ab2f-ab273ced36bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800044, "uuid": "b2aac29b-c605-4755-91d2-1f607b445927", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800044, "uuid": "5f7b930d-92c7-49b0-8b38-f6c1eeb56450", "value": "f7db7fbc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e30f7d-bbd8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782210, "uuid": "8de44b8d-bc00-4ae4-909f-857a7d7c0a75", "comment": "Malware payload (Dridex)", "value": "ba9236032b834825dcf3db7ead89f872", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782210, "uuid": "8d94c8ce-5655-4a72-883d-a982a866017b", "comment": "Malware payload (Dridex)", "value": "a4c33524581e4ea34d76af65cb42bd77511a48ff47a2b90bf09ed04717272946", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782210, "uuid": "72af793f-d043-4953-9e7c-21d1b24c7098", "comment": "Malware payload (Dridex)", "value": "e73436e01cf3571433de6924c1cbc1311ffce9d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782210, "uuid": "5f8b2a90-530f-42a9-bb91-80e74d73614a", "comment": "Malware payload (Dridex)", "value": "3efe0eccd155802fe224613738ecce9fd8f384953817fd2b1a9adc5dafbe7dc600b7857be1b10448adbcdf9da90d7763", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782210, "uuid": "fcfa1dba-fbf7-42ff-b7fd-e98f349f4eb9", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782210, "uuid": "305c1997-37d2-4726-8ec3-421848d0efb3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782210, "uuid": "0b6b4bc5-3642-48f4-97f4-431baad57240", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782210, "uuid": "32d84045-6694-4947-b21b-fcd6c45c86f5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782210, "uuid": "85bc68ee-8bf5-40dc-b18a-4dfcbfffd0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782210, "uuid": "95c2a207-9489-4f59-83fd-64a9168ef437", "value": "ba923603_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1159607e-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738845, "uuid": "7f406618-140b-4469-a347-318c750e007d", "comment": "Malware payload (Dridex)", "value": "927efd216b02d26f253084e69da55b8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738845, "uuid": "bcbb11a3-69c1-4bd3-b88f-c290c4fb6e15", "comment": "Malware payload (Dridex)", "value": "a57838e93bb06e1ed186550a3469d3563f5f919d835519526c6d6a00c925b56b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738845, "uuid": "3e705f8e-aef6-4093-bf94-075a05beb049", "comment": "Malware payload (Dridex)", "value": "e37005b9ff6c7978b436218c241f5ca83d9aa764", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738845, "uuid": "43586e71-294c-4eed-9d9f-1cc76520d728", "comment": "Malware payload (Dridex)", "value": "da31151af966ab961710c74d5179d3bca334ef8a426393e08563b8da862019afb2be9ed4665aa12bcee4c2d2462a9ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738845, "uuid": "49414c0b-26cf-4e60-8433-9a9a93076676", "value": "99F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738845, "uuid": "5c387694-6b1b-44e0-a4de-7517ead1941c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738845, "uuid": "67c96c9f-5cf9-4129-ad5a-26643ab5be20", "value": "3072:1lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:1lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738845, "uuid": "6ca1b17e-7bb5-496d-9782-e4a7e25b5e6a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738845, "uuid": "8cd39480-1fa7-4d51-8812-3e5aea480027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738845, "uuid": "39ce6058-922f-46ff-b5b3-c34d0f9a01ae", "value": "927efd21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcec8c8-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800092, "uuid": "8c0a4c74-61af-4be7-a61e-b35596b145b6", "comment": "Malware payload", "value": "e0887377b6ec270ad4b26e0aa7306241", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800092, "uuid": "90562bb2-db82-4ebe-9748-baff89bff64c", "comment": "Malware payload", "value": "a57b624b6736e6dad71cb7e579b087daec88fcdc006c26a20b60fe749cd8e23e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800092, "uuid": "90261e07-f28d-428d-b8f5-2f36990ef8f4", "comment": "Malware payload", "value": "1514a7f75014212eaa53557c9a87b718c63939cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800092, "uuid": "8049ddd0-b71e-4f87-bea0-0190d8525792", "comment": "Malware payload", "value": "33c0893f4c328b450d28657df51ea0107dff6ae471f17069b70cd2113d142122852f3a6230cd299bcf9491a7cae76289", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800092, "uuid": "7a145ec3-5e12-4b86-8064-bdfc1be2dc45", "value": "CEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800092, "uuid": "09815695-e84e-43ff-953c-e667ee0b4526", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800092, "uuid": "13e9117d-816f-4025-baf3-ffef5e3897da", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800092, "uuid": "96eba41a-585c-4d2a-928b-aa615fab7d0f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800092, "uuid": "df8a081d-24d3-4d21-8f66-92f2cb44bc77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800092, "uuid": "9c360b91-eb2b-435a-8510-998b7b663f51", "value": "e0887377_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec2d8a1-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621779320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779320, "uuid": "898c8a1e-a5b9-4937-9d9d-0a5131f9d20c", "comment": "Malware payload (RedLineStealer)", "value": "fad24ed0f7319eaa0b9a38010c3620c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779320, "uuid": "ff5fa983-b114-4d90-888b-a1332261b06c", "comment": "Malware payload (RedLineStealer)", "value": "a5e79ae2f930e6ae8ba7057f14c5b96a7962c0720ddd040a655e59c8dae4b959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779320, "uuid": "fd526251-8c59-4390-ad7e-bfe6d1b16654", "comment": "Malware payload (RedLineStealer)", "value": "22fb8a170b378be7bfec5ce1c2386306fa925faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779320, "uuid": "e3e4bcbc-ee49-4b1b-9b06-cb1ae3db46cc", "comment": "Malware payload (RedLineStealer)", "value": "1e229c3f38d30e18be57dd4377e18319bf2064c1860e0473d1501c8bafa10b7b18677bebd72cbba550f9da1bfedf424d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779320, "uuid": "e4c8c22f-357c-4eee-8570-64d5e9191aed", "value": "FB84AF1067A1C034F2BF22B449795369A53E7EA26F2490FB12D53AED5A346E0EC3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779320, "uuid": "70819608-400e-450c-bc15-6a6e2247d6b9", "value": "15df311e20a736975dcc2997e77a7625", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779320, "uuid": "ffad3d58-80e6-4caf-9d05-43d8602082e0", "value": "6144:actnS90h8tcyhX2zMBgnmW5sxy0t/TVBMmTInT92qPP3Ts5uVrXsTRV:zA9PhX2zMGmW2xy0t5WmMT92WkyrXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779320, "uuid": "a46bbcc8-f782-480b-906d-10386dadbb62", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779320, "uuid": "ac99ef25-24ee-41a4-afe9-e5e5973c1ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779320, "uuid": "af46d534-b041-4ecc-9ed7-1a99812c475e", "value": "fad24ed0f7319eaa0b9a38010c3620c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078c378c-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621779201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779201, "uuid": "4c536685-0f46-4b36-9502-8e2256d036be", "comment": "Malware payload (RaccoonStealer)", "value": "31dac136c58a578cd442f036cfdcff9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779201, "uuid": "518690c1-3e85-4ac4-a045-42aeec33a555", "comment": "Malware payload (RaccoonStealer)", "value": "a6fad6eda99cf8a1097f5222d9183323be396ad6ae37e3dfc364d196cf7f64fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779201, "uuid": "5143f109-e8ba-492c-b0e6-8cee7ea28a42", "comment": "Malware payload (RaccoonStealer)", "value": "a9626740d451b6250d34d588596147b7ba6cf3a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779201, "uuid": "654e4bee-2349-4ece-9b61-d968410e73fd", "comment": "Malware payload (RaccoonStealer)", "value": "3ebb24ef7f0dcbca77559b7a9d4737a3b0585c29175a290c89b5e9c5f6a8fec5efaabacbf2381f6bdd8118c039831c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779201, "uuid": "88aeed93-d3e1-4dfa-8760-09dc5b27e66d", "value": "E105F120A6A0C031F0AF06B449B992B8A52A7DB1BF7450FB22DF36D9D6305E59C3175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779201, "uuid": "d4289b73-75db-4d85-9375-6d765e906068", "value": "b37d3fab91f8c78b5fe4ea0b668f6280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779201, "uuid": "99bba9c8-58ef-4374-8169-8a1488084191", "value": "24576:KyJqbb/K0UjCyYSUigSJ4vYwuxFmdLXsL:GfJ0pgw4vYw8mZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779201, "uuid": "ad3f327a-ac28-4912-a4d8-2db07ef4e42a", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779201, "uuid": "016ad216-4973-49f0-bc00-cce92bdb2d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779201, "uuid": "648376ed-9efe-4d64-a488-2ca8e710cf35", "value": "31dac136c58a578cd442f036cfdcff9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5a584e-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810809, "uuid": "591e585d-e1f4-4db4-a40a-ee28f5f8ff1d", "comment": "Malware payload", "value": "2bd446aa57a34fbc7e3fa9c0e561c3f6", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810809, "uuid": "d1b4628f-b940-4107-9cc8-7324130be802", "comment": "Malware payload", "value": "a70e64c91e8704d53a71ea0628203db5b038c05f322ac11e803051eafdcd4f87", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810809, "uuid": "c1adaad1-b26f-41f6-b5f5-cd9b06d9ba37", "comment": "Malware payload", "value": "4cad3d681ca4bb6be6a7c3e6cfdace1cc4650a3f", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810809, "uuid": "f00cb242-d134-4108-be39-32ff4f86cdc2", "comment": "Malware payload", "value": "8bcf2d20bccdda771b2d45c393a01ffec6edaf8fdf2c39c818ea47394cf3a9109e78161349c3b1d054a9a085bafda8c6", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810809, "uuid": "75ada94c-f3b0-4c29-aa22-ec56c0a51079", "value": "F651971AF947D14C9BB9232BDD978562FF1B411B9EA2104C71DCC2495F2080996ACF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810809, "uuid": "2917d513-2d9a-4042-9091-ba65c76a23ed", "value": "48:kxL48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:2GhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810809, "uuid": "17a85c81-748e-4ee8-b9b4-63798661d0f0", "value": 3117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810809, "uuid": "b0745799-243f-4a2a-b92f-5ca5f13a9e6e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810809, "uuid": "a2dad3c6-cefd-49a1-a11d-6712c81ff366", "value": "7xKjK0Ap.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537fbb9c-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749693, "uuid": "e45a2e86-4ae3-45d6-8b0d-038a68d4e40e", "comment": "Malware payload (Dridex)", "value": "8df83be8b44bfe5f904fd5775ef29de1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749693, "uuid": "2c1b663d-7189-4d31-b684-e7e3e0d9509d", "comment": "Malware payload (Dridex)", "value": "a7a132e26fd7470698be2512a755e8319ce97863a82d8ab05a4d76b7053ac36b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749693, "uuid": "a5d3e713-0c41-4097-8744-45e894d651ec", "comment": "Malware payload (Dridex)", "value": "ddb9ac1133bb8664d1ef822c419558cf514e0e53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749693, "uuid": "bd190ada-1f62-4d7e-a615-a5cbd20fb50a", "comment": "Malware payload (Dridex)", "value": "564c09a65f47dc2b71796ddfe8c6010fe2ec7ff3d1173a3130a86ff356b8ee7a16cabfa237b7c0775070fe2fc5f974f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749693, "uuid": "6dc4e03a-7353-44fb-9860-3cea2950798e", "value": "C5F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749693, "uuid": "e7dc64bc-7675-49ca-8b23-6bfc311c81cb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749693, "uuid": "ea562056-f58a-4c7f-bf2d-84ba0c457cf2", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749693, "uuid": "14d0d8cb-77b9-4af4-97f5-3edd6c8cc2bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749693, "uuid": "343a8945-09e3-4ba6-ba7d-8ec5dece6808", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749693, "uuid": "6d190bda-b3c5-4701-b526-093e99262980", "value": "8df83be8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4853549-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810844, "uuid": "b2a965b7-d41c-4300-ab0d-b4448344064c", "comment": "Malware payload", "value": "3748caeb3fdedc0d026416cf0019294c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810844, "uuid": "bad540f4-cc03-427f-ab30-a0281551ba7d", "comment": "Malware payload", "value": "a7e713f80a72ff8b1cf8f8f4c7bcab229a721df4882dafb6b32c3172c4aad204", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810844, "uuid": "d95b90cf-8054-44fa-b9f7-4e5bfb996188", "comment": "Malware payload", "value": "71fdcbb8e4581b75de57708678b7fcbcdf90b823", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810844, "uuid": "1636c34b-52aa-4cea-8e16-e055d74aa863", "comment": "Malware payload", "value": "772be736186f7768702919f4aacf8f00f4fed6568b4c4f57f13b3ec6bd51a9546f1db144cbd4c7c3d01c95029f5a9132", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810844, "uuid": "23d0d529-e194-4c09-8ea9-193a7f689748", "value": "43F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810844, "uuid": "03010758-ad1e-4cc9-af80-b651c9642d89", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810844, "uuid": "2924617e-939c-4107-aff8-c8411939aa17", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810844, "uuid": "72efdaea-0e99-4b44-8d6b-009be461ef0a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810844, "uuid": "7dc65f6c-8833-4a54-854d-b76e9ff781a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810844, "uuid": "c2095fb7-7b86-4b33-9be6-13823dda37e7", "value": "3748caeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249bbaea-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767653, "uuid": "fde8c7f6-72e3-48d0-94a7-3c67483b8e31", "comment": "Malware payload (Dridex)", "value": "c054394a5108b6f313317e81de870be8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767653, "uuid": "884691b5-01e3-4405-bfcf-d675ef6f6575", "comment": "Malware payload (Dridex)", "value": "a7ed335fdbb2f4513ca5e7165f13c42591e3c1927c12a78aa028be3d45555aea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767653, "uuid": "49745424-039d-48d4-970b-0e979ac3a3fa", "comment": "Malware payload (Dridex)", "value": "140f2e0b4c17b63f3abdc98c2a0efaeb82608551", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767653, "uuid": "44163bb8-9e53-4db3-950f-1f412ba2724a", "comment": "Malware payload (Dridex)", "value": "96a9840e344201ed554979fbdbc9a6b0f24c3bf55c49035414605169ca0dcd4a842316d5b500dc8060ad4f194db2aa0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767653, "uuid": "97e8df13-b670-4c53-91d9-55ea5e98b3ea", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767653, "uuid": "25a86434-943d-4133-bfc5-b36ff6f355c7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767653, "uuid": "6fd0f7c5-7f94-4e0a-96ae-09673784a7d4", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767653, "uuid": "b75f0c24-0472-404c-806d-258abcd08cd4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767653, "uuid": "54bff5eb-48df-4090-bf57-d9042109cd72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767653, "uuid": "769eb2bc-2c3b-44dd-8b09-3c2e70b4b1c8", "value": "c054394a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b30635e-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760443, "uuid": "11de9a70-c27c-4795-bfb1-0228afbb525a", "comment": "Malware payload (Dridex)", "value": "c3e26425bd469c6f323b122512e9f6c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760443, "uuid": "caa1116f-7015-42cd-b130-e6fdb6cf6295", "comment": "Malware payload (Dridex)", "value": "a8cac42136887704b54d90436a9639c41b27393c5e588b5df9b6d6130dd4daa6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760443, "uuid": "c3836392-bb1e-496f-b26c-be59b9253e97", "comment": "Malware payload (Dridex)", "value": "4c475ddee0e19dd157798c41e182ad41a531c0a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760443, "uuid": "f4f8f038-a9e8-4fc7-9c22-bd3a5d2db3a8", "comment": "Malware payload (Dridex)", "value": "75e4b21c9a57ae3b0c09a5684adcd1b92be45416a414006b5a1f8d2d361f4b04fc5c724688c87b9f6b037e6a542cff91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760443, "uuid": "093dbc9a-f98e-48c5-9295-47d78eaaeb8e", "value": "5FF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760443, "uuid": "fa4dbaba-d927-40cf-8b31-235866022bb6", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760443, "uuid": "086b8784-3e98-435e-83d9-315891385086", "value": "3072:l9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:l9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760443, "uuid": "50d66792-eba0-426d-8458-15e46e1b8321", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760443, "uuid": "5c90d6b4-edd6-4e2f-a687-05b954b1c090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760443, "uuid": "b89d16d9-c9a6-4137-a5b8-0b07e2785566", "value": "c3e26425_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b01197-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621778453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778453, "uuid": "f81a4b40-6905-4c49-83eb-7bde348dccdb", "comment": "Malware payload", "value": "83593af567d3a1872a71d51c3d4ffd3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778453, "uuid": "3e0879ae-8b59-491b-bcbd-d32074881ae4", "comment": "Malware payload", "value": "a8d4bd61b0a8d9cf68ac1aea6794c7728f8ac55298dac1f3cc283f7e5e606fb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778453, "uuid": "11433238-0b12-4c6d-a874-e6e19d98eacc", "comment": "Malware payload", "value": "8cd225933b8ae781d0024409d952d8c37b866799", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778453, "uuid": "7f820109-f0bf-4f1b-965d-92cb281f0c86", "comment": "Malware payload", "value": "bead06af4437c12bc9ad3187fe14407616b0cda52225505d7129d290bb476136f11864b7913e1b27c32b4c89b310a6e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778453, "uuid": "532acb04-9531-4c93-b02b-c9a43356b2b7", "value": "B704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778453, "uuid": "54ef4cf6-5c15-414d-82bd-f65c3f98e8a6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778453, "uuid": "e9cadb76-53c6-49a6-b29d-7865723d0e1d", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778453, "uuid": "e42060aa-3941-481c-bc23-124e2d95a547", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778453, "uuid": "01daf5f5-f7b7-4dd7-9748-7acd23a58aa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778453, "uuid": "bba1100d-7cd1-4ff6-817c-89158501a334", "value": "83593af5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d795310-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771265, "uuid": "2e14632e-5c84-4751-9596-15d45dd14689", "comment": "Malware payload (Dridex)", "value": "465020f14667bc5dfb563689f407f079", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771265, "uuid": "3ed4307f-f926-4943-b61b-f2ae0dc00b9a", "comment": "Malware payload (Dridex)", "value": "a8dff877a0164cc9a24c14e8f6ca4870c56106bd3afbfd9a3b197b3666e0d35f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771265, "uuid": "1715530c-fd77-4acb-9362-6e2bfc1e890a", "comment": "Malware payload (Dridex)", "value": "c80e6e97f1f40652ea629e51afca4a51bb3f66d6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771265, "uuid": "a66da46b-d47d-4880-94d2-2077eb969e8a", "comment": "Malware payload (Dridex)", "value": "ee82fd010abc5f996c5262be31476cf0e802422fa06c3232a4ab2d1aa9146114092ed5bee0320f354368f9c5547a1707", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771265, "uuid": "a9a83cc8-1438-4b4b-a887-1e03f30b9994", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771265, "uuid": "8d29310c-e096-4251-a797-f9aef6db061b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771265, "uuid": "a17537cf-cad5-4b17-b169-d7696a429c80", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771265, "uuid": "e04e7c2b-18e2-489f-bf08-19470ceffcff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771265, "uuid": "60eeab80-53ea-4b95-8f65-6381a710212b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771265, "uuid": "af222334-f2c9-4603-b54d-e7e0dd59a598", "value": "465020f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d112691-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731643, "uuid": "533e5df2-fe4a-43e3-80c2-4b553ed30003", "comment": "Malware payload (Dridex)", "value": "5d06d3276fefef007d86d09d6a17f27e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731643, "uuid": "0c2c1099-3655-4f28-a207-84202d522ba2", "comment": "Malware payload (Dridex)", "value": "a91fb0618314dc59323d7337777598e7ecea49df97efeb1b39c3e5d3d445bff7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731643, "uuid": "24f87634-8a04-4fb2-b3fa-40868498cc51", "comment": "Malware payload (Dridex)", "value": "f003a95d11072865f0d6136b55eb7863276a9719", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731643, "uuid": "24493104-f5c9-49c1-b234-357c227121e9", "comment": "Malware payload (Dridex)", "value": "eaeafbdce5b6b8d0d5a45c4624425a33363bfd966ad7e26bb14a6f34f591afa170857ba517ac0ad4e9baf57a84d8dd71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731643, "uuid": "7d906517-37d4-4977-a724-7f7f5cfe2b0d", "value": "7FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731643, "uuid": "c60f5010-1096-40fd-a4dc-fda610ccfd09", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731643, "uuid": "0f2ff1ec-dd50-444d-8f3e-4f4cf2e86018", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731643, "uuid": "52f76b7f-f5e3-41b1-817e-add0a7f178aa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731643, "uuid": "cb154be9-8970-4afd-a11d-3244ee670907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731643, "uuid": "94c81560-9d6c-4574-a599-da8487c47218", "value": "5d06d327_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d492ec9-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785707, "uuid": "57041c36-1077-4cde-8abb-f05a531fea22", "comment": "Malware payload (Dridex)", "value": "8ef09763e91802d4aaf80d804eded3fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785707, "uuid": "8f7206f7-cd5f-4b86-a798-ec5f4fe7fdeb", "comment": "Malware payload (Dridex)", "value": "a9c02219234829a84768018dde2d659f9b4f19edb23233c65663783c8ddf1a1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785707, "uuid": "de6d7c59-8b8f-4c02-aaff-60fa8c3fc89d", "comment": "Malware payload (Dridex)", "value": "a07a35b3c0f68ee98f1ad2f1c5e358374cbc55c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785707, "uuid": "d0e1bf90-5eb6-4c03-a020-96c95d6f4ea5", "comment": "Malware payload (Dridex)", "value": "78ad575c4806d407614e3c82158f10bbce29cb5cdc01b71c6adec00845ad493994582d5a9f601318262b6eb11d387198", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785707, "uuid": "16428164-7cbb-4ca2-bd29-d135fb9380d4", "value": "B9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785707, "uuid": "8f1b9319-e3c8-453a-8a7f-7f67a37cdacf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785707, "uuid": "b4e5deb5-53ac-44de-970d-fab6adb71b39", "value": "3072:Qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785707, "uuid": "7397b9bb-b8e4-4bed-b516-e1192d01ea7f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785707, "uuid": "41222024-a169-42b1-b540-077c3981bfe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785707, "uuid": "ec237126-5e1e-4052-9d7c-c9abc336a86b", "value": "8ef09763_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d5f9c5-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1621789231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789231, "uuid": "7963e493-b048-4500-95b0-40a9a0672efb", "comment": "Malware payload (Adware.FileTour)", "value": "27118a12fe3aaac9fc76624ceb4ec722", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789231, "uuid": "64aa9916-fbae-4633-96a1-7cc8c266c9b4", "comment": "Malware payload (Adware.FileTour)", "value": "aa9be79c40da851c806a4cbd196aad2731e57090c5c4e0bb107437073e0ebd11", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789231, "uuid": "f433a835-db8e-45ea-91a4-d7fb7bb52227", "comment": "Malware payload (Adware.FileTour)", "value": "912c07ea3c0f3399c9c0b87524b763e11f50d322", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789231, "uuid": "6660b248-5274-4aaa-8929-cc442077737d", "comment": "Malware payload (Adware.FileTour)", "value": "2889398506dbcf55cc15c6b05430e142152be4a524621de3e676013e025731a98cc2388276663c99023bb8a60ed5e8e1", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789231, "uuid": "e861a440-ccf6-4c4e-8be7-6f01505d71e0", "value": "68841243F3F19439E073CEB05C90E962893B79254DBC650876ECAD8E9F3B5829256783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789231, "uuid": "6852a4d2-835b-43a0-8193-ee5edfddd3da", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789231, "uuid": "ea8a209a-b934-49f8-9fa7-9e5687649379", "value": "6144:x/QiQXCakm+ksmpk3U9j0IBeOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3aP6m6UR0IBelL//plmW9bTXeVhD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789231, "uuid": "befc7bf1-486f-4463-8fa5-dad8cbbef891", "value": 390088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789231, "uuid": "47c9a31f-dcff-421c-8f6e-6a1f623d8cdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789231, "uuid": "bb37a42d-cdfe-4dde-92f5-ab53550683a7", "value": "27118A12FE3AAAC9FC76624CEB4EC722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2960a44f-bc20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621813188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813188, "uuid": "459913b7-7d9d-447d-9198-ad0f2f39d6b3", "comment": "Malware payload", "value": "86197f35f1d61be6782f1e6c01b5516f", "object_relation": "md5", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813188, "uuid": "be819845-50dc-4ec9-9f04-cb42c4cfef49", "comment": "Malware payload", "value": "aa9d64a497fdc12d21398258cfc799eb1381c9689f0c7d5851fb1d6dfd00566a", "object_relation": "sha256", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813188, "uuid": "fa8a76af-c4da-4fa6-82c2-6e8d11e7e494", "comment": "Malware payload", "value": "de5798e8cb0085d3b242bbb4ae7c58524019ba76", "object_relation": "sha1", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621813188, "uuid": "91cbe0b6-7441-47c4-aa91-f088b2b56dc0", "comment": "Malware payload", "value": "bb7de2d245829f2c831e77514943c15e4c8359f635b9e3dc346fa9cd1b6ba3817c641f321fc2e2b9abd4f72897c02927", "object_relation": "sha3-384", "Tag": [ { "name": "PurpleFoxNuggetPhantom", "colour": "#455EBC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813188, "uuid": "2cac2820-4cfa-4772-b6a8-da6190a43c5d", "value": "4A124A566E6556F8E74FAC5014CE3E82CEFED21B2D1F28E274CA4D0D309AC1A78674B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813188, "uuid": "3275b157-c3a0-4ab6-93a3-1da3db037d91", "value": "192:u7d4KUEgs3e3H7PzHUprboBRFu7GMnntoQIf5UduNIgNF70T:wd4vEgsgY7G6ntlS5UdiIc7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621813188, "uuid": "afbf437b-80bc-495b-941a-98bed74bea6e", "value": 9852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621813188, "uuid": "71a91345-6444-46c4-a99b-c37221232745", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621813188, "uuid": "bad819ff-0fee-4857-8e56-800f0d5567a5", "value": "RgpfzQKx.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87be355-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735286, "uuid": "a547b2cd-eb5f-4acf-8012-9ff2e64fffc4", "comment": "Malware payload (Dridex)", "value": "9607942e39a24edce1e3c2ee796a67f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735286, "uuid": "1f5463a5-d3d3-4c67-ace6-7a4eb0805818", "comment": "Malware payload (Dridex)", "value": "aacecf3f56f06f740c615ff2b32dd94c25311a4b720c64b4ee22d3da93f3083f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735286, "uuid": "e4369b45-67b4-4e2e-acc7-cbb0331acf24", "comment": "Malware payload (Dridex)", "value": "d239ad4c014c45f528ec353d56cd5bea5b35b78e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735286, "uuid": "ca08be7c-b7ba-48e7-96c9-d916a2d7b50a", "comment": "Malware payload (Dridex)", "value": "d18fd3dcc9c4fdcfd064c854f5109d3fd19cfcc6cf30d33f7d7a6c0ad094ebd11415e6d126ed5802da0c756ba30c2adb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735286, "uuid": "8145aca5-79cf-439b-90c5-0c710f82c052", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735286, "uuid": "35e0c4e9-2d6b-454a-8a90-80bccd29ec1a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735286, "uuid": "d2c9a482-7bdb-44d5-8573-21227cb4ccb9", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735286, "uuid": "8959e6ed-9dd8-4da3-a43a-56a25714b377", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735286, "uuid": "ef62559e-d7a2-43bd-8bfa-5d6d4e0bf6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735286, "uuid": "b098a64d-30a0-4d63-9cbf-ba1181d362f1", "value": "9607942e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a95cef6-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749705, "uuid": "a6bcc912-e0c1-42db-b4cb-24bc6369572f", "comment": "Malware payload (Dridex)", "value": "4a8ed6d742bcf9319f2fa16acd384b74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749705, "uuid": "d6238a23-ccdc-46d2-afec-24ef85091fb7", "comment": "Malware payload (Dridex)", "value": "aadccc9d4fa9a4f577027bc5c3fe2a892c35e95b6dca05ccee00242cf6a29d67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749705, "uuid": "5e08c068-2ee2-4382-a17e-875ce88bc7ad", "comment": "Malware payload (Dridex)", "value": "f3e7d1d49a94676ca474c8f9d34324b170ffc3a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749705, "uuid": "4cb32296-f908-4b7e-b08a-7bab5808123a", "comment": "Malware payload (Dridex)", "value": "0290782a68e00a9943dad2f318c672ed8cced45a6393f408d3b2c1351a5fe8e36a14041c4bab2a6f065fe50ccf10b508", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749705, "uuid": "a1545350-4d50-4aa1-8bbf-cf5ba83d0e9d", "value": "94F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749705, "uuid": "fd27ceb1-3c1e-4cb4-b5f2-a141a98c1992", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749705, "uuid": "0f67255a-e9b5-4ba6-a5eb-5477cf6cd7f6", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749705, "uuid": "4d956f78-8816-4eb6-80ce-e3193d983946", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749705, "uuid": "5915f766-ccc6-4f37-9815-e43caa38c9de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749705, "uuid": "26832876-e2c0-4253-8a10-ef541f47a530", "value": "4a8ed6d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801b019a-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789282, "uuid": "caeb63be-89b9-43a8-b867-f5947cd4a711", "comment": "Malware payload (Dridex)", "value": "e0870492283437c49f7d4fddc0bbfd16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789282, "uuid": "6b735243-1d77-48d0-a13b-b724e960a19f", "comment": "Malware payload (Dridex)", "value": "ab5f34288348391be164c991a21343edc4b546f9f401781d14208c1cc6b549f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789282, "uuid": "09ac7bf1-98c2-4df6-8c33-4b8e73ca52ca", "comment": "Malware payload (Dridex)", "value": "14daaebca841696e3169bb4c28b5b7b46257681b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789282, "uuid": "a35dc494-236b-4023-ba53-69ab5804c423", "comment": "Malware payload (Dridex)", "value": "c3e573c5f853be6082f1f41b74e9a72e9a882544fab188c60a83618bdd0c52d2b54fb2ea0beea635d584249fb5533d7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789282, "uuid": "8bd7a5fc-8cfa-49d5-b05b-6212936848d3", "value": "0EF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789282, "uuid": "3d22e817-1256-4466-a67b-99f26b31b80a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789282, "uuid": "b6129db6-78c2-4cf1-971a-0a69feecf260", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789282, "uuid": "c39c85a8-65fd-44f4-a0eb-6fecced1d7e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789282, "uuid": "25f5b944-0de0-46b3-bf29-d66a766014c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789282, "uuid": "84d7e2bc-806d-4ec1-ab68-eaf077021438", "value": "e0870492_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618c94a1-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1621779352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779352, "uuid": "b0be2c52-949f-43f5-830f-604ea2522a4d", "comment": "Malware payload (FickerStealer)", "value": "49707bf912e8eeaa04d2928c25c51890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779352, "uuid": "99188ed5-6552-43eb-be58-37871db5bfdb", "comment": "Malware payload (FickerStealer)", "value": "abd4cf7d1a34383935fa7c757e96752ff61353f3b8633cf9a7ad7e059c3d8761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779352, "uuid": "8cdcbb9c-a807-4106-a6cf-655aeb162fa8", "comment": "Malware payload (FickerStealer)", "value": "6853b3f60aeb34cf15f23ece531edc308ac082bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779352, "uuid": "6251747b-8737-4997-bb08-28f3cadb49e6", "comment": "Malware payload (FickerStealer)", "value": "e3c67efa73b38e0ab5b81ffab3738b7949a57c697f7aebd2a3a184b740dae2993d4e694b297825c6be99ece1075da6f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779352, "uuid": "b13b4033-479a-4260-9ed0-fe5c5eb636f2", "value": "6194AE30E6A0C035E1FF12B989B5C278A53A7DA19B7440FB12C63AEE46349E59D3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779352, "uuid": "6cc0d869-fd06-4714-b958-d41951a9a290", "value": "504bef34255b8691aaec7482375c58bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779352, "uuid": "fd8889ef-09a7-4ea5-8f14-58ecf777ee11", "value": "12288:EeyBo/fhIOQds1sp7sIrf0SHU3GMXXsLN:Pyu+OQcsDMUUTXXsLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779352, "uuid": "71ab22c7-d651-49cc-994c-6e5733b29d1d", "value": 418830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779352, "uuid": "b0192e62-6060-446f-8366-84b63c3aab94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779352, "uuid": "f614e708-379b-4dad-997e-784094ef1fb2", "value": "49707bf912e8eeaa04d2928c25c51890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba1c841-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774940, "uuid": "894312cd-fa4f-44e7-88e3-39eb1020dcd3", "comment": "Malware payload (Dridex)", "value": "3a6ff37dbb92046e616a670e8610c8e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774940, "uuid": "7624c4da-2878-446d-a69e-45bc338eeea4", "comment": "Malware payload (Dridex)", "value": "ac63193b66b95b466af38f19f18fdca34b6d83ef4b4cfcc775c3749f37025cf6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774940, "uuid": "a892cda6-9931-455f-9374-8041274b34d1", "comment": "Malware payload (Dridex)", "value": "13cf55d73cb92ec6dfdaf16fb49ee73ee93181ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774940, "uuid": "a97dba80-96cd-4791-933e-1b32470c3475", "comment": "Malware payload (Dridex)", "value": "37992e1438061440f6f08a0a416bd872e717e80815487a39d52eebd3f884352307dce91cc2f8f6e588c09c2a6c5290a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774940, "uuid": "337a6d88-1738-43cc-8a9a-97af566335a9", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774940, "uuid": "973afad4-a06a-42b3-ad87-05449b4cdfdf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774940, "uuid": "4183025c-7752-45bf-80f3-e565b8a057de", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774940, "uuid": "6c9b05ab-66a1-43d3-a655-358dac160900", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774940, "uuid": "7c207962-4327-4f32-9e22-bc15731331ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774940, "uuid": "691ff516-7b7f-432b-8208-b3306417dfed", "value": "3a6ff37d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac115736-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735239, "uuid": "4920717f-1068-4ea4-aaea-f53f26d940ae", "comment": "Malware payload (Dridex)", "value": "9faed39ea1b35427327d54125aeabad3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735239, "uuid": "26e61e72-26cb-4bf8-a146-6508fa5db0e5", "comment": "Malware payload (Dridex)", "value": "acb233befc2a344f2283c909b264722dc0f5e0cdc7eff0491fc0e43aac65bb25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735239, "uuid": "749a0054-4aa0-47ad-a9e8-53bb122d18bc", "comment": "Malware payload (Dridex)", "value": "679099ee222c20c0db008c1427caa828eae90ec8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735239, "uuid": "b82fd3dc-b61c-46a6-8342-be7782801feb", "comment": "Malware payload (Dridex)", "value": "1c70be6a4cff1508b844ffd06a2dcadcf59f6692d22bc55bf2c236b7190c0a9b1463d063d830bc69fe3d8fb57898e87b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735239, "uuid": "aea39b34-3ae1-4fbf-96a1-8ee3b66ccf6f", "value": "7DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735239, "uuid": "14d5677c-9edc-4a6c-b366-62cec1aeabdf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735239, "uuid": "438310e3-ca68-4892-8a9f-179a5a1bf1ea", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735239, "uuid": "6ba904bc-eb18-44cf-a09f-85188bbda65f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735239, "uuid": "21cda950-8383-4315-864c-94524ff2a517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735239, "uuid": "d4b28fdf-b6f2-44c6-b247-04c54e6340f7", "value": "9faed39e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea68f47-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785655, "uuid": "760bba2a-8cff-4910-ad05-03c160b1fd6e", "comment": "Malware payload (Dridex)", "value": "2d23fa61a8aa564124c743905d7cba65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785655, "uuid": "25b90b5f-1396-4524-a2ca-eef2c6283141", "comment": "Malware payload (Dridex)", "value": "ad8f72d34231fae8e73711121624b108cf201a01c5475b039eb356759c33bdcc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785655, "uuid": "24cd80b6-6f03-4446-a208-72456c47b37d", "comment": "Malware payload (Dridex)", "value": "c507d421e62ff15decf503119e652eb865b31bb4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785655, "uuid": "84f983b6-4e3c-44c3-92eb-421b3ea79af2", "comment": "Malware payload (Dridex)", "value": "c83eed78ce9954a1d77d2df42978437fa9b5b7cff0be4069982963cc3022233201f7100af87898ac67e320be32b3af21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785655, "uuid": "8d019bbe-d760-42a5-a812-ddb9c2ab4cbb", "value": "62F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785655, "uuid": "ea67d336-8c84-40bf-b997-14161290511a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785655, "uuid": "07acfed2-30a8-4e3a-b5e2-ee0cc6bb63f1", "value": "3072:/A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:/3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785655, "uuid": "e8159e02-3f8f-4be0-ad36-b905270d9ba8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785655, "uuid": "6ac316b4-8937-4637-8d00-f6f34734f0de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785655, "uuid": "6377e29d-eaf0-4550-8c70-d96a465593ba", "value": "2d23fa61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeddd81-bc1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621811426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621811426, "uuid": "7f7c2b16-b1d3-4a6b-8ef6-523158c6074b", "comment": "Malware payload (RedLineStealer)", "value": "a481840577935cb609055493968bdbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621811426, "uuid": "a3346c46-0186-4f70-bc5d-3eccaac6861e", "comment": "Malware payload (RedLineStealer)", "value": "ae990cf48bb85bcd47b72d4d1b3ccf8d751be2a4110f9d052b6096fd9bcea108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621811426, "uuid": "21369b8e-156f-45a1-8164-990e13adba67", "comment": "Malware payload (RedLineStealer)", "value": "ff880e004b8cbd62434a8571fa2cb73477745d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621811426, "uuid": "051dd496-ac87-4cda-84b8-0bf704d477bd", "comment": "Malware payload (RedLineStealer)", "value": "a0ba93acaf405816062d5adfe74c1fe436c5ae1a3d02c2929850faa493592d16956cf82911e3b6c2b4ab05160413c0ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621811426, "uuid": "f1fa0446-7edd-4213-a53a-c776c4754b92", "value": "70048EACBBCA6F47CBDC4D3EC5C0561083B5CD25404BE31B698137E826AFBE6760654A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621811426, "uuid": "16735437-2046-4fa3-9967-e3391bf3b38e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621811426, "uuid": "f8ae026e-df16-4ab0-b806-6e37ca35b6ce", "value": "3072:5GnEg1lz3GJjJNBnEbxmceF1OP+GMBAWcp2XknJqEkFl2b:RJJNNBnEscAODM3Xaq/Fl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621811426, "uuid": "6fcd36c5-1c77-471e-a942-3a572446ea84", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621811426, "uuid": "974c52f2-e6c5-43ea-95be-39aa29d2a104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621811426, "uuid": "837241d0-6d01-42bf-838a-8865843dff42", "value": "a481840577935cb609055493968bdbe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2f28d7-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621751882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751882, "uuid": "9e8d3d9a-41fd-4951-8605-860e24d4a1fa", "comment": "Malware payload (DanaBot)", "value": "2809de5c1d9de29a85dcd05e179b70e4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751882, "uuid": "1944ace9-74f4-43cf-88eb-511d46ca9e99", "comment": "Malware payload (DanaBot)", "value": "ae9aabd03661ced937c594cf83df2303a5991e3c2382474111e69322e6f22f32", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751882, "uuid": "f2f12aa1-8a78-4b0e-9d49-475122c40899", "comment": "Malware payload (DanaBot)", "value": "5d8814ebcaabf09d9e7b033e105371367a9e09f2", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751882, "uuid": "160bb5e8-58da-43bd-8cd8-77e25abe6e2d", "comment": "Malware payload (DanaBot)", "value": "ae337b02a91dc0260040f597f590d8c20f1ef9425b142865731975615be4d02177163072d76bba57abebff58ca004545", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751882, "uuid": "b3a48e9c-defe-4a1d-9370-ab2c644d2774", "value": "E3452391A98A983AFD908CF0DE31AB1D94B76C660534E32B03A6FC9E75778944F107D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751882, "uuid": "7cd7aacb-b4f4-44f3-b643-aae20e822561", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751882, "uuid": "d82ab7d9-a06d-4756-adfb-f85743c83fc1", "value": "24576:ZH1ZKjj8ndBMq4HVf84B3htQoJ6oZ5GTCB1dVp1Oj:h1ZSj8ndlj4ntQofGTC9VpUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751882, "uuid": "bad9c9e2-3792-4a5a-9716-bbb6598fe1cb", "value": 1265551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751882, "uuid": "d992be85-ab49-4c7b-9972-bb2e3b352222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751882, "uuid": "7ebecf50-95f1-4f6d-b687-1ae388659a87", "value": "2809de5c1d9de29a85dcd05e179b70e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f227a5dd-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728055, "uuid": "a5537084-d938-4fea-88ba-bcf392c925eb", "comment": "Malware payload (Dridex)", "value": "24b05e8abbb1eda7e28c150efe1d84f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728055, "uuid": "fb4097f8-3641-4796-b8fd-ccba22f7c9cf", "comment": "Malware payload (Dridex)", "value": "ae9fd9cc89a6430cdfbd9d44f1b1916b115243a4a988f3958187c751b75e6ff8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728055, "uuid": "e9045c73-3857-4109-9ea3-d6e3c835f130", "comment": "Malware payload (Dridex)", "value": "74644aab67a4de4496451d8171f2e68b69f97bc0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728055, "uuid": "feb4bbbb-8810-43f2-a27f-9c57d1a7ef24", "comment": "Malware payload (Dridex)", "value": "1ba12ad460e624b03d8386508803306aa143dd11f97cb9693e8e5c37e0bf5e3c3b91169e8cc40962240d9220c92f6c32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728055, "uuid": "1e70c2f0-c82f-48f6-8f2d-94dd404e2993", "value": "39F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728055, "uuid": "24509f49-0c96-4aa5-a562-7bd294c22e55", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728055, "uuid": "b6eb1787-10e9-46a0-bb7b-b0d5fe016bbe", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728055, "uuid": "9b3ae918-51b8-440d-b9c5-147d4e708527", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728055, "uuid": "44d9bd32-001d-4f57-82cc-f50c7454cc09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728055, "uuid": "c9799599-adda-437b-8c8c-54bb2c4a4e8d", "value": "24b05e8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588d7248-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749702, "uuid": "d64919e1-1362-4dab-97b6-ee2516daa61e", "comment": "Malware payload (Dridex)", "value": "06b318ba737806875e13136d49aa1641", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749702, "uuid": "396a0470-cd5e-4812-9417-162cebd08797", "comment": "Malware payload (Dridex)", "value": "aeb5b3cb65297fef0f73defdf9b7816f85e6446537f1e6964aeb9212df1dc96a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749702, "uuid": "e19b751a-f562-4b33-8e80-036224d26a1b", "comment": "Malware payload (Dridex)", "value": "c86432023bab24ec2253eae5a03c3feb54632391", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749702, "uuid": "877b6583-a188-4954-b448-bc12c900a5a6", "comment": "Malware payload (Dridex)", "value": "e2ccdaff10c3cf505ab437eb7eb7526c8be6960a4d89a110e3a03f118e40f418a0191007337a01cec6da46d6866e7db3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749702, "uuid": "8362edab-01c3-4346-b252-5a73c149578e", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749702, "uuid": "f3d8b281-5f47-4716-9fe1-1657f95f6260", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749702, "uuid": "1dc66401-2811-4a89-bca4-c0633d71ee3f", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749702, "uuid": "01ada99e-c467-4158-8c38-417b8673b30a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749702, "uuid": "3964d134-ad0f-4200-8eb7-d01dc274a9de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749702, "uuid": "cfc45aab-e3fe-408b-8fc0-efca7174e212", "value": "06b318ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596c3dbb-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731664, "uuid": "bdd4b049-3a57-4fe4-b395-86a78caf55d5", "comment": "Malware payload (Dridex)", "value": "514e60ae122bbca5f66b7ceefaffefba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731664, "uuid": "3383c569-332a-4704-b94d-e76cd61b1295", "comment": "Malware payload (Dridex)", "value": "af11efc66b9714e7f481eae8123c249baac5ad9a26a0c12f5c56737f5c9d9d4d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731664, "uuid": "35bfa0eb-ca76-4211-995e-c0f1de1cbf57", "comment": "Malware payload (Dridex)", "value": "da1124ac276b8dc9e323dd54ae41ba83ac33d9e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731664, "uuid": "09872f80-7485-44c9-a763-b8a1b3eadd5f", "comment": "Malware payload (Dridex)", "value": "a7194a335673cae74c3119a5e43f769c1bbc74a9b9e720bc482fc9a07b8a9dc80157b5be3644c407e2a20bc3cdee647e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731664, "uuid": "63dccd59-3b50-4234-9570-c0ee34188831", "value": "0AF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731664, "uuid": "a2ed5b8b-29a1-49bb-be59-7f837a74dc6f", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731664, "uuid": "3e2af9aa-bc2b-4c56-afcf-adee95a3b9fd", "value": "3072:P9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:P9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731664, "uuid": "eafbe8c4-e400-4b8f-9ee1-95762a93b1fc", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731664, "uuid": "3a284c32-9793-4465-947e-4172e5d55026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731664, "uuid": "6e139a8a-c655-4165-a0cd-f96d9a658b26", "value": "514e60ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f23af5-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800049, "uuid": "ed5884cc-f4e9-45ba-825a-b858810f3fe4", "comment": "Malware payload", "value": "e370e559ef9ce52e32789c1e60e2aa12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800049, "uuid": "1be753b6-be79-47e7-8f49-f4eaa59c7925", "comment": "Malware payload", "value": "b06a6d85bc5851aa2954f74180cb77e407f7fac5d494cea5b87f524a7d76a143", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800049, "uuid": "f7b377f6-7ded-4295-849e-cc0ea5edf072", "comment": "Malware payload", "value": "1e8e7e12a7393b140c13ece8e011cac9da2393cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800049, "uuid": "555cc8f6-c5fd-40f0-9d9d-f57d275348e3", "comment": "Malware payload", "value": "5041614b0fa1534863c0fc3ea3841574c25b9a6c41e742afdd570480ea29e7b8266aca62423d9350d80c800e6303a04d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800049, "uuid": "b7066bdc-6f7e-41aa-9d2a-941e9b3c4310", "value": "CCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800049, "uuid": "29358650-79e2-41f4-a56b-526e88fdf992", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800049, "uuid": "b3d218d9-f6b6-4a75-b1ae-e97f893c1448", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800049, "uuid": "94b25c2a-3e5c-4ece-9e5c-8d78cfebce7f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800049, "uuid": "f3f1b46b-b9b9-4499-a3c9-8d5dd55d2c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800049, "uuid": "a0abc72d-bb88-4586-83c5-a175013277a5", "value": "e370e559_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7c5fc8-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760449, "uuid": "2ded6ed6-9488-4f6d-9580-204743b1693f", "comment": "Malware payload (Dridex)", "value": "52f1890302ff7fe71d597fc8a3a1ba0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760449, "uuid": "b0c96d7b-6b70-4fad-926d-635f354b383e", "comment": "Malware payload (Dridex)", "value": "b1451b13ae62204733a931f973a985517167d3d4847e28fd84c89169f65c1624", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760449, "uuid": "0f1cb25f-248d-4e23-95fa-7d37a491bba2", "comment": "Malware payload (Dridex)", "value": "420b5a0d69b059a5af62753f13c6fe49b48e503b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760449, "uuid": "207020d6-f518-40b4-803e-edae7c2c3101", "comment": "Malware payload (Dridex)", "value": "5d47d239d8d51041013b3ebe6d33f850d70dd8a14e0d7d7f5b87d6e58b70f3722895b0fc13bff32a35854263421ac627", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760449, "uuid": "6fefc105-be18-4dd7-ace8-dba3d3b6291e", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760449, "uuid": "4a4b8024-8f8c-4b6e-bdc2-88332cf7a2ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760449, "uuid": "e1fcdc87-4d44-4276-a2b4-a5835722540e", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760449, "uuid": "d064db46-925c-4522-99fb-3aca2d7104a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760449, "uuid": "244b8a25-8029-49b0-8c75-d9c107983405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760449, "uuid": "0b552a0a-2334-41ab-a401-86c0fc46bafc", "value": "52f18903_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b92f74-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738939, "uuid": "5cfeba10-a3a2-4d99-894e-af3fcc655adf", "comment": "Malware payload (Dridex)", "value": "f6c6f98cf5e9380f9fbe3c294528296c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738939, "uuid": "ead40339-42bd-4066-ae66-2d7cb6dfe36e", "comment": "Malware payload (Dridex)", "value": "b24fc5f22fd666321792e207107b77a2b5b36dd3d0856b72064c399029d5e82a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738939, "uuid": "d7b8a475-f41c-47bd-a193-72312750f2aa", "comment": "Malware payload (Dridex)", "value": "a201bff875b8d4b97f900940b160c7595c6e9db0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738939, "uuid": "03d13403-181b-412d-9fbb-e44ed879ad45", "comment": "Malware payload (Dridex)", "value": "5892d01a5af9221940bbc6ded288e7752e5670e5ab2adefcef4c5a087185feb14a42f00dacbe2ab65608b2cf469b6fe2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738939, "uuid": "334dff07-f17f-433a-a89b-f8f993212e98", "value": "E3F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738939, "uuid": "e2df61a0-de49-4757-9194-32b38b1e35a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738939, "uuid": "9699d126-059c-438b-aefc-43eca1a0b31c", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738939, "uuid": "e9df8939-4dc6-4718-815e-434211427da9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738939, "uuid": "94846279-106e-4fad-972c-004e5976a205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738939, "uuid": "696dacfc-62b5-49c4-8ad8-d6c2aacd8de9", "value": "f6c6f98c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0307b5-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621764124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764124, "uuid": "bb14ba5b-bda3-45ef-9025-0784b293f967", "comment": "Malware payload", "value": "0ed1c7cd22d8287795e10290129f1a96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764124, "uuid": "1cafdfe4-7c00-48dc-85aa-439ec1c29348", "comment": "Malware payload", "value": "b25097feb53d3473c0614e48f997d3decb646d3db560d08246087b432d8d8c04", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764124, "uuid": "f3f6e9f7-8b05-45cb-a0e0-79b37c712fbc", "comment": "Malware payload", "value": "4a36bfea9397fcce98df254418e2f69dea8bc835", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764124, "uuid": "7bf12e05-e12c-40d2-9f80-092d306ea09e", "comment": "Malware payload", "value": "b7291b14efff0055ec773e96edb534a39cd4c7780f535c1cb83ea07336e7f73726a98cf3e97c2dd31d0fafb86284b8fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764124, "uuid": "3de59ed6-9040-4bbf-b135-a2945bf1efeb", "value": "722633B6F503870F5E206AB5ADB21482F62CD89DF61C75073A490303F68796F4EA58DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764124, "uuid": "37ce52a6-7972-4046-a3cb-ae07bcfd0dec", "value": "98304:bZBrEY5YXnsuj0jjKHhgUQh1QVUnBBH6M9UN9xMdzThbgKZ/4yHDx:b0Nn1N5Q1Hf9xdhgEjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764124, "uuid": "bb27af95-2a75-4d08-9259-1f6850d21ead", "value": 4736931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764124, "uuid": "a3ad5268-c40a-495d-b6a8-37545669cbf6", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764124, "uuid": "58efbdd1-c7a2-4cb4-8729-8bb7652a3416", "value": "0ed1c7cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a6ac98-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792836, "uuid": "3ea71ce0-50bb-41f9-bbc7-3b467a75bc7a", "comment": "Malware payload", "value": "63b662426c6acb11420ec6e2eaec3e26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792836, "uuid": "da2b0c7e-4f46-4944-9e3d-55383e1654bc", "comment": "Malware payload", "value": "b25a3fbaa113bbdff3ea5f3844990ab69e5c5525f8a3b3f3ba92068bead73a24", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792836, "uuid": "6f38ef81-5249-49a8-9fa8-b415c0b606d5", "comment": "Malware payload", "value": "01148aee4874e032b2e5acdd5f0f4e87519d2d06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792836, "uuid": "eb04a4d5-2f79-43ec-98fe-0f80569a7843", "comment": "Malware payload", "value": "2d97271d6cd12261b6fd6589dd64a7b3e2c3e324424b354afe35f010efcba24216f6d483ca28b82ee17fdfde228d512c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792836, "uuid": "29cc220f-cd23-4ab8-a817-a92325b7f1c3", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792836, "uuid": "e4ffa7c8-7bd8-44c9-8130-1e2bba7021c1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792836, "uuid": "d1404ec0-e8fb-40e3-a112-1d875d6921ea", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792836, "uuid": "03c49c64-f660-4c88-885b-16f944c35834", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792836, "uuid": "ced197ab-a1ab-4fad-803f-ebef83162ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792836, "uuid": "f71700be-89da-4572-b23c-8f398b030017", "value": "63b66242_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e047aed9-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792879, "uuid": "fa88cfef-7464-4219-a228-57d2192e8c87", "comment": "Malware payload", "value": "4c8a7a0191b1882a692dc0c3e6cd44a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792879, "uuid": "74a78cd4-e848-489c-9b52-767525ac61e6", "comment": "Malware payload", "value": "b295f37673ae2dc7c83ea4ecf04a65acfce4398473d911c70e25e89e48d0fe04", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792879, "uuid": "c87aa689-4d1a-4d8f-bebb-af3d2ad65948", "comment": "Malware payload", "value": "d2b5cd4bdc2e0ff2b6712c2bdf52d2bd06c2b1e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792879, "uuid": "806652e8-6d43-4779-bd48-52340dca8b3c", "comment": "Malware payload", "value": "0a24312596d9fab76dd3fdb15f2c48e9ee46aaaf3119759e647d92432bd8fa58e473393c2f6aaadf5881de42be4c715f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792879, "uuid": "b350c19d-bc40-4a38-90cb-e937c2cd6495", "value": "C104B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792879, "uuid": "e12fa400-cc21-4b55-86c6-53f52fb17817", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792879, "uuid": "38fd342e-f7e9-419b-bfa1-377fcfc88763", "value": "3072:0WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:0WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792879, "uuid": "5ac2a2c0-eb03-49d8-b472-cd7776dd6c9b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792879, "uuid": "9829a69f-a178-4672-9f34-4109a15f260f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792879, "uuid": "feb843b3-44aa-41c3-b8cd-7bb247daf0c5", "value": "4c8a7a01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b28b63-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742478, "uuid": "9be11fb6-f1a7-430b-84d0-1119c27dfafb", "comment": "Malware payload (Dridex)", "value": "dcbdd30a9bd4d0dacfa30f31a2e4b70c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742478, "uuid": "25360a7d-41b8-4447-8bcf-a1b42b833124", "comment": "Malware payload (Dridex)", "value": "b2b376f422f1a15d2d50802d34fe9cb55d30608dc2b8c3eb4265be51e12a0477", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742478, "uuid": "eccdf137-f139-4ce7-acc0-e145a80486ac", "comment": "Malware payload (Dridex)", "value": "b2c02695733676a677ee350745a8fc12befbaac8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742478, "uuid": "eba452c0-0904-4245-b224-2181dbea61ee", "comment": "Malware payload (Dridex)", "value": "3c9f17733f17b93099badf78eabd0cd707411895945338f4085b81775bf61aa8a35ab467ae7a59cee821b4c034db3dd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742478, "uuid": "d2fbf0ce-dc47-4381-885c-f8b58aa9e53e", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742478, "uuid": "fce1ef05-b879-487f-b668-a14dd09f3779", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742478, "uuid": "242f08cf-cdeb-4eff-8247-f1de628977b4", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742478, "uuid": "dae2b327-b0b4-473c-923b-2d2af3e7ea17", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742478, "uuid": "3fec56db-f398-4b4f-9784-88c5670c6201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742478, "uuid": "e7852afc-c026-48b3-a0e5-3407670e9fd6", "value": "dcbdd30a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87854fa3-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771255, "uuid": "c96aa8f5-13bd-4996-8b54-e57eb05ba99d", "comment": "Malware payload (Dridex)", "value": "4ee7811faab98f54f37ada57ab4ef4ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771255, "uuid": "6bd21c4e-8b6f-4070-80a0-ab420285a988", "comment": "Malware payload (Dridex)", "value": "b2caa8186d3b857c56e69d37e77362b6b355c974843210391e938061404aeead", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771255, "uuid": "af304567-f373-4df9-b8bc-270aba7104ab", "comment": "Malware payload (Dridex)", "value": "ecc1a169e41a323c6ad0c2ba18233af661fb95bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771255, "uuid": "61e2ba58-622e-4aa6-a507-214a00260e49", "comment": "Malware payload (Dridex)", "value": "aa31174905787a888b97ea36c560fff97ad96022a2ed0809f049f770c0ed1b9142c651faca939d2e45c6f122d4381d29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771255, "uuid": "abaf742b-74e3-48fe-a566-b61663e809e6", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771255, "uuid": "84680743-2eef-4a01-ab27-84f8bdbb84eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771255, "uuid": "141e24ce-9fe5-4721-9ce6-dba03e89c640", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771255, "uuid": "7bb62288-d51a-469f-8b15-8cd728c554ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771255, "uuid": "2265f5e0-84cc-4f50-ad25-c1acc1f63705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771255, "uuid": "cb19b80d-f226-4c65-bd9b-535fbf4ab181", "value": "4ee7811f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce93d9d-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778539, "uuid": "db864ac8-948f-4ccc-87ca-8064beda1f77", "comment": "Malware payload (Dridex)", "value": "fa1cc0ed1dd622347c68fb8ee016cb0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778539, "uuid": "2b940115-203b-45ce-8da7-9a800c4c1b20", "comment": "Malware payload (Dridex)", "value": "b2f05e97dbe6818abb2edc4ed3f420cb9910fd87b333e741be66b8f8d3e60e98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778539, "uuid": "975a08e7-ea14-4ea7-be94-45aca05347c7", "comment": "Malware payload (Dridex)", "value": "10308c7791cd4496678ffa3aab0565c22e4e0509", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778539, "uuid": "80011a76-d1e2-411f-b84c-58b6d84df13b", "comment": "Malware payload (Dridex)", "value": "6519c58667e5d02992bcefe60cc4019bc184e7807232f80e1c31e3ef6e6293ee6d9f4b7f632e80bf12244b1f079990d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778539, "uuid": "6a593a76-a7f4-4603-b041-7dc5e889f2e6", "value": "63F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778539, "uuid": "2bfcc123-9c13-4660-a8b0-84469640aaf3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778539, "uuid": "90783a11-d52e-4187-99f6-98f301ae829a", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778539, "uuid": "091c56ce-43ee-42e7-a0de-91cbf0a5e89a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778539, "uuid": "41b55c80-7143-4caa-8775-e63390d6ca2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778539, "uuid": "1a18bde3-e033-436b-b700-0bb2c6652299", "value": "fa1cc0ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b477ef0-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742458, "uuid": "9d1121fa-eedd-4dec-9e45-a81fb3422d22", "comment": "Malware payload (Dridex)", "value": "7a7cc0e9b9552a543770044628d2ea1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742458, "uuid": "e5601ef5-2773-461d-87d6-bffabc032d02", "comment": "Malware payload (Dridex)", "value": "b30de9fdd52b986cba7e6ded93d890e57799b3236ad60c22ca5c2b09ccd32e3f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742458, "uuid": "0c46ed7f-74b6-4f97-a1d2-c99cba0815de", "comment": "Malware payload (Dridex)", "value": "9d9e2cbeadf27611e906974651ee1bc3a2a871c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742458, "uuid": "9c3bcd40-034f-41b1-a721-850c1f871b3e", "comment": "Malware payload (Dridex)", "value": "f28db74089fedbb3ffb05b7d1993be79b5f8cdc1b55658cd47ace1109a9787c5b87014c33f36a592d916dbbcc8eecd0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742458, "uuid": "e6760535-1402-4fc5-a115-6e5ec32f12d2", "value": "2CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742458, "uuid": "f351879d-4ada-486d-8785-824f473dcffa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742458, "uuid": "08306002-15e4-4008-9a1c-32f1ff05d248", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742458, "uuid": "81663f7b-af47-45bb-b741-e5ddbb60379c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742458, "uuid": "d30652bb-6dd5-46df-9ad2-0a175074a148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742458, "uuid": "9be67c89-19a6-4199-ad8d-48eb958bf4fe", "value": "7a7cc0e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379680ad-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785724, "uuid": "7a59b99b-2dda-4060-9717-6d38f3f6efa2", "comment": "Malware payload (Dridex)", "value": "a60954f8a875725ed3f6d02aaa4ea3ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785724, "uuid": "8d3f5a88-9d0f-4ff9-aa0d-ed1097d5900d", "comment": "Malware payload (Dridex)", "value": "b41375c1a5bbf2db2477f83841d47edd1d5481391cd02a0d177306c5d5d6a3e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785724, "uuid": "379c44b0-7030-4eff-a680-020e2540f2bd", "comment": "Malware payload (Dridex)", "value": "853aaeff4870dec2f7328ad8f35f920d7583b5cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785724, "uuid": "02ef0f57-68a9-4b21-a342-dfc958b1a611", "comment": "Malware payload (Dridex)", "value": "30165e033af81d3ce915c828194956829ed3bbf36743c9f45b62f19611b85b249495335c20508ce99fb2a1b3a8fd774d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785724, "uuid": "12fc2111-9d73-49b7-a01d-acf77c83fe73", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785724, "uuid": "a7f635ae-74d4-4bb4-98b4-8a1d465430ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785724, "uuid": "348c33ae-78e8-4ed6-ad85-8b5b935ee85b", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785724, "uuid": "a85eaa48-c6af-4aec-b881-a2ad69a9bada", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785724, "uuid": "b98adf08-599a-420f-a206-9b9022255ca2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785724, "uuid": "3bedc66f-385d-451d-ba56-d64690bed833", "value": "a60954f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1366019c-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803702, "uuid": "3e2bc2a4-0c56-4e7f-a8e0-017e7aa75571", "comment": "Malware payload", "value": "e475074da87c637c4857ee551b3ba512", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803702, "uuid": "223a4624-325e-466c-8b15-de316a9ca839", "comment": "Malware payload", "value": "b44df03a5237b0c46a0fab8365bda24f50213bac6225c5e2105bf04e566058a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803702, "uuid": "e3b74e1c-8644-4065-a979-48b44bc8173b", "comment": "Malware payload", "value": "40b7a0f6e7d3f8185791559ad1e8e4db38d8d4d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803702, "uuid": "d90af7fe-a58e-46a0-84e1-0e84fe8d01bc", "comment": "Malware payload", "value": "7b9a69166fe42c18fffe13f857426fb6aa7b7c51ee4195a7db3d18f6256ed522e19e703e69b782551958e3622b5a1fda", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803702, "uuid": "d20fdb77-b8ba-4d23-858a-220a9f764f55", "value": "DAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803702, "uuid": "7c36c22c-1b9b-471f-87ce-6e567252a2b7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803702, "uuid": "1b521598-de3a-44aa-9c80-1b120e0d3183", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803702, "uuid": "f54da4e5-1248-457d-92b3-2b6cd5218df7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803702, "uuid": "3cca5abc-90e0-4bc3-b914-2f75fd859730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803702, "uuid": "acc58252-0080-414a-a69b-f127dfc37ca0", "value": "e475074d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927e9f6f-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753235, "uuid": "9902808b-b515-4470-9543-2beced3c9cf0", "comment": "Malware payload (Dridex)", "value": "eb44292f1ccb67b505efa142a728cd88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753235, "uuid": "0cef1e3f-f417-4c4a-9cda-b0ee49822103", "comment": "Malware payload (Dridex)", "value": "b46f88bbbd5d2c87fb43130323b78f637246d4ce34381f9c79fe56390a73e9cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753235, "uuid": "c410c949-b3fd-47fb-bf2b-63a155abf5d9", "comment": "Malware payload (Dridex)", "value": "7386334140811dd6f0b5e3b77ef248fed72293a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753235, "uuid": "2f390470-0a07-471c-a69a-693ab7ea3b67", "comment": "Malware payload (Dridex)", "value": "61cde578654624a03b9eeecebbf5d6a44bd1e00d24e98c80c045c3c6e943310abcfa7daca2a678fc26e9ac7c0c3f6abb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753235, "uuid": "49608693-a346-4a10-8394-4d94c04c2ad0", "value": "9AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753235, "uuid": "76b662fe-5a24-4529-bcf0-c14e8f6321b8", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753235, "uuid": "35248757-5f30-4df7-95e5-42e4a2ad3a6f", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753235, "uuid": "0180782d-e0a9-45ad-bb39-bc137a597620", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753235, "uuid": "bb0cedd2-2c09-4da2-99f2-3fadf2858119", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753235, "uuid": "4b4c8911-a727-4fe5-9813-a5445255b5a9", "value": "eb44292f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceb603f-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774834, "uuid": "38eaaa6a-a330-4b75-a187-17c542b819ed", "comment": "Malware payload (Dridex)", "value": "12c11f72d8d18435d6ebc42767e4a615", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774834, "uuid": "28f44542-d3e6-4810-9428-1e61776a1de2", "comment": "Malware payload (Dridex)", "value": "b4aeb113d2a6665fa66506b1e2c4769e20c0bd5082cfa8664589a738927b66a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774834, "uuid": "935f34c4-2728-4065-8932-9be2ee6622e6", "comment": "Malware payload (Dridex)", "value": "69149014e96b25f8ba705c67aac81adc07fa8347", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774834, "uuid": "e27810f7-0f37-4b47-be33-9bfa011d4fb6", "comment": "Malware payload (Dridex)", "value": "9399fa9c6ad4ac7940ef37592be37e363126a4fcd3577c63ad1cec3c2db9d7c5d0b4b9e36fb1516995826ebb86c55e70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774834, "uuid": "d01a806e-c537-4679-a498-c169591b4963", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774834, "uuid": "7fb4238f-916b-4c88-aba6-0e38a8a5a32c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774834, "uuid": "82afb2a0-6fa0-4995-84e4-92a11645c9a0", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774834, "uuid": "bda3ca1a-f99b-4045-ad1b-a57bbd4ca723", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774834, "uuid": "233202e8-2833-4b5e-be35-076bb3d3b623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774834, "uuid": "bf9413f4-aef0-4580-9e02-fd5e851f63c3", "value": "12c11f72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cae4de-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789268, "uuid": "c7e86560-23e3-440c-9e78-d5d4cc84cb79", "comment": "Malware payload (Dridex)", "value": "9ed81c69eb61bde6a8cbe7a18d482692", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789268, "uuid": "e2467c53-b28b-4c07-8100-e25bd2a41010", "comment": "Malware payload (Dridex)", "value": "b4e54d8150dda6deaac72ce7eb6fba148f8cc17b4ef6be6a55abffa8e5ee8d67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789268, "uuid": "c2aa4868-7654-41b5-9984-a6493f49411d", "comment": "Malware payload (Dridex)", "value": "228dcb3abbc0436fc7ae30a4a191efd698d14ca6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789268, "uuid": "1f2cc6f7-5a0d-4766-82be-702e719f6855", "comment": "Malware payload (Dridex)", "value": "07ca6789bfd29e07a97371c19573244ba1b78a4c1ff8a0d6e96b0953abc5c90537e59f12b46ee1cb7435ba6d569c84a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789268, "uuid": "805a3886-cb85-4405-8f3c-dde013f4c5d8", "value": "41F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789268, "uuid": "88ab462f-7968-47c7-bd80-13b268a2b314", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789268, "uuid": "a11654be-8b0a-42de-838b-5b56ccf69ea8", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789268, "uuid": "89d5f90b-4cfc-45ec-9bb3-52c8a825d203", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789268, "uuid": "0ee4aedd-58a0-4d93-a274-311c57e44194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789268, "uuid": "9300d36d-20c4-4c3f-a8d0-75d083e70717", "value": "9ed81c69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498a8685-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767715, "uuid": "893df63a-4374-402a-ad4f-9ace37571e91", "comment": "Malware payload (Dridex)", "value": "4b34357d4037ecca24270bb9b8a464e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767715, "uuid": "d9625325-9cb2-4837-86e8-abe43c435451", "comment": "Malware payload (Dridex)", "value": "b4e5830f1a8a4732e849822567401009fa25b98c506a53e8414bd85c757a28b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767715, "uuid": "e85ed0ff-c855-49d5-9c8a-98bde44e08de", "comment": "Malware payload (Dridex)", "value": "2d84080a93e55d40322483836bde66c406816ead", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767715, "uuid": "97e78e8f-2cfc-4ea4-85d3-a51469b8f55a", "comment": "Malware payload (Dridex)", "value": "1386f184d1e80ae26765826600c75e140b4f5fd500bf1658a7a0ca80915275cb39b705ff2f81a0bbb4249df37272890c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767715, "uuid": "b91ffa88-e116-4bcb-9f2c-9b91c5ab3f12", "value": "1BF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767715, "uuid": "9e0e7225-c698-46fe-abaf-8a904db018a9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767715, "uuid": "b292934b-7e5f-438c-afae-9da50c6d5034", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767715, "uuid": "cd670881-ad4d-48d0-b16e-627ee57194dd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767715, "uuid": "fa2f4697-c707-403c-847e-033bbe17f6e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767715, "uuid": "b91e3baa-6105-4711-896a-db988186a13f", "value": "4b34357d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79188683-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778532, "uuid": "97031a1f-077b-4f48-a710-1298436b8188", "comment": "Malware payload (Dridex)", "value": "b0cf7e29df1029eafa265cbbdad402b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778532, "uuid": "49659797-5012-4094-8335-4874f9437ebf", "comment": "Malware payload (Dridex)", "value": "b4fbd9a8dcd509c899d0cc3bf8a3e512d67efc598a7b12daae8f6466b68d773c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778532, "uuid": "4e007175-3e71-43f2-be48-7b0f65ae74d9", "comment": "Malware payload (Dridex)", "value": "4ce229c8160eb08ca0674a786566c8918588f38c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778532, "uuid": "8ec58851-d158-43cf-abec-1271a9d67d32", "comment": "Malware payload (Dridex)", "value": "d86a4c1526ed0778445dbf892a23e6eb55cb04598ef05a0f6ed70fba1194572aafb5706f4bdf3353f3f7b6630b7a1e0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778532, "uuid": "26ced901-fc38-48ed-82af-3ddc9be74d72", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778532, "uuid": "59917273-b4e3-4c80-98af-3c2df80cd561", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778532, "uuid": "771d20f2-98de-4ec3-bb89-d3d935b4bef1", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778532, "uuid": "0b4024b2-d62f-4edc-b326-297a3c2130c7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778532, "uuid": "99846484-1fb6-42de-a892-9aa3851a2904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778532, "uuid": "aefe4456-0afd-4834-b5b5-51bcb6db31e7", "value": "b0cf7e29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d2eb69-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756857, "uuid": "4467abb0-c4cc-4428-84c6-a289648ec359", "comment": "Malware payload (Dridex)", "value": "92d51b1126c1caceb65e56381f68289d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756857, "uuid": "325463ad-e69f-45bd-b3c6-2f8c858ea5da", "comment": "Malware payload (Dridex)", "value": "b527b0774434184e2061efe326180dc4beb64751e6d1c3a47e1ad431ca99f8ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756857, "uuid": "c65b3ef5-7280-4d30-9b6e-27a62ef2e050", "comment": "Malware payload (Dridex)", "value": "0698b146099fdc66dd988b3c67b39967fc076a86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756857, "uuid": "32e6dd44-8783-48fd-be49-2aaafd0f3b33", "comment": "Malware payload (Dridex)", "value": "867b1d356f9c09fdee671077c8f68fbbd47b794ffb3cabf309480c093e4962d9b747fa4ea582e8799c9f1ff0f4fe20e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756857, "uuid": "6bd3a3b1-cee3-4fac-858e-112e99158cd8", "value": "E2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756857, "uuid": "758a5a85-49ed-4d78-b076-63b550768bf7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756857, "uuid": "72cd210c-3261-40c4-a81a-cd29afb8a0e9", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756857, "uuid": "89e109be-63e4-4ba6-ac77-ff6759686c57", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756857, "uuid": "240261c4-655c-4584-a9d5-00ef988b9113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756857, "uuid": "7d212f08-cb57-4a16-8b6a-435f665d3aff", "value": "92d51b11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358c006-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771356, "uuid": "d11f0ae1-8436-4725-a426-0b3d52e18b49", "comment": "Malware payload (Dridex)", "value": "f07c72ba6fe12301c5583b83e87ef5ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771356, "uuid": "86c6df86-0ff8-4fb0-9686-4b08599eafb1", "comment": "Malware payload (Dridex)", "value": "b56b2199ad279318af62d4c25692bcadd976b378f3e4e0db39d1757815bf1b52", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771356, "uuid": "a5a1247b-fdc2-404c-bb0f-22ea15e9f37f", "comment": "Malware payload (Dridex)", "value": "f0b26739132d651bf3283046ba63d1deab8fbeee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771356, "uuid": "75bbf189-8e17-497b-bce3-f22d27a490a9", "comment": "Malware payload (Dridex)", "value": "1d63494ea01be85c72b0a3c8e257a89a01c5e7e9400cba2a572a1eacc8240b4f4a18a3e50209c721fb9585cad6b730a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771356, "uuid": "9d65a430-9423-4303-9831-9cf8d992c26a", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771356, "uuid": "8229e376-c1da-44e3-a823-a6f5ab12ee01", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771356, "uuid": "ca4e117e-c11b-4781-ac2e-b678de9feb12", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771356, "uuid": "989aaf95-85d4-4f0a-b8c2-a7eca3fb9466", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771356, "uuid": "fde170d4-1579-4483-ab9f-7666ec496b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771356, "uuid": "7597855f-5ac9-42d9-9ec8-540c6768e9f5", "value": "f07c72ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3d2e83-bb5c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621729224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621729224, "uuid": "37853fb4-1661-40b0-b494-b3b37f3fd6ed", "comment": "Malware payload (RedLineStealer)", "value": "646f4905675a72ed633380e124b0c169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621729224, "uuid": "da6ecba8-f7f9-436d-9381-f142c9cdc543", "comment": "Malware payload (RedLineStealer)", "value": "b6088d2366bd800caa559867848abb1f192ea1e88350409aa91989858285bd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621729224, "uuid": "9e2181fa-60bf-4a31-89be-186df4393710", "comment": "Malware payload (RedLineStealer)", "value": "3b24decfcf8083d49c1d6f4efc30aae7a25aae13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621729224, "uuid": "4a09ba5e-3c29-4b61-aa0a-2fc7341d2f96", "comment": "Malware payload (RedLineStealer)", "value": "cdecf3a5d7ae797742f9ccf1b8b592952172a052c4358edf9398972f8574b8b3b59d1788a739cd12cd4b04b96ecf8154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621729224, "uuid": "fa37bf68-e7f0-4a22-a234-1daec70f2f25", "value": "EF94AF20A6A1C035F1FF16F449B982B8753ABDA1573450FB22C53AEE5634AE49E3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621729224, "uuid": "46c64139-c35c-4e1e-990e-e7925a5c2a19", "value": "14fdb4b837b8c194816b4cabd515f1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621729224, "uuid": "c2190b37-5913-450c-b603-8ca2ab0f2fe4", "value": "12288:wNeFzReCLKgvP0Wv7HW5NkmtFHkydyOxnfXsL:wWReoJ7Hg5bEygOxfXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621729224, "uuid": "43c6106a-4a58-4827-b1bb-a36f168b551b", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621729224, "uuid": "b6befed2-ff19-492a-818e-07c033372ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621729224, "uuid": "19f81526-e0ce-4d2a-b650-3498e96d23d3", "value": "b6088d2366bd800caa559867848abb1f192ea1e883504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c86ccb-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731740, "uuid": "bc9161d6-117f-44d0-adec-4de4507de4d5", "comment": "Malware payload (Dridex)", "value": "5e366f76f895a5d28eb2cac6b6a94248", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731740, "uuid": "cb2441df-7e4c-4571-a912-c5610c16537c", "comment": "Malware payload (Dridex)", "value": "b61a4ac8692994d46278a6558c171cedbf5b3fdb65b4099da8a32b3e94d5d568", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731740, "uuid": "0ba14bd4-bf5c-4b2e-b716-7dc339bb75eb", "comment": "Malware payload (Dridex)", "value": "58a6b70081bcd7b975c7e49bff4dfd4d03260c48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731740, "uuid": "24b67b1c-52c5-4952-9ceb-7df5ecd89241", "comment": "Malware payload (Dridex)", "value": "f880b3861c3592c19ac750a0c3828bef4eb9fbba5c8cc11de1b751c0fc738aa8c06af1f8fd33f4dbc4a7ffda1f753599", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731740, "uuid": "85b87afe-d315-4a5f-91d7-39ef033a643e", "value": "9904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731740, "uuid": "266092bd-a0bb-4a00-8d98-a224bc4b1851", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731740, "uuid": "882d0f12-660a-4f9a-8bbd-ddd0df3cda92", "value": "3072:XWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:XWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731740, "uuid": "07949d58-1e5f-43c1-bb1a-c9cce95749f4", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731740, "uuid": "f1477b2b-d7aa-435d-8910-c1ce548a306f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731740, "uuid": "58a9b0a4-0ff7-4b72-90ff-c929e068789a", "value": "5e366f76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2155b46b-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767648, "uuid": "57897ec2-0e9e-4a7e-b0d4-18dd9b91fc1f", "comment": "Malware payload (Dridex)", "value": "404262942cc22187f44fcfddda61610b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767648, "uuid": "0f00e7a8-03f6-45ae-81ad-e3998a10a701", "comment": "Malware payload (Dridex)", "value": "b6d7a413141c4d61eeace0a722cc0973d4de1b04430b821cc0aef8b4d7da05df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767648, "uuid": "7e7ed14b-952b-40de-ab32-eed0b03b5451", "comment": "Malware payload (Dridex)", "value": "144cf3b597b5634b293b9069728ce63a7b52cf66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767648, "uuid": "fa7f5e0a-e77f-4429-b94a-347e5f9d8fe3", "comment": "Malware payload (Dridex)", "value": "78983cc36f9402b69b0303235333df327d0cb26eea7ef714b1eae3713f282f13abeece7e84cf7cb6154c49fed6299827", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767648, "uuid": "866bdb96-c519-481f-91b5-8159fb1e287d", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767648, "uuid": "90a9190d-c469-49ed-84c4-34658fadc0bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767648, "uuid": "106ea25a-7f93-4b46-af91-c23e5e1d4405", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767648, "uuid": "86b4c3f1-11fe-4f80-a42a-dc19df79da44", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767648, "uuid": "c0a329e9-4edb-4f15-a2eb-32a51d2db1f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767648, "uuid": "127fcb4d-c93a-47a4-848b-a3b60d348dc4", "value": "40426294_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef07ee83-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803641, "uuid": "8c830413-2696-492f-8b8a-0a6b25878c74", "comment": "Malware payload", "value": "5971b3b58cc3a53e1b046baa8ced5851", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803641, "uuid": "d50da3c9-1f48-4a03-a7eb-3aefab697368", "comment": "Malware payload", "value": "b7b00ddb6feb4bb8dd108a7cdcbd692e16e02c4ad9f273330cf1779fbbc33c39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803641, "uuid": "995bc0e7-dd2f-4ae1-a3cd-df9afd61f6a1", "comment": "Malware payload", "value": "9c0285621e51310134451775134cd3af05e56f63", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803641, "uuid": "97231c11-d39b-4796-ac85-047cd85da5f3", "comment": "Malware payload", "value": "6edb7d905b7daa71b694001cb174035508b63d4f8cc2a8775b2ee87ea38db8fb251b27e65daa3ac9e3fedbaf0b13b8b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803641, "uuid": "bccc023e-0900-4a16-9150-a035be29fdbb", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803641, "uuid": "db46c4f6-2e5a-4e6d-a4b3-54da606a19c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803641, "uuid": "176cbf9d-baf6-4072-9f86-51e2e8d85d11", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803641, "uuid": "dac16e26-b541-4b52-b6a5-6d56b98febf3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803641, "uuid": "0fb2efd5-fc13-4c83-ad14-f79adc7be973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803641, "uuid": "6256cd5e-8fea-42c2-8ca0-527304680b47", "value": "5971b3b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d2f322-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621751707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751707, "uuid": "a2a1298e-7edd-43ce-9840-fa1275212c98", "comment": "Malware payload (RedLineStealer)", "value": "0b9dcfba164851d0381c9a54e272c396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751707, "uuid": "85eab01f-2dbb-4173-82e5-e0fe27544901", "comment": "Malware payload (RedLineStealer)", "value": "b7b0e78dc65af7c233732f31918767f5b84df9ba70dfeec55fa82778f7cd6654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751707, "uuid": "61bc01d7-d3b0-4c58-b6d6-25f62b9f5935", "comment": "Malware payload (RedLineStealer)", "value": "2c4488c53399333455be2416f42bdc1d4b352838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751707, "uuid": "c537705f-f968-45be-a2f0-796ef8878c06", "comment": "Malware payload (RedLineStealer)", "value": "98f35567e565dc31b3d0ef40f4a9b6e8e8172aab781e1c6a35c9527514688941647512461811817929a1a9de6d518a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751707, "uuid": "e54b31d8-4835-459b-9dbf-cb7dbbb0e3d7", "value": "88848D20B6A0C036E0AF11F445B59268B52A7DA26B3440FF52D62FFA56375E4AC307DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751707, "uuid": "c1f414fe-6f87-4796-a864-bee250e528b9", "value": "eaf6c398deaaa81e3b5479039cba0b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751707, "uuid": "ce7314c6-2198-4f2e-9ddf-83db76cb7e74", "value": "6144:niBeJac9lDTkjMY+uRdQSxCLWBFeB4xfW22CRz2H5OVjgrP0XsTRV:niBeJac9lDAjjRSc5qkf329ssD0XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751707, "uuid": "b211ab77-3064-49e6-8ec4-8bf834f333b7", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751707, "uuid": "5ab96664-fea6-447c-9123-fbf78eb96c24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751707, "uuid": "12ce2bb1-e599-4451-b30a-5e0445281906", "value": "0b9dcfba164851d0381c9a54e272c396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352030c5-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767681, "uuid": "d4bba5f0-0fb4-4cd1-ab9d-6266acaae3c2", "comment": "Malware payload (Dridex)", "value": "a741719e6bb013efec46ae23afc0409b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767681, "uuid": "df9545cd-f20c-45dd-aa31-08a515eb1c00", "comment": "Malware payload (Dridex)", "value": "b7b3e03a95ad00552cc26a4ff78cc0acd33e93fa8c81dfb598940cc85996ceba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767681, "uuid": "1a8eb62a-4610-45c8-a5ca-bc7ce47924e4", "comment": "Malware payload (Dridex)", "value": "fd30e7b2cd668b6b0b6c438abac5f969d9effb22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767681, "uuid": "8057f210-ba9e-459b-aab9-00afc9c03dde", "comment": "Malware payload (Dridex)", "value": "468dfe59db9353e8f25015c2dc4a7d211790b968091b4bab075fb9d503a8b897bf10d9ffa36212473036cb51b33c719b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767681, "uuid": "4e34b71e-6556-4810-beb4-f60544ef976a", "value": "D2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767681, "uuid": "1706e22a-e170-41ba-ada2-915cd5214337", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767681, "uuid": "8a3be04a-32ce-4f1d-8218-8671f9d3fef4", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767681, "uuid": "3e0dc08e-dc3b-4677-963e-ed04ef1b6a46", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767681, "uuid": "dfb68a73-5930-4ada-9f9e-6d7794c05387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767681, "uuid": "156323ca-0254-4f79-aa77-66d07f372277", "value": "a741719e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a2b467-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735310, "uuid": "ba8dc12b-4038-46f8-b70b-0a7a8368f3c0", "comment": "Malware payload (Dridex)", "value": "a6a6185058a0d96c46005ca395f27d65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735310, "uuid": "3a5c82bf-1b57-478e-b5f9-5c8046ba6109", "comment": "Malware payload (Dridex)", "value": "b81105f4c7b7ad5b4aab278cd30be2cee7d740f69f1065ec6521944c933f8460", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735310, "uuid": "af621bf7-f88a-48b4-b7d9-a409ddb657a7", "comment": "Malware payload (Dridex)", "value": "e667763af6f8f9e120de71ead4bc5027afc14a2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735310, "uuid": "1f0b6fea-9241-4df5-a122-4c8df8362b78", "comment": "Malware payload (Dridex)", "value": "150ab5b11a3a780d2e1ab7aef6aa663f8fe46fe2d7c868c059978ca8218949989f9edba3509dd0abead572b0869a0238", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735310, "uuid": "945ace66-35a3-4950-adfa-fb0c9f6c9f91", "value": "C6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735310, "uuid": "9290e3e3-b352-45dc-b73a-4c546facb856", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735310, "uuid": "a7b5f709-5431-4d4d-aaa3-214f58563243", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735310, "uuid": "cb57e9d7-9814-4103-805a-b4c93a6de312", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735310, "uuid": "a855ad09-8600-4d7e-99fa-c83bea0a5d37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735310, "uuid": "c50466f0-12f6-451a-9e76-465b07ce01de", "value": "a6a61850_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f2f220-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Zegost)", "timestamp": 1621756564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756564, "uuid": "74ea3955-4862-49b7-923d-b62116d78ed1", "comment": "Malware payload (Zegost)", "value": "ac2f5a364cfacb088c2ef92e9a73c5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756564, "uuid": "f852316b-d43a-4499-b106-93cb955927b1", "comment": "Malware payload (Zegost)", "value": "b89c262b14911c4480ed00b35a53500ecabb8f9df4169f2a84c3028f468cff48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756564, "uuid": "943f5fa7-4af3-4ae0-9951-7a50e92b3ff6", "comment": "Malware payload (Zegost)", "value": "c5c8d21405758d05c44f680b7c4d687581b3d494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756564, "uuid": "cdd1cf72-ac22-4488-9321-e26eb4a7fc5e", "comment": "Malware payload (Zegost)", "value": "44e8e47766eba7ecbcd9451dbe4a6dad047bdbf0a0558bb4159f8e566270479c09ffaa607f84a1a4e07f3c8409186a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zegost", "colour": "#84DF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756564, "uuid": "be4fc94c-feca-4b53-9769-fdc5bcc639b5", "value": "B4D37B003F26A802C9F174F62BC79B72E00E55E3A7D98D41230F92525DE785C6F96EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756564, "uuid": "841ab3bc-85d2-450f-8be3-1f2e6da4f675", "value": "eed9182d328e7e994d0c62e9280718d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756564, "uuid": "4b90379a-667d-4d5d-a81a-f93edda25c33", "value": "3072:0FrX5RaBaz+oA9IxnN8GeepiiepFv5DmiqyN+ZJNl/13Z:0XcBaz+oA9IxnN8veMdpRTAZbl/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756564, "uuid": "8a27071f-d1be-4da3-8a97-4851212f4d13", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756564, "uuid": "14693bde-c750-4e30-87e0-c2ed15002f09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756564, "uuid": "fec8821e-e817-46d0-837c-249e3089d2a1", "value": "ac2f5a364cfacb088c2ef92e9a73c5ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc13d93-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807263, "uuid": "5285808c-3cfc-4288-abf7-67e8f7abba4b", "comment": "Malware payload", "value": "c110458188f8249363d2e42109058b82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807263, "uuid": "f163e708-f68d-4e7a-b487-35c54420012b", "comment": "Malware payload", "value": "b926d4dc680fef85c129fd4e4138124a8c03a54c97b3a6ca69a08132f3cfafbd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807263, "uuid": "52ce2070-625c-4e16-a4b4-8a346c218f3e", "comment": "Malware payload", "value": "497a0bf37d2b66923cdc275c33bfc4e6b6d4ff8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807263, "uuid": "9e9d9b30-897c-41eb-acdc-fe371f0d5120", "comment": "Malware payload", "value": "7ed221e9c62b8cbd58fc636d0565a1bbba816eae5b8c3c9410f740eaacca4453ed8ca21393fd86c5434f98ab3aa5ba8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807263, "uuid": "42487a60-337f-4dc9-afc5-20a663aac9da", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807263, "uuid": "04a8cf52-6386-4192-8d12-4795bdec6d09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807263, "uuid": "8dee6150-0b27-40c1-a55a-d46afe01ea82", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807263, "uuid": "ee860998-4535-4a9f-97a3-37221a8ee708", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807263, "uuid": "b98851c2-2d78-486e-9572-91216297ccb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807263, "uuid": "51354852-54d7-4fc3-8419-09ce32d6deb0", "value": "c1104581_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f5b327-bc09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803649, "uuid": "25a4f867-4e2b-4484-a856-01e286d7e87b", "comment": "Malware payload", "value": "e05abb6b77567a7611c5c13e9fcce86c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803649, "uuid": "cc347e6a-ca64-4923-93da-29989c4c4d84", "comment": "Malware payload", "value": "ba5b1a1cec387fefde7174f7bab4c2a0f324a4e4aeda01316b7542d1678147e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803649, "uuid": "9f0d1cfc-adf6-4ea3-a01d-193ceb3f3701", "comment": "Malware payload", "value": "917260fc5f7221b1491579fb9360a7630c4e710b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803649, "uuid": "b0c49cc2-11c4-4e8d-b329-ac107439005e", "comment": "Malware payload", "value": "d2370ebd8b6115cced7a7d208ede4c2940adccfdeaece1f636711cc62dc9cca1496febf9d345244b0c31662852abb109", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803649, "uuid": "56ff8313-591d-4268-beb4-f5f073060a5a", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803649, "uuid": "98d89270-0cd3-4d19-a8b6-f5186648b3e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803649, "uuid": "b959a35b-f260-4975-9f7a-dd6be1327678", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803649, "uuid": "cd97826b-8568-428c-ba53-719d4038bca5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803649, "uuid": "da704631-5113-480e-90d5-9522c7715bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803649, "uuid": "8d03ce74-7f10-4998-b98f-a105cde24d05", "value": "e05abb6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60667597-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731676, "uuid": "2a2d6b59-d6d9-42fe-9e82-254b2afb0033", "comment": "Malware payload (Dridex)", "value": "fad35ba8840772d4840c965c6ace1bbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731676, "uuid": "fa5ceea0-a4eb-42ae-82ba-cf97d019f3f3", "comment": "Malware payload (Dridex)", "value": "bad1bcb972fb93b6380b75890bacb1c5a76a67d6bd92d1417e14a6d0d6483abf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731676, "uuid": "39347c09-389c-41cc-9930-c7df32c74b0c", "comment": "Malware payload (Dridex)", "value": "b48d7b78acb382fe9e7c3601579d6218750be466", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731676, "uuid": "a26d7885-7e10-4283-b6d7-6f614f3d4c2a", "comment": "Malware payload (Dridex)", "value": "5098ae76babc7abf1da7f6f694204ffe875d1f250a1727ed189ad99011360330832d5b3476b5c5aaea3bb16c5e1dd40b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731676, "uuid": "f17e5501-06cb-4697-ae43-ffbed070b77f", "value": "61F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731676, "uuid": "b384cb42-b225-4369-9422-aa592ad1c083", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731676, "uuid": "efe6129e-47be-43ed-b890-407621d5753f", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731676, "uuid": "5b650ba2-c9be-4f9c-8fb4-60aaef86bbe9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731676, "uuid": "d47eb5ce-5b56-4567-91a1-38c8773823c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731676, "uuid": "ce11a159-4962-4e4f-b9a2-c35af74f5951", "value": "fad35ba8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4db977e-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771304, "uuid": "e74d9dd6-0f00-4cf7-8c4c-4750f4ce36ae", "comment": "Malware payload (Dridex)", "value": "7c422fc8b66fb48920898367489b284e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771304, "uuid": "1ca581e9-d04c-4ea5-be3e-4c181a586a64", "comment": "Malware payload (Dridex)", "value": "bb09fecc96fd561797940f900c839e389afa79df39c09046c1dcae1a1c940357", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771304, "uuid": "892e9f30-a9f7-4650-be4e-e59ae8141c38", "comment": "Malware payload (Dridex)", "value": "e1ca81f473dd981af5cb8ac8202a45b1d39903f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771304, "uuid": "09b2cae9-d78a-425b-a11c-b9bbbffa0f27", "comment": "Malware payload (Dridex)", "value": "a432c89c57267978273d68504027a9171f1b40b19ba65c0af3ef03fe8f11829eed8efec43c8beb0c027e091c859bdc6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771304, "uuid": "d7048c6a-079f-4393-b414-1bd1d4e72969", "value": "D004B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771304, "uuid": "4847efb6-6ce5-4af7-a3df-c713a044ad65", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771304, "uuid": "c1d01210-af5c-41ee-b8a1-97db82178de7", "value": "3072:iWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:iWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771304, "uuid": "d98e6e56-f155-40ad-83cc-cbed38879f0b", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771304, "uuid": "d3d288fd-451b-4f1d-9c3a-f193a0a28898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771304, "uuid": "d109eb47-b800-48a2-8594-e7457ebc4834", "value": "7c422fc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f0505a-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767689, "uuid": "a1f7d009-7af8-468e-94d4-e8c736366fb7", "comment": "Malware payload (Dridex)", "value": "e6a7fa8010ee5d3ba6f7a65eefa218cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767689, "uuid": "fca2d6a4-8925-4444-a35f-15b710688b39", "comment": "Malware payload (Dridex)", "value": "bbc477e35647eb7e67bbd7807daebe262321586a1e135bf4cbd6f69af34767c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767689, "uuid": "cc051332-6afd-4466-a017-c38e968ce1cb", "comment": "Malware payload (Dridex)", "value": "a6a40d14cc6dd59984696dcff8c1f0bac21b251f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767689, "uuid": "4af5944e-20ac-4b07-ba06-6d67d8a04122", "comment": "Malware payload (Dridex)", "value": "52ba6dc3334aaf9d450637961bb5efeebf503557ad9917c8d389b357dcbccb2c654f00d934b39c64b8ea1aa69985b184", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767689, "uuid": "89b758f6-18f6-438c-a83e-2432b7278bb9", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767689, "uuid": "d9cc9850-3cb6-4a6e-a386-11434af8c2e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767689, "uuid": "8ed1e0f0-ca59-471e-bbdb-674532edad69", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767689, "uuid": "e72dc7cc-9d7a-43b7-95bb-61012f9b2914", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767689, "uuid": "8ebb39c0-4845-4fce-bd2f-6d34c3976365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767689, "uuid": "b2f3c3ca-0b87-4144-a7d7-808eac6a2d16", "value": "e6a7fa80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464fb248-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796486, "uuid": "b363107a-8d20-4e6d-a12e-d3c097488956", "comment": "Malware payload", "value": "2398812dbb161bf3a64ec924b66d6927", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796486, "uuid": "346b96d7-cc31-4159-ae2e-66fce3e14946", "comment": "Malware payload", "value": "bcdefabbb300af2a083c366415bd2b02c453b96950d1fdf6b87bdb4b9cfa3718", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796486, "uuid": "2ef3ff90-69ed-4dd0-954d-8bdbcf4ad76e", "comment": "Malware payload", "value": "2f63427318872ef4e33067d2b00dca02d6352374", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796486, "uuid": "ad2147a8-8d99-43ec-ac22-eceef4bf8ce7", "comment": "Malware payload", "value": "8e4ab7eb916c272630c2cfe980796a5b20c28b0085802dcf6dca5a8bd1e8f959853d41dd7ba689948f6e1123b9911326", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796486, "uuid": "3e628853-4522-48a2-bd01-767fbf68246b", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796486, "uuid": "e5cb0435-c258-41de-a9f8-72fdabf6e083", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796486, "uuid": "57d98d88-800e-4629-b7b6-398cfc45cb14", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796486, "uuid": "ce0d348e-9234-4ce9-b8db-8b3f1da6f176", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796486, "uuid": "7dc88901-ff6b-47a2-a10a-ab72cae0e1e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796486, "uuid": "b12898ca-334d-4e20-9055-0d26de7b2f29", "value": "2398812d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b27bf7-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728031, "uuid": "7d9ba999-93c5-4b83-bc65-ff4399a2dc9e", "comment": "Malware payload (Dridex)", "value": "bb4941eefa9f8835e26d6f78c137c20b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728031, "uuid": "deba8db8-9ebb-498d-8d83-b21f333df98a", "comment": "Malware payload (Dridex)", "value": "bd4618dd6997eba0faa85985a2c9c12c1409ef4c2b662c0bc5f678e8826b72f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728031, "uuid": "fd07173e-9bde-447d-b84b-e73f13cd65e8", "comment": "Malware payload (Dridex)", "value": "1347eec183509cefa50751854cbd235bf6e55ece", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728031, "uuid": "31c962ff-b709-4394-b66b-f2253e35b613", "comment": "Malware payload (Dridex)", "value": "62ddc3c572e6fbf46a358e3deaefc125ab40b90a2bbb31c3aa14c98de6c81874aade1bd911dbd3e633a251cdb4778164", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728031, "uuid": "0d74dff5-cb31-4603-893a-1c4e373b7cf1", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728031, "uuid": "544cd053-d476-4582-945a-136508fa06f1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728031, "uuid": "d3774577-3e80-4639-9cab-18d01690a3b2", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728031, "uuid": "2169817d-6aa0-4fa7-89c2-c8f03ee3bf1e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728031, "uuid": "dbab7003-59fd-48f5-9708-858734382ba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728031, "uuid": "1e2bb378-685a-4232-83c4-7407972e99e8", "value": "bb4941ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808648e0-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778545, "uuid": "9203bef5-823a-48df-b0bf-631bf495e7f0", "comment": "Malware payload (Dridex)", "value": "b3c4fbeb74898239287e4519538fae28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778545, "uuid": "b4c2cb9b-6b6b-4da8-92cd-8f8921c3b582", "comment": "Malware payload (Dridex)", "value": "bda4686c79cf333265949f144c17d18e93e33fea2a3a1a83cebaff5d67588191", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778545, "uuid": "2f3c535c-a9c2-49fc-92a3-c2695b70c922", "comment": "Malware payload (Dridex)", "value": "fce7b145f76765b5d4918243427f264b888fa45f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778545, "uuid": "0619052a-b48c-45dc-8060-7e302c3be0ce", "comment": "Malware payload (Dridex)", "value": "c68736d32bf73895fbe59a45b3cd3ae0d5da7f8efde9a9aaecdd688e6d0f967557f4fe4842cda023d3ed384ba62321a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778545, "uuid": "30fe18e4-8131-4209-8d01-f6fc669808b2", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778545, "uuid": "b84b2672-6c2f-431a-98a8-6b6bd58a2027", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778545, "uuid": "f3eca833-f977-49de-af5f-4b3b8d7d1c09", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778545, "uuid": "8aa59a1e-88af-4b9f-ab3a-f663ab2791af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778545, "uuid": "62e96375-909c-4d38-80b0-0b2ec77e9a1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778545, "uuid": "e9c554c4-ca98-48bd-8c3b-ec24a1e40ce3", "value": "b3c4fbeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c03b53-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789264, "uuid": "27ddedf0-9f76-489f-81e5-fd179ade6e97", "comment": "Malware payload (Dridex)", "value": "a03acfabe8be5642fd3e8f776f73cf24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789264, "uuid": "fe4d9e5b-bdc2-4e91-a3d2-dbc489d8090f", "comment": "Malware payload (Dridex)", "value": "bf37bfafd40734e07183eaa620b2374517156f43ff09f74580a87030acb95fe1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789264, "uuid": "5ab2f956-2d32-45ee-9a2e-435d1c147a8a", "comment": "Malware payload (Dridex)", "value": "c83b0752b98bbf7be46e164b2d2a5f23e1fc3542", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789264, "uuid": "9a5ab11e-7d65-4232-bb99-3998dd49570f", "comment": "Malware payload (Dridex)", "value": "778fdb4ff007c5f50ce0ecebe4826f4d459a24ab386b5bfe16f80c9343b5efff1c5238ae5294796d0fc987fe93b94c38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789264, "uuid": "7f5b79e5-8800-48c3-881d-9601ed9dfe2e", "value": "64F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789264, "uuid": "e124570c-38bb-433b-8116-57ef5ee201da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789264, "uuid": "752ad425-4f4b-4e15-8738-2a8691de47cd", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789264, "uuid": "033ae3e3-a7be-4984-9a0f-3cf117fc1458", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789264, "uuid": "5cad2264-4e2e-47d5-abb9-ff6f5f85d80f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789264, "uuid": "efeb3e83-ce40-4bf2-a96a-00dfb66245b8", "value": "a03acfab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba9cca7-bb93-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621752606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621752606, "uuid": "02c8f752-281c-49ee-b904-e0d68601ad96", "comment": "Malware payload (RaccoonStealer)", "value": "a6b77177d4e4bb966466c65c82f7428b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621752606, "uuid": "63071584-4e19-44c7-a75c-fe503c842652", "comment": "Malware payload (RaccoonStealer)", "value": "bf864ffc01766f30758d5503ee51d15e0e1349cd9bff9b4f90ad775dcb7950c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621752606, "uuid": "bc1d6add-dc97-40d6-94bf-3b5f26277970", "comment": "Malware payload (RaccoonStealer)", "value": "ebd08bebfa09ef28c39a8ac187af9592bc8f43f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621752606, "uuid": "a86a6275-5e0d-42ae-8950-897d1e5e835d", "comment": "Malware payload (RaccoonStealer)", "value": "95119e4392df9082f59e21053a19412ed8aee397fa33946213199630198e5b1d2a60084ec9af2379819b48ef7bfc41eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621752606, "uuid": "aeee75d1-173e-403f-976c-6ab5011ac2be", "value": "B135AE027391D036FFAB9173AB5AF24556BC69394123852F23D81DB9BDB01B1233E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621752606, "uuid": "9eddaf88-a8e0-4938-b506-4b97e193dcbb", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621752606, "uuid": "80e58b28-2554-47ea-8f66-c9a6d55eca24", "value": "24576:0AHnh+eWsN3skA4RV1Hom2KXMmHauTVVtQPcRJJ/abMg3D5:Dh+ZkldoPK8YauTfePo4MgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621752606, "uuid": "3f476635-c419-46b2-935f-b48a52f4cc56", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621752606, "uuid": "67e99b7e-fa3c-41df-8b62-c6fe5ea153a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621752606, "uuid": "d1039c59-408a-449a-a371-f6d6562bf19e", "value": "a6b77177d4e4bb966466c65c82f7428b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f244cfb-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774972, "uuid": "1b79dd3c-cea4-4e09-a0b0-05dcf5053a6d", "comment": "Malware payload (Dridex)", "value": "4eef4883c7388464fda58695f9cc2573", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774972, "uuid": "7b95b35b-7a7f-4aa3-8755-1e92758fab3f", "comment": "Malware payload (Dridex)", "value": "c00b895f4426d5901ba32568d55271652261c5bd6f0d3cf7e1ba8b3348061461", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774972, "uuid": "4c497ca1-32ee-4075-a141-ad90d08e90a3", "comment": "Malware payload (Dridex)", "value": "3468ef83cd7d9bc978bc4f5045e02d281df5b93c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774972, "uuid": "91991dfa-2bf7-4dab-9f51-42c699f1313f", "comment": "Malware payload (Dridex)", "value": "0c45f8cc61bfe0eb9be5a711fadc37afcd29a6582501ca039bc545f9cfb5bf3aca80068ebf1889b3b53cc843831a8282", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774972, "uuid": "ff9fd80d-c092-42b9-bce9-e204aa79aecd", "value": "7BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774972, "uuid": "34c41710-574f-41cf-b7f0-a3f468fc6399", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774972, "uuid": "025831b5-4e75-45dd-a955-c095ee4faff0", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774972, "uuid": "7395ab9a-79bc-4252-a209-eb80b03779c5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774972, "uuid": "159a2149-a56c-47f0-a55a-658262571f90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774972, "uuid": "fef64d49-0cdb-48be-8a92-79b19f844607", "value": "4eef4883_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466d3e05-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767710, "uuid": "c59a4e0a-4ec0-42c6-843c-3cc4cbbc889b", "comment": "Malware payload (Dridex)", "value": "5d32ddf114f1426541a72371f21fc58c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767710, "uuid": "b8d39eb1-532e-418d-9100-f98df79620e3", "comment": "Malware payload (Dridex)", "value": "c07d21f3e5e80f1f5adcadfbb61360493215ca23fe6b8db7950957145b6e842c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767710, "uuid": "de036691-3191-4e1d-a64e-971c1e3d8cb6", "comment": "Malware payload (Dridex)", "value": "b001dd66e48d0e129edd09c3fd6d9b087b2fea4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767710, "uuid": "11050c3c-b3a3-4579-b400-e7a17df7a856", "comment": "Malware payload (Dridex)", "value": "2e1520a5b3676be57c057c61ba32b5d0c14f9d1d312190b8984034af34ae308687b415d7f6537f6a32fc273aebd5723e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767710, "uuid": "af5ab518-ca2c-4ef2-9665-ffa7eb17f1d7", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767710, "uuid": "86b4729d-add7-4b7f-896a-d29dc377b45d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767710, "uuid": "c038f990-0a7c-42c5-a490-d8115fd55548", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767710, "uuid": "99e7c200-a78d-498f-976f-eef2422df0dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767710, "uuid": "392eca11-5556-40c6-8ce1-f82752785d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767710, "uuid": "5d8f58a6-c3f7-4edc-b27e-314fbbe792f0", "value": "5d32ddf1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9eabfc0-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764092, "uuid": "acb0d4f9-afbd-4393-8451-7462b162b45f", "comment": "Malware payload (Dridex)", "value": "a02fdf49ebc9324b1d1207dc487ba5fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764092, "uuid": "34dc67aa-38c3-4754-863c-3e6ab77d948c", "comment": "Malware payload (Dridex)", "value": "c0fe7ada8a7f009dc3b13d07afe05cd8f19abef24cec6c987f82f53a94a7d4e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764092, "uuid": "ef3a56c2-bcf0-466d-84f5-b6d654bf1957", "comment": "Malware payload (Dridex)", "value": "11c4391d90c7e7830ffc00f3905b5a39dd365c65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764092, "uuid": "409c1bb9-20f2-4caf-bb48-57979059e6f8", "comment": "Malware payload (Dridex)", "value": "2d5316d795df3568a31b1eaa2ea30a37fe144b5f5719b09baf8023a9e2c6abbf4bf72acc58ab7f9d5a8cabd31a42437c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764092, "uuid": "6ddb6a52-f037-48b2-8bf1-f7938a79461b", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764092, "uuid": "1c4da89a-7e90-4665-b2dc-47dc9aac9d77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764092, "uuid": "7f001032-689a-4b2d-9285-bf4346edd333", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764092, "uuid": "978a413e-c04c-4d75-8f49-50fac061df57", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764092, "uuid": "194f4494-2dbe-4cb6-b01a-87a9f84b9fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764092, "uuid": "cdadc44b-1623-4802-bf24-33ada9993054", "value": "a02fdf49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f531a1-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621764131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764131, "uuid": "888e8197-6f80-4cc9-ae0c-dfd3b10bb62b", "comment": "Malware payload (Gozi)", "value": "4c9065ecd97030b2aca0265006c6be0b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764131, "uuid": "a157adae-d82c-4861-82b6-f1f87ba8458f", "comment": "Malware payload (Gozi)", "value": "c17cabf00510d5041b0434d6e8797fd44626a507802d618ff441e3edfd9114e1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764131, "uuid": "f511cb58-6c51-473d-9b0b-9555e7cfb7af", "comment": "Malware payload (Gozi)", "value": "89c22d2ec25a0ebe137da2a013160e0f54b762b5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764131, "uuid": "ad524a68-d86e-4cf5-9c86-83546e69c65f", "comment": "Malware payload (Gozi)", "value": "6cafc7f1d18470804681674ab38202e7601996a5732d501165f0bc15659b03bd069d570c1d9f58da5c4377faf1508738", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764131, "uuid": "42d51081-8d91-4918-b6b9-48064f5e6dff", "value": "A6742344615C0DA7D6B539EDA0DAF9510B0C3AE8BE263CC0AA0CEB64D46DC94DFE1713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764131, "uuid": "5dc91368-0c82-4527-ad25-50d1153d273b", "value": "6144:mOGgXz7ISjs1LuTWqwxSYTtYQNVtfUJOTYJ4xttNzExow1NgqxZH58gnDpJD4GMV:mOTwesFuKqwEEhfUJPWtb4mR2ZH5NvFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764131, "uuid": "9097ead9-d673-4176-b3a0-4a20e1fb26bf", "value": 342946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764131, "uuid": "aadc093e-e076-475a-8e54-777ab9231c36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764131, "uuid": "2bec59a0-782a-4544-a114-46ed3ca44370", "value": "4c9065ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734e6816-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789260, "uuid": "9bd9ebca-6ad1-44fd-9226-00fa3d2f3f01", "comment": "Malware payload (Dridex)", "value": "93d427fe650190632eb8c2a59ef59cee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789260, "uuid": "c1590d99-3478-42c9-9371-5506a079bf57", "comment": "Malware payload (Dridex)", "value": "c1b8636dd23f56eec9c9aae576e881bf0947a37b38cb2314d4be6ce7c3112557", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789260, "uuid": "e91cc167-99b6-4033-9522-338ba7f5370d", "comment": "Malware payload (Dridex)", "value": "7ba0b6a2825410ce6a9494b07465096148342c62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789260, "uuid": "2368f40b-44a1-43a8-88a3-83feb1b8fba1", "comment": "Malware payload (Dridex)", "value": "2112482cf644ab94b9795a9a8c9fcaa769cf48339a10c18240fbe4a8c59e689116408ae9d5a623a50df0d52355910f03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789260, "uuid": "f503799f-c852-4763-992d-6a751aa8f6b7", "value": "88F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789260, "uuid": "8ba2a861-eeaf-45a7-8df2-b6ca443c75a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789260, "uuid": "43227bcd-ff7b-44e2-a519-b761b21dbc16", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789260, "uuid": "81b15bdc-f465-4818-a41e-17ec22555b47", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789260, "uuid": "4fcb0ca4-80ec-4022-9fbd-4007eb9ca1d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789260, "uuid": "7c6c4a2d-8a30-48a5-84ab-56d09a73d282", "value": "93d427fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf3ce24-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742513, "uuid": "c2c9b8aa-7ebd-40e2-8a72-27accb3742e7", "comment": "Malware payload (Dridex)", "value": "3d7d6b6d8823a40278bba0bed164f1ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742513, "uuid": "6403f27e-2c01-4d43-b0cc-4b4e52fa2721", "comment": "Malware payload (Dridex)", "value": "c2d68714ea7bee0ed26a0497f54c725caf4eff08a3031bcee3b3995639055ada", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742513, "uuid": "729c2e9b-8ab4-4c50-83c4-c6308f394e0e", "comment": "Malware payload (Dridex)", "value": "53afa6ca21ad342e7640ce48439986a72e16bc6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742513, "uuid": "493a2f6f-a55a-446a-8b44-96f5c91fade6", "comment": "Malware payload (Dridex)", "value": "3b1aeb0f28ca7ea208aac21bb55af025f53026a68c00e6b64b2aaa4a61287afdc95b848a9767a840e4d1bff016416e97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742513, "uuid": "9c51e66c-7b59-423c-9f88-75ab7523883a", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742513, "uuid": "f214e6ea-7abd-463a-9dc1-ea09094862f0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742513, "uuid": "00ac3312-66e6-4b73-9613-c0911b3e6280", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742513, "uuid": "2c46c21e-0546-4e51-b2f6-f88d29826ebc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742513, "uuid": "39bdb0d9-3ee0-494a-b1cb-d776eea8a424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742513, "uuid": "5104e600-2749-4da4-a1de-478eca20f81c", "value": "3d7d6b6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6581ac4b-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621751441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751441, "uuid": "eaa6c1fd-3862-4c3a-aff8-713df85603f2", "comment": "Malware payload (RaccoonStealer)", "value": "9e3e65ee2e3e46b8b12184b66e562a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751441, "uuid": "e5240d2c-3880-44bb-a7a3-0ec09c20fb29", "comment": "Malware payload (RaccoonStealer)", "value": "c32f64cff507a0d5775b26e570f1ac2dd07b24365d0ae38f42e5c954a5359756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751441, "uuid": "e1491f85-6ae3-42bb-a4d8-e15f284259ff", "comment": "Malware payload (RaccoonStealer)", "value": "bf868caaff1a7ca95e792d3d21ee23e178a3648e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751441, "uuid": "58348d0f-e77c-4866-bbcd-1e06ccc39525", "comment": "Malware payload (RaccoonStealer)", "value": "3f0e6ddb6f69ab2a77616ba654cbb331c746ef8b7c1de48312eebddc3110fdc99e348b167b12145177d24f1fde36022f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751441, "uuid": "56f9fed0-9548-4cb7-97d7-215b1fdfa7ce", "value": "90C4CF30AAA1C03DE1BF15B449A9D2B5642A3DA26B3400FF31C16AEA46345E5DD31FDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751441, "uuid": "d09040a2-8312-4c5c-befa-f936b587e51f", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751441, "uuid": "92fe7952-08a5-49b9-828a-eba49b3ac076", "value": "12288:FE3M8z3UwGxLF7wxrvBgWqCpQhiOLSz5YqZQYA473XsL:OM8zLoJGjAhjGzpQP473XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751441, "uuid": "6fe55a20-057a-4f51-bb7b-d7d33d5f5ebf", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751441, "uuid": "6271ef10-7814-4798-b466-ea9e19ba415b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751441, "uuid": "cadd28c3-bccd-439f-b4e3-81c72ba77d6f", "value": "9e3e65ee2e3e46b8b12184b66e562a01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed0dc45-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807318, "uuid": "c8f820b4-ad0d-4cc7-9a18-7e6665357b9f", "comment": "Malware payload", "value": "f64dac47a18736137e6956127849dd01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807318, "uuid": "9bb28143-e610-43e3-96d2-84a11202e9c8", "comment": "Malware payload", "value": "c3594f1b5a537e45f217c7e4df13bad9fee3f045350cdf4c75e0ccb779cd7a18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807318, "uuid": "e0d12a88-4fcb-4076-a0f1-b77c56af3853", "comment": "Malware payload", "value": "82c7fc9b1e084dfb99d466c558bedd5b80ec64a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807318, "uuid": "2c22211f-f126-4ee7-bd93-a0cf4593cd65", "comment": "Malware payload", "value": "c93d31254156d07169577f5d0ab0cc0f1da65e0172293a29796baf41ea3b8a3e82ac4ee8637301c5c94e67a82c01c8c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807318, "uuid": "6a277ae5-5514-4ab2-b41a-060a4511da8a", "value": "A9F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807318, "uuid": "cea73ea4-a98a-47a4-bbff-bcad5bffcb2c", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807318, "uuid": "c019a6d4-745d-4a3f-bb61-817418fab11e", "value": "3072:T9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:T9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807318, "uuid": "bba8659c-5090-4d66-a2e9-ed6253419658", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807318, "uuid": "41c992a2-a4d2-40fa-8490-ef84dada58a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807318, "uuid": "b90ed902-40c1-4ddd-b501-9f10e9acc15f", "value": "f64dac47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b95eca6-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742432, "uuid": "aa73568a-8260-46bd-a3cd-b80adcc21dd3", "comment": "Malware payload (Dridex)", "value": "665741b694850f0e7b758307b6767358", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742432, "uuid": "5067e279-a201-469f-84a8-7b85f1708edd", "comment": "Malware payload (Dridex)", "value": "c3b7a2b0d9b79e085f177a5aeb346ae322127607a7bd8c6e826bea41ae1d8af3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742432, "uuid": "3e4d770c-fdfd-417a-ae38-9851081c7e45", "comment": "Malware payload (Dridex)", "value": "ee4881f995036575fb479e45894dd9aa2e596c8c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742432, "uuid": "ad64ea05-12e6-42f9-97c1-634ded396486", "comment": "Malware payload (Dridex)", "value": "9960b35dcc9fd0f5ba38ae00deb23accb7360c2a0cc5a06f575e3fcab1750b2de8ed9a399b4085349758f7f019323513", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742432, "uuid": "bf800786-468c-404f-b8a0-eb64f3d16f52", "value": "DFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742432, "uuid": "da07abc4-35ac-448a-8c5f-40475eebbd4e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742432, "uuid": "9b8b4e67-d65b-46fb-9ad1-fdde1c3fc3cd", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742432, "uuid": "4269ea8b-ff8c-4ce2-8490-9ff08091b559", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742432, "uuid": "749ffa64-b467-45e1-aa87-e5f95e7c9a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742432, "uuid": "94d04b9d-d7f3-4de4-898b-f89b0b4cee6b", "value": "665741b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7f9eee-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796471, "uuid": "233b0e10-4e1b-4c1f-8ee3-97db529ae1bd", "comment": "Malware payload", "value": "61e5a384aa658f92e0a33dba718dfe98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796471, "uuid": "02ddb7c1-355f-4c30-9160-1b243ea0abab", "comment": "Malware payload", "value": "c3c94b74e5cc8c43574ff2183da40ed2371d12b6bbe4c2c51cfc2b076a886118", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796471, "uuid": "7a07655e-7ff7-4a28-9d91-de97e2d42c69", "comment": "Malware payload", "value": "010f577c9069b1d7cd1647ecc3efc682b7bcd153", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796471, "uuid": "caf0ed8e-0325-431d-b14f-b4c3143591a6", "comment": "Malware payload", "value": "5a1eb91c9778dd5e31d05130d4aaecbd3382572fded9ea19e58b1821b3ac4ca95d16aa6ce0f4fe21ea00955853422bcf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796471, "uuid": "b9f6b299-760b-47c1-bce1-cb2110f26b66", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796471, "uuid": "67731beb-2d32-4a1a-9210-8974eda8b706", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796471, "uuid": "126434ed-aea2-48f4-a94b-5c85556a9f13", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796471, "uuid": "2f94c2b1-a281-4ce6-90ca-ba960bbf8d2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796471, "uuid": "ae2cbd53-a7b0-4780-a8f1-3ff8b92e0ad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796471, "uuid": "623599aa-5c46-4609-9679-9b33bace8c12", "value": "61e5a384_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d8bb8a-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782089, "uuid": "c0f6910e-94ad-4f30-bd3c-7a667e1032c7", "comment": "Malware payload (Dridex)", "value": "e49820cd120b20d7226335c89008e7a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782089, "uuid": "d018cbce-2d4e-43f6-adb0-5a25fd8e618e", "comment": "Malware payload (Dridex)", "value": "c3ebde7542e24a081eebdc73934416cf03e46902cf18a0b7413530ce29be41d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782089, "uuid": "fd528bd2-5e72-4cdc-93db-18067d3ffdd1", "comment": "Malware payload (Dridex)", "value": "c4c51e2a3833835583df159d12bb2fa724483352", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782089, "uuid": "a1a1ab5c-7d8e-40b3-80b0-cdb43cb62a4c", "comment": "Malware payload (Dridex)", "value": "ae163732b13b9c8cd6be50f36a9d8dfc946255b90a928b85c5d277ed8e351f79d46b42a3d156f462f594c882cab599c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782089, "uuid": "eddb985d-2aef-49d2-9453-fa8dd5a0a2a3", "value": "6BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782089, "uuid": "4d39249e-68b3-4800-950d-700f4b0f4245", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782089, "uuid": "3f489d80-fd10-4797-adff-49efc7a24b43", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782089, "uuid": "4e29695c-7fb9-4623-a1da-75a3ee577a01", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782089, "uuid": "53d5c586-7fe9-49ce-824b-fd94d7759225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782089, "uuid": "30894236-1f13-424d-b967-b910b1dcef86", "value": "e49820cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95aa35ef-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742503, "uuid": "cefbf268-3fb1-4a7f-a95d-2ccf61a6555f", "comment": "Malware payload (Dridex)", "value": "c67765159976b6e6c114c060418c4cf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742503, "uuid": "872aab39-2555-4459-af83-f86521be0d65", "comment": "Malware payload (Dridex)", "value": "c43a06837f7cb206f3aff4e9500f126b69507e831768bf34ff3ac97339dd9618", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742503, "uuid": "d4b644af-72e4-4d6f-b6c5-0c1de65e96e5", "comment": "Malware payload (Dridex)", "value": "7722f3778c13076fc2b557419782962c06a3d087", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742503, "uuid": "d274f564-2263-46f0-97f1-43dc31e82ae5", "comment": "Malware payload (Dridex)", "value": "2e20ae094f33954a7524317b78bc296f0ceff8a52713345d49af3b90e1e066713220d31e5e2778f5c04c40dd062a2a7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742503, "uuid": "86c2f9d8-6ebd-403e-a709-c5f33b40561f", "value": "A0F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742503, "uuid": "404df6fd-c0eb-446d-b739-6e85adfcb000", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742503, "uuid": "4c9ccdc8-cea5-4d75-b6d4-00b917ad5432", "value": "3072:3IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742503, "uuid": "199da580-80d4-430d-ad30-db07748b59c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742503, "uuid": "1dbe76fd-6ff7-472e-8251-fb0205aa1ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742503, "uuid": "8d8e2c64-3d4e-43cc-a93e-fe1a61ad0535", "value": "c6776515_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907ee2b9-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771270, "uuid": "a7a92858-e49a-4a75-905d-d45f09980392", "comment": "Malware payload (Dridex)", "value": "76bde9dcebee4c2c8869d4f478c31fe2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771270, "uuid": "344f20c1-d047-438e-8dd2-2388335bbcfe", "comment": "Malware payload (Dridex)", "value": "c44f9bf6d24bd67773569a14a3555c614c5e31a422803e3253a6ad9d239f46c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771270, "uuid": "e1f42e97-8e4a-40cf-8813-90affc83d38a", "comment": "Malware payload (Dridex)", "value": "a1330e3a3358c8b71673330d2ef20043c97ce7f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771270, "uuid": "780ecf75-a50a-4f0b-84b2-0645925f74bf", "comment": "Malware payload (Dridex)", "value": "18065868990d241ad3d0e80b09ae6667980a8b8b910b1a1ef08611019fc1c17ffe7370d622442562643027b9522eaf30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771270, "uuid": "2c6a3960-c17c-439a-97e4-790bd37cc45c", "value": "60F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771270, "uuid": "f3b54609-68f8-4b65-bfe0-f336bc2b0633", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771270, "uuid": "9a9fabbb-bdad-4591-a3b5-6d5fbc96cbb3", "value": "3072:8IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Vc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771270, "uuid": "9eb2f00b-c8ef-4eb5-ab99-77edd8c43c02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771270, "uuid": "9b149a4a-523b-4f95-8493-5abae65b368b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771270, "uuid": "4bd1bf7c-8769-4401-93b3-ddc0807f790a", "value": "76bde9dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76ad65f-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774852, "uuid": "ebb38be7-96a4-4ccc-9b35-073c1adbd0f2", "comment": "Malware payload (Dridex)", "value": "0272852f4e9de51ef7901d3f068ccea4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774852, "uuid": "45187e00-8b3a-485a-8956-969e2300fd5f", "comment": "Malware payload (Dridex)", "value": "c47385f3d060debfc3e58eb7d6bfcc66c9469c9da14652de8be6f754b5326e72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774852, "uuid": "f3870088-bf87-4598-af2a-d257e7ee1c6c", "comment": "Malware payload (Dridex)", "value": "ac8261c776fdfd3ef03b7eed3dbc3e27dbff8b0f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774852, "uuid": "8304adf2-e7f7-4592-8963-9335861af8d0", "comment": "Malware payload (Dridex)", "value": "9999fa81131479590a1a378da002c68d6f59ad69d127ce9ea08bfe901f2e453c2f616e52ad3c2fd7892ce1434c32f45a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774852, "uuid": "90575717-f954-4c0c-bbc7-9b2369f3dee2", "value": "45F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774852, "uuid": "b63da203-2d24-4957-a4b7-bb089cea4e2d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774852, "uuid": "4604586a-e026-436f-8738-b8b07f059692", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774852, "uuid": "fa22387d-bff9-4ce6-851a-692bee74195c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774852, "uuid": "a70ac95b-62c8-4379-ae97-87f9c6e5d879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774852, "uuid": "47f25870-578e-4cb7-bf2f-bca793010225", "value": "0272852f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c07d89-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767727, "uuid": "53422b21-b214-49ed-8824-37560a7e963e", "comment": "Malware payload (Dridex)", "value": "62ff072d4be40b04a4256b8d3118ade4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767727, "uuid": "a6dd6722-c54d-4e81-8f87-74f213ea12fe", "comment": "Malware payload (Dridex)", "value": "c49e0f4dc5842ff47bd208361e91f4eba28ec6300d5ae58a919b7f9de588d22d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767727, "uuid": "68f56abc-9df6-499c-a4af-91c7e67e0489", "comment": "Malware payload (Dridex)", "value": "4d5266a629e1053bd99d0bbc74a25433dcd5ece7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767727, "uuid": "7b7e3e15-a8fd-4ac1-bae9-44c124fb8f1d", "comment": "Malware payload (Dridex)", "value": "440d49109e0b6b84c9a7f0dd5a8d4f4a2f077c6fb9309b4a36c83652ed684d0311d797a0739e77278a3630af6f2b320b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767727, "uuid": "1d4b380a-0fc7-4109-8881-e948205c14a2", "value": "6FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767727, "uuid": "1d7b05bc-163b-4eba-893a-148ab28deb68", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767727, "uuid": "1881f978-aed0-4a1d-a161-be488195b790", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767727, "uuid": "fcc3c29e-50b3-4daf-8ea6-8ca19b4b6d93", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767727, "uuid": "a0bf28c2-4a11-4264-ba3e-530cc72e0888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767727, "uuid": "d936034f-9d2b-4906-aafe-3b224b47d5c5", "value": "62ff072d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a926d3-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789314, "uuid": "cedcc717-aff9-4fa1-98a2-268cae0ee12c", "comment": "Malware payload (Dridex)", "value": "939d208d218377f5bce06c896c622666", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789314, "uuid": "b1cbc51e-2734-4aed-b960-a9ad7d4d5954", "comment": "Malware payload (Dridex)", "value": "c4d6d7b11633dd338bf966fbbc8cf3bbed01ae3abbaae322da7a0480a5709faa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789314, "uuid": "10d6b3a3-8d47-4e26-87a3-f026dc1321ed", "comment": "Malware payload (Dridex)", "value": "ef3c846305e596f9a0dc8b5957c1205dd4268f41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789314, "uuid": "0b027acb-12dd-453c-a957-b4a78e3f5547", "comment": "Malware payload (Dridex)", "value": "d0df89cc1a03ac13985bb90529042e1ced9235a068128d772f12946694736b6ffa55cad35a96249e8eae9cb31db0f637", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789314, "uuid": "6da53cbe-58ad-470d-b34b-61a57e46f0d7", "value": "33F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789314, "uuid": "168d8939-ac6c-4d8b-8ce6-a0125f0aa07c", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789314, "uuid": "38663493-78c6-4677-9a82-bdaffffc113f", "value": "3072:99F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:99F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789314, "uuid": "e4864a42-be25-4076-95cc-f88fac295187", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789314, "uuid": "b96aac1d-e6f9-450f-88d6-72f9730e1f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789314, "uuid": "160cf7ac-fc9a-402d-ab49-b20b89c8b500", "value": "939d208d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d16082e-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767667, "uuid": "7d604b4c-7173-42fa-ac0b-616746cea3b0", "comment": "Malware payload (Dridex)", "value": "574253c1d5573d5741ee9f3526a4d8e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767667, "uuid": "6c7a8bd7-633e-4540-a0e6-18f95280481d", "comment": "Malware payload (Dridex)", "value": "c5b0928bc49c9ad01701aee8e998ae0823362cc59a4a4a6fd2ae8ca34df71b29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767667, "uuid": "9c0714d7-e5d4-4d6f-aa8e-5fda4a910ea2", "comment": "Malware payload (Dridex)", "value": "9a4676778bd1938c47d91e737d251fc055141752", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767667, "uuid": "d4a661b4-2635-460c-8b2a-cb3bc196c9b7", "comment": "Malware payload (Dridex)", "value": "942befc7eecb4a31eed6be3bf4530116d81b0c804b11ca00bdbb117ef0f784204da8a12c9d9a541b9fb2fd3a2d9247f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767667, "uuid": "0e92553f-8ff1-437c-aea4-9d57a5837ea0", "value": "37F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767667, "uuid": "415fae36-0626-4e65-bf78-def300bab395", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767667, "uuid": "15aa05f7-4f54-489e-a12d-c256a91193f1", "value": "3072:WIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767667, "uuid": "1dad8816-e0ab-4372-942b-16de9bb6f8c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767667, "uuid": "78497bec-e73d-485f-a693-3075159a5a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767667, "uuid": "e5f57245-3c98-4895-991f-a0160a9d5001", "value": "574253c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96f42ee-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764064, "uuid": "8807e290-ebba-4fd7-bf33-4595106ff827", "comment": "Malware payload (Dridex)", "value": "1a8c4b33ae69d6e0b599db5bfd4e7fe9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764064, "uuid": "0a1b63ba-ebcd-41a8-bbc0-d534f594ede2", "comment": "Malware payload (Dridex)", "value": "c5d58d51b4077654437a3d46b6bfc7849ed24e19ebe650be60d0b89694e8d237", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764064, "uuid": "a4c757eb-0fbc-446e-be56-b11f35741db0", "comment": "Malware payload (Dridex)", "value": "9917f5151d6468ed58399f596ff62dedbfc94083", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764064, "uuid": "c9c07ca7-f85b-470f-acbe-ae1d6f628475", "comment": "Malware payload (Dridex)", "value": "076849b12f876c62f07f216345f832d36c3b644c97983eb5d5d3b291eda75ede670f47b3a0c4cc54a1891e94226a9aa6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764064, "uuid": "53ebb9e6-8fdb-492d-bf92-d2b010fa7cc2", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764064, "uuid": "78bd5ef6-374c-4a7c-84e8-919586fd8cf2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764064, "uuid": "95002f87-ebe6-4b76-ad48-57c850f818e1", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764064, "uuid": "e0dc1d61-13bf-428b-931c-7bd9468f978d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764064, "uuid": "f63552dc-ff4d-4f27-8dd0-50d86b76367a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764064, "uuid": "e7bc7bfe-a57b-4f66-b86d-b148621e94b9", "value": "1a8c4b33_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd55ff20-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782190, "uuid": "73f9dc46-ab22-42cc-abf4-d2357852aca8", "comment": "Malware payload (Dridex)", "value": "f821338d4f498a2aeb800c0ae3bb5a4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782190, "uuid": "687fc1cf-f25a-456a-9414-745ee0ec8f81", "comment": "Malware payload (Dridex)", "value": "c684ed9316d2eb3ec1176739091cab790b68d961ce975ca227b300b8bdfb7d54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782190, "uuid": "005617b6-ed6a-46b5-bc11-006e615a7beb", "comment": "Malware payload (Dridex)", "value": "45bef1bf66ac195f42b16490acabb35eddeeeb75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782190, "uuid": "a000b8bd-7d72-4aca-ab51-cb43128588cd", "comment": "Malware payload (Dridex)", "value": "e524e9f264018bdff7ed52fd6764a8b3a78def1deef151d411721178bc82a6446a491ab372ddd478fd6be65b12d7dee9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782190, "uuid": "6df77066-f3f3-4bb8-898b-d0100388fde3", "value": "65F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782190, "uuid": "eb603e42-50f7-497a-b701-6b4cf9eadec3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782190, "uuid": "05de8759-a5bb-4d0b-a443-4a63c3410959", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782190, "uuid": "1600af9e-b0d4-49f4-876f-9da5c5ac0350", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782190, "uuid": "f134c833-4d7f-4430-8a71-6c9a4822828f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782190, "uuid": "e5d3e577-db43-412a-9c52-1bf598765b35", "value": "f821338d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e162acd5-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764105, "uuid": "ba3deb37-5c7c-4021-8fa2-de646094d995", "comment": "Malware payload (Dridex)", "value": "f03ea6c8285108c3e2b9e169c99ccfdc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764105, "uuid": "329fadf7-d8be-4fe5-ac07-01d736541d62", "comment": "Malware payload (Dridex)", "value": "c689d5805bd3402111b094b82da5f0b93fc463ad446b1948e8e0eee0121882c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764105, "uuid": "9604e175-112e-449b-b159-b60867bd0735", "comment": "Malware payload (Dridex)", "value": "17929f174740cfdfeeedab0239d52051d1880e8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764105, "uuid": "a85d2bf0-07d0-4e9f-bd83-e4c4b7785a65", "comment": "Malware payload (Dridex)", "value": "9efccea96e857e73190f09974374b9840d8476f3fd499f88bd340fdd513f6dcb0edae49007b383fc01d23c69150e38dc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764105, "uuid": "1f0af904-f809-4aa8-b6be-0e71fd0e4183", "value": "88F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764105, "uuid": "4edf30aa-3c30-4743-9695-51731b81fd1d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764105, "uuid": "6bf7e317-7f38-4a5f-84b4-a348a3b3987a", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764105, "uuid": "bc4078f0-de1c-4338-9931-b01117bd25e3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764105, "uuid": "9fb37671-c9cf-4417-96f3-3fa5b6565cbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764105, "uuid": "ce7ef506-5850-48c5-8550-655862580530", "value": "f03ea6c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b99f1f-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621751841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751841, "uuid": "f14fbe59-cb44-4b65-a4e6-d3018b6f7bd9", "comment": "Malware payload", "value": "8e5152b9d4bebcd69c24e7d160b308b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751841, "uuid": "cb2f4edf-d2e2-40f0-bd70-f94c383ca4c2", "comment": "Malware payload", "value": "c6f393a54a5e5d14fe6e364c9e2533e287922f2e8fb3894c5b78186bdce72e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751841, "uuid": "896fb9be-9105-420b-a621-e7f6374f59a0", "comment": "Malware payload", "value": "ec289b0e35ac62a6080cf727a0ae9d92a411619c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751841, "uuid": "d67029e5-06e9-4a3d-97b3-57cff1f244e4", "comment": "Malware payload", "value": "580186b879c4a2d32f4de79d27c09572f068a2a6977ed4decb5590b2ad606e3b08ac77fa9e63832417aa5feedda24e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751841, "uuid": "47490467-9306-4e9f-a204-2a74849a6f6a", "value": "90445B20A6E1C034F1BF12F849B59278653A7EA26B3440FF12D63AEA56347E49D3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751841, "uuid": "c364ebcc-c91a-4598-a12f-276af2eb4c78", "value": "eaf6c398deaaa81e3b5479039cba0b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751841, "uuid": "6ed2eb95-087b-44a1-a5cd-c993c01017fc", "value": "6144:UxBesoVMlDMkjUYxumATz3LWpi4XsTRV:UxBesoVMlDpjGmGzq44XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751841, "uuid": "65c22c8a-cab9-48a2-960e-59f1c581eec1", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751841, "uuid": "096c1b9d-f7e5-4076-9270-22ef8ee66df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751841, "uuid": "2f115118-62c9-48ed-94cb-c8aa80ce505c", "value": "8e5152b9d4bebcd69c24e7d160b308b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d3ec10-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728118, "uuid": "8a47bf16-68a2-471c-b3f6-61dd6a073fc8", "comment": "Malware payload (Dridex)", "value": "9fa899da9843b0c750b1d35b6e95c18c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728118, "uuid": "37f04135-2146-40f5-8a30-0ea1ed3269a0", "comment": "Malware payload (Dridex)", "value": "c708a7a335c91ed2a03cca3d5aa80cac445dc9b4a0a0eab437aecf8fd391a1be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728118, "uuid": "3de74c06-29e7-4820-8e18-f611ad4c3b99", "comment": "Malware payload (Dridex)", "value": "221b1fc625dc729a7afb7462fd698adeb71b1b34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728118, "uuid": "a36d4441-63d6-4d0d-8519-ae356c3b5260", "comment": "Malware payload (Dridex)", "value": "2643e5c878693afe14e001c66e5fe2fb5b47b19d0137eaaf7a88e2cc10e1dcfafdf5efe87f2ec94265071986fa0e7590", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728118, "uuid": "8b24b8c0-6efa-467c-a217-06166fec1c63", "value": "50F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728118, "uuid": "29b1552e-3294-46ee-be8d-ab06dc5e60fc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728118, "uuid": "c21042ff-d578-4779-a28c-36ab0aecd50c", "value": "3072:oiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:zeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728118, "uuid": "83babc50-302e-4423-a7ec-31535cf2ab17", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728118, "uuid": "a77f8774-95c4-467a-aab0-b346577b7b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728118, "uuid": "0b1ca8da-cfc6-4634-89f0-41d53a6c05b1", "value": "9fa899da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9809ec40-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789322, "uuid": "ec7198fd-24cc-4076-89f0-d5292f7cde25", "comment": "Malware payload (Dridex)", "value": "d82fd632236e6d11716cc603b3dd80bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789322, "uuid": "a38b8b5a-9fbb-4c2d-a878-ef12978f3adb", "comment": "Malware payload (Dridex)", "value": "c72973ae5aec07af6e2a182ed4faaaa3ab97156bb6b2cadca2781c26c056a02d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789322, "uuid": "0cd4f099-e777-43e3-9c69-88902b680408", "comment": "Malware payload (Dridex)", "value": "1e76491c646414af94a2639518c73219e5de0a13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789322, "uuid": "43baf763-112e-4a8c-9593-13a9207826ce", "comment": "Malware payload (Dridex)", "value": "9e964ad60cbaf29bdae52481e43eecb1276e58ca7e0bfc0b51385726c724ec20cf1662dcb2846d628dfa6b089e94a18f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789322, "uuid": "bb641ad0-d8e8-4077-b679-1d616323f54c", "value": "DDF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789322, "uuid": "a46cd7e0-0a06-4790-b464-3f8029216428", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789322, "uuid": "2a80d8cd-8e34-4280-9353-4c1412d1bc64", "value": "3072:YIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789322, "uuid": "b0bf1fea-df89-49d3-9870-9b5f5e82c7ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789322, "uuid": "2608f662-e074-4c26-8cec-c484c4e7ce33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789322, "uuid": "7fda37c3-47c6-482b-86f9-384f874ab981", "value": "d82fd632_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14814a47-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728113, "uuid": "2724c33e-6bf6-4a09-b056-031679e26c1f", "comment": "Malware payload (Dridex)", "value": "e4fcec8443e639e9f862d816adbfef91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728113, "uuid": "b9db4d36-6fca-468c-a28a-6510f86062f3", "comment": "Malware payload (Dridex)", "value": "c7796a610e2ee45330111c953f1e6eea5b445eb319bb14a919b79f1d73bb3e0a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728113, "uuid": "d65b6e48-e699-4b61-a7f3-d416eb510f6a", "comment": "Malware payload (Dridex)", "value": "f22ba58c4b8ddf1f726bd6cbf26d305d3458924e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728113, "uuid": "20671edc-ef2e-48b2-9021-6032edf12b73", "comment": "Malware payload (Dridex)", "value": "ecf06f62a42cad595e38ad87b7bfc9eb8b6ae7f0f6fb6f73a04061a78f569d152f8ba87b27d3a6a03365ab54beb3b442", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728113, "uuid": "ac60827c-9b58-4bfd-82a0-87afcfa0b75e", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728113, "uuid": "9826f70d-71ef-43ea-b4fd-d04750e13a8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728113, "uuid": "e5486f6d-0c21-4327-9e78-fd0241ae4210", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728113, "uuid": "4dfc4a71-257a-40d3-8b5a-c425c9877179", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728113, "uuid": "97f1b84c-12b2-4526-88fd-cd0e88e7b5ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728113, "uuid": "707287a5-f2cf-42ea-93f9-d7c311290736", "value": "e4fcec84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d457f-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621751606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751606, "uuid": "2dfd37dd-7ddf-4b6b-9911-453c10c58d60", "comment": "Malware payload (DanaBot)", "value": "0d776ca723cf2469af20d6d5195c5a54", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751606, "uuid": "3e32e7f9-15e9-4372-a75c-0bf112915b33", "comment": "Malware payload (DanaBot)", "value": "c78fb90b193dfecaa1570596f5273bc7b78ae13a132cfa0f71d4e49417f31cf4", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751606, "uuid": "feac055d-f4bc-4c9c-858b-3d59f32ff28a", "comment": "Malware payload (DanaBot)", "value": "922cf565c3cb296bd6bfcab2e0f7842974b11056", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751606, "uuid": "035c3f43-de9b-423c-aa6b-24f723d9126a", "comment": "Malware payload (DanaBot)", "value": "89f79a64d030bf85b8f6e9a1f390b6650b6a6f2133cf6b43bed73947678bfe4e81936e518889a9210ff36e5643ee9ff3", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751606, "uuid": "19ba3931-adec-4343-aa9e-86c3e2509d87", "value": "8C563330B6A0C039F5BF63B8C87542B4A53A7DE16B6840FF11C63AD956315AAEC3534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751606, "uuid": "f54b9e3a-c8ab-4357-910f-047a5136eae9", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751606, "uuid": "e4317a60-e4de-4e37-8a9d-8c22794a850f", "value": "196608:IgI0sicB8Hl0tw9L3s5C0TY7Rp4IvbCwim:Z7sioneLtR7RyI1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751606, "uuid": "ca2dd86a-8a4e-4856-839a-5a02ae2440e2", "value": 6327296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751606, "uuid": "1b3b0e37-8c5c-43fa-9e0f-f81e8c5cf6cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751606, "uuid": "507420a5-6de4-4549-8801-329ea869cb8b", "value": "0d776ca723cf2469af20d6d5195c5a54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7253cd6d-bb90-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621751463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751463, "uuid": "03ad9dc0-fd19-4ad6-9626-05d5f9ccadd1", "comment": "Malware payload", "value": "48cf930c7dc00b406af91fd98c7fa3c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751463, "uuid": "b9edb3b3-58b8-41bd-bda5-4107d191b6af", "comment": "Malware payload", "value": "c8f8da4789a3b14ee6b8b7738276f66f9207b7467cb2e7a67dbc92bcec435823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751463, "uuid": "63f9a8e5-2348-418d-903b-2d0b576782ec", "comment": "Malware payload", "value": "872756dbffea0e045944673f07de810718af22ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751463, "uuid": "1100363a-6f27-4f11-bdd9-723786ed439f", "comment": "Malware payload", "value": "16f30b3452cbcdb2b2f2d9a7e9b9a06850809102f7a2aa98f295bbb3547e6c02dbb14646f06c67a1fde380dd38ffee9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751463, "uuid": "d27bec3d-401f-4e75-85b0-24b1207efcf7", "value": "78445B30B6A0C035F2BF15B449B692B8642A7DA16B34D0FF12D526EA56F49F4AC3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751463, "uuid": "9bf8d63e-1a47-4baf-823e-8b7c583a43da", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751463, "uuid": "bb66e239-d3b1-4a02-aafa-f5b61160cce9", "value": "6144:xEY7MxvD2wX/RfgTntLgCOMIM6EHHHHIljfXsTRV:xEY7MxvD2wPRfMLgCytEHHHHIljfXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751463, "uuid": "9c0213e8-723a-452b-a5df-9e7f27d52322", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751463, "uuid": "1e6f71ac-16bc-4bbd-b891-1f2298215e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751463, "uuid": "f9c8cd31-134c-40d3-93f5-63ad4bf54055", "value": "48cf930c7dc00b406af91fd98c7fa3c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7827f4-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749737, "uuid": "46193e7f-c342-4382-a0aa-9884a2dfef0e", "comment": "Malware payload (Dridex)", "value": "aec591b1af46d5352a25f8879731c42b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749737, "uuid": "da42d969-f186-442d-921f-986a5f88b361", "comment": "Malware payload (Dridex)", "value": "c944d9ba50e469d3c569aaebb7a1aa21f4d102122606d3bbd1c7729acdfdea37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749737, "uuid": "31197427-2a6e-45c9-93b4-96a286dc6f32", "comment": "Malware payload (Dridex)", "value": "22033b3e2c357989b97b4aaf15423d24726b7a6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749737, "uuid": "46d5d8cb-59d5-4130-a42a-4ec9d91e21e8", "comment": "Malware payload (Dridex)", "value": "202b5164548b55030333bbc4e8d6a7f1bf0562042c273fcc7d032fd612d2d3df977745c50bbb51f06b18579fe43faca4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749737, "uuid": "0e33c114-6ac9-4227-833b-3d8366512220", "value": "47F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749737, "uuid": "c614d0c5-ff04-4029-920e-e7ec131db329", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749737, "uuid": "0047026c-55a8-4169-b648-f3a46d7a434d", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749737, "uuid": "f0c066e8-b160-4c30-b396-3d1823c146fd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749737, "uuid": "934c6099-5eea-4dbe-ae00-ab932af9ac75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749737, "uuid": "da934fce-1aec-4dfc-8187-a50f276da4dc", "value": "aec591b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6be1156-bc1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621812593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812593, "uuid": "48f8a894-5448-4585-b0ae-efae36916a76", "comment": "Malware payload", "value": "a9a69efa43b3a4d4b1c0f01986f5538a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812593, "uuid": "0014bbd7-56c5-4fca-9416-e5000a398062", "comment": "Malware payload", "value": "c94b0d524e45a6ea9b4b904587ebe2df73049b1b73e3474b9796f48746adde99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812593, "uuid": "bc0602ca-aea5-43da-8694-da29f00b1ec7", "comment": "Malware payload", "value": "4112b9f368e53da23757c86cb094f4ba18054fa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812593, "uuid": "94b3feb5-182d-4c64-a10e-cef0cca933d1", "comment": "Malware payload", "value": "2d46902d75954cc5e2606c72571f6b3ad8b07034f72c6ed53500955e9c8976b6cece14b942cdf3d728c884f575c6a804", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812593, "uuid": "f557239c-b7f1-402f-9694-ea88a79e6286", "value": "1506F118FF70AA04C012AEB04486954BC45B83592D5DF1BF2F5994C87CA7CA92687EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812593, "uuid": "21aeb810-22ee-4954-bb3f-6e5430aa5d0f", "value": "98304:3/cGFTv98BWEZams08AYR7Mk5jL3i+j5O5QAb/bTk2rhg+nRvU/:3/cGxF8BZam2ldORvNr6Cd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621812593, "uuid": "532cd772-ddc1-4324-a579-c446f32e9e77", "value": 3767233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621812593, "uuid": "787db569-7884-4a77-9f1b-a680ac755d14", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812593, "uuid": "42a24f02-f0e6-450b-9cab-873b612cb635", "value": "chrome2321.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb79d8d-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807239, "uuid": "3ad14b3d-dfb7-42fe-9e4e-08bd97a8f0ba", "comment": "Malware payload", "value": "d401cc2c5a315a50319b0d63095f8ba8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807239, "uuid": "5844fc4f-a410-4aef-a81a-0b2a546185cd", "comment": "Malware payload", "value": "c98f7d542e77119e15c357c52640f68ef1436e631db0c02b38e36c941c6f36f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807239, "uuid": "2b82d25c-6638-4324-89c8-c520a574385d", "comment": "Malware payload", "value": "2918b46ec671cfbdc9944d2c737d1ce1ce54dd3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807239, "uuid": "4077f354-4979-4219-adbd-094ace646eb9", "comment": "Malware payload", "value": "2df2e8a7abed9f4c1a5f619a3676d5706cb3b56c9564e9cb09c9747b2d526822b6a3cba195d7c7da817f223df5b3b8db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807239, "uuid": "efd7d3a0-8a7a-4c5c-a901-a9884467533d", "value": "CAF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807239, "uuid": "5d4744a4-99d0-4d9d-bf98-cd61436f9bc0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807239, "uuid": "171516c2-17c0-43c6-9210-6fb200ac63ed", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807239, "uuid": "0b0a0b3d-0a0c-4bc2-b64f-09888c156c24", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807239, "uuid": "118a0ba4-fec4-49a6-8989-91362ebbb160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807239, "uuid": "2a54b4b8-d06b-4085-8bef-a5d5e27f0363", "value": "d401cc2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c564bc95-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735281, "uuid": "60facba0-a4a8-4bd0-b321-21dc7a128574", "comment": "Malware payload (Dridex)", "value": "a6ef0d23a5eb920ad03de5ceb95eb756", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735281, "uuid": "4dddb994-4b01-4056-a506-c75c80f05721", "comment": "Malware payload (Dridex)", "value": "ca3f417e2ae9a53149e25baa43e96e9e2cd233d3d8efde75cedeee33c3867aee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735281, "uuid": "b8525e5d-ab0b-4b59-b2be-deb6ef91e16c", "comment": "Malware payload (Dridex)", "value": "d37a5ac65309f269e5a984a1a577ab10953b9062", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735281, "uuid": "9f3e7c75-288d-47a5-b6ce-a5fe6f9dbda9", "comment": "Malware payload (Dridex)", "value": "8721d84a1178bb678c8870a8da68628425b22156edc5d67569d009451acaf1df97d462437950a692e1ebe925c2376da2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735281, "uuid": "34431e2c-8a29-4939-97da-8d8fc377d70e", "value": "64F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735281, "uuid": "47becae6-710d-49a0-8e95-2adc6bb82d50", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735281, "uuid": "ade84d9c-cc71-4793-a714-6df3c44c742e", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735281, "uuid": "e9937db9-09f7-4101-bbe7-04e47e050cc9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735281, "uuid": "6eee9c32-4f16-4e87-afc2-a4f2e3ea43d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735281, "uuid": "6ad65881-21f4-440f-9f3d-26702783cff2", "value": "a6ef0d23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e9ca04-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1621767677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767677, "uuid": "ecedbe2f-ac6e-4189-964b-0f3ed1ba0aef", "comment": "Malware payload (QuasarRAT)", "value": "b86fc48fed9141b3f05409fdd5251293", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767677, "uuid": "ba598823-5158-4df9-bfe3-ad5aa6bac6de", "comment": "Malware payload (QuasarRAT)", "value": "cbf539d4eea26320e66428cddd0a2dbfbdf4861670e20ef9b074a63f6e142783", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767677, "uuid": "a6c2d0f2-97b1-42c2-9cb6-19001034813e", "comment": "Malware payload (QuasarRAT)", "value": "75563902edbec9380ff9f0d4abd5a3f31d39156f", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767677, "uuid": "5e976aa2-fbc6-404d-8946-790531ea026c", "comment": "Malware payload (QuasarRAT)", "value": "e1c8191a45f6276a28418daae319484111bc5c5f14d90e4af75eb6ff85d32995d898924111c0de94bb64f21eb63aae20", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767677, "uuid": "75317a21-b521-47fd-bf6f-f9eec5c5b504", "value": "09256B343AFA501AB173EFAA5AE474D6DA6FB7333B07A45D1091038A0723A41DDD193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767677, "uuid": "90adf035-1ef8-444a-ac32-c240e14a56d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767677, "uuid": "e7d19893-2489-4646-916c-d7f08486ad65", "value": "12288:RksFsjhrIq134lbmMP0y+ssK8UlwetBkff+ruMZZkeGz+h00sAhcKLujJEb9Ox62:RFdqQtYfbMgihLaiCKObP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767677, "uuid": "61afa1bb-67bf-4776-80fa-c18c80315de7", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767677, "uuid": "3a9444ca-08c7-42c3-b4e4-d67e4707c9a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767677, "uuid": "f729c233-8a9b-4523-91a6-09feaf38fbdd", "value": "b86fc48f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e428af8a-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774847, "uuid": "fb8b72b5-d62a-4c0e-bdeb-69ccbee64fbc", "comment": "Malware payload (Dridex)", "value": "922d368bdca7e09e3da1b0d64605a38e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774847, "uuid": "3dc4938f-19d7-476a-80cf-8360b557d0c6", "comment": "Malware payload (Dridex)", "value": "cc464fc33e6df7a3a6d08c0c3cd36c23bc056fe214884b6a9c0acc3b00ade3ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774847, "uuid": "127133c5-ba91-4eb8-a61d-b8d0dfb1a947", "comment": "Malware payload (Dridex)", "value": "8b9bcb162341fcd17c4d7a1042e23a5be55ede14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774847, "uuid": "a9880d0f-72b4-4f6d-b585-a7d1a478133d", "comment": "Malware payload (Dridex)", "value": "f5f0353dbd69f69421c4b1877cc6587a75b4fafc67f91c0ebfc2ca69226ae7be51d0ac55a586d3eb99288aec432e0403", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774847, "uuid": "0b302952-1520-4410-bb9e-be21bb119fa5", "value": "42F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774847, "uuid": "ca8256bb-ade8-4469-999d-eb5fc3f3f517", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774847, "uuid": "e63587ea-de56-47e0-9524-8edc95e5cbb4", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774847, "uuid": "203e5c76-87eb-4b61-82d6-fb38ee0b27bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774847, "uuid": "60ba4e9d-564e-4d11-8a08-c7eb774116a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774847, "uuid": "74f34f38-7575-4c9f-bec9-3ac221df0e4e", "value": "922d368b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce5a421-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774969, "uuid": "1bbe3d13-670c-48b0-a831-c45b6c6b2e9e", "comment": "Malware payload (Dridex)", "value": "a2ce41acaa27fea679663be51a29a2c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774969, "uuid": "6a852948-5db6-4d2e-a158-1760000ed528", "comment": "Malware payload (Dridex)", "value": "cc6945664164ef2686bf614749be54bea4a6abc4c48c112bde13ab6938251c31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774969, "uuid": "d9bb9981-c7a2-48b5-9ed2-2891b23e0c3f", "comment": "Malware payload (Dridex)", "value": "7540fc47ce5068203071bc2d701b4da07255af1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774969, "uuid": "3901e721-b907-4b57-8d56-fcdd75220fca", "comment": "Malware payload (Dridex)", "value": "7a2cee4d336588d46b8ab69dbef4f7763543384b5317c82104c38fdc0f212ef877ff6366316696fac314201a73feb4b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774969, "uuid": "abfac467-2a6e-4aae-a8a4-170148ed72b9", "value": "70F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774969, "uuid": "949d5e0c-dbaf-4cab-9a75-ac381a0eae9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774969, "uuid": "2c3f5f0a-dfea-4708-979e-418757863850", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774969, "uuid": "b3a3f2ab-81d0-4d2a-b0ff-933e98b17eea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774969, "uuid": "8b91374a-f515-4c71-b638-f26eac9b51be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774969, "uuid": "8ceddd85-8cd8-48b1-9d9c-d7bf5a382476", "value": "a2ce41ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53b480c-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735227, "uuid": "2751a2eb-b197-4bc7-9d9f-92d70e9b008f", "comment": "Malware payload (Dridex)", "value": "de0dc986bd53f3acb2f040de88a04f32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735227, "uuid": "b7c583ab-582e-4f52-b1c7-b0f17d576ae7", "comment": "Malware payload (Dridex)", "value": "cc804923bdef58ed1da66ab61ae9f01098b743671afd07b9230f99c723c1a6c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735227, "uuid": "c76d489d-2519-49fe-8aaa-e0b5377f6475", "comment": "Malware payload (Dridex)", "value": "026b2b1451b7dac545ee506e7747796ea87727e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735227, "uuid": "08fb335f-33c2-4188-9bf2-923023e5ff12", "comment": "Malware payload (Dridex)", "value": "7ac8a9f4e16058a706f1b56562de9bdeb6a7c53c370fa9c5e9acec19b8c3cfef406a88f00113dd42896d75b826cf2ad7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735227, "uuid": "35599a84-6bd3-4888-9d75-e4890e51a897", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735227, "uuid": "22975146-754f-420f-95b3-aa35b4168912", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735227, "uuid": "3366a78e-9c9d-4b0a-a887-a2456a53f1da", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735227, "uuid": "a222c429-4fe0-4d85-bb5c-8f24be37bab1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735227, "uuid": "cb2497d5-7b91-4a94-9544-c0b541d4f8cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735227, "uuid": "078d5a45-73dc-4c50-9dca-4fc30b07d920", "value": "de0dc986_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d2477c-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807256, "uuid": "dadf2c78-db52-42cc-80bd-3d987efd8087", "comment": "Malware payload", "value": "5bd16689827646eccb1b560dd223ce48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807256, "uuid": "1f5878b1-14cf-4d05-ab94-a966d2732614", "comment": "Malware payload", "value": "cd79395535a2bae1cb1e032cf0c7e5129579f76610dcf46f0768a51d86215071", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807256, "uuid": "05def0ba-aae9-4ddf-8899-e0c2d3098ef9", "comment": "Malware payload", "value": "810ceeff7aa4461e31b7337f07385ba6401747b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807256, "uuid": "8f352bf0-396a-4566-afba-eea52deb017f", "comment": "Malware payload", "value": "2153501b3542f11056cf3bce786b42a224e068aad25468876e59f03ece1bfc0d163e7ed9c6c90afb933b19d2a25baa81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807256, "uuid": "9ec3209d-088e-43c5-93e4-f8425b5e38b6", "value": "89F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807256, "uuid": "6c9a5f16-0b02-4421-ba48-252e19e87408", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807256, "uuid": "bc13fb13-567f-4d1c-a152-96ade09bf711", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807256, "uuid": "90d44895-e0b6-4816-9235-8bf30e792368", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807256, "uuid": "dd3c39a2-ff0f-4daa-8183-bc6959d0c6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807256, "uuid": "1aaa33de-310e-4c89-b03d-efe54fb3b154", "value": "5bd16689_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651b9956-bbd0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621778928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778928, "uuid": "0c51ec25-6213-48df-84c9-21d43b006652", "comment": "Malware payload", "value": "7b6888e1115c1d63443f3bef526a9297", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778928, "uuid": "018dd8bd-b292-4318-af43-c764e7246bf8", "comment": "Malware payload", "value": "ce5bb6485af68ecfe37a05334e340716eca01103224cb41554f535c8d5e931d7", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778928, "uuid": "6aabe3b1-28e2-43e2-90d0-1c6f6ecd3b87", "comment": "Malware payload", "value": "36e3c23dd1fc73aa82a9d87bbec3048d190758a3", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778928, "uuid": "0163f837-e7b2-4143-8545-452a40144038", "comment": "Malware payload", "value": "d54ef4ce38070a5050e58cf06abb311f10e47744846d90053bb47664c1e45f4be2e1d5884b1e6321cf3278b1dea2c82c", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778928, "uuid": "d17fd52c-8a58-466d-ae2f-759b9e538aa8", "value": "7982C014217B6D42633F5A8483783C2120B4D57ABA0FAB712935D85707FBED9AD882FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778928, "uuid": "7c86c103-42fa-40c2-b107-cf14da1b9f33", "value": "384:wnXOVQ7VsURb2qyyHIa8JKobdz+ckxb8fMYgYzDUHVVbB9ySAHKTzJ:8DRhb4yo1oobs+g1HvdMKTzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778928, "uuid": "188f95df-17c0-403a-b5c1-93fa92f966f4", "value": 17709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778928, "uuid": "114dcfcc-2b08-42df-b68c-d01b7dd7b3f4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778928, "uuid": "adb0de6f-54f1-464a-abf6-cad4df9e8a42", "value": "FedEx_0000549771.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3968a39b-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738912, "uuid": "6c6ea105-ba46-4c6d-bfd3-fac2ed34928a", "comment": "Malware payload (Dridex)", "value": "387ce7af8c4badb57992c789e5b6dfde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738912, "uuid": "93081470-4cd6-4e09-beaa-cf6fbe8655d1", "comment": "Malware payload (Dridex)", "value": "ce6b50b7e2aed6448562d586940acf329c4e0ad3ba476c3ec12a3cddac08bd23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738912, "uuid": "054c303a-af4f-4926-8149-536b1dcb7b92", "comment": "Malware payload (Dridex)", "value": "098b144a6acd71bbe61b8d4306511af89aa6252b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738912, "uuid": "aa191c00-8eff-4db1-8d95-fe35cadf6d27", "comment": "Malware payload (Dridex)", "value": "08267212eb882ef4859dee5d12eab7cbdef48606156208d6879d4c9298dc5c24dfcc0bfebd8b675d2081cf6c2b791c31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738912, "uuid": "0cd291b7-59e3-4d83-8a45-e4b37c975858", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738912, "uuid": "01752067-1b1c-474a-8dc3-9485dad89347", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738912, "uuid": "fe372a2c-f1ef-45fb-95af-30def746cbd6", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738912, "uuid": "ed9b9bc5-ac1b-4c1b-a443-8206925b7bdc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738912, "uuid": "c4a98994-1e11-4098-a66e-2e0c2edaa8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738912, "uuid": "793b903c-2cfc-40ae-ac88-3d25b39e7fd3", "value": "387ce7af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06900259-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803681, "uuid": "bab41c3b-e2b0-4cbf-aa40-423d94f999a3", "comment": "Malware payload", "value": "7d9eeacd9bb59f859aadf9b2ebf56600", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803681, "uuid": "47755847-67ed-4e6b-9071-5ff28bacfb20", "comment": "Malware payload", "value": "ce812608bd96446f3a1c3f933dcba898202f7af138f52b59e1c8540aa8a7bbb4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803681, "uuid": "6516baf5-fa9d-4a78-b57a-b22ebe542f05", "comment": "Malware payload", "value": "911c4072b896ed287eb1456da585f3429f810790", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803681, "uuid": "bd1a223f-98c3-47ab-892c-71a6001ad93b", "comment": "Malware payload", "value": "6fb2140a419cb253f78dd16b04fcd75ba9ebc9942e2704d91bd85c2373a77376bea16ca5cc2ddb33a5ffd4e1c4a59a91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803681, "uuid": "b01eadc1-109c-4a1e-add1-d914496553a0", "value": "28F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803681, "uuid": "5a0fbc28-634d-4fc4-9c14-0b2dd8955f37", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803681, "uuid": "1b42e7bb-287c-40ec-a66a-7c8e382fd461", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803681, "uuid": "20cd1386-0eac-4b7f-be0b-e70398f91284", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803681, "uuid": "0f6e970e-aca6-4d87-98a1-9f3072f378d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803681, "uuid": "81a87a74-12bd-4761-8ec5-b9ada2607f05", "value": "7d9eeacd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c091d066-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735273, "uuid": "190f25c7-da5c-4d9f-84f3-43dbbe85e8b2", "comment": "Malware payload (Dridex)", "value": "e648a37d8bdaf747696786676e6c91f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735273, "uuid": "d92943ae-27ac-4d5f-b175-c8faff107751", "comment": "Malware payload (Dridex)", "value": "ce889c9846d62a05adab9935ab2ea7b1830659214e59275e36fc769cd861785b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735273, "uuid": "1780830e-d903-4a49-9d18-703993d92f18", "comment": "Malware payload (Dridex)", "value": "6338a1ffd4eb0779b6960cf14884c0c48b58af81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735273, "uuid": "d46a01d3-ae6d-41fe-b5f9-0e9af450e2b1", "comment": "Malware payload (Dridex)", "value": "80171855d0e31bd03017964337bbe5b3dfbb3ab3ad1bb03fd68106c8027f3ce56a2ffaad757f433516df265212951900", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735273, "uuid": "adb08b23-e366-48a8-9806-748bd8c6d9f6", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735273, "uuid": "12cfa38a-9357-45e3-a827-d78428f0429b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735273, "uuid": "22982826-49a5-409e-8ad3-a78cc995daad", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735273, "uuid": "338c3277-1c57-4c5b-ba4f-b5e7f2815cc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735273, "uuid": "0b9c30b9-3b55-4ead-b6d1-4643a45f86c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735273, "uuid": "3caca030-a785-4318-a725-bc3d69d5d5d4", "value": "e648a37d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b37b812-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789300, "uuid": "9ffeaa8d-0df6-4e84-af64-6e2f516a7cd5", "comment": "Malware payload (Dridex)", "value": "7150ff6a50bbac4abbf9c472e0bf5ff9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789300, "uuid": "6f95b2c6-bdc3-49a3-a1c2-125dcca774b8", "comment": "Malware payload (Dridex)", "value": "d1486303f3044f5d4210f66c57d9bb60f9a9b1f11370ec58fbd7a410e3b15352", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789300, "uuid": "5abd8855-31c5-4bd6-a0fb-42f750060094", "comment": "Malware payload (Dridex)", "value": "1b8ee49d78b78794438cf774de31a656998ce575", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789300, "uuid": "0d45a352-b39f-4d03-bb52-025d7775025f", "comment": "Malware payload (Dridex)", "value": "0a52dba7e6b35cdb723eee9dbfd4306b42f58b2561b9045dcdb7401275d75456f137ee82df1fdb3fc774a8edf3f92702", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789300, "uuid": "ad0d3199-5644-4607-b991-1672f12a54e7", "value": "62F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789300, "uuid": "b8f5222a-25b0-4b28-8099-d6800ae2b971", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789300, "uuid": "dfd6f5b9-97ec-47b2-a003-6fefe77abf11", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789300, "uuid": "e17d50fb-a3d8-40df-a2c3-fcb256baea9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789300, "uuid": "f578a07a-d8f3-4623-9d2e-2755d1fb5961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789300, "uuid": "b3dec51b-90ee-465d-9ff6-9e5d333240f7", "value": "7150ff6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f4e75c-bbbe-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621771276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771276, "uuid": "11c5573f-74ba-4d57-8c4d-a6833307a862", "comment": "Malware payload (Dridex)", "value": "1f8c68df07080c78a796b72b8ec43478", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771276, "uuid": "97333e9b-3203-47d5-8496-6c8544699aa7", "comment": "Malware payload (Dridex)", "value": "d16b1d87f5170bb19d72cc7f147831ae0a0d643840d2d22cf944b627c38948d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771276, "uuid": "9677ed8f-31e4-4b1b-a5cf-e602a0f9ab89", "comment": "Malware payload (Dridex)", "value": "52960a22d6a7c55fc301212b511b75e130f88f61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621771276, "uuid": "a2b6557e-10f6-42d3-890a-586002924c4d", "comment": "Malware payload (Dridex)", "value": "cdbdc5e3dd74c434c151f5dee8e0a2e8021cdcdc41402059f1227434cf52a3ab9360ae9dc4dfb518224a9a89a5e12a9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771276, "uuid": "901aa374-fe17-481e-a3a6-8e1918befed2", "value": "A9F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771276, "uuid": "fb15456e-bce3-4b8f-be47-8f34020a2215", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771276, "uuid": "e6c01291-ae3e-4601-9c42-f5d4be78b70e", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621771276, "uuid": "b0dbd145-4ac0-4daa-a436-bf4a641aab70", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621771276, "uuid": "b79fb251-0b44-4a90-9c1e-5e1902a711f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621771276, "uuid": "afc0c91e-2a25-42de-a1a9-aeaa77e36107", "value": "1f8c68df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1796cb-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738893, "uuid": "682a1956-8fa7-4661-b256-0e14d6611dee", "comment": "Malware payload (Dridex)", "value": "32fe364f1db821c435828df0409dacb6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738893, "uuid": "98400c19-6b07-4604-9a20-d4782429474e", "comment": "Malware payload (Dridex)", "value": "d1b222d9bce50f5e1d744a11019a83118bffcdd4de56448cc2c482417bee2f65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738893, "uuid": "1cc44944-dd3b-49c2-af59-9281531095b6", "comment": "Malware payload (Dridex)", "value": "cc0d776600cc73ef7322b27d2c3ceae4259c0ddf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738893, "uuid": "ee8d277c-85f6-4431-814b-1816815ef7ab", "comment": "Malware payload (Dridex)", "value": "ff60981f53be80ec55f6abd94aef71e4bad20cddf3c13efb976867f3951101e794262848b71b02273e3a59f4f8e2ee84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738893, "uuid": "81edc487-eb4b-4a71-9d44-c6f2f6743b14", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738893, "uuid": "0a83cf42-7d9a-484b-88d1-fb82691b729a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738893, "uuid": "42c9ea13-8a92-49cd-a73b-804fbbe1ec36", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738893, "uuid": "cb300a48-d1d4-472e-9e5d-52e741a11150", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738893, "uuid": "714b0253-bad8-4111-bc48-eba2eb6644bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738893, "uuid": "789a827a-f0dd-4c38-a9d6-c679a167ca03", "value": "32fe364f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ef382b-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782050, "uuid": "a57bcad2-6bec-42f6-bfb0-5935b0dd21ad", "comment": "Malware payload (Dridex)", "value": "5e6428072f8d405d2705ec320c08371e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782050, "uuid": "0bbb93b3-00d4-4e8b-a260-59b013b5ee83", "comment": "Malware payload (Dridex)", "value": "d1d6f849b0984b204340cc0e940c3e34326996155e1c278aad2f2c4c576e6ad5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782050, "uuid": "80ab7961-f135-444b-9a54-f76abc998258", "comment": "Malware payload (Dridex)", "value": "fac5f6d8ba44ee35f4b77322ab2d2d91eb11b4ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782050, "uuid": "5ce18903-131d-4222-9907-ed6623d3a0d6", "comment": "Malware payload (Dridex)", "value": "9ea4abffef256f87932a803872b81fd20339b222ba80beab3a087177e41d1bb11ee26493b3a74b0f5493d3a7fa87b3b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782050, "uuid": "f1526f16-7a79-4956-bba6-337c65663954", "value": "C9F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782050, "uuid": "c61e4aa1-bea7-4386-866f-91337ad5b9ed", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782050, "uuid": "2ec4689c-4bfa-4059-8b86-92acf865b080", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782050, "uuid": "76f114a4-aa46-4ac9-8106-4476962ce16a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782050, "uuid": "1a473603-f1d8-4d53-82b5-e77512892f7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782050, "uuid": "c5a1f6a9-0cdf-45c8-8a8a-89acb369539c", "value": "5e642807_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f84fb8-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738852, "uuid": "8b060b56-aa26-450a-95a4-348d219d96e8", "comment": "Malware payload (Dridex)", "value": "46be5a0d15be7d0018f71009cd739e8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738852, "uuid": "5da6eed6-adbb-476f-8fb6-a3ffd4bb30ba", "comment": "Malware payload (Dridex)", "value": "d2781c55fca3ceb885c2e153a331eaec2ac870c4d8aeb2ae3c1a127c587f561d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738852, "uuid": "e6073541-4121-4018-8866-9f767dbbf187", "comment": "Malware payload (Dridex)", "value": "320720b78929ab4e6774f47b6a54b2767e91c011", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738852, "uuid": "cfc8d326-5a0e-47a4-a5e5-ac3a704c9f39", "comment": "Malware payload (Dridex)", "value": "216f706cddd8b0008b726d1b8cb5a115d37017134c4cf9992406b8205b760b2ac557e182c57afb78a89fdff577fbcbf3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738852, "uuid": "81cee6f3-d1a8-4fc3-a640-f26571886c63", "value": "55F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738852, "uuid": "6953d794-958f-4530-9e94-8afde7e71bb6", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738852, "uuid": "694a961a-0a7a-48ba-bca4-314ad3696d8f", "value": "3072:u9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:u9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738852, "uuid": "386a4443-4d87-4f7b-8a4a-facff3053ae6", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738852, "uuid": "4c1f23ac-a8ab-4d68-ae54-7390cef7a87f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738852, "uuid": "895b10eb-0ab8-4851-8f4e-ed0fc73977e3", "value": "46be5a0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4761824f-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785750, "uuid": "5a083018-6127-4af0-94ac-d2c339568db5", "comment": "Malware payload (Dridex)", "value": "ec76b0676f73942547473d9bb7b094d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785750, "uuid": "0af5f79e-3776-41e4-b701-4aea956d95f6", "comment": "Malware payload (Dridex)", "value": "d2c5efefe269679856cd23b5684ba653b73f8d4e6f7bab499bd35385e225c3e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785750, "uuid": "760043d9-f16f-4c55-8be6-0cd3705ca728", "comment": "Malware payload (Dridex)", "value": "b032cccd7b1b00676d18f7c95cc9f275ed583918", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785750, "uuid": "a5c105f3-96b8-49f5-82f4-6ef54305859e", "comment": "Malware payload (Dridex)", "value": "b796fffce7cdbe1dc173a783f39a04e6bd164ed07de0ee76bf007b061c41abf11fa82651cf8b105903166c97d5a7bb90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785750, "uuid": "15a234f9-2990-4311-85d3-ce8b661373dd", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785750, "uuid": "f11d29c0-9d23-453f-a180-ada46087e64f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785750, "uuid": "2ed781cb-3f62-4c8d-9f99-b11262278451", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785750, "uuid": "bc76ef27-b58b-4d41-9a5a-fb4b3e066388", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785750, "uuid": "debb3b86-bd28-47fa-bbfa-1f2abc8c152d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785750, "uuid": "6e76fba2-bc92-430e-94a3-f69533a299b5", "value": "ec76b067_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1234052-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753286, "uuid": "262b0db0-d5d7-4b0c-8a42-d0299d3b2199", "comment": "Malware payload (Dridex)", "value": "2440115bda5a5cd0b40a5ec8e934d20f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753286, "uuid": "86d33433-11d2-4e6c-a2cc-8829fc4ec96e", "comment": "Malware payload (Dridex)", "value": "d2d04615bc2ff2145aa59517d712ceaa953d84c1c78b8514f6e5afa17c0d9f9a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753286, "uuid": "c85c3f5c-1a5b-4cbb-8384-c3fd3397412a", "comment": "Malware payload (Dridex)", "value": "f83aee820d9c28cd71bdccfe9c8df7f3a141f7b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753286, "uuid": "ea2e0ab9-0e13-443e-9c48-c4959202d904", "comment": "Malware payload (Dridex)", "value": "507964d2fa213a736414c9339d2d072ae6ef2e96afdb5947ca8210e4602b6b629d1bf122121f3c789d3154b2a5d619b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753286, "uuid": "11c72bff-6b26-4328-8ee5-18002b8a4526", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753286, "uuid": "88298ba1-e96a-498c-bc92-04139e4b927a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753286, "uuid": "bc651f02-3369-40ed-bc50-c845f51ca85f", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753286, "uuid": "5ca6aec0-4c0d-48be-a5d5-9de0a19161e7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753286, "uuid": "046f3bde-a995-45b9-b9c0-f543fb4f208e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753286, "uuid": "2529ab7f-7c0b-4535-a696-d0f5c226ac39", "value": "2440115b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec38f66-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810862, "uuid": "600da29f-66ff-482b-b556-7b558427aead", "comment": "Malware payload", "value": "36b04257ad948f44b1018407486ddaab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810862, "uuid": "abe468bf-a0b2-43bf-8d22-8164295c135d", "comment": "Malware payload", "value": "d2d849a6e6ea535cb48997b361a749e5d05d4799726721d047af10cac1294b9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810862, "uuid": "98aa376c-84d8-43cc-b532-700e631d048e", "comment": "Malware payload", "value": "adb224ea2484f0f0d2b05562d880c8fe35bf0ab2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810862, "uuid": "bc6f11aa-3fdf-4a05-844d-ea5b485f61d7", "comment": "Malware payload", "value": "aec25826f9f8a6191f9acfdd6cdfddaae9f344de9a49414d6b5419c865678a980fd3e1befdfc1626ed8c5a458548f3e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810862, "uuid": "32a429fe-8229-40c1-8db8-cfbc6a1eb1f4", "value": "7F04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810862, "uuid": "43b54f1f-3d27-40bb-a882-60e5fb1a3d3a", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810862, "uuid": "ca3d7082-e33c-4331-8be2-5c73ad3dfa45", "value": "3072:oWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:oWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810862, "uuid": "4ff50fb9-be12-414b-8b34-2f18eb54038d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810862, "uuid": "1326e43f-d11d-46c7-b6f3-29f1c27b2af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810862, "uuid": "c83c296e-7b6c-4d11-8996-f46bc9e008c0", "value": "36b04257_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd3165b-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735319, "uuid": "7204e3e2-b125-4b85-a1e0-c7afce32302d", "comment": "Malware payload (Dridex)", "value": "8db8c6f7203474d77c774c24cc87341a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735319, "uuid": "3bb83bed-f8cc-4538-b048-f24bdd1eecf8", "comment": "Malware payload (Dridex)", "value": "d2fd1ecd8e011e4817b7341187bb16326ba3af654b04aa2d72d3e0f5fccf362a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735319, "uuid": "682167f6-dfb2-4b70-bfc8-c4d76d370716", "comment": "Malware payload (Dridex)", "value": "5912ca8d424b08c18bdad21e9d6453aeb249fc88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735319, "uuid": "2fa4e407-7039-4057-a5ab-9b264bff7e6e", "comment": "Malware payload (Dridex)", "value": "6df8ee98ba9199943fb6308d28a10194bd5b820b307ce99e9666c81ae4826ea3dc4557663a96dac46ab2526c744e2ff6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735319, "uuid": "e05bf170-3da2-456d-924c-fa93309127c5", "value": "A6F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735319, "uuid": "fc5843a5-7bab-44ef-90ec-0bcfb3079dd7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735319, "uuid": "aba9c013-697b-4d8b-a5c0-00435681caaf", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735319, "uuid": "5fa3f84e-d22c-4302-8ee5-5533a1a4f28c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735319, "uuid": "8850fd15-8eee-4e12-afc9-99465f27ccd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735319, "uuid": "430c429d-1bca-402d-bd10-c9cac2aa55fa", "value": "8db8c6f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce9f03-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782057, "uuid": "e1f5db65-a2e8-481b-b37f-501433048781", "comment": "Malware payload (Dridex)", "value": "ef5de546a401b12c83d81b13324bb54b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782057, "uuid": "6e5b2b6c-853f-48b0-8f91-85ea4e242d40", "comment": "Malware payload (Dridex)", "value": "d3256eb305a733c7006c20046d7e91b602ef0cea5282450fa4c28207e54010e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782057, "uuid": "30a87468-5983-4574-8d09-d5b81d3a39e5", "comment": "Malware payload (Dridex)", "value": "7152966714082c227d4cea5c32002d2fd694d31c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782057, "uuid": "31dda8c9-4daf-4ec8-b18d-7ef7781b4081", "comment": "Malware payload (Dridex)", "value": "c08d1113963a823b1893ed370182dc8bc0f2a664b0a0bfc5ed4d358fb64f2d66f0891563e1cb63181ea77427dc204021", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782057, "uuid": "ceb35160-d193-41e2-b205-48cfdf8eec14", "value": "3B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782057, "uuid": "64743197-60ee-41ee-a5a3-8aeec36db119", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782057, "uuid": "7973be91-0c4c-4eeb-bf56-df53cf7525ae", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782057, "uuid": "f7c1ac05-5a76-4b05-8052-f83df5dc42c0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782057, "uuid": "ff2743e3-79ff-47e3-972a-19ec0d4333c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782057, "uuid": "8acea1e5-9fc0-40f6-8ad2-48484215b695", "value": "ef5de546_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5363e3e-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792887, "uuid": "f476f240-397c-4bf0-8695-6c416d9aa0c6", "comment": "Malware payload", "value": "adbd8fded02053913248d37d9ae790af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792887, "uuid": "e6c73656-1720-4f82-96df-a7f10bc39fb6", "comment": "Malware payload", "value": "d34360882d61a90ad1c5b59135a8c1ac8fb43b239b6b3e7cdbb15ef551db816e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792887, "uuid": "3ac8a88d-f647-4c2f-9350-1373cceb1587", "comment": "Malware payload", "value": "e7b3618edcaee4d642c5edda48af5d928854fe3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792887, "uuid": "5b03ca14-f1d8-429f-baea-b0e2361a7886", "comment": "Malware payload", "value": "32eb010c4061d1a100d4a7d4abe82f476eac20b31e053183b6e580b6260c19c03b1ddb7681c3e1281d7a6f9e4b8d181a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792887, "uuid": "04c17844-fe89-4318-9887-bf445a3b1a34", "value": "78F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792887, "uuid": "15faa63e-071e-485a-89b9-09e6cc58b7e0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792887, "uuid": "6101890e-3b2d-4d62-9aae-67d49a4d4e66", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792887, "uuid": "b3f898c1-eb16-492e-af4f-b8d99762e288", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792887, "uuid": "b1eeeb67-eb33-4626-9288-b54ea7425cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792887, "uuid": "89e75232-555c-48f0-8f08-24f9128470fa", "value": "adbd8fde_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53b91f1-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753320, "uuid": "efb19f44-a319-4616-a70e-d7a48602e6fb", "comment": "Malware payload (Dridex)", "value": "0858b8f2a45d8d01aa0ae2b8cce1431f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753320, "uuid": "85e49166-4253-4917-97b4-a4ea7d88b6fc", "comment": "Malware payload (Dridex)", "value": "d34c7a80187ed456b53960040701fa27925788f63bdf1b66982dcd2b8a435d82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753320, "uuid": "39a45cfb-19f9-4ff4-8be1-d1d34487112a", "comment": "Malware payload (Dridex)", "value": "caf310ebd26db1ec84eea3c2450edf795a6e9c4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753320, "uuid": "4ad70418-3923-4e91-bbcf-0461572f9f48", "comment": "Malware payload (Dridex)", "value": "a3edd01d647f515d56127c1217f9cf8956824c1e741b9972e17e54c101b485919e703b6640967f1888fb706e76cd29be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753320, "uuid": "6d9f8528-29eb-4066-8ba3-106814a764b2", "value": "A5F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753320, "uuid": "53155019-24d0-499d-9d49-0432947e63c4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753320, "uuid": "05c46b45-92b5-4a6a-b435-d324828194af", "value": "3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753320, "uuid": "e99d1d93-5cca-46dc-8ed6-dc5ca7ab61ae", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753320, "uuid": "dda70e1f-0641-44a3-a89f-8ca4c5138349", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753320, "uuid": "58800a00-9234-49e5-8f25-7da4c298c469", "value": "0858b8f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d8cf57-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800034, "uuid": "bc221278-2f9e-4fd7-a8e9-56a9662ae465", "comment": "Malware payload", "value": "328a3af152173b2912b107d54b57cf86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800034, "uuid": "014f2126-ccee-4f95-83e3-6c8a6445dbbf", "comment": "Malware payload", "value": "d4ae558cfc1b7d8dc309a0bb7417174ca1e52f006acbd5f13fc8c468784e5822", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800034, "uuid": "fd48b7e3-0ec1-4f64-a8e7-e4c7b21f3754", "comment": "Malware payload", "value": "d238ab2c16c3e0851a04b5e436eedda58c35f7de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800034, "uuid": "8539bd75-e919-4844-8bb7-aaaba4e60861", "comment": "Malware payload", "value": "6fbf9681353366e72f01789247328fd4ebce843d77d0ebb4b45f9916c3f4a99acd987254c0164e8277f57e233796d9bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800034, "uuid": "3bd2137d-3ec7-4eb4-8f57-3d23bf8ad2aa", "value": "DEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800034, "uuid": "cd51b80c-afb0-4cb7-8037-d30a8030ed3c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800034, "uuid": "1243251a-c3d4-4af2-bd41-7b3b6a292ace", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800034, "uuid": "4bf5d981-e489-4367-8e5c-7b4ba9e47319", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800034, "uuid": "60eaf539-bfc8-40e6-bbe0-f95a94be32fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800034, "uuid": "cf965307-0e15-44b7-9ccd-4708ff17b2bf", "value": "328a3af1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1a4d88-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735269, "uuid": "8393b6b2-987a-48cf-b424-c21b4531e0a0", "comment": "Malware payload (Dridex)", "value": "22194592b4e92f3a60e83dd7a64267f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735269, "uuid": "2ab2d20a-ab09-4029-aa64-0c550ac6458e", "comment": "Malware payload (Dridex)", "value": "d510f715f0e8e0a48c0ba41f8d8719285f64528f5e07eaee78c153c61cf2c4bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735269, "uuid": "44fb5694-fa29-40a8-8c17-68ad2c4b380d", "comment": "Malware payload (Dridex)", "value": "28dec2ebac5cbd0135a3807c9bd6f685111520e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735269, "uuid": "17796a1c-eaac-48c4-836e-ca4a1663958a", "comment": "Malware payload (Dridex)", "value": "c1aea83a7b1a48a9598dc5eadf4ec8b011aa2f882908d4ebefcb46f01630e7c4da4bc4bbcee5962c45256abcaf9f01a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735269, "uuid": "7af1f76f-d565-4216-9770-f20f62b5bd18", "value": "8EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735269, "uuid": "cebb2c6e-f517-486f-b065-124d9a48ad20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735269, "uuid": "e33a2486-0599-4335-b54d-74950344a9e4", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735269, "uuid": "f0c6b551-caa2-4319-8912-24295fda8bcf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735269, "uuid": "28c96d5b-fe66-4428-87dd-74e087e371e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735269, "uuid": "d2a5b11a-1a6f-4274-985a-abab3a10776c", "value": "22194592_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d36eea-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742525, "uuid": "0613595f-e1cc-42a6-85e1-f370a39775af", "comment": "Malware payload (Dridex)", "value": "c5dbe429a87cdff9dd672a203011cb7f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742525, "uuid": "96f8f1f8-e380-4301-bfd6-d5b6f787f6bb", "comment": "Malware payload (Dridex)", "value": "d5b0c84cae00c897bd7f5ee09bf3816c59a96b20381da65ce03139011cf6100d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742525, "uuid": "98d05eac-d189-4062-9ff6-6a88bb8b8395", "comment": "Malware payload (Dridex)", "value": "1f8d0c6af0c584dddb9ce34f4d3b8632802500a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742525, "uuid": "77ec2fec-3e4a-4969-b97d-14fb4ec73e29", "comment": "Malware payload (Dridex)", "value": "0c42387fa501943a01d7e7f42170aa11bae5c5ca7b7b7a1f347c8bad3e40f95ecd96eb749a810cc3820cb617c925bf64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742525, "uuid": "64891ee3-9ea9-44a2-98cf-d564c9ca479a", "value": "2204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742525, "uuid": "ea81c492-d36b-4b81-aa9e-4fe0a7e4c020", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742525, "uuid": "d9bf9c90-3fb6-4f0c-ac87-ae6b62b440a8", "value": "3072:CWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:CWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742525, "uuid": "6a03d928-8d6a-43d2-a70b-25e6122902b8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742525, "uuid": "ec79cf23-51c4-42fc-bad1-d014d88e7206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742525, "uuid": "aa2abaf2-1017-4500-91ed-a69b7dc085b5", "value": "c5dbe429_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847d90f5-bbb7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621768244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768244, "uuid": "a6d30404-3b42-47e6-8653-9abd5435ca09", "comment": "Malware payload (RedLineStealer)", "value": "b44c5fc6bf219ac3c0b46b1bafbb7d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768244, "uuid": "f3be7698-7c89-4663-8aa5-9c801bfce75a", "comment": "Malware payload (RedLineStealer)", "value": "d65295b48adc9fa520cd63a3f707213e8ec725738fcc13cae75d8456415ac11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768244, "uuid": "fac18572-d11a-43a6-a76b-042aa9ba7cf8", "comment": "Malware payload (RedLineStealer)", "value": "9dbe14a50cdc5f3510a49d7429dc27ca3dcbc7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621768244, "uuid": "afe14238-9069-4eb5-95d5-01287cf0af80", "comment": "Malware payload (RedLineStealer)", "value": "04edb1c4af58f6b244fd655dc4452b62df0708474f3a891819ab8a73b628e3cde9997b3c1ca50f20efec2c5ea2773725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768244, "uuid": "7a8d95da-ad94-4cdf-a416-1706e29f7d4a", "value": "C8D3D00A1F889833CBAB8F7760925011D3B1A1427353E39B6DE0B1A95E863E41B567F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768244, "uuid": "ca9464f4-0c3c-4eeb-a3cf-d9b3342d829f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768244, "uuid": "a2218bb4-491f-4192-92c0-e578fd54b22a", "value": "3072:u1Lp9FkJ4ABJ2iN/0QmQhSfFvn21bw3fhp:yLqBgsdSfFvubw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621768244, "uuid": "a90a4ebe-bd96-4ee4-a336-0f52477e8c30", "value": 136688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621768244, "uuid": "f9e05a67-4ac2-4493-a8d2-bf63439b8ab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621768244, "uuid": "839b4396-5acc-4e6c-95e2-1917feed733f", "value": "b44c5fc6bf219ac3c0b46b1bafbb7d12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fe5661-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738925, "uuid": "a7373035-e0a9-448a-8e38-15bd838727f7", "comment": "Malware payload (Dridex)", "value": "c6a1bc4280595179a121e81c49877eed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738925, "uuid": "517ab194-5994-46dc-98e7-4ca70ed51763", "comment": "Malware payload (Dridex)", "value": "d65431b712024b4a33cdb6923bfa6f913f1570ea4b22a48cff16a4124fdf36b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738925, "uuid": "e1c4d5b8-0055-4083-9c20-4b0d13069b39", "comment": "Malware payload (Dridex)", "value": "8b1036d0fc27664a80735092bb5e96ef947f13b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738925, "uuid": "91ab975c-c173-40ae-96b3-4ab2077d7f29", "comment": "Malware payload (Dridex)", "value": "bab6e3f3c37f3e535d4fc2c37ddea7cf2832b03c7eca4d47cd8db8e62fbc7fcb4f1b4d9ac8bc10b41dc05b5c65b1f38f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738925, "uuid": "30156429-c9da-49bd-b653-8f1d44de59e5", "value": "3EF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738925, "uuid": "dc077f3c-5302-4a82-86e2-ec8780a7d43b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738925, "uuid": "0a4f9d0d-470f-46c1-aab7-4a0410f9ca09", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738925, "uuid": "c6d7bae0-a9a6-4d16-9902-62a1ed064f6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738925, "uuid": "0c07c161-41c3-40e1-84dc-6a71c5a19332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738925, "uuid": "1f5c95b6-29fc-48a2-9c93-1b858274ab34", "value": "c6a1bc42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0693252-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774840, "uuid": "8295ffa2-35c6-400d-a1e9-03ed60c66b9e", "comment": "Malware payload (Dridex)", "value": "6cc725eaf2c909f199bccca97289d0fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774840, "uuid": "a3fcabd4-3462-4030-b2fd-8c2a4b728ab6", "comment": "Malware payload (Dridex)", "value": "d8b1636b2dc083d4965a6c8c252eeae7a8cfe59f730a3ace7916809ac736ba0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774840, "uuid": "bffd50f6-efbe-4ce2-a6e0-5a77582e82db", "comment": "Malware payload (Dridex)", "value": "d7b0de1ded3ec4ff82c8de398f7370601f298958", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774840, "uuid": "1087ee2b-91f5-46f8-9f23-e0d035d45cee", "comment": "Malware payload (Dridex)", "value": "2a2158408aa650a042459cbbb39fb28a524a8a1fa9c69bccce7157a06828e9f53485de4f37251c71fc3fdb743ac0c768", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774840, "uuid": "ef79b5be-55f0-448c-8ebe-2251b4b5a035", "value": "10F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774840, "uuid": "a9c93347-4048-408e-81c0-9509ea143205", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774840, "uuid": "e231afbb-89a0-476e-b42c-cba5f929ec0b", "value": "3072:n9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:n9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774840, "uuid": "32db8030-fa40-4356-a681-0642aeb7470b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774840, "uuid": "170ca15b-afca-4b27-a5b1-183b2dfe71ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774840, "uuid": "fc33c545-9fdb-46d3-b32d-bf6244351694", "value": "6cc725ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3cd55f-bb62-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621731728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731728, "uuid": "6353a500-dc5c-48ed-9308-e2d68a093f82", "comment": "Malware payload (Dridex)", "value": "a550d0d6caab255f5cfc8b9a532e10b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731728, "uuid": "b4cdff61-997d-4bfc-b0c4-dcf9ea696437", "comment": "Malware payload (Dridex)", "value": "d99ae7e37ef9b8a96193ea5e48d0da4b3948ab609a608b714a543917f356f289", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731728, "uuid": "9b72627c-5ada-4a06-90be-015e8458918e", "comment": "Malware payload (Dridex)", "value": "d4f66c7c71751fdcfeaa02d597f3fbc93501ff66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621731728, "uuid": "b04f571e-919c-4fc0-af12-b1779420626a", "comment": "Malware payload (Dridex)", "value": "3ed6b7e5c4e4a6b2faa2cf6da196d2642e103d17caccd8c15f8779d8030a91a335aa51a3cbd725477b6879adb0438ddb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731728, "uuid": "4f05a77e-f0f7-47e0-8630-5418682ffa67", "value": "9EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731728, "uuid": "b13b41dd-1fb6-4fbc-aefd-125153a8b76c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731728, "uuid": "f7afc3ef-9a13-442e-9143-56bdf8e63e88", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621731728, "uuid": "d4259aad-d0e9-427e-b49c-22963fb09a75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621731728, "uuid": "174874c8-b26e-4b71-b48d-f7d2a7b84373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621731728, "uuid": "cb4fcf53-24c3-42ed-8a18-515fde67eb4f", "value": "a550d0d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4bf1bd-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789248, "uuid": "7862bd42-ddfb-4e24-91ca-8b0ccfcf25b0", "comment": "Malware payload (Dridex)", "value": "0542757ec29a6027f66e1764b094d4b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789248, "uuid": "5eb75a86-2a75-413e-8ac5-53eb5ed6f5e7", "comment": "Malware payload (Dridex)", "value": "d9c6052970e7596451503d3678aa28d2f620a50612716ef6c951eacc82d69196", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789248, "uuid": "e4fdd8ce-6c01-451e-a42a-c73397f3518a", "comment": "Malware payload (Dridex)", "value": "ca1a8a93dd6efc97eff7a24062744e180c0f293f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789248, "uuid": "0bdfb3b5-b63e-4c6d-a6a8-3aef96a21122", "comment": "Malware payload (Dridex)", "value": "8a9b7a5959e1b8d92626ba6b04e0fd95103b9e458f5182fad0271a51f383ef3f25e987b34e4d2f17b37ba7f54b847d49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789248, "uuid": "80a69a18-e60a-43f7-9cd9-f8e7386d6c1d", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789248, "uuid": "ef664aeb-1f64-447b-bf98-29740bccfb4c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789248, "uuid": "a704b619-d757-4267-95a5-24fcea8fba29", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789248, "uuid": "058dcfdb-c982-477c-a90a-b571f22addcc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789248, "uuid": "45e6e33d-6f65-41a7-b86a-d66270e97cda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789248, "uuid": "61e4e5d4-9df3-44d4-86a8-8090ccadea10", "value": "0542757e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d84fa74-bb8d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621750247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621750247, "uuid": "a329a036-504a-4fa0-890d-4727f9c3d55f", "comment": "Malware payload (Loki)", "value": "abddf19e8bccd6a1c38167c143a67cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621750247, "uuid": "e1efdd71-b10d-4265-93fb-9b095f25ff41", "comment": "Malware payload (Loki)", "value": "da724708c94906235692d59370274e99f43ba839b52781fe5c541cb56396f7fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621750247, "uuid": "385ce88b-4bae-4a37-a988-52c818dcc94e", "comment": "Malware payload (Loki)", "value": "7b04f3ab6b10185139e3afcb96d2897375e01316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621750247, "uuid": "287121e2-d235-49e7-b9f8-78768e95623a", "comment": "Malware payload (Loki)", "value": "e552645509fea2e6c92c0da0db186add8f30e231657264133035fa6722f3031c889b29fd910c1ecb5bf74497df840b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621750247, "uuid": "3af725d7-0c4f-4d38-b70a-dff0faf5096d", "value": "7B25CF023344669EE43E57B160A6437123F1EDB9DF82D17E795EB12C0EB33132A4B95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621750247, "uuid": "6ed479b7-7654-449b-9b81-9cdb5448c983", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621750247, "uuid": "160b5bbe-228b-4f03-9eb0-44064f006d43", "value": "24576:RTzs3kJxR7VxR7GiSHcVNotfrFL4jgB+ac1:5zsM/xR7GiSeMrFL4jgBlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621750247, "uuid": "19d82cde-eb51-4011-bc24-c7c2e916d635", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621750247, "uuid": "331fdd7e-c9d6-43d6-a208-af14dd969076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621750247, "uuid": "b72f55a4-8373-4c08-936a-f79d1094a877", "value": "abddf19e8bccd6a1c38167c143a67cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789f0037-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760493, "uuid": "ace5ef31-e88d-4c59-a77a-4c5c02343cac", "comment": "Malware payload (Dridex)", "value": "7791cb1ea812c80ad11846efc758d16a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760493, "uuid": "447afdde-fbc9-483f-bb44-881cf9a02bce", "comment": "Malware payload (Dridex)", "value": "dadbcda4ef01a666defa9ef1933a56ab45c4b7c27ad33d9e50da3de498f343bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760493, "uuid": "c97bb0ee-7b78-4584-b91e-c4a6cd5fcf64", "comment": "Malware payload (Dridex)", "value": "46385fd2f4da9e7929306d91d4e31c2bf000659c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760493, "uuid": "a8b2c399-6d90-438b-8209-842b6aca2b7e", "comment": "Malware payload (Dridex)", "value": "7a0eaff326d25a6a1d2280dfc5efdc9c0758b8ae34e30d8a526d4b7af425cc527486f3cb472a07508de9f597c5bc9110", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760493, "uuid": "f7acb8c6-7e17-4589-befe-e3b46279c82f", "value": "B9F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760493, "uuid": "e61e96eb-3d49-419a-955f-7c26f26a25bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760493, "uuid": "4bc5c582-f38c-434e-aba6-f557fad19e65", "value": "3072:YIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760493, "uuid": "8c7f8f02-3af3-4352-be7a-6b851993ef9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760493, "uuid": "e0145b09-abba-4d42-a698-6691b5822cc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760493, "uuid": "bb5fe4cd-f962-4548-bd7e-ce1caa02a74d", "value": "7791cb1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202e7907-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803724, "uuid": "d2ca00f0-4f5e-4581-acbd-8de1d5d380f3", "comment": "Malware payload", "value": "1192b49166b6e1e49f53ec07cf8499c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803724, "uuid": "f8487bc1-3862-4883-906b-a881ae13e44a", "comment": "Malware payload", "value": "dc7bda12db8935cefaf3139011ebf8352e94081cbc9353bc693c8aaca9e7c6ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803724, "uuid": "11210eb8-cd27-4d6a-a347-f88ef62950a8", "comment": "Malware payload", "value": "548780c41dfdace92655590ee833ad13d3823b4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803724, "uuid": "6764be58-8564-44c7-8f94-c8aa1607e236", "comment": "Malware payload", "value": "d36e81bff19fc31cdf0e8cff2cf60672eb635efa284dd1df9bcfec82c7591bb6ac9581398fd8797e96b5daaffc691887", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803724, "uuid": "6699e399-83e8-4238-bc4d-a5e879391b72", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803724, "uuid": "ad7cea1a-6047-4b95-8e4c-5c2024bb57dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803724, "uuid": "6ec8bea7-64c0-4ee1-abd2-034073e8746a", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803724, "uuid": "49744f73-77de-4540-a6d3-33ddff8df10f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803724, "uuid": "715d18a7-e916-48ce-9856-bb19db8db706", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803724, "uuid": "4759ea84-b8ff-48e2-82dd-18466b96a1ce", "value": "1192b491_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23867f62-bbaf-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621764645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764645, "uuid": "2401b9be-58ea-406a-a870-a89bece75697", "comment": "Malware payload (ArkeiStealer)", "value": "861e64648421df38bb83bc105663aa1f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764645, "uuid": "2d6b3c26-442f-4775-a3a3-6215d39e7680", "comment": "Malware payload (ArkeiStealer)", "value": "dcc67d946b8fab4a036ce1e8a2f200fb446fb22248a423e15cc4234eaa2c0ca1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764645, "uuid": "82f7629a-8574-4a51-b619-c622d2136e4d", "comment": "Malware payload (ArkeiStealer)", "value": "12e0dcb65c184ab79efaddc05fe454a16ef8bca0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764645, "uuid": "26b6449c-89eb-48c6-8abc-d0fe735c3dfa", "comment": "Malware payload (ArkeiStealer)", "value": "1a93553f4aefe84d36457ff1d6f7188afbbd0c9d36633559ced2df4751d75aecda8d1048a768d058d6034245a22e2c93", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764645, "uuid": "523b8e43-4693-4701-8338-8fe4176b30d0", "value": "A9E4D03066A1C035F1FF25B449B592B8A43A7EB1673450FF23D52AEA5A346E0AD3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764645, "uuid": "16aa4144-db72-466f-9496-cfdd5392c402", "value": "eb5d6f8736c18200e63064e7d3f83282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764645, "uuid": "c24aa2ad-ac3b-4a51-9e93-ce12582969f9", "value": "12288:aJrB0dSigKdG+3SGGjZ2cnNjGDCBbSJhDPYSC0srYBTpHF85o6XsL:ldSJ5jZ2aNjjgZPYcTTpHqu6XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764645, "uuid": "67965563-85d2-42aa-a1f0-b2029d521001", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764645, "uuid": "253e82e8-faa4-4c85-a6b7-b276879a02f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764645, "uuid": "6cc770ee-f599-4076-9223-711eee7eaf80", "value": "dcc67d946b8fab4a036ce1e8a2f200fb446fb22248a42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1eb954-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728100, "uuid": "de41967e-30db-4497-b2c5-329fbb4e9be5", "comment": "Malware payload (Dridex)", "value": "e82575268dcf5b670293ef9c0c5c245b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728100, "uuid": "db96a89a-6a44-4024-85ec-8cb3d141a24d", "comment": "Malware payload (Dridex)", "value": "dd237f1d00aa7017e53e1e39cba552f6045d78d1eba1994c27586aa355c1c71b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728100, "uuid": "823b6da4-28dc-4a1a-8fb9-4c40b6258693", "comment": "Malware payload (Dridex)", "value": "0e24e36843a6e66b9a5e46ccec3904a7f038cb3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728100, "uuid": "bd3dad76-aa19-4411-b1c1-d0e665c29078", "comment": "Malware payload (Dridex)", "value": "3ca577c18d6632d34edf4cb6819128367a7d6379c67f9cb68c47113d0c22d128f5652acf5ef3cf2a06cbbdcdf0c2eb73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728100, "uuid": "2b753db5-22c1-4898-b443-8275149ff9af", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728100, "uuid": "8cb7454a-9bfd-4893-9aaa-238e0952980d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728100, "uuid": "0579c57d-aa3e-432e-863b-ff78ded2c34b", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728100, "uuid": "33443431-6f2a-4a28-afb7-1b31676c5220", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728100, "uuid": "5660be7c-e075-4377-b052-88a1df311f41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728100, "uuid": "8c1f9dd3-d5f7-4af4-8b1f-1898cf28e921", "value": "e8257526_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694b20da-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789243, "uuid": "1a464023-1f9c-40b0-919c-e6c766df5082", "comment": "Malware payload (Dridex)", "value": "1ae2921fb1366a71e863c9321a9cd9de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789243, "uuid": "35dadc0d-b662-4f97-820b-084e0beb4243", "comment": "Malware payload (Dridex)", "value": "ddcbe86e20020cbd06780825b142a1d626ef8c3d5afa81c05ddb703a11254c4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789243, "uuid": "bc82d18c-d48c-49d5-9d91-923aba65ddc5", "comment": "Malware payload (Dridex)", "value": "149efe1322bc3b1abcf76add7f807c6f1435c214", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789243, "uuid": "6d5022d7-3329-4d16-9c01-a4649a1d4fe8", "comment": "Malware payload (Dridex)", "value": "2a1a146eb8b26d76dcc0d3b9bf90e59a74a06848976678b9e6b06d19f855fe2ef5f19bf249b0541ad5a46df87009bbe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789243, "uuid": "510d6efa-9707-4d30-bbb8-81464119f526", "value": "13F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789243, "uuid": "a51b7946-59a4-440f-9679-2bf199dd616c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789243, "uuid": "96fcb94a-a756-415c-86f5-ac2cde893336", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789243, "uuid": "48555385-0201-4ce7-81ad-0e8b97cb7a39", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789243, "uuid": "1baa9996-f400-40f5-a111-9a71b36c3c59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789243, "uuid": "1896dc9b-580b-4259-a58a-b839fcca0197", "value": "1ae2921f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9157a0d2-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760534, "uuid": "d0dc0a5e-5a2a-46a3-ac22-8b0ad775d400", "comment": "Malware payload (Dridex)", "value": "78e0b8dcf6de0a3c8454c72649094e4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760534, "uuid": "4320db09-f826-4bec-95f2-b9aa2e6e2452", "comment": "Malware payload (Dridex)", "value": "deb361b378ffddf4da38d7dfd4b3c0829faca00792249ea21884ae76c8e73810", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760534, "uuid": "2b8110bc-1bf7-4a01-94ac-bdf430897a72", "comment": "Malware payload (Dridex)", "value": "21d88ad77193ee6a6b37b70d0a890a7e3adde96c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760534, "uuid": "af498e3f-6796-445d-a61a-575c9efada76", "comment": "Malware payload (Dridex)", "value": "712c479353a50063994fe6f081c80d40b8ba33fbb7445e84d5e829ed546ceb7a85dd7db20d2398b11f59372cae4cdfa8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760534, "uuid": "41aa36e1-ebb7-418c-9554-48413cce5161", "value": "7504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760534, "uuid": "228b6ae6-ac4e-4c35-8125-ea8467cdc60b", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760534, "uuid": "2ee5e028-3108-4749-8445-10015b360691", "value": "3072:OWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:OWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760534, "uuid": "38b7a476-3451-4959-acfc-dd1aed685400", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760534, "uuid": "4f6f44a1-8ca1-4b42-a22f-33290bc1cfbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760534, "uuid": "6e28df69-634d-4950-9bf1-9fbc85a239d8", "value": "78e0b8dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f971fb9d-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756843, "uuid": "a28414e2-810a-41d8-8d10-0fc0852df8b2", "comment": "Malware payload (Dridex)", "value": "62d7de932f0a7adda270df2121bb06ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756843, "uuid": "9b159594-2946-43da-be0c-4dc06bbed62c", "comment": "Malware payload (Dridex)", "value": "dec72678081426464689f227e54d5dbdfd54f0ba1224161817b124d582f2e0d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756843, "uuid": "36ec0c76-6e1a-4b4a-99c5-2464aac02176", "comment": "Malware payload (Dridex)", "value": "99bae81926747d5a3ace1efa30a705f3c3b6a175", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756843, "uuid": "7ed7302f-e844-48a5-a4fd-89dd8fc43072", "comment": "Malware payload (Dridex)", "value": "fc109814c4bd6377d707261de0e75ec0f25635967af950d4764163232e42cacae53bda5cacd8b911dbb7f40c2fa09b1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756843, "uuid": "61e5b6b5-e032-4298-9592-81b898f355b3", "value": "22F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756843, "uuid": "ce928f16-7e9b-4d32-93fc-42ee262ad8c7", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756843, "uuid": "caa5fb7b-0e3f-42d9-8a49-63822d644eb6", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756843, "uuid": "c75025cc-8288-45df-ab70-5df0c078530f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756843, "uuid": "5947be94-9b96-404e-b1bf-0989c95c3251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756843, "uuid": "eabbed4f-a3cf-4981-b7e8-39431e01977a", "value": "62d7de93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5a5ac2-bbcf-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621778489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778489, "uuid": "37ac2451-fa38-48e6-9128-f3941225cb3f", "comment": "Malware payload (Dridex)", "value": "145da4599ab227b0004f876f02d9ed66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778489, "uuid": "fa017665-f051-4b49-b337-6fbf572947dc", "comment": "Malware payload (Dridex)", "value": "df84580b015a910c3f2d607d314e21964792b5dba33ddeae316f6077ee7b2002", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778489, "uuid": "f23538ad-a947-424d-af08-d3a0ca69b4ac", "comment": "Malware payload (Dridex)", "value": "8d040a8af6471238e26989b73bff9d584b9b3973", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621778489, "uuid": "29436aa5-ee61-4eee-8ce6-b8d57b7925a3", "comment": "Malware payload (Dridex)", "value": "6450a07c316392d37070ba1ade84972b67d2f1496bb96c36f06c0a6ed7c0c580c73d17b2b280ed94b2e411b3401ba81b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778489, "uuid": "05528c61-def3-4c07-b46d-b9d6bcc05521", "value": "90F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778489, "uuid": "fcad57ba-c54e-4b34-b453-033eee587146", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778489, "uuid": "30f58717-b03a-4a67-af49-bd5de283c362", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621778489, "uuid": "ebfac72e-fd0f-41eb-b1e6-bb00ff0d9029", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621778489, "uuid": "ccb05506-fba1-47cf-925b-c166e6a5fc7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621778489, "uuid": "052ce12e-302b-4c2f-b8d2-e775184691ef", "value": "145da459_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efea2337-bbd0-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621779161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779161, "uuid": "67e2463e-d371-4cb9-91e9-b34135bbb78e", "comment": "Malware payload (Gozi)", "value": "9fcf3ab8703045032737668793f5563b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779161, "uuid": "516632e4-d52b-4a1e-8c35-dfcb9253ce21", "comment": "Malware payload (Gozi)", "value": "dff28a4e03d3df0f6a7d39a77dd7d6243bdc9117b0b0da3b280447184856f4df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779161, "uuid": "c047c3c9-3c20-44cb-813c-811ef1526506", "comment": "Malware payload (Gozi)", "value": "8d4db3886f332122eb430b04419d0befd0833107", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779161, "uuid": "11115fd0-0645-4c68-9a4c-459ca7d3ef9c", "comment": "Malware payload (Gozi)", "value": "077b388bc5dc93d3f120c3d67d398c32f04a6d90e70911f1cd38e4296fb8ed6e650b03c41236ff8e65c852e44012fc66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779161, "uuid": "4141ecf2-0532-4ccc-a190-9d6b5d1c4699", "value": "2315C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779161, "uuid": "0459636b-67f5-44c3-ab84-c0f4713d7d0d", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779161, "uuid": "cb255a65-4bc5-41bd-9718-1046d44c9b1f", "value": "24576:HQfpzjXPgfO8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgqJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779161, "uuid": "4b6d5269-6615-4bfd-9808-4d16242983f7", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779161, "uuid": "0724ac1a-4407-4501-abcb-5bea85fce65d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779161, "uuid": "c8e6d8e3-e7e1-49a5-931a-55eb00f857f6", "value": "9fcf3ab8703045032737668793f5563b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07506a0-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764049, "uuid": "f9f980df-7ae8-4db2-9621-23d3aea5a73d", "comment": "Malware payload (Dridex)", "value": "7d509b24790ebb6029101533203b7188", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764049, "uuid": "443322ac-70d5-49eb-bb78-d4901387b4fb", "comment": "Malware payload (Dridex)", "value": "e033014230ad305ae234102056afc81bffb1965c968550ecb0adc26f84109bcc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764049, "uuid": "68c40c5d-54b4-49e7-b000-836051dd58d6", "comment": "Malware payload (Dridex)", "value": "f9b3ae876c9ba04c4c9324a476df7a32d6e706fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764049, "uuid": "fbdd077f-bf6f-4323-a760-91b27eece1a4", "comment": "Malware payload (Dridex)", "value": "57dfbcf0223820bcae15f71d3bcd6526d4774acfa51d427757c400c3333c9379466e7f7acd45f0d722f8d71996d2e092", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764049, "uuid": "be557028-9e22-465f-98b5-c0e1956f7550", "value": "7104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764049, "uuid": "0b268263-8077-4e55-a149-962a1721cc5c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764049, "uuid": "54f5f1b4-abd4-4c0c-9374-40eee034df36", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764049, "uuid": "75703df6-ef92-435c-ba4d-911c38027f22", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764049, "uuid": "7b09a549-41af-473f-a1a3-18499d5dc31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764049, "uuid": "b6634a3c-289c-406d-93e1-e321953c7908", "value": "7d509b24_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed8686a-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753309, "uuid": "b19a4332-0964-4442-89e8-33105ca3888c", "comment": "Malware payload (Dridex)", "value": "df51ab999c94f17d9bcfa66126d486d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753309, "uuid": "89a19497-2bf6-47db-b728-2bbb5c5abc9c", "comment": "Malware payload (Dridex)", "value": "e08c28a7c2120bef6a34f5c0fb33a1fdd8b6375e8fa0911ab944faa90b05fe17", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753309, "uuid": "9652d54b-34dd-4d39-b956-2c6671be3279", "comment": "Malware payload (Dridex)", "value": "bb35484689a17e8d546ccb1a985b29d4bc1fe8aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753309, "uuid": "59473604-6865-41fe-8973-8cf59b841cb3", "comment": "Malware payload (Dridex)", "value": "750b9a0b59e88de338d2c8863452e4181455bae0287a85715a4056c3d8d7f303477710b7dfa36ad6dfda0f7f0f62251d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753309, "uuid": "e0829bbd-f102-44a1-9c8b-c7f74c7eacce", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753309, "uuid": "f301daf2-5a2b-43cb-a979-b9583c901b6d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753309, "uuid": "e21e4d02-a166-422b-9bb5-a9d5535cbffe", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753309, "uuid": "0c680f4e-06ee-4645-87c2-762a0e7d83bc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753309, "uuid": "2f677b52-adcc-40ca-826c-21b69e58d5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753309, "uuid": "ace58665-6e5a-49cb-967e-8a88cb143e39", "value": "df51ab99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be606002-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782085, "uuid": "be27f534-fc93-45b1-b57f-4db5802e188e", "comment": "Malware payload (Dridex)", "value": "c3445728b5daff96136998414f506c24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782085, "uuid": "2d5586b4-1052-489c-91a0-940f97181cbb", "comment": "Malware payload (Dridex)", "value": "e0bbbcd64587b2d580f963f3f1d8d50a8e8ab2206e8dfb8793d5719fbd0861ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782085, "uuid": "46ae0dd3-dc3f-4783-84fd-f8b501f560e1", "comment": "Malware payload (Dridex)", "value": "dd8a47e68d65237fdc60c124b90bc1e4e60d8144", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782085, "uuid": "55df962d-d4c2-4fcc-ba4a-c07870609b12", "comment": "Malware payload (Dridex)", "value": "de5aaeadaafb77029636d1ef6799bbe7ea0e138fd787b022efc26da0dce7c9b06ef1d430aa6e6d4192150aba19affc8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782085, "uuid": "f7e3f536-c694-4b12-ba49-c4fa25e22a80", "value": "E4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782085, "uuid": "5985ffe4-05c0-485f-aba1-8d29ae2891a0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782085, "uuid": "8c70b91a-33a5-4110-a150-a6b0f5b07373", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782085, "uuid": "3955bc96-9fec-4628-a9f8-8cffe68771b8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782085, "uuid": "6fad28b1-997b-459f-bdc9-cfbbcb8d432b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782085, "uuid": "994eed1a-88eb-483e-b951-dcadb120c284", "value": "c3445728_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1448b1dc-bbf1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792966, "uuid": "53e84463-f22f-4274-a47c-c6950b8b7a42", "comment": "Malware payload", "value": "bd6c9f123ca5a7b29a92f7bff6d64f52", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792966, "uuid": "2bd4af8d-2d3b-42ce-9516-5610b511b982", "comment": "Malware payload", "value": "e10030b7a00b0c1d4f514d2d23110c9ed5c31f30b9d6b868cb9b3c02ce338bbe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792966, "uuid": "fa206082-e8ba-4c05-817d-fe1f8a69fe75", "comment": "Malware payload", "value": "0001a86c4ec93a2d2d275ad7d5c9a6e92f21e2e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792966, "uuid": "1ab2cb1a-ad2c-4d0a-8440-c05c14099af9", "comment": "Malware payload", "value": "ab2c50c587d51616b4e8f29979739c8fcd586ef45a56fe708aeab8e34d50805b6a30d5724066043de4c31040f9f7d273", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792966, "uuid": "46923183-1773-42b2-b027-a52015149abf", "value": "A9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792966, "uuid": "65b2565f-ac85-49e6-ae73-50a38795872e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792966, "uuid": "742d08fd-499d-4f95-b295-3fd35bac938a", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792966, "uuid": "760f4a66-a7e7-474a-9c19-f1f36dea6eec", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792966, "uuid": "be1ba107-f539-44fa-9541-9706f06f2cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792966, "uuid": "bd9d059c-217d-40af-bb23-a17914291348", "value": "bd6c9f12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323a1d19-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621779273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779273, "uuid": "9708ba11-66e1-4e7a-a97e-25703ed4d0bc", "comment": "Malware payload (RedLineStealer)", "value": "ed6b638616aa2da40c8c3fd265825ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779273, "uuid": "cd1e2471-9cf8-4c19-a7ef-73ab6d26b9ad", "comment": "Malware payload (RedLineStealer)", "value": "e111cb308bfaeaf36a7954281106aa741eb51d212640692e500ad1da63c4dd5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779273, "uuid": "a5a94ac9-7304-445a-bc60-8f03f6a7192d", "comment": "Malware payload (RedLineStealer)", "value": "260b84668e13333746089520355161b3397f79b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779273, "uuid": "9b759694-11fd-4d77-82ff-2fec140b7412", "comment": "Malware payload (RedLineStealer)", "value": "436442372a68bdac8dedd1f6d48604251473a22205adb8eeaa7834bec2234e945e6e766fb925d11b73fabb01e1115053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779273, "uuid": "8036a8b9-7e45-40e4-90b8-ae4585cfa52e", "value": "1EE4E12866A1C034E1FF12B04AB592B9742A7EA16B6580FF31D63BEE45305E1DE3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779273, "uuid": "c3ad6105-2d87-485c-a94c-2abc01460b4b", "value": "b37d3fab91f8c78b5fe4ea0b668f6280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779273, "uuid": "1420cc7e-8676-422f-b7d3-59cf30077b0d", "value": "12288:f+y+6P/SvHcaNUXZp8PYbP+lqU57CbtD4q2ZwNkZ2q7sGP3Y0FWU9iXsL/:GyLMcaSe2P+R5Wbt+8kZo43Y0FJiXsL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779273, "uuid": "58e8d6f8-53ac-4045-86ca-b2c209254f30", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779273, "uuid": "82917606-e870-4093-b726-156b788a26ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779273, "uuid": "1df15dae-d33c-43d0-8dba-e6bd4d69b419", "value": "ed6b638616aa2da40c8c3fd265825ca2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82365453-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789285, "uuid": "e92e03c3-7888-4927-9610-4a97f135c048", "comment": "Malware payload (Dridex)", "value": "ea9aebe78a9348fdc1f3fed9c53ec548", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789285, "uuid": "ae7c0728-67c2-491e-84ce-e2b0d3bd5417", "comment": "Malware payload (Dridex)", "value": "e1ba398c2daac6efa2e6ba74ff65dfbf0a1a5754cdd23ba21719f3382ecd4b02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789285, "uuid": "df37bf89-e9ff-43a6-bc6c-9cb14938c14f", "comment": "Malware payload (Dridex)", "value": "a2f4949213dd25004b2c2b54c4a7254b3771f0b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789285, "uuid": "4ac916bb-8820-49c4-acfc-d69048ed134f", "comment": "Malware payload (Dridex)", "value": "8b2fa461a17a01515cb3dc1f18b9b6f200b74f3577f9827137741fd00263d6c662e54804246406bc312a35b56e8c6f03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789285, "uuid": "01857086-ad7e-4d8a-aa98-04a3b2f34501", "value": "47F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789285, "uuid": "178ebf68-b3d6-48dd-b280-3da224f56a4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789285, "uuid": "ae2e63ec-2341-468e-8a88-7f57deed7440", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789285, "uuid": "4bdcf8a4-2def-4a3e-9cb8-bdb600b0a318", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789285, "uuid": "5a4c4d89-c94e-4039-91b4-1b0f5f6665e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789285, "uuid": "2f83feec-12c3-4211-afdf-5c40b048b774", "value": "ea9aebe7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0362dc8-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728052, "uuid": "83c91836-d95b-4a9c-a23f-3ac87fc7dccf", "comment": "Malware payload (Dridex)", "value": "fdb203362db0292db3a4c0ed45529116", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728052, "uuid": "c2931adb-4ef0-4d63-8e6c-12e9f1a6fd0c", "comment": "Malware payload (Dridex)", "value": "e2514960f7e3b9043e9ddc5ce15eb1c3c8b4b9c633842c2be772968c17b1ae45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728052, "uuid": "3787f16e-2fba-4544-8dcc-5f71d6612947", "comment": "Malware payload (Dridex)", "value": "9b771797bf171813b4bf9d3926cb1c6eeb2f29cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728052, "uuid": "7bcca4f7-a1bb-4966-bcb0-a15a7115e82a", "comment": "Malware payload (Dridex)", "value": "c94b5c682047b9011a150764942b8d0606e9dd5bcc68f46cacbc2a7aecb350ef25ad802b0890e5e560560f33df51fa4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728052, "uuid": "84b6ecc6-de24-43e5-b609-18e34454cf70", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728052, "uuid": "3e559fa4-3c7e-4327-9e1b-995ac3c5c451", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728052, "uuid": "f104f132-2d79-4633-9f31-6df849c7ac65", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728052, "uuid": "d6614d45-9516-4266-8cec-3ec1766b56e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728052, "uuid": "4b896dc8-5664-4901-af93-a0b9b23c9b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728052, "uuid": "795838f3-638b-4081-bed4-7b4507029c3f", "value": "fdb20336_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda85f62-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792928, "uuid": "85826024-eded-42a0-9dd8-bae3babd19e6", "comment": "Malware payload", "value": "57db531548122e639e0c7d65cbc61a2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792928, "uuid": "35891a6e-3cd2-426c-96a3-3a1f7a30308f", "comment": "Malware payload", "value": "e26693056cd5de4374f63d4e324c554e51095ab7c947e3c81e1486bcd5a81ef1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792928, "uuid": "e5789b1a-de23-4cd8-b19d-03a6d56df139", "comment": "Malware payload", "value": "7624a9e32c8a98ea1ea16401496bbfb435e8a11a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792928, "uuid": "c3577356-69e3-4a21-88d2-cd9fd41e696f", "comment": "Malware payload", "value": "f1c81457e1e14e0c4682f7d5bf03fc371ab2d33795443b7ce7e64b6430c35ec1793ee05cfc7f860aa6144130ee40d485", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792928, "uuid": "6f18b278-96a3-4fda-b9f6-39ba772ee250", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792928, "uuid": "447c991d-8650-4ea4-9925-fe0b01b1375e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792928, "uuid": "78fce2dc-3a28-4f2a-9e8a-f77602fc0794", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792928, "uuid": "10bb3b67-6402-4142-a7a0-722ef82a41d2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792928, "uuid": "ad57e72e-4a93-475a-b7a4-2d6788cc604a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792928, "uuid": "0893f322-00c3-4967-baa7-4261f98940b2", "value": "57db5315_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdc9c04-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749633, "uuid": "4b51d3c0-ef2b-47ea-a284-ecea0836b5fe", "comment": "Malware payload (Dridex)", "value": "54df32dbad30625964537229b1b2a6ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749633, "uuid": "14a75e28-b3ae-47c7-8cb3-02130ae7d44a", "comment": "Malware payload (Dridex)", "value": "e298e129b4ed9c1d729287d32c3616adf0746a4ad204f22abae8285f102912e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749633, "uuid": "b5a9743d-e577-46b0-826b-25cab0b17923", "comment": "Malware payload (Dridex)", "value": "962bc4e6c2db73c2714c23e4b257d9f71b8b45bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749633, "uuid": "199c9535-dfa5-4f22-9bfb-1cd9300f5e27", "comment": "Malware payload (Dridex)", "value": "c2fe5e5e2b747a2b2186c34dd74d54bbbc6b9fad55413180c68f3fe87c47c02432f8f6bde9b61a530f0d4b4bfbb12a6c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749633, "uuid": "167f86a6-6396-493c-8d1e-858a8b2addaf", "value": "F0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749633, "uuid": "63b2ad2a-d98f-431a-aced-d6981a010a28", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749633, "uuid": "de3d84a5-e767-4ba0-a82c-16ffdd2bd595", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749633, "uuid": "974e999b-3b8c-4890-8bcd-7d0a9748bfb3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749633, "uuid": "44240595-c028-41d1-86f4-578d42a9376c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749633, "uuid": "d05cbc0d-7b6f-4b9d-91d8-0872be6425dd", "value": "54df32db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac6670d-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767771, "uuid": "4242d498-856f-4e33-88bf-f4959e97f9c9", "comment": "Malware payload (Dridex)", "value": "0dab93abae1ba8cc6a3048c82ce205fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767771, "uuid": "6582162c-980a-4d20-a0fe-5ae262e99a3e", "comment": "Malware payload (Dridex)", "value": "e29daa1546d4408a50e1edd5eea75602c5d8dcc3458ab90232c1c84f8dde0110", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767771, "uuid": "f89a838e-e513-4804-bd8f-0dc924f3b620", "comment": "Malware payload (Dridex)", "value": "f506861e8ba41c38fa92853f076514be1535a20a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767771, "uuid": "a2dda9b3-3ec5-45e3-b471-1e6d4cfbcd64", "comment": "Malware payload (Dridex)", "value": "d283b0b8808b0c1b04bf4295e0b3252019ce89136d38723a41f0496bbf0d45dcf367d2c1908a66d621ab2817af0bab96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767771, "uuid": "e4f9316b-a135-4545-a17c-cae4f630aa44", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767771, "uuid": "fcac7744-1367-4d31-bf25-6d1333e61e32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767771, "uuid": "1e251332-466b-4523-a8e4-b12b0ef6078b", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767771, "uuid": "d8df5c1a-da70-486a-bb9d-119f7d9d2011", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767771, "uuid": "e7394ff4-8be9-435a-9b15-c8d117632967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767771, "uuid": "c6ef71eb-c027-4d7a-bb27-9f17d761ec40", "value": "0dab93ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089f720d-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728093, "uuid": "6c6bb533-9a46-464c-bfba-775644894f1c", "comment": "Malware payload (Dridex)", "value": "e4a1b91014646d6e45caa33bceadc40c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728093, "uuid": "fb1612db-7ca6-4227-9e86-1bf26b365269", "comment": "Malware payload (Dridex)", "value": "e2abf9ccdea0f98daf574893c633488e20b200de5c06874a7373a38355da9cde", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728093, "uuid": "65b240fd-4a37-4cfe-8047-2056642b1e89", "comment": "Malware payload (Dridex)", "value": "3e8bf76750b55cf9ae45dcbae3566be97e901590", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728093, "uuid": "51eef991-1078-4a2a-acb1-82065b5be003", "comment": "Malware payload (Dridex)", "value": "dd4ca52d9a541d513597879be74d0c8a461b1fb93e0529372d6379472187d6b9a47e2eba71e0078d32012caaefae44da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728093, "uuid": "040b383c-8524-48c4-8cdb-210d2db273f9", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728093, "uuid": "a12e0b1f-7fc7-47c6-8361-26311589ccae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728093, "uuid": "960932ed-5e48-426f-a58c-aa266d45a912", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728093, "uuid": "c19c29d8-763d-4fb8-b96b-e26fe3dc16f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728093, "uuid": "ac2e3ca8-6cf2-4537-a555-a75292a3779f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728093, "uuid": "1b5b8f6a-ac1b-4031-beea-e5e06ed6a0e1", "value": "e4a1b910_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5eed02-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800040, "uuid": "e2647f3b-6c24-42cd-8078-67f1f751ce82", "comment": "Malware payload", "value": "e584c2f1c6de9ca614b4f0db049b68ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800040, "uuid": "c3e4c1a0-ae6e-46a7-937d-eaff3da8e038", "comment": "Malware payload", "value": "e3009b96a11ac8632a8b114b9aff4d9bd366a7dfa06f3cfeba638e65245fd594", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800040, "uuid": "1dacfc02-a6a9-4481-bd84-14cd1ca29e11", "comment": "Malware payload", "value": "742c2aefe68626caba1c28e338863f66ff177676", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800040, "uuid": "1ecc240e-1916-480a-8e8b-63587fc4591c", "comment": "Malware payload", "value": "9fad9f2d987fe7c2d2f2f9c71616b08cecc39cd8b1796ab779fdd6b37a4954eeb4208bc1eaae9caeed2e959c7d6578bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800040, "uuid": "d158977d-2c15-4840-8d65-819644b0c04c", "value": "BEF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800040, "uuid": "456705a7-43c2-49b7-b997-f3e867070069", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800040, "uuid": "d0a525b2-7b55-4ad9-a2bc-f8ebb5887df9", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800040, "uuid": "cd295339-ed7f-4cd4-8256-90f48e228465", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800040, "uuid": "d0ebf8e1-4389-4856-bd66-c97b9cf5c083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800040, "uuid": "37df750a-3425-4618-a312-2296b1ca2a9e", "value": "e584c2f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ec5c36-bb9b-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621756403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756403, "uuid": "500f7821-088d-4940-9ea4-b633f2bfb934", "comment": "Malware payload (Gozi)", "value": "cc1c967671cc2cc3af6bd11abf613b0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756403, "uuid": "c5b27740-c80a-45e7-bb1d-b16050dde31c", "comment": "Malware payload (Gozi)", "value": "e3bb271a901c491f3154a36e14bea0c9feda8d847425a1f1fe23e176f79460e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756403, "uuid": "0071360a-c938-4291-90e4-a82b19c162a6", "comment": "Malware payload (Gozi)", "value": "381063253c14932de8dbac004c80b78c6b4aa0d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756403, "uuid": "23fd3d30-bf93-4501-9682-7b2e5129a8f0", "comment": "Malware payload (Gozi)", "value": "a04f9af5b6f2bb09b085c2ea005661aff72e10c0a106b93f5ddc056c2d87401a020720e064f3f11959011bd17c0c75ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756403, "uuid": "aefcfc92-cc3f-4225-ba18-c4141b0ad63a", "value": "5B15C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756403, "uuid": "e86cdc33-bd76-4763-8204-59bcf85da69e", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756403, "uuid": "167c8778-9da6-4897-b40e-9d7af1e21545", "value": "24576:HQfpzjXPgfy8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgeJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756403, "uuid": "33bde86a-50c8-4464-8270-d5677efeab20", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756403, "uuid": "ba642d59-fbaf-4dcd-b79f-592efed08b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756403, "uuid": "48abb052-5e19-4f33-8ef3-3ce7470331d9", "value": "cc1c967671cc2cc3af6bd11abf613b0d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a0ebf4-bb5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728083, "uuid": "8cc789b3-ba44-452d-99c1-4c9313d2728e", "comment": "Malware payload (Dridex)", "value": "80c3afaf63c5f0fe068e34b8120098f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728083, "uuid": "85f91bcd-e18e-47c2-a2dd-d49cdfe11e36", "comment": "Malware payload (Dridex)", "value": "e4243e32d8fc3961adf6df9ba3f4edb1a61a0ed60a0ffbef1a21dad6bd0d970d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728083, "uuid": "4d2c9704-5938-498e-9cb3-856fe940f59e", "comment": "Malware payload (Dridex)", "value": "ef2cdd86f8d7a7e70e0fc06c1539fc0e84a50824", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728083, "uuid": "db97d4fd-c8c7-4173-a657-e057c68a56d5", "comment": "Malware payload (Dridex)", "value": "484128e8f26d9f5b01fe840331e40c4a5d462d1f5ff4a2a7bf1b21547d60ca670ca396573cad95a7fadc30551640eeb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728083, "uuid": "13ed5ea3-d9a5-4060-9d26-9165138d60f0", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728083, "uuid": "b87fc558-be42-4a2f-a5f5-00e48ea2a9e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728083, "uuid": "8fa3fa1f-10e8-4975-8a89-53265bbb6d72", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728083, "uuid": "3e972881-0bef-449a-b743-940810f190aa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728083, "uuid": "5519c5f9-036c-4c68-939a-0c97ccc7fc33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728083, "uuid": "a34c20bd-612f-4a86-9b48-c6261a6ba91a", "value": "80c3afaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3342dfb-bb6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621735278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735278, "uuid": "50dae734-7148-433f-8507-fc1eb9eb39fd", "comment": "Malware payload (Dridex)", "value": "9ac0d149c6584a3b3af8a6a16ff93e3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735278, "uuid": "d968808e-e40e-402b-bfa1-9873f3aee9f1", "comment": "Malware payload (Dridex)", "value": "e50b15375fb05f93c8ce7e17d89d82cf2328075ab443478fe9325f43402d571f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735278, "uuid": "5d36fa0a-f6f6-48f1-918b-58fa53c9138a", "comment": "Malware payload (Dridex)", "value": "8bdee956f244b1c457b2a4aa13ef39120baa3b6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621735278, "uuid": "87973ee3-75af-42b0-983c-7c9bd62d1394", "comment": "Malware payload (Dridex)", "value": "e4e6a07e7536aa528a950ca27916d4bf6c14dec5913ca63abd2c84a07065dc9d427356239aa08a84b52ce394d1b863ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735278, "uuid": "cefb33ac-0754-41b1-84ff-4fbe9e87d51a", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735278, "uuid": "fe96c2ed-5691-494a-aa1d-2bec22339a8d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735278, "uuid": "ab22ef74-f2dc-4b1a-b7d7-13c4d5a5328e", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621735278, "uuid": "1d1292d5-e373-4a89-9486-6746b467c541", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621735278, "uuid": "766f962e-1b9f-404c-b284-5897b24a610e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621735278, "uuid": "dd59072a-8cf2-430d-996c-455885a5b85e", "value": "9ac0d149_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae1e941-bb73-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621738888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738888, "uuid": "0bf0ea19-e342-427d-89c7-5f71a1713fe3", "comment": "Malware payload (Dridex)", "value": "05fbee13c483616c984c1350477e82ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738888, "uuid": "d20721df-0b57-4520-90e5-2202b7f87d10", "comment": "Malware payload (Dridex)", "value": "e50ebcf44c10517cc0ff1f43bc6b6b05633c1bbed722c77b3b3ef1dc84374542", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738888, "uuid": "d5be3b9c-87ea-40ea-8018-e117ce6f82f1", "comment": "Malware payload (Dridex)", "value": "c7224486b01d77e8637be5e4cd950603ea1242a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621738888, "uuid": "7bc744d6-027b-4783-846d-508070d95aee", "comment": "Malware payload (Dridex)", "value": "957e22c737db5ae18512051889dec75b8bb5b55bc342d92f269c080d4f5c743944ad1f1dc59b08d76fbbfb337f3cc73d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738888, "uuid": "c9b88441-ad4f-4988-9966-61bbf87b52e2", "value": "03F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738888, "uuid": "e9bc306e-a8d9-42db-bc7c-f0f1cc6fa924", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738888, "uuid": "20385627-aa10-496a-bd82-11cadccf6536", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621738888, "uuid": "8c8c0a31-3f61-493f-a133-7d1a568c2690", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621738888, "uuid": "a8cb49ea-b76f-4e2d-bc12-5e691b72fe93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621738888, "uuid": "fb9db77c-9abc-4c9c-b770-b6eaacff44e0", "value": "05fbee13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeab6b00-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753389, "uuid": "057a6f1c-fd3e-407b-863e-803b20783e3b", "comment": "Malware payload (Dridex)", "value": "1dc7e85162a06428a6b63c41d29a0fad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753389, "uuid": "f704117f-566e-4093-8b06-c58abe1a7bf9", "comment": "Malware payload (Dridex)", "value": "e54e4ec5559c3d22ea638a53b5348df4e49adbbc97a1a2f4a31292165916ecff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753389, "uuid": "afaecb41-5fbd-4037-9872-2ab73e0544e1", "comment": "Malware payload (Dridex)", "value": "3341a9f946f5545058e8013ef67f658c6541d6bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753389, "uuid": "b69fd1ff-cd58-4f36-af88-3784351e51bc", "comment": "Malware payload (Dridex)", "value": "d176e503cf23338624db19be79f2ca3d3aef9b5f15436a1430d4aae45e63ebd174dcca2bd0a420a893fda37782b5888f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753389, "uuid": "1201139c-c12d-4364-b2b5-61973d009695", "value": "70F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753389, "uuid": "60fc38c6-fb33-4e46-a46b-1a280f969735", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753389, "uuid": "2c34ad60-65c8-45af-9dea-38f75f9ef2ff", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753389, "uuid": "6c0d0b12-259d-4bb6-9e16-301f41258ea1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753389, "uuid": "08ac4d3f-5b60-4a72-9fc0-fa5c13dbf99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753389, "uuid": "84c3493b-08b1-4c1a-940e-612e2e8ab97f", "value": "1dc7e851_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9a1faa-bbc6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774888, "uuid": "5e6443b0-49ea-4419-9e2b-499cab49df07", "comment": "Malware payload (Dridex)", "value": "9e42cc8b149e7cc97226caa429a762cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774888, "uuid": "3476b2b0-b0b0-4281-b37b-2b06baf7c77f", "comment": "Malware payload (Dridex)", "value": "e58f74e7aea349d4db9cfe4397c3ac3618f16e82d23fc42a88ca7e5f98ecbfd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774888, "uuid": "4d6a9508-dd19-4f85-9c9b-6b42d4bcc364", "comment": "Malware payload (Dridex)", "value": "b41e5621491034c9e5d700389c11d76598c30a6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774888, "uuid": "9880bdf4-2b6b-4a52-b14f-6ee018ddd4d5", "comment": "Malware payload (Dridex)", "value": "087c3b1b68c3befce37418970834d17d324a9abbfb111cd2108393ab7f3b41fb4dcf79d25e6bdf2c75a6ee6be946f1af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774888, "uuid": "741b0cc8-1c04-4e25-9783-5de502a4a80b", "value": "50F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774888, "uuid": "10c3a0df-0ecb-4917-80fc-06d6c31703eb", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774888, "uuid": "ad069a0c-e603-4bda-a4b6-943890d901d0", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774888, "uuid": "409ac8ac-586b-45c3-9d52-5bdd5967fd69", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774888, "uuid": "3a2f2e36-ebc4-43d9-aa90-2f9c837560db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774888, "uuid": "58d49b33-25d4-4384-b252-11bef1bbf42a", "value": "9e42cc8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693006fd-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796545, "uuid": "76d33fb5-ce0b-4aef-afe0-7e200546a13f", "comment": "Malware payload", "value": "5bc0b88dca892f5f12cdc8d6dd4fdf5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796545, "uuid": "605e452d-b50c-4ec5-b43d-3d435e444fca", "comment": "Malware payload", "value": "e5c0e235ab1eaef43646b287aff2526c8f0b39549ccb7d8d66c9804e8dc699ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796545, "uuid": "d142203e-e862-4e0b-925f-109d9bfbae25", "comment": "Malware payload", "value": "c256ea91d03613ef7e640a0a393aab3cdb25ea31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796545, "uuid": "1d9ec188-4be0-47fe-aff2-24b25014d933", "comment": "Malware payload", "value": "2137c16ff07a3a2857c1de531dccf44b15b1c1178056e3c22b0071fbc8dfe59dd724461263d2b950f3001dba9b0ffb77", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796545, "uuid": "3b1ecde2-9c01-455c-b3cc-493147e83236", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796545, "uuid": "7b1f0684-5148-4082-a1e7-156ef63509e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796545, "uuid": "e31e227e-c38f-4097-8c4b-42235a232fa3", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796545, "uuid": "7b3a24bd-098d-46c5-810e-29f92621f38a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796545, "uuid": "fc19136f-93ce-45ae-b378-b46e0b0f2afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796545, "uuid": "f904a593-dc66-4bd6-9fef-b049d7dead03", "value": "5bc0b88d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760faf31-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742450, "uuid": "f9b4f03e-b077-42ad-98bf-1f7e20347189", "comment": "Malware payload (Dridex)", "value": "8af3ec957d0bc0721c793cb8f75d5a6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742450, "uuid": "10e81dee-9775-4ba9-9cc0-6d9ee8484ae8", "comment": "Malware payload (Dridex)", "value": "e8368434d562f490cdfe7bf0cc4e9bcc1487d4a7e4ff84dcfdf4d35afb837e11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742450, "uuid": "828ec520-3063-4451-953b-432e54d69c42", "comment": "Malware payload (Dridex)", "value": "1ff0824e809a8efbce4b96629b5d17c33ff18bfa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742450, "uuid": "4c3d77eb-2068-4385-9261-70f84ab3897d", "comment": "Malware payload (Dridex)", "value": "12fc23a6b55fa26bfc5801322c6e45f5d75b1113d30b05a6fc452da68c60bc550b697f472908ae6fd4a72933d72d2232", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742450, "uuid": "6bfd13f7-5371-40c3-b225-98c5d2522e3e", "value": "54F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742450, "uuid": "58005901-7730-47a1-9f6e-f1e12342ad50", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742450, "uuid": "9cbb63b1-a806-46ce-bf37-aa110798eeb8", "value": "3072:w9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:w9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742450, "uuid": "b300ea9d-933a-4f5a-ad02-e99b86fa5f94", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742450, "uuid": "ef52fc7b-2ae2-4c23-b30d-15ebed54b0cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742450, "uuid": "f37b31c3-96c1-4c5b-9ab4-0c78d113f506", "value": "8af3ec95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8372f95-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800113, "uuid": "3e00bbda-d74b-4f89-9abc-ca2c3fb0e7bb", "comment": "Malware payload", "value": "ace37fa664745146da50049e4ee6c931", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800113, "uuid": "1ebe8d01-d2be-47e2-8c55-febee590b084", "comment": "Malware payload", "value": "e868e0d84ca5505fc12359ebcd4275f828242a9f2f897158f2b0876e272e8b3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800113, "uuid": "8811964f-32bb-4740-a385-38d960660298", "comment": "Malware payload", "value": "98cca2b0a0c5b633616fdfb0535153b5e37d3800", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800113, "uuid": "b6a0dc1a-5de3-4548-bb3a-ddde315f8232", "comment": "Malware payload", "value": "c0330558dcc6b7313ecf9bb702ed8519d05311c11fc821e9bbf36f512912adf6f7cd5f9e7f6b992007aa0e5cb1c6c0a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800113, "uuid": "b7c88d21-8707-419f-90e0-11f703133cd0", "value": "00F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800113, "uuid": "4404eeba-f85d-492a-806b-4b208d0ceefb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800113, "uuid": "9764b0b2-a815-45e7-8f2f-f463a6c75d07", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800113, "uuid": "704d5a7f-4462-4dfa-bd7e-349b7200a382", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800113, "uuid": "2bd959d1-f4c0-4608-8326-479dc4a91129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800113, "uuid": "b61970ac-b2a5-4210-a786-3ed15bfd0c8d", "value": "ace37fa6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d755f09-bbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621789277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789277, "uuid": "88fbe9eb-ede0-40a8-8939-f96d9a8eba1e", "comment": "Malware payload (Dridex)", "value": "f1e226ea6f74a2462f2353c0732ec545", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789277, "uuid": "60ac4412-a920-4f08-9445-3f89a102a6d5", "comment": "Malware payload (Dridex)", "value": "e8f0ecafdb6eb2f574055983f9bf2cabf85dbb9ba947f95605e3757d44954c69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789277, "uuid": "2fdb6e6f-4b92-4455-9e29-60b01ec9081f", "comment": "Malware payload (Dridex)", "value": "7dc4f55bdc4b5c621195387d562e1ed6f6b0ac0b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621789277, "uuid": "a7fe4951-cd3c-4e56-af4b-87d16032e4a0", "comment": "Malware payload (Dridex)", "value": "141c252a7aa3c95dc43eb447dcd1ed28eef464284ee6447373adba3f96a239b07f829385439fc3fc373a94845909ffac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789277, "uuid": "e436880e-72ea-4707-bb9a-151ea2fd7b39", "value": "8204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789277, "uuid": "33235f44-06e0-45b4-909d-37f3ba6ba4da", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789277, "uuid": "2929422a-0a29-479c-9ecf-94ff6b2e01af", "value": "3072:QWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:QWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621789277, "uuid": "5e01904e-a6a7-48b1-94db-9913a82501dd", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621789277, "uuid": "bde18754-8e74-435f-82bb-e241be37dfce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621789277, "uuid": "f866344c-b3d1-412f-a827-39d93acfde56", "value": "f1e226ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7f93e9-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749651, "uuid": "00dee318-a158-4769-bec0-843c345a44b4", "comment": "Malware payload (Dridex)", "value": "f1fa1950650bf080a7ac79ede41e7fa7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749651, "uuid": "ea8eb12b-317f-4f0b-8bbb-ae6618ce42e4", "comment": "Malware payload (Dridex)", "value": "eb0f33038e7482f785b6f00ebdc67371fe8135aed3b20b4f068075f233103274", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749651, "uuid": "28a7290f-7824-4f68-ac40-74f84071f2a6", "comment": "Malware payload (Dridex)", "value": "8db6d8c2a3092dde733c296fb2996ffbcb436513", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749651, "uuid": "bc7038b9-74e7-4595-9fe5-6b582017d52c", "comment": "Malware payload (Dridex)", "value": "cc602808d41e7a8ed33f32004842c0c0ef389c7e0f210afe1ccb25bc83ed0f2e99bb3779d91815af09465258714056ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749651, "uuid": "0bd69cbe-cd99-4e58-90c5-59bb89759fdb", "value": "6804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749651, "uuid": "2f665b02-0ce0-4b5a-ad78-5ef588fd5527", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749651, "uuid": "b4a88608-0d27-413e-80d7-ed75e88f283a", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749651, "uuid": "101bd37b-1fdf-46ff-8c29-7788215f6fc2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749651, "uuid": "bee149fa-abcb-4ff7-a86c-d91065399c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749651, "uuid": "5554f634-6295-4475-bc4f-ffb0ce8c13b6", "value": "f1fa1950_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab22c9f3-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810829, "uuid": "f2804200-fd1c-42d3-9a9b-c560f41c1d05", "comment": "Malware payload", "value": "723506ca7bfe26275db5ec0389ed6a42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810829, "uuid": "4d2781c0-d05c-4d8f-81c1-8fd2445018b5", "comment": "Malware payload", "value": "eb41855fc4b2708ed98cf93ac063999cbb8a9e5ffbea11d0f2a1636cee15c2e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810829, "uuid": "804f5a3a-b152-4b99-8c75-f0fb6955465f", "comment": "Malware payload", "value": "711b7b7a3e998a482dfe08aef67a1ccc0d13665a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810829, "uuid": "3a80f3f9-a600-4d64-b203-2ca5ae21a167", "comment": "Malware payload", "value": "075c9f16a43c9eb4f55d09628f25d0758e740942fb77a65ee40d7e6a43afdfb23162f59a2fad1fbc68a09b54a7be0981", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810829, "uuid": "d59b862b-dbaf-4414-ba1f-fa0750a185cf", "value": "46F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810829, "uuid": "dea26c7d-b9d8-4977-afec-bcfdbe75ed94", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810829, "uuid": "adea08bb-a154-460d-a2e9-295f0afbd088", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810829, "uuid": "84a73fc5-8e68-44b1-80de-4cb1de73fe01", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810829, "uuid": "a755ebc2-a367-4ce4-9db1-9f0d75edef95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810829, "uuid": "e1a5d713-0464-4977-b484-572a8f5ffba8", "value": "723506ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8f63d0-bb9c-11eb-875b-42010a9c0053", "comment": "Malware payload (Tofsee)", "timestamp": 1621756771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756771, "uuid": "ab8badef-e9b5-4b87-ae55-5a870168ba5f", "comment": "Malware payload (Tofsee)", "value": "a8f5177fee0e96f74efcca064555968a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756771, "uuid": "6805550a-adc1-4e2d-afb0-928113677a29", "comment": "Malware payload (Tofsee)", "value": "eb7d2f18d5fc15bbdeb4da2d297db7ec72004f54a4a6ef8194c23d0651538a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756771, "uuid": "9af08b85-8ab2-4610-a08a-d22850e3b6a4", "comment": "Malware payload (Tofsee)", "value": "c47d6a6049eaf9686a1582f14470581dcd26d3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756771, "uuid": "68e505c8-fcc9-4769-b0c5-1f8866cd9693", "comment": "Malware payload (Tofsee)", "value": "438aaf16e92c7256b23073be453369e6a707f6ff4f2c2d08da7f92454d3cb26cd61945f60be4451b510318815046610d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756771, "uuid": "9e4c4b93-afe4-46f4-ab30-bbc24a1a0893", "value": "F9E64B33AAE878B9C130917DF72D7F1149BDE2B6CE3C8033984595D41C136962CE6A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756771, "uuid": "8fac4e4c-ea7d-4031-afd2-a7e819780dd7", "value": "0afee8684bc07205be6c2f7b21cf3271", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756771, "uuid": "60bfce40-ae5a-4fc1-a072-7d00c0d69e63", "value": "49152:frH/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756771, "uuid": "3605c131-cca5-4638-bf4e-1b8791ce0ca5", "value": 13976064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756771, "uuid": "2a73bc1f-06e6-47a9-ad54-278dc7d282ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756771, "uuid": "2b150ea4-d83b-4bde-8126-4d1453ac2e17", "value": "a8f5177fee0e96f74efcca064555968a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e912a8b6-bb59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621728040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728040, "uuid": "66712cbc-8bea-4cdf-a243-736bac016eb6", "comment": "Malware payload (Dridex)", "value": "f40063deaa32521191ab2dcc67094994", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728040, "uuid": "475e45f2-d4fe-482d-8036-06a5f0aa055c", "comment": "Malware payload (Dridex)", "value": "eb821922aeb60c66a421b2f44676ea320c61b12a87a07ad1e6a964f00b92e3f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728040, "uuid": "d546431f-2c51-436a-b4cc-f2b080ddece7", "comment": "Malware payload (Dridex)", "value": "db532f35c149917a6686fa6c6eff02e99570cbe6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621728040, "uuid": "e1406f44-7b82-4e73-b78a-8a813a1d887f", "comment": "Malware payload (Dridex)", "value": "648d624d488edd6f4771c0dd14633a5d626f620efa0a133e98444eb120747ab65d89349e41eb5857000287e37d953f65", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728040, "uuid": "7939ee4b-aa30-4ad8-bd93-21683e2b65ff", "value": "BEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728040, "uuid": "9522f965-7328-47c4-9dc9-a8f0fcf361a0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728040, "uuid": "c549d286-7e46-49df-9c4e-522900f76ada", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621728040, "uuid": "24b1ed0c-18c8-41ee-a694-91f2c9f72cdc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621728040, "uuid": "38a0d925-23cd-4ef1-978f-ba3c69682709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621728040, "uuid": "aceee562-6a13-4a0a-a0b9-861675b4955f", "value": "f40063de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d9d50a-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785659, "uuid": "56550bb8-dab1-48cd-8087-4e7e632380a5", "comment": "Malware payload (Dridex)", "value": "0d06dd2a427638465f97a2188126f68e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785659, "uuid": "234d02a0-13c4-438d-93bc-f98e30c8730d", "comment": "Malware payload (Dridex)", "value": "ec02edc4eac2ef074a88b4693c522fc4f438de2dfe0ad4c771709ab79bad4768", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785659, "uuid": "3ad80940-f692-497d-8d54-1a22945a1caa", "comment": "Malware payload (Dridex)", "value": "3230fdb988ab66168bbdf5188ddf14825a497dfa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785659, "uuid": "70baf438-26f9-4a60-b2eb-ccabf07321c3", "comment": "Malware payload (Dridex)", "value": "3336a10430fd11defc70728940464487e73452707ca6eb2309c058a85f04f73ea5310b887a74c79ce851308726a73857", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785659, "uuid": "80653544-ab49-4102-b54c-3cd0dba8ee97", "value": "D4F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785659, "uuid": "e11a9091-8ea3-4421-94f7-256d83c4469a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785659, "uuid": "03124bc2-a731-4a8a-958a-eb0cfa37069b", "value": "3072:+IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785659, "uuid": "a01c70cb-d9a0-4208-9c37-1cbe10b9af9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785659, "uuid": "54d9495a-84a3-4712-a732-bd52b60a612a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785659, "uuid": "481b6c66-bc17-44ec-b016-9b1827080427", "value": "0d06dd2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c43a286-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621756875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756875, "uuid": "9bb809cd-6e20-4280-886d-330e37ad5368", "comment": "Malware payload (Dridex)", "value": "c333cc41361a3460685be90fdcceb7fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756875, "uuid": "9242b21e-d755-4b52-9f47-3fe02fcc7fac", "comment": "Malware payload (Dridex)", "value": "ec48dd5a3dccb6a223b4a256bb04b587c44b9ce9ac6d0109055a42c23321c9b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756875, "uuid": "86472d8c-4bdd-47b3-b765-068577bb86f0", "comment": "Malware payload (Dridex)", "value": "8118539a06546f05efc2b46a7ecb8b5e034e586e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756875, "uuid": "5df01e3d-0c87-4839-8e64-733035527719", "comment": "Malware payload (Dridex)", "value": "5aac63dc0ffda63cf3292d589af06ceeefcdbf57659f9f2d73037d1adacf010ac09b369d09059de2a1482e3e7c05e7d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756875, "uuid": "5801506c-d3c2-45c1-8672-c5a54f0bc910", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756875, "uuid": "58f14011-cff4-44d4-8fed-3ec89da48c4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756875, "uuid": "d9efa559-db1f-45db-93c9-3a2a1e37bd6f", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756875, "uuid": "340ec3d6-1c8c-4f2b-a7ae-284a671e8df3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756875, "uuid": "3b0518ec-7158-42b5-9a74-2f22ead8de0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756875, "uuid": "165476ac-42d0-4df8-8b08-bb9b9af94dae", "value": "c333cc41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadc21c8-bba8-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621761946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621761946, "uuid": "80fa075e-025c-4149-93bf-b69110c18dd0", "comment": "Malware payload (ArkeiStealer)", "value": "a18b2338e696e78ff21d7fd811a66773", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621761946, "uuid": "f1ad78e5-c690-4145-8e9f-2edebce0524d", "comment": "Malware payload (ArkeiStealer)", "value": "ec606c6695e9c2716c8b3eb6c8b45d085caa03658274366a846ad37c452bd65f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621761946, "uuid": "a7697c5b-f06a-49f2-a56e-2ea66b4ee946", "comment": "Malware payload (ArkeiStealer)", "value": "48714e09243222f52fbcee2f9ba2f93f396381bf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621761946, "uuid": "eebc3903-4e50-4e4d-ab1d-9fe0cb2e18df", "comment": "Malware payload (ArkeiStealer)", "value": "6d453d8d3c71ebbe569d8bb615e05a09a28a0224329e170d8e41fe77f05d3e9e413c88859c2ef9b9395eccaac74008b0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621761946, "uuid": "1f36ad2a-7ea0-4702-ab80-b70cf8a727e2", "value": "62E53320B7F681B2F2A10470D95CBBB1C1FDC3684B2585AF33A1E84DDB7A9556307A5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621761946, "uuid": "483fa9d1-2ede-40ae-9d6c-d5f3bbe19c5e", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621761946, "uuid": "c98c76a1-6af6-4930-96dd-92620fecda54", "value": "98304:xRCvLUBsgFSK30AhDkPF5YSZKXHbBv8tZ1Wks6Unvk:x6LUCgFN30AhDVJX58tZ1Wkik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621761946, "uuid": "31c0bdb8-0e89-4562-b455-4ffa3f54abf3", "value": 3238835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621761946, "uuid": "9f6dd397-0797-45b3-ab03-e858cf329a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621761946, "uuid": "09434adc-c797-46b4-b978-f4b5b1c995c6", "value": "a18b2338e696e78ff21d7fd811a66773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db8ab19-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742489, "uuid": "54ae8c06-ebea-4cf9-ac1f-47edea6f4535", "comment": "Malware payload (Dridex)", "value": "e9c3bbabbb0231455c5e52de87531b06", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742489, "uuid": "1366ce4b-7467-4b4c-b8bf-213efa7ea054", "comment": "Malware payload (Dridex)", "value": "ed01737efb033f997b9f6d788f969cda005e4497ab42a0b63e53102d5d9d5eec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742489, "uuid": "b1e6f06f-53a3-4570-a373-008f2bf4e7bb", "comment": "Malware payload (Dridex)", "value": "496b0de3633500984799170596bd76d35c9eafa0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742489, "uuid": "7d4c0bd4-c185-470a-a45d-6f72c668994e", "comment": "Malware payload (Dridex)", "value": "85af1078804f81d3d8ed675e0988f0854e301bc676a66a3013a5c2ff3ddcabbdcb2363fadec79e482a33c003636e91b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742489, "uuid": "ebfbd9e7-2d23-4a97-a5c6-4915b9755cbb", "value": "1AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742489, "uuid": "678b330d-b1a8-4c5a-9bd8-45bbb9588265", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742489, "uuid": "b547b5f3-fd38-423a-987c-21f743d09ce2", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742489, "uuid": "70b1890e-4620-4cec-9d46-d97ecd12c261", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742489, "uuid": "6a99db0b-24ef-4b85-8071-3fac03e8176e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742489, "uuid": "3a550a5c-8647-4ef8-9376-ee1516e885ae", "value": "e9c3bbab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aa4cd0-bbc9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621775763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621775763, "uuid": "fdc6ee04-04d8-4b5c-8b44-c6df5075a59d", "comment": "Malware payload", "value": "40c56581e4cc535d86977acc5e7dc0ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621775763, "uuid": "de56b3ac-59db-43aa-9dca-c2cda4e6a422", "comment": "Malware payload", "value": "ee10d418d5b6b952a28e276555a325762972d6e047fe03ba31b5e53844b01f90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621775763, "uuid": "8234f236-86c1-4f41-9b62-af2afa319e51", "comment": "Malware payload", "value": "34c180860449ca37a6c2b1a481879ab9ac63a9b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621775763, "uuid": "c0444c87-17e6-48fe-ad60-f5b70576ba60", "comment": "Malware payload", "value": "c153561ae3cbcc3f7e4c69356b3f57f112628cd287ec614c056511501a4a86a39d92beaadae14c163fb89ffa04981099", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621775763, "uuid": "89575c35-8b7b-49f2-8128-dc55a4f71cc3", "value": "18152067D7118EF1C18844BB894BD7552274507403AB53117D5C511C9C8236C2458F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621775763, "uuid": "5aef4446-de9d-4dbb-b82e-de1bb6931122", "value": "6:MxlEh/jKjXFeyclltAxhs5gtx2W/8cCo1lCpIKD9M/6EbKIm8olaXGq1:OEh/G70yUQxhs5E/8sKZsfbKBlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621775763, "uuid": "68d08864-a65c-4720-a172-6b3431d09993", "value": 947656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621775763, "uuid": "144a1f3c-5101-4bc5-9036-c3fa42a0c811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621775763, "uuid": "2935fd52-2edc-4ef7-a02f-d6b696e0e5d7", "value": "8dc8b6369e94b8bd51b1b060e9fc3235.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1003b1f5-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803696, "uuid": "39c2e806-d3fe-40d4-b823-fd99a137e915", "comment": "Malware payload", "value": "ec9ab07b8bd6d0dcb5784f84d7d6d293", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803696, "uuid": "160e6cf7-0041-4b46-b91e-7ebce2dccb56", "comment": "Malware payload", "value": "ef42483ffa7ea079f58b42773800b466ba981cef14f523e32be7d1499ef7dfbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803696, "uuid": "3953606e-a25b-4528-a184-6071a602f7cd", "comment": "Malware payload", "value": "d423a81391867308d066f568b2a6bdaadeb8721a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803696, "uuid": "71f6ae9f-d797-4fc9-9810-54c2398398bc", "comment": "Malware payload", "value": "c1500a09c921b80363f9bd71079908d399aa2e8bf9f0afbef63398ab8c613ae8d85bbfa33032dea52a69a895bc7a474e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803696, "uuid": "53e00747-a8bf-49e4-85b7-630d2bb485a9", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803696, "uuid": "2fe9638f-22b5-420a-8403-7adb03a65e0b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803696, "uuid": "979c39dd-428d-42b2-8932-a9686279d98d", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803696, "uuid": "ec308b4c-59a5-41ef-8000-cfa90627fb22", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803696, "uuid": "c1ea0bce-94bf-4c9f-985a-34f8cb7ad073", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803696, "uuid": "588e81e9-9779-441b-be1e-b682a16d3780", "value": "ec9ab07b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b0d82a-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807295, "uuid": "0a710874-b945-491d-ad5c-baa9b23917bf", "comment": "Malware payload", "value": "4c316740675832f706af7eedbccfa0b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807295, "uuid": "8c024c5d-e2d6-4116-a2e2-8c28d3fbce64", "comment": "Malware payload", "value": "ef524363c180cbbe9556cb65ed71e1730ab0b0cb169969a0bef76bd4b5f3aef9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807295, "uuid": "f84afe8b-97f9-4196-8590-00edf85fd9bd", "comment": "Malware payload", "value": "12c8f78c747e49fe00a5c6e0e37feb02397c5b19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807295, "uuid": "1958582b-0a5e-4c22-8a59-a868dea13cba", "comment": "Malware payload", "value": "1ec993d6969df8ce2ca425100d340b5c185b4f43037dca4528a240ad1407fe884e36aa84f6825d3c018a4de222d3a9f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807295, "uuid": "22c43206-d717-4301-96dc-2e1929f7dc9c", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807295, "uuid": "e8988dd7-de28-44b2-838a-8d16b02b74fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807295, "uuid": "c1b60ccd-7f83-4f16-9453-59eb5c89297f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807295, "uuid": "776a5122-5f1e-4a92-8e02-c348d161a1a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807295, "uuid": "920494aa-f8bc-46f8-8cb9-780497cfa565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807295, "uuid": "980abf2c-944d-4606-bb2c-595e02fbc8ab", "value": "4c316740_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3ed33c-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810882, "uuid": "66b6993e-4188-4313-8675-f1175ed86158", "comment": "Malware payload", "value": "7815dc2b1adeb2aff522e759a304969c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810882, "uuid": "c6b0c148-3df1-4ac9-a51b-1eb2208a1a9a", "comment": "Malware payload", "value": "f07d8830d5a847b02799707a9d32e63787035ddf1677abc54a216bdd7e552a40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810882, "uuid": "42b6fa60-c475-469b-9c22-a85d4e9761d7", "comment": "Malware payload", "value": "345959b72ee2a71090ff1ab9dac4e24c4c62afbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810882, "uuid": "4636989a-62a1-4ecf-81ea-ed45fd935035", "comment": "Malware payload", "value": "1057d40af630c002dea2e78753588b03bd3c3dcd1d4291ff0689e71b7eb3506c8a56989c43608c9662b9da10e4154c57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810882, "uuid": "440c9c42-44cb-48df-9d55-d4918e34a02b", "value": "79F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810882, "uuid": "2d0c6b2a-5346-4a60-a9f9-df8547a9055f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810882, "uuid": "fef253c0-a37e-4f66-a79d-c933f26def4c", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810882, "uuid": "117f79cc-8aa3-4f94-8045-e887fe5de70c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810882, "uuid": "4b13611b-081e-41f8-b46c-32d99aec0abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810882, "uuid": "3afdaa1a-76a3-4648-998b-0fca9c1dc6d9", "value": "7815dc2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b19ed8-bb9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621756914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756914, "uuid": "ee214c5b-bfec-4dc5-8121-2ef9cf2208f2", "comment": "Malware payload (Gozi)", "value": "8b0aa7b2df531503ebb39aa142b004a8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756914, "uuid": "92e2ce4d-253e-48f0-8c97-384bd96dc38f", "comment": "Malware payload (Gozi)", "value": "f09569b61b068a70e2570e2df7bd6ee6c288f8ccc4bd03ceabdf3fb6893261d1", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756914, "uuid": "dfe160f9-9614-451c-a2b6-25d8498f5bbc", "comment": "Malware payload (Gozi)", "value": "5284870ca7f20e2f830ece441a4b246cc3f2bda3", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621756914, "uuid": "4370164d-49c0-4737-8665-049ac5c714a2", "comment": "Malware payload (Gozi)", "value": "1a9d298b4f39a7e0d059f7af25bc8fc0758c5b5a4a5fa64ffb40ca3802ef16e6cd93eeb6700e183088e8cb82bec79884", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756914, "uuid": "c067a6c1-e471-45c4-ade8-1b23b9ef21b4", "value": "9CC4AE547582F132E47214318FA6D9F90B28FC115BA909CB73E41FAF5E2CAD36A31726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756914, "uuid": "9c3abc16-0a97-429d-808a-99f5484beb41", "value": "d4b06b16b61e31badd075bc25c28ffaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756914, "uuid": "47827685-254c-4d06-9e57-b0b44b36713f", "value": "12288:XrH3MGVMH0t75f2dVlVk3BhvunYUB/hq44JS15yE4TeCVCP:bXMGVMH0tdaLkft2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621756914, "uuid": "669a45d5-3931-4811-af33-8ab7d845dec4", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621756914, "uuid": "73a94ab5-dfe5-4ca2-95ed-ae7cfd29f8b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621756914, "uuid": "660008e3-5d82-4de8-8755-52df953aec72", "value": "8b0aa7b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a71da59-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785729, "uuid": "348d04a0-2d8c-4859-8eb3-8f816f950c4d", "comment": "Malware payload (Dridex)", "value": "aacc2c70c3c677b4f843bfa3ade14526", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785729, "uuid": "726b13f2-d9bf-476a-b393-ffacb5d82059", "comment": "Malware payload (Dridex)", "value": "f117b716981bdf5412b64a0a1d7551a3f0ad287b0680e01c7e4faf05c6c1a15c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785729, "uuid": "16a38c20-7b43-43ac-bdaa-9652bb72cb25", "comment": "Malware payload (Dridex)", "value": "f299209680faf8cf6be418148d0675bc5653f5c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785729, "uuid": "54e8adfc-69c7-446b-b21e-672dcbca5c5a", "comment": "Malware payload (Dridex)", "value": "35c305f6437f34d807c4106e140b3037b484f240902b71c0c529e5973a3c62031534e1fa30d7939fa3a66344a8c5e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785729, "uuid": "3d051536-b7eb-4928-842c-0e7c045da9c6", "value": "5DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785729, "uuid": "7d03f3b8-4258-47d1-b709-8ab7f2fe190a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785729, "uuid": "3511be11-4b1f-4cde-9d3b-95169f6032aa", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785729, "uuid": "745ebc0f-59f9-487f-97d2-89400fe601bb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785729, "uuid": "26783d32-2c58-48fb-9476-1b24c9b28913", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785729, "uuid": "f2270931-05f9-4779-9a48-79c8fe74a355", "value": "aacc2c70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95f7107-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792840, "uuid": "2d9140fc-421b-485e-b36f-9a2cd43726e6", "comment": "Malware payload", "value": "a17d8652763ca67bfe0ff6761c3da1bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792840, "uuid": "3a40d78a-57e4-441e-a47c-288241da3192", "comment": "Malware payload", "value": "f11a4759131584ff043fb947357be3779af7a7a3d9e8fc647ab165be2bc4afc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792840, "uuid": "d50e8235-6d03-42a6-ab56-9d47bce91173", "comment": "Malware payload", "value": "139394884f6429ddd31f46d4661f5a40543519a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792840, "uuid": "7e92da71-9eb4-4f43-9488-4134f327827b", "comment": "Malware payload", "value": "0172c773d3a22dbaec9e31bfb0be07d99f3a1c16ea2fff9c0516ca8615a080e26df87092a5b41e37f0774494452d4809", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792840, "uuid": "9d69dbea-30d2-425f-9a1b-a185d28819b4", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792840, "uuid": "fdc92612-aa60-40e2-b599-a369e12177fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792840, "uuid": "65429009-f58c-4d04-b425-58c22c6e5c74", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792840, "uuid": "22c2ae64-3a8e-4d8a-aac4-f605a4f27192", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792840, "uuid": "8f330644-ad7d-41e4-879c-27a7bd09d3ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792840, "uuid": "eafcd403-a3a6-4a12-aa03-5f3bdd32c113", "value": "a17d8652_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93530d17-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760538, "uuid": "79b76b94-e8c5-48cc-b2a6-cbee13344106", "comment": "Malware payload (Dridex)", "value": "fb1a4e85505841442996f1ba3915316e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760538, "uuid": "204e0a83-44de-4aea-b59a-c5f4968a0d1f", "comment": "Malware payload (Dridex)", "value": "f13fd3aa8517a1ccfc677e5e17ee92e92cc7a56d107134224f55c09fe654d475", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760538, "uuid": "89ce0f1d-7c67-4288-b84b-d3d4fa668d30", "comment": "Malware payload (Dridex)", "value": "5fb1e6fc6c8936a914f280f997264cfbab2f4388", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760538, "uuid": "c3ac4947-0e9c-46e3-a8fa-b71c262e01f0", "comment": "Malware payload (Dridex)", "value": "1db416eef9cc92f35084c604af52c4317decc46189dec84d60a540fb416a1f11a80b6b57efee8a8f493bc4b7af2433fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760538, "uuid": "b24c5107-0a89-459e-addc-f5aa52e1dda8", "value": "A1F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760538, "uuid": "3598ea5a-aa41-464c-91ce-7eac822dce12", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760538, "uuid": "a779cecb-ba8a-4c30-8f24-1c199ca99abc", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760538, "uuid": "061a7a13-dde1-497a-ae0c-f41c7050b645", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760538, "uuid": "2bdc1703-f6c7-4a92-b0e6-a67d2be2dba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760538, "uuid": "0d980290-c9e9-40a3-b57d-ee4a65b2b4ca", "value": "fb1a4e85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295541c6-bbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621796437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796437, "uuid": "b9fff9f7-773d-4df6-89e8-4f4a77c41a0a", "comment": "Malware payload", "value": "a79385b5ef27172fcb7fd8d293fdf036", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796437, "uuid": "2240db3c-a783-4287-865d-4f837418b2af", "comment": "Malware payload", "value": "f1c035de0b7640a5101168f1c8f1150f4d67db7325556eeebd1a037bce32b5f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796437, "uuid": "49be8010-8f1b-411a-bf5b-c054fd043d67", "comment": "Malware payload", "value": "3e0aa6b37c7b953c3100609ac12856b875e69eef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621796437, "uuid": "2fbfaae1-ee20-43df-ab51-7457c7c185b0", "comment": "Malware payload", "value": "5f72ad8d7c5ae08b092feb189d4635c80feb1b4605a9b2c4ccc26ab395345916747f156508224301b22e98f0bd0ddb50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796437, "uuid": "ff548c27-70cf-4d79-8ed4-dd09007f5e80", "value": "6CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796437, "uuid": "0dccc778-635c-487a-84b8-77ebfa3c52e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796437, "uuid": "124db36b-1537-4586-8a9a-0f5f05bd4a18", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621796437, "uuid": "444eeef8-5de1-4d45-859d-083593b8ea88", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621796437, "uuid": "2c4dd017-b630-47ad-b8dc-6a74135c0019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621796437, "uuid": "867a95a5-9e31-4a4d-aaf1-40fdce88a4b5", "value": "a79385b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5da5482-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753267, "uuid": "0edd2c9c-2382-4903-8f09-589db27061da", "comment": "Malware payload (Dridex)", "value": "e385b54930d5eff3800d868d4a2db3c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753267, "uuid": "485151f2-00f4-4280-b6af-65ada13160d4", "comment": "Malware payload (Dridex)", "value": "f209d9c1cdce7a28d400d7fc03a27c36759faa03c745b80ea9d892ecece25d37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753267, "uuid": "a0e74533-de3e-4ecc-b00d-e0d58a8bf024", "comment": "Malware payload (Dridex)", "value": "1f712227e6c298e3df7414012df5d3ea5224b5bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753267, "uuid": "0722d182-b789-4a90-9781-d264711810dd", "comment": "Malware payload (Dridex)", "value": "27c1bd10b1f84c85724b0272177a41ea06aae76aecc0b41c356eaa541a14a391144de1f52377c277978c7c0e805212d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753267, "uuid": "0c971e9f-3324-4f78-bcb9-dd28b9e48736", "value": "88F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753267, "uuid": "ec9ad25c-735c-4a54-b94e-49baa139def3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753267, "uuid": "51ff2d06-2e89-45cd-813e-8418e48ac7c4", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753267, "uuid": "bc5a0cc3-dfe2-46a9-8708-2c254c260191", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753267, "uuid": "648ddf4a-1bb0-4ba4-9968-f70884c73b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753267, "uuid": "2bb730bd-d97c-47f1-82d4-f544ae1a1a23", "value": "e385b549_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445f9211-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785745, "uuid": "13f25d86-89b4-42a7-b842-00e1c1892863", "comment": "Malware payload (Dridex)", "value": "3af91cf8b33dd302f8592e390121eb89", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785745, "uuid": "2bbbd264-dc26-4899-9639-d72dc82b695a", "comment": "Malware payload (Dridex)", "value": "f21107b1d5afc8509a2c10802825b290d7322e909612108a50d9695704123740", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785745, "uuid": "aa5659d2-8c9a-471c-ac05-cafbaa7d83a8", "comment": "Malware payload (Dridex)", "value": "3b39afb64f1a59e1257758a40f51987f0efa9ee0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785745, "uuid": "52c5f92a-b28c-4239-8f4a-047c21088bd8", "comment": "Malware payload (Dridex)", "value": "2e599bde393f3e4653f172e9031107a8bf658051e9f67716e398b6d19e67f9f1387a2d4e0d315f01717ee385b3500bce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785745, "uuid": "b3c56144-2fd5-4329-aa37-f942fbd5e0fb", "value": "6EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785745, "uuid": "690e2949-ee32-4f80-8761-0d367227d36a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785745, "uuid": "dd2887a9-622b-45d1-b433-b4ea70aa8389", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785745, "uuid": "88443860-3fc0-4082-8e29-1def8ce1d330", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785745, "uuid": "fef2db47-f7f8-464b-a017-a492cea253a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785745, "uuid": "95267548-b94f-44e5-9da4-12b38ebcd85c", "value": "3af91cf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15277ac-bb94-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621753394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753394, "uuid": "a8ccd189-c2c3-4dcf-bcb9-0f2f60b25af8", "comment": "Malware payload (Dridex)", "value": "cd32d5c516e4dfca0d536018522d1c13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753394, "uuid": "a67f6908-ddab-4d3b-89af-752f727a77ee", "comment": "Malware payload (Dridex)", "value": "f270231a12a137314cc3aa5a3b89ed6b672c86d7019e339c25044f5049b29990", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753394, "uuid": "6dab9be4-3ebe-4576-ac4a-6da35abf43d0", "comment": "Malware payload (Dridex)", "value": "8880488026cfed153f2d0c2f753c7db534edfd51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621753394, "uuid": "f2a30f60-d6d1-4c49-8b98-5bfdff3276ea", "comment": "Malware payload (Dridex)", "value": "442a96756cccc3d46912628a9ef2724db73d079c4df741d7593face92a54bf0cd9c7f5c076c7bf11a5510959241a049b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753394, "uuid": "c1424830-8847-47c5-824d-1862d7f5817e", "value": "A0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753394, "uuid": "b06726af-090e-4ee6-bcba-65dbf6c62dd3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753394, "uuid": "1bc03be8-4ed9-4a26-bfb6-6cceaa5d3cbd", "value": "3072:uiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:leAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621753394, "uuid": "1a21bcca-0d30-4a08-8725-a2ba2d145973", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621753394, "uuid": "f44448c2-3af3-4fc3-8854-335559c96585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621753394, "uuid": "703b3525-83bb-45a2-a22d-214100983f76", "value": "cd32d5c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f735c3-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803735, "uuid": "69bc0e76-65fb-4b46-ac54-11b61488d3fa", "comment": "Malware payload", "value": "41d552962d6ad34bb4daae907cc374f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803735, "uuid": "55413a95-4cac-4ba0-90dd-602bfc1260cf", "comment": "Malware payload", "value": "f2c4c9e8f6c3a4b0a1f3bf3354a8af4ce838bb1c886cb2721dfebfe8a6f0416f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803735, "uuid": "d4e25b3b-9149-4003-a557-02978d94a3d4", "comment": "Malware payload", "value": "c55296c97cd694f27b629881086cfa4a559df529", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803735, "uuid": "369a61e0-8423-4632-8610-3589fd45cbd0", "comment": "Malware payload", "value": "ffd760b48f4edaba6962efe6bf1c231e22a332fca66e0116adf15af5b962021cf04c1edc16dc8320fc73d40ce5a93dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803735, "uuid": "727ba017-3da9-4098-a863-03c70240e56d", "value": "6604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803735, "uuid": "b92feb92-40b0-43f9-a450-86424f5f0ae6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803735, "uuid": "937aa47c-a943-4354-89ac-cb540cd6de70", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803735, "uuid": "cfc688e7-d5d8-404a-9857-7f6d1e0be3af", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803735, "uuid": "f547e6a2-c9b2-4dee-b427-591106bb2706", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803735, "uuid": "7f24551b-edc6-49d7-97e0-91f7ef753ddd", "value": "41d55296_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952c91e7-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800054, "uuid": "1d4288c1-420e-40d9-8b47-a28be525f9ec", "comment": "Malware payload", "value": "cfa3a7fc165c4ab6c33d8c52f898b960", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800054, "uuid": "6836b2f8-846d-422c-9097-28c970b1ebbb", "comment": "Malware payload", "value": "f367b05a840f69f8341b186c186fe7ad17ebec5ed5fef08abb2544f96d163d6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800054, "uuid": "2f978d0f-f783-4276-ba24-939744760dcc", "comment": "Malware payload", "value": "d9d36e68024bcfaf3c4914a3b7c7c9dcdb806616", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800054, "uuid": "f44a6003-5c26-4756-b866-9e74f779fc39", "comment": "Malware payload", "value": "3015e197c0235f96890d8d25a10a34e1ad6fc9d22de781377a6216569671722c9d0d4a7d776dde5b6b129e976fc1b8bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800054, "uuid": "9733b06d-f979-45ff-b3f8-613d5c50daa1", "value": "DFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800054, "uuid": "4f7e539a-3e5f-4198-8477-fa5e464374d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800054, "uuid": "ab7badda-bdfb-4777-82f4-d9ac0b9833bb", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800054, "uuid": "d4542ff1-e90e-4ab5-a3ad-6a38d5a02704", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800054, "uuid": "16dd1af1-bc17-4c64-a150-c5fdb2cc8a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800054, "uuid": "1c74e7c4-c34d-43ee-abbc-83022a4cad21", "value": "cfa3a7fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4282d82b-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767703, "uuid": "3b69b0d2-d588-4c53-8040-99506857afbf", "comment": "Malware payload (Dridex)", "value": "fa622f6ad190a2a2f37bcf6461932bd1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767703, "uuid": "13f085cd-e5fb-4e31-90bd-25f70ba305fd", "comment": "Malware payload (Dridex)", "value": "f43395352ab417fca90e138941ff10d63cd35bdd5c8b1a8ac00e52a386b2c5ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767703, "uuid": "8c67b513-5a2f-4f12-9e48-79dd50fc937a", "comment": "Malware payload (Dridex)", "value": "b454ab7fc18d7023803650d4b365cc02cc4be613", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767703, "uuid": "c922ac08-1be0-456a-907b-53abac621279", "comment": "Malware payload (Dridex)", "value": "3a11052dad666059a74181a5769212a7fbe40db03cd655e67e66cff8f35a1be49e072c23bc4ea5df0423506ec45c7f49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767703, "uuid": "f2b06309-e5d1-477f-846c-75a23b827899", "value": "74F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767703, "uuid": "10eee4c7-1949-47e5-ad1c-a1500a254b67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767703, "uuid": "2dd6d09a-3599-41d4-b1eb-fcd0838414fc", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767703, "uuid": "4ba8c16e-ec09-467f-97d1-7f9a9bea2e99", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767703, "uuid": "c03b7f47-27f8-4ed3-970e-bef39d716e5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767703, "uuid": "78ffedd5-ee77-4c35-ada9-1e0b026079a9", "value": "fa622f6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf21fdb-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785651, "uuid": "8182b4b8-315f-4128-af45-7ec0d142f003", "comment": "Malware payload (Dridex)", "value": "fca03242422b629b2e756d6041c609bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785651, "uuid": "f2a62949-c7b1-425a-99fd-f6423c39f693", "comment": "Malware payload (Dridex)", "value": "f450bc7bf3cb809ed4c2d54198e218d78ab8dfb049ff08f774e72e32603c83e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785651, "uuid": "344dc2b3-c640-43e8-beda-2106a908996a", "comment": "Malware payload (Dridex)", "value": "1d2c755e98e0330a74f715c2d4f2b7396f030c3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785651, "uuid": "e11c5e8d-416f-4551-ac5f-590ae9998669", "comment": "Malware payload (Dridex)", "value": "a8ca7c61193cbaabe8a315c557b7475f25e202bfa249f269bfa0ce142858276835883cd4c44e154807fff383d952e944", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785651, "uuid": "557959e7-8c47-4c4d-baf0-2df3fe42a1d6", "value": "5D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785651, "uuid": "98fc57ec-0a73-43bd-9bc5-551152562b35", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785651, "uuid": "f5f519a5-148a-404f-a995-545c1897684b", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785651, "uuid": "ee96f390-27d5-4e2a-b2c2-3d130455cc02", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785651, "uuid": "de5a964d-45fd-4631-a102-889cfc74bde8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785651, "uuid": "b518e80b-5875-4dd5-bcdd-19501947736c", "value": "fca03242_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9314257-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764037, "uuid": "5b5c8ee8-8316-4391-9527-4f23c1a2bc36", "comment": "Malware payload (Dridex)", "value": "2683022fbf146403dde31d7b5d85232e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764037, "uuid": "d2de3d5f-fbe0-4dfd-bebb-275ad91ee918", "comment": "Malware payload (Dridex)", "value": "f5390f8acf46a4b78c6fffbd3b3db7ad7a6bc21f0208ed78e9e1eee95e0cf72e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764037, "uuid": "d424f63a-157f-426f-ac6f-7db03dd8df11", "comment": "Malware payload (Dridex)", "value": "11bf582e4030eeb6b1756c5d3a5d9b30c67ed767", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764037, "uuid": "31df14c8-a990-4462-8fe8-eee0333d19da", "comment": "Malware payload (Dridex)", "value": "ab9e0b0b7d64542164ee4e0cb7b546c309203c30da7aa6f068b532b45978430595aafd9f878d155aa156e447358e1091", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764037, "uuid": "b8f18d1a-4cce-493f-8aa9-3c3fa3742f24", "value": "31F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764037, "uuid": "2c8495b6-29c7-48fb-a52e-278061eafad7", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764037, "uuid": "e332543c-93ce-4928-a73d-eea5e100d8d0", "value": "3072:b9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:b9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764037, "uuid": "c2af3854-eb53-481c-8d43-a59e03ba336b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764037, "uuid": "98adc663-8602-4af7-9684-d628b324c200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764037, "uuid": "905ae9a7-c2c4-4586-b06f-3d66b6f64de6", "value": "2683022f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2439ce-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785703, "uuid": "31f8fd13-738f-4110-b332-aec4390540e1", "comment": "Malware payload (Dridex)", "value": "b872316478e89e50ffa1ec0b73808db7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785703, "uuid": "342d0e5b-bbec-48a8-96e8-c007ff2a9b61", "comment": "Malware payload (Dridex)", "value": "f6c81deb31d47c6e34d0355c2fb5eec9facf837ec7eb156f3e57005aaba2afa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785703, "uuid": "f3572246-370f-40f8-ac84-3afbbde25ed1", "comment": "Malware payload (Dridex)", "value": "318071c441bfe70a9a965a620f2d0c9f0f1a576a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785703, "uuid": "eb27613b-b971-4703-a072-60cb0864f06b", "comment": "Malware payload (Dridex)", "value": "bfb3efb5fb08a88739586fd86993d89bd9c2a2c97b51b4e5aac0ac7dc37efc29f57c76491fc60c2e12b52c2f6b0dec8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785703, "uuid": "b5d6b134-45e6-4ebe-8ea5-95a2269b767a", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785703, "uuid": "81311574-d01c-4984-a599-ba7bc35ecd6e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785703, "uuid": "ccaa23b0-e766-4b33-acb1-1faa5c408d42", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785703, "uuid": "d7ca0c0b-e3cc-4b59-8a48-342856c8fa24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785703, "uuid": "5302f935-5288-4175-9f65-5ea6c59af50e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785703, "uuid": "3d1f3bd9-dade-4306-89c0-2562c6cf8263", "value": "b8723164_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd40213-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621785677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785677, "uuid": "b49c40c6-5c1c-4874-b09e-3889d2bc2c06", "comment": "Malware payload (Dridex)", "value": "15e8c54f65b12aa49e99941dc2ab2796", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785677, "uuid": "29a340f8-0940-427f-9424-6f096fb2bb74", "comment": "Malware payload (Dridex)", "value": "f6f039cf2bfe31347ebfddb200f5c9338eddfdcf673ef314d0c0896901ef2979", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785677, "uuid": "c664df30-e941-44e1-a7bf-0b0c14536507", "comment": "Malware payload (Dridex)", "value": "8fa99e561998db67f72579240f70936e28628120", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785677, "uuid": "9ff54734-d8e9-4e18-a8ce-d83fa257931c", "comment": "Malware payload (Dridex)", "value": "0cec29637dbf12099d9c9cf217bf2706baf6296794e9a1727a91815ce6ca6171cc493e517b6098418d9645b177d202cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785677, "uuid": "021b30d0-b006-4a07-8cb5-98958880022e", "value": "E1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785677, "uuid": "6f2d5825-f636-4de5-a45e-b84b1e52d86b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785677, "uuid": "1e4747b1-09c9-4ac2-a258-a30e5be3fe6e", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785677, "uuid": "6f2dea33-3c42-49a7-813a-1a70414f58cf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785677, "uuid": "6443d83c-fe34-405d-8dbb-9f8c1d52fac8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785677, "uuid": "a503b02a-f5c0-4cb7-8916-f779ee2d204c", "value": "15e8c54f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3257105-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800105, "uuid": "2e61e382-fae1-41a0-af54-32aa54447536", "comment": "Malware payload", "value": "8aab76d089bd49f20ee41901582e2891", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800105, "uuid": "803e5133-38c6-4870-99cf-5d6e54913c5e", "comment": "Malware payload", "value": "f7024e1a8e30a6760df2d52199b0348f4036477db5f173ec929480e8896c36d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800105, "uuid": "6ebf38c6-7cb7-425f-ba0a-97c807c5973d", "comment": "Malware payload", "value": "fa72080b70584a09b9c596412ea0cd705c01b202", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800105, "uuid": "280241ea-3463-47f5-8f49-a570688d0bd2", "comment": "Malware payload", "value": "76876d283ab2c1041c28928e7d1a9886dddad277705ded9407ae88d13f3c9c502dd6138f72077fb328505ffec1d2d46b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800105, "uuid": "f8d8391a-32ca-4d34-aae9-4dfada2c0a38", "value": "B9F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800105, "uuid": "8610c111-af17-4bd2-80e2-187f8640d582", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800105, "uuid": "2c113826-f09e-49f0-a655-1e121725fe2f", "value": "3072:eIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800105, "uuid": "1c399eab-1629-443d-9c40-52244aedfe13", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800105, "uuid": "290e7b83-d76c-4323-94fe-dbffb56545e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800105, "uuid": "fa33ed48-f55e-4a4a-ad3a-c83250a04cf1", "value": "8aab76d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d00307b-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621767640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767640, "uuid": "7ad32857-2f77-4ac7-b3fa-18d22fe66bec", "comment": "Malware payload (CryptBot)", "value": "7e9d57f98e3b8378f3bf8e5beee0d1fa", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767640, "uuid": "8df771e6-59a7-4b94-adc7-3a5763f8b8c3", "comment": "Malware payload (CryptBot)", "value": "f7538c1641168a73906c017c7e840834aa498335c83f4c344b7375272f02ad15", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767640, "uuid": "a9025328-d772-48b2-a051-4fc2d7436337", "comment": "Malware payload (CryptBot)", "value": "2a7caeb14462e8fd72c6e84d0fcbb8331cb7665e", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767640, "uuid": "83cf71f2-60af-499f-8bb4-f57ffad21885", "comment": "Malware payload (CryptBot)", "value": "a556dd6f29c0c4d3f9e24778b44a8fe5f76454dd2a6ba694616a0b5ed9d6975e8382fadfa90dad05ab8cf81bf703fa0a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767640, "uuid": "4a322dcb-b2b5-4e64-aec3-3cec55f1a21d", "value": "D8F4E020F6A0C035E1BF56B06ABD82B9A43A7DE1DB6440FF12C63AE946345E59D3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767640, "uuid": "a482b201-10dd-41b5-af14-883c61b3fd51", "value": "504bef34255b8691aaec7482375c58bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767640, "uuid": "312aed0e-8b3f-4bdb-ae24-97bd66a5fa14", "value": "12288:jCyAt//sfXQjcu0XufpulvO3y1ATh9P2HyutzL7VG5qmEXI2kKrPU29DpAOy5OXx:GyQ2XQFZAlvR1ATzP2HzzFG5qmE42nPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767640, "uuid": "fcbbd535-d885-412d-8d69-1b4b08fb3c3a", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767640, "uuid": "6870d586-758b-4640-867a-57e8f0fe3242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767640, "uuid": "7edbb4eb-af00-48df-9f41-9e046c85d5c1", "value": "7e9d57f98e3b8378f3bf8e5beee0d1fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedf72ab-bbad-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621764100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764100, "uuid": "5223dd7f-e4da-4531-8be7-424d9bcdfe90", "comment": "Malware payload (Dridex)", "value": "51c8f90c94cb3a661e642a8324fc538f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764100, "uuid": "a9009424-230b-47b3-9961-f79a6c3fa9db", "comment": "Malware payload (Dridex)", "value": "f7685d306f6dbfc33a91fc132c1d4487f14de659bbe502b84d64873d1ef9caa7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764100, "uuid": "b00fbb21-4c74-4150-a769-b5bc93423573", "comment": "Malware payload (Dridex)", "value": "e23f75f6dd5e98d90912f5a45396146762c116c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621764100, "uuid": "75ee697b-50e8-4dd0-b5cc-bf9fd9484337", "comment": "Malware payload (Dridex)", "value": "f11d2547d79857eaa50d00a4c4cacf43826c881d77d673e2b5e950cf579301ee94548e0b3751e1ba0abfc476e19ba106", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764100, "uuid": "94778efe-01d2-4204-acd8-7461bbc524a0", "value": "4C04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764100, "uuid": "705c0a20-5f2c-435b-9769-7ca1d7b03201", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764100, "uuid": "48ef9f5d-7e85-49b2-ba36-2fa95e7273ce", "value": "3072:uWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:uWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621764100, "uuid": "67adafcd-3c14-4fed-9be5-183e3dd0dc51", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621764100, "uuid": "0328f1da-7c54-4dad-ad21-6af6f90f0922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621764100, "uuid": "64ce66bb-d182-4131-ad66-8f3e9aa3eee2", "value": "51c8f90c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4150875a-bbd1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621779298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779298, "uuid": "56be6c06-a391-4b53-9129-b0edcc6137cc", "comment": "Malware payload (RedLineStealer)", "value": "6f12bb8a5e274bf47b87ce43c7893d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779298, "uuid": "2e695fe9-0f7c-408b-998e-c327bbfc58ef", "comment": "Malware payload (RedLineStealer)", "value": "f894a82a85505aac3767cd5cc4bf1e86c51c920cc5e865aeef61886e3e482649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779298, "uuid": "7a80befa-cecb-4b61-b6a4-004dabaf8d27", "comment": "Malware payload (RedLineStealer)", "value": "2e66fe7a661f2605d93bb8835740cfde7fa7d39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621779298, "uuid": "f1ea052f-9298-4ff3-9014-2ddf854c7355", "comment": "Malware payload (RedLineStealer)", "value": "03aded6b87d4ce312a73f41bafe5a9f3aff25b15337eaafdd3bb7fc83eb42873e5acf5bcbc3d44bba17a9c3df345f6ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779298, "uuid": "c0efec6b-b21e-445f-8692-ff3141669dba", "value": "6584AF20A6A1C035F1BF13B849B582B8653A7DA1ABB450FF32C526DE56345EDAC3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779298, "uuid": "7e31f8b7-26d7-4dfb-bc90-46938b223b52", "value": "a61874996ef957c79786ba3bba5ffda2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779298, "uuid": "64657065-2418-45f0-aaca-8769ebbaedcf", "value": "12288:oiXMc95SwzvtZtyK/cI9ne7++IOR7zQiXsL:rMc9bhPLkH7++Z78iXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621779298, "uuid": "f1dee320-943e-4704-a1b5-9232feac9965", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621779298, "uuid": "7326a2d2-6c9e-4e1d-883b-6477a9ced930", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621779298, "uuid": "bcad4087-1f8e-4e62-847e-9c95259f8999", "value": "6f12bb8a5e274bf47b87ce43c7893d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0cc28f-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742465, "uuid": "bfa2b64f-e781-42d0-b359-717bbd4d54f9", "comment": "Malware payload (Dridex)", "value": "c41f078b796a7ecf1869b2c573cb7299", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742465, "uuid": "57468f17-f2be-4033-8804-ccdb658bca0b", "comment": "Malware payload (Dridex)", "value": "f8d2cf25c94a56eb014e91d6c76c0c90397593dbb201cb03b5593252d8e9c14b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742465, "uuid": "43b381d3-356a-4eb7-b628-6854ab436df8", "comment": "Malware payload (Dridex)", "value": "36b597b39f67c4fe2314472cf95c97f20e04d3f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742465, "uuid": "b11cdb58-988d-4b7c-9a9c-b4c726b1cdb5", "comment": "Malware payload (Dridex)", "value": "c724384bd2af244d6d9f4cf73da7abb7df8ffc1352d19b6f8f125ae60d5c50bdb9059ab05fd9194123b9fae0d65cad76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742465, "uuid": "0d6e0dca-e395-4229-afc5-b69fe23fe96c", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742465, "uuid": "5d6e3171-e6b4-4e57-a6a2-cc1c32315295", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742465, "uuid": "a2ae6673-26d7-49b9-a5f5-f186626e52b2", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742465, "uuid": "bff392d7-7b7c-4f70-8bda-f77001dcfc22", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742465, "uuid": "e40d0b2f-8148-4412-898a-a59cf7d30f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742465, "uuid": "7d9e90e8-8ab4-4f9d-b0c7-80bb89bc0c16", "value": "c41f078b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030f9b6-bc12-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621807267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807267, "uuid": "5d14b835-6fb3-4d3a-bb0d-a778a9e2efd0", "comment": "Malware payload", "value": "b16a27832382380813a6921a3aedc8b2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807267, "uuid": "b95465e9-2403-4d6e-a139-e1a8a2f7bb7b", "comment": "Malware payload", "value": "f8da153de1d415a0abf8ddfa849f4cc01f4a4e757ba3db9c818f1acf99abbca3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807267, "uuid": "bc14082c-fb57-4066-90bf-573e41f89a20", "comment": "Malware payload", "value": "c011b06eb7cbda80b149f4dc6d1223205baf7796", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621807267, "uuid": "20c3f9a6-43b7-4b62-950b-12b9ed940051", "comment": "Malware payload", "value": "734918df9fb7ce0263e6da978b7fc03579d0b98cdd35006ef2206fe3b950f8801f60f1b868b5f32d84408b2045b4cad8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807267, "uuid": "dd9d22eb-3559-4c7a-a9d6-3121d5c5f3b9", "value": "6704B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807267, "uuid": "db91a0d9-8ca2-4b62-9d74-9a69de547fd0", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807267, "uuid": "cfc29f5e-20a4-4862-9f73-3b973ba2cb95", "value": "3072:tWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:tWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621807267, "uuid": "d352b51d-5c7f-421a-91e2-27218a6f32f3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621807267, "uuid": "1a178614-c09c-401d-ac60-c539844fa41e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621807267, "uuid": "e29274f7-e821-4fd5-b807-4daf82575357", "value": "b16a2783_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f88bd4-bc1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1621812640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812640, "uuid": "f9b26cdb-d1ac-47e5-90ad-f632ede22424", "comment": "Malware payload (AZORult)", "value": "a507a6a033778b53efdf4fab06f6fee1", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812640, "uuid": "26e62c7c-fe4c-4f99-95db-0d2afb76d36b", "comment": "Malware payload (AZORult)", "value": "f8da3ee80f71b994d8921f9d902456cbd5187e1bdcd352a81f1d76e0f50ca0b8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812640, "uuid": "7103c0fd-bd02-45dc-a245-aeff9194008b", "comment": "Malware payload (AZORult)", "value": "d66634306ef267aa1176ffb7022b933f02073287", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621812640, "uuid": "9a3a9195-b25b-4782-9e96-73c1c6fb4d29", "comment": "Malware payload (AZORult)", "value": "46d8e685b9fb9895eae9ba030e800dce399121c534a3de4cfabd5a21f0b2117d38990ec74fd5e89e2877a8cd1e679aee", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812640, "uuid": "0e2316e7-4b66-48b7-9ee2-012fca07e20c", "value": "24058D167794A121E16D4EB00E6642F4B929BD322916841FF2FD774D1F33E82D821BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812640, "uuid": "ff32131f-a843-4abf-9eb9-ab41fe177122", "value": "4dfea731e342ecfb5ceb366d5bafbbf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812640, "uuid": "ed0d1229-bae3-417b-b288-ef5d9820eb37", "value": "12288:s0sFPxWhe+xYlXz2UOFoJk3jtp8n9hnLJ7zV8n9iHE:s0GvZsFo2Ttu9hnLJ369z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621812640, "uuid": "f9e712ca-0216-4b37-a353-480dc6673160", "value": 839056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621812640, "uuid": "a7e6318c-dbee-4ae9-834c-4c7d08b006c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621812640, "uuid": "dd2dd4ba-d62e-45ab-b3b3-aa1d1de58a9e", "value": "a507a6a033778b53efdf4fab06f6fee1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d1af3-bb7b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621742509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742509, "uuid": "92b0ab13-32b5-4748-be98-fb6105547c6f", "comment": "Malware payload (Dridex)", "value": "987a5235ade9629e7ba2b0e1f38c4f98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742509, "uuid": "f9627276-48e5-41bc-b4b8-041cb42daa95", "comment": "Malware payload (Dridex)", "value": "f8fc1071ee22462f709850e375e08adf802fa7a515eb2b9e2ef370d95e05243c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742509, "uuid": "0e52633c-f6e6-4396-b954-2fbfdcd2d217", "comment": "Malware payload (Dridex)", "value": "2918680a0799217046af7cd69ad3e7db6cdbee7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621742509, "uuid": "275c8ae9-1ee7-467c-a886-8daa8326ad7c", "comment": "Malware payload (Dridex)", "value": "c05a34b2f6a84103ef1a97721d6c89f2cbf1f087bbf02cfb11065420a78e5bbddbbafcad38c4718d09cc7d95fc8e2b7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742509, "uuid": "afd8f258-370e-4503-8d7e-978eb5bdfb4f", "value": "42F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742509, "uuid": "f3b2f951-ca9e-49b7-ac94-d2effab1e9dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742509, "uuid": "23424fa5-63b8-443a-a327-f141c443dda9", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621742509, "uuid": "ba6b3f0b-efba-483c-9cd8-cfab54dab322", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621742509, "uuid": "3f51c0dc-ecbd-4342-a0a4-9a40038fd317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621742509, "uuid": "d46326f9-de3b-476c-8d9f-453669347897", "value": "987a5235_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1749cd24-bbc7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621774932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774932, "uuid": "bf437b97-bc99-4275-bd8b-ae64f4226db6", "comment": "Malware payload (Dridex)", "value": "ea91b2fac763ebd12f5f09cff29181bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774932, "uuid": "a435d9e2-066c-4ac6-9e1e-ec927e1995d3", "comment": "Malware payload (Dridex)", "value": "f903398093153161c38c49eac00b42745ad173c92a99e68f37f064aecf9d00d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774932, "uuid": "df1a09ec-2a03-4d30-8d0a-c0db76bf6ed3", "comment": "Malware payload (Dridex)", "value": "5f34b40ee6b491a2ae668d91df22f7d7df0980f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621774932, "uuid": "67262077-5771-4f18-916c-e11956b328cb", "comment": "Malware payload (Dridex)", "value": "c5f33095a571230a6bef32b3b5313c4502f386747133aa78a48107f94f87eb1a58928c69e89b6463290685f9ec36c918", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774932, "uuid": "928c165e-d531-495a-98a5-96fbe108bfed", "value": "7FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774932, "uuid": "db203c95-eb17-486a-84dc-df809131f772", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774932, "uuid": "3d6645b2-e472-49ce-920b-9e4875de360e", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621774932, "uuid": "f6658932-c38c-45ca-aecf-8ee16ae04924", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621774932, "uuid": "64618603-d6ed-48a4-a977-70664c01ce4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621774932, "uuid": "187b7f49-b684-4192-a211-3652bb22f23c", "value": "ea91b2fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feac804d-bb97-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621754705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621754705, "uuid": "61cfb3e2-dfde-4cc9-bd2f-6a5139a8c749", "comment": "Malware payload (RaccoonStealer)", "value": "ac30150a3e5afb12a5be4e656c982211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621754705, "uuid": "0844ae50-4088-45bb-ac21-8d05a730e11a", "comment": "Malware payload (RaccoonStealer)", "value": "fa9d93120859ab98f0f088f3e651360fbecb2c11d216597a5ea7da34debc020c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621754705, "uuid": "0bc87f3a-50f2-4ae2-ae96-aa33c26d03e6", "comment": "Malware payload (RaccoonStealer)", "value": "85f4b74db7099f648ed1e81f262a3aa0dd08250e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621754705, "uuid": "aad7795a-3f33-44ae-a633-f8145bd32d23", "comment": "Malware payload (RaccoonStealer)", "value": "b2ca58e7166f60f117a6fd4c6aca23e72c8cdb02bbd30907b94038774fd3b5609136e3bb95da77ed0b2be1d3d66437ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621754705, "uuid": "cec073be-2b04-4b71-aeb4-51b3a4fd711d", "value": "BDC4E131A7E1C035F4B712F449B582B8A9397EB0A77490CF52D52AEE52346E8EC70397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621754705, "uuid": "0837d364-c5e7-491c-b91d-979e2ccf4ba5", "value": "61a5414d5fb27fb23e34a369e71c6cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621754705, "uuid": "9b17617f-e377-4cbf-9c1c-9da65127c892", "value": "12288:lKkmWSetpupA6hN4zDzXCqb0+GfzIj37XspF3O6Jyr3fhC5B:nSW4OzX++WEbb6o/r5C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621754705, "uuid": "c1e7ee3c-0dd7-4eab-acef-38f9adb97aa9", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621754705, "uuid": "9563b673-c8d1-418f-9837-99d7b4ac47e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621754705, "uuid": "a7a65143-72e9-4183-a0d9-bad457497d21", "value": "AC30150A3E5AFB12A5BE4E656C982211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77bb152-bc1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621810849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810849, "uuid": "5c421e84-42b1-4009-ae8d-325652877745", "comment": "Malware payload", "value": "e8c589632dabac7c1233c8b4491626b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810849, "uuid": "0daed20b-3af9-4614-8dc0-51cb82180161", "comment": "Malware payload", "value": "faa3c017479597535677605d503e5fb363943a98afa478a69b4feef3c0520bac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810849, "uuid": "60d3718f-def4-446b-a469-5d7e518200ba", "comment": "Malware payload", "value": "f9c8fa324b06438835f92e2d7730d35ae9b36045", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621810849, "uuid": "867c5065-c0ec-4a55-9d54-2806af008899", "comment": "Malware payload", "value": "24152638f06e18f3871c06c11def94a86a2263f27179c96d23c62f44057a686ad3625231619b738d4cb04c03c2683f16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810849, "uuid": "54349b3a-1f42-49af-a560-56fa7000d72d", "value": "D4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810849, "uuid": "242e7181-f0fd-4416-877c-d9b4ee914b99", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810849, "uuid": "244f242f-28c5-463a-980a-9db1acfbd1ab", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621810849, "uuid": "3afc8fd6-0c29-484c-a07b-671d240be362", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621810849, "uuid": "edf9648f-815c-493f-94b1-22e6af29e6bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621810849, "uuid": "e8f11db0-321a-4980-8a10-07af202d03db", "value": "e8c58963_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dbb12e-bb91-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621751891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751891, "uuid": "35924c49-c16c-41a1-b80d-fe0f87f1fc23", "comment": "Malware payload (RedLineStealer)", "value": "e19f8b76b5a0c4959fcb41fe5b46ad80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751891, "uuid": "87ec79c8-2399-4992-9e05-53ec197d2dba", "comment": "Malware payload (RedLineStealer)", "value": "fb4b3f42369b356e01ff430cc836d9291693cd54f7073f4293f0277c3450b500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751891, "uuid": "7655b3a5-d4a7-4ef0-bb6b-48b34b719ddf", "comment": "Malware payload (RedLineStealer)", "value": "063ebfc56a5d210757bf44c3d09c323365769b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621751891, "uuid": "664ce319-5c5f-4528-b775-1e73e86c2191", "comment": "Malware payload (RedLineStealer)", "value": "e13df829d9da2e70fa4363e2cc8bf07a944233f42de99ff11cf2773c9953274b1230df893679715a6596e76e7c8155a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751891, "uuid": "3acf3067-9c6b-4d3a-91ee-2d3ee27d1c70", "value": "C1047BEC23C97F44CBAC463FC9D1465483B6CD6B4547E31B688473E8289FBE6720265A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751891, "uuid": "5989b5cc-7206-4fb8-a64d-fbe3354018b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751891, "uuid": "f303e19d-e3e4-4df8-957e-f3e13e354b19", "value": "3072:QwKgTlSUxJ/JdoSEj+tlrWJZjRJU2xnJfqvkFl2T:Qj+JBdoSEKbCZjRJ9fqsFl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621751891, "uuid": "fc9448f6-e173-46f8-b88c-51fc42cd0c29", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621751891, "uuid": "29b43250-261c-493d-b57b-b01e9cfd6f7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621751891, "uuid": "55404351-0a17-4e59-88f3-b5d1a8cf0f8b", "value": "e19f8b76b5a0c4959fcb41fe5b46ad80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a4aa83-bc0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621803676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803676, "uuid": "42371bce-9a23-4219-9273-b9c86a84e7a6", "comment": "Malware payload", "value": "7710113638b4d86dddeb68f082dff0e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803676, "uuid": "b7a89488-4f43-4ffd-aaaf-442f57c03827", "comment": "Malware payload", "value": "fcdaa027e40268e9609b8a88fe24712862fd786b0d395a7def984402d25a6122", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803676, "uuid": "1582d70a-da31-4b8e-aee5-339cc6e98b4e", "comment": "Malware payload", "value": "a41718435f060df0a2f74aa00dbf1a60352027ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621803676, "uuid": "32feed22-5af7-4c80-9ee5-4c9aa16c743d", "comment": "Malware payload", "value": "a87fe659b15537aa7b2f6dd63a175df96fe303d7389d139b76f5655b9233fefb1dd3df6afbb6fc211c5ca231adab1c89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803676, "uuid": "f2682280-5d78-4fa7-a2b4-221d98b5f424", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803676, "uuid": "08505efb-5306-4c30-9a3a-fa4e3fd3339e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803676, "uuid": "c2c57383-2641-4f28-86d3-4fee65086645", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621803676, "uuid": "5c626b99-40aa-4d90-97f2-e1385238802a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621803676, "uuid": "761a3e5f-3b3c-4d88-968c-ea589bdf26a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621803676, "uuid": "e50e0f70-d8ad-4d22-bdd3-d4d59fb82a56", "value": "77101136_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07aa906-bbd7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621782061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782061, "uuid": "1f899e6a-97e9-4987-a8c0-f9205b350bdf", "comment": "Malware payload (Dridex)", "value": "a355740c57b26480c80be20f25f13241", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782061, "uuid": "07e15dec-dc5b-4cd8-88bc-8cf09d129fb1", "comment": "Malware payload (Dridex)", "value": "fd23d3ef3026e44798f83a5949946e913e2a600bb51d5abf75bfb70b21a8139c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782061, "uuid": "795f0708-4689-40c7-8649-62ed08da02b9", "comment": "Malware payload (Dridex)", "value": "169fda35d7d0fc2db6f02d4eeba62f9c7bc4266f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621782061, "uuid": "4836247d-3c6d-45c0-83ef-68c6aa8ff63d", "comment": "Malware payload (Dridex)", "value": "a2e95037c98c4c18e22c04ad96ff1c501c4ecb2a968c1fb0dcb48f0a49eef3cdfe11e5352c64493f64bae00714e4bd32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782061, "uuid": "8c350ee0-8538-4aea-822d-8d2cb672dd68", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782061, "uuid": "970e031e-4509-461c-bcc3-de9ae8b5e809", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782061, "uuid": "5df0cb64-24d4-40ce-a23b-c87ef4ba4076", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621782061, "uuid": "1c0d835c-b257-46b1-b74f-2922e261ec60", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621782061, "uuid": "3ac7f3fa-f978-4fa2-a38d-9536216a55bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621782061, "uuid": "56d6765e-0f9f-4b60-97c5-1f3f704db052", "value": "a355740c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a6e8d6-bc01-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621800089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800089, "uuid": "bf1905b4-7320-42be-9535-150fc4e26822", "comment": "Malware payload", "value": "e66e3500c58598f62e70051ce5a8086b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800089, "uuid": "eca13326-897d-4ce7-9b08-9857fea97eaa", "comment": "Malware payload", "value": "fe577118538b3d3c7c3e58d058c4441573f12cee22b4b84d25b8db268ccfcad7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800089, "uuid": "e67762fd-1d25-4fed-bf05-dad2f1592869", "comment": "Malware payload", "value": "12097feb13201e222d8d37472096977409842c44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621800089, "uuid": "cdc957f0-4ec7-47e2-87ec-a7458922790b", "comment": "Malware payload", "value": "e1471e03517e5f58fb8ed408628acc5e9ec6d7dee3a014ad7ca6b4ca47fc0b105ccac6eda51fe1bd3e29fb9089575c40", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800089, "uuid": "d5501065-4673-4887-9691-528923f007f1", "value": "77F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800089, "uuid": "c1e2f287-eb7e-4cd1-8ff5-fdc170e48ff3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800089, "uuid": "f4a0ebc6-f9f8-46dc-ba19-d40ab99189c1", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621800089, "uuid": "68df1b29-0ac5-419f-b604-1cf079f7cd2d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621800089, "uuid": "2288c00a-6f17-41a3-96d3-41dfd89d519d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621800089, "uuid": "07a0057a-2ed9-42e9-b5c9-bc4868ac44c0", "value": "e66e3500_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288c2aec-bb8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621749621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749621, "uuid": "904f7886-db00-489a-9e7b-89f94e4dfbf8", "comment": "Malware payload (Dridex)", "value": "00f66df992da2df9d627a7ec804adb5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749621, "uuid": "09cf143e-cf05-4399-a020-f759fbce4120", "comment": "Malware payload (Dridex)", "value": "fea85e81702fdd100ef5588f35c5a8f8881e74898208c0cae530177f754b8973", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749621, "uuid": "5f36d493-5aad-4544-9bea-e13bf4171fd1", "comment": "Malware payload (Dridex)", "value": "11db78ebc3531f41605db8924fa8d98189e889f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621749621, "uuid": "de524231-88dc-4262-a45c-4413af7b809f", "comment": "Malware payload (Dridex)", "value": "c33cf4c79b923ad549a0b0d89431f2d63203c4b1e1e99fa53f886e800b4161629d8882f4e0efdf420bfdc1f65435ccb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749621, "uuid": "7c3deb23-e9a7-4b8c-b08c-b5392a73e5e8", "value": "33F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749621, "uuid": "53485f4e-eef1-4cf9-8589-4d053589c201", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749621, "uuid": "6de66774-94cd-414a-826e-593e21eb2a34", "value": "3072:5lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:5lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621749621, "uuid": "85b6e218-ed6d-4430-8784-4361881b6ff3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621749621, "uuid": "7fbca8d6-0cbb-460e-bbd8-2c12aa601baa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621749621, "uuid": "ad9f8add-1c20-4498-93f1-df144fd64694", "value": "00f66df9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414e897d-bbe0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621785740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785740, "uuid": "fc796cc9-6535-4967-8889-db0ebc1162cc", "comment": "Malware payload", "value": "209d60c3470720d73f51e74f7a0fdac6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785740, "uuid": "fd36696d-392c-4844-9fcc-f619ef700e1a", "comment": "Malware payload", "value": "fee2ab796339a6c3a4b5d3607dd2e23d8d42591ee0d82d602a7bf993bac85a00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785740, "uuid": "8796da2f-5d18-4c93-8f06-93eda3bfffb0", "comment": "Malware payload", "value": "48537e44a5ee88f8de7d92202571313000401b5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621785740, "uuid": "3ced9ff4-2233-4b92-8edb-9c712f31b5e8", "comment": "Malware payload", "value": "b99ac89fd2437981f51196c19ebfdff02230cb498527d6ec3a53e0190debe8ebb0eaaa47c885beabd8d69e6f1662f0ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785740, "uuid": "edfe5a33-27ed-4dc5-88a9-635adc33e176", "value": "AB05330727C83B58C5EB8912B709350F4E7BEB50BC5981D6CCE82E48B374BB46A66F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785740, "uuid": "e6fd6aff-48fe-45e2-af8c-dd11fe09757e", "value": "24576:gHpJSOMzpGIUmfgaBJbnzrgHQVAvBWLvDMIbFGw0x2:ogOMzAnmYGbnfaQVApioML0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621785740, "uuid": "deb26d22-f9f7-4e58-bfa3-eed556045013", "value": 849250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621785740, "uuid": "4636b987-838c-4bbd-8b84-e619d60cbf4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621785740, "uuid": "acae8e2d-12b4-4287-90ea-74cc25533465", "value": "209d60c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f7ea4e-bba5-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621760571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760571, "uuid": "ef5c85c9-8e5c-4041-ade3-d81f7a9eca23", "comment": "Malware payload (Dridex)", "value": "b3c28365f1af1f404c76b8aa1ba8b26a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760571, "uuid": "fdd32471-80ab-4af7-9f19-ee293d47ba60", "comment": "Malware payload (Dridex)", "value": "ff635e480b7bc64181326eb553d34cf60c82e434926dd456daef151dcfdce54a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760571, "uuid": "617aea78-6b09-41c1-8b27-de957253033f", "comment": "Malware payload (Dridex)", "value": "59bc7d823547849834494609611eeae3b39b1b38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621760571, "uuid": "46ebbb7c-88a0-4b86-8af7-d1a5a44e008d", "comment": "Malware payload (Dridex)", "value": "b8e80bbddd6d9aef117091c99d086006a2df4e6698c079e330028fc82ed0439216a49ed1b8c94c96cd99be75ac1cb090", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760571, "uuid": "9352b45a-0ca9-43fb-a902-2900424099d9", "value": "9EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760571, "uuid": "35456d29-a40d-4627-9268-b89a70baafba", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760571, "uuid": "1710400d-ac4d-421c-9af2-35db6fa6a521", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621760571, "uuid": "314702fe-b95e-4abd-b4b2-f9588a79cf50", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621760571, "uuid": "516f3c4e-02c3-40f9-ab0c-0eb053d6800a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621760571, "uuid": "56e85975-804b-47ac-ae4d-0cbc25bddff1", "value": "b3c28365_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7de79c-bbb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621767672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767672, "uuid": "1f7bf6dd-d618-4cfa-9680-369896e78c68", "comment": "Malware payload (Dridex)", "value": "19fd96a387e3837633e682faafcc581e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767672, "uuid": "aa43075c-15cc-41ec-8948-51294279707d", "comment": "Malware payload (Dridex)", "value": "ff8daa93059a5d95ca0bc76b2a900da7df657a2c3c04a405960a8a32e5f2e760", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767672, "uuid": "84b12e2c-d7a1-42f9-8d65-a35ba93237bb", "comment": "Malware payload (Dridex)", "value": "14d8e6f01e955743f7c731227d40c544bb2cede1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621767672, "uuid": "06a1ab4b-1879-4b81-9219-c41110fee433", "comment": "Malware payload (Dridex)", "value": "dbb51cad5d006bc3c5a94d89df73d099a31ca524784a57d8a543358e6a999991bcbdb43059cd1ce0373c396d8915cb27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767672, "uuid": "55bd7f72-c11d-4a94-82f3-c54a03dc9947", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767672, "uuid": "27901549-7519-487b-a0fc-64f0c701419b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767672, "uuid": "e8f69cbc-1b93-4028-8601-f3cbf174c5a3", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621767672, "uuid": "7e426b9c-6f74-48e7-aa5e-98b0307641a9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621767672, "uuid": "f073dfb2-020f-4932-b248-93e250bf834a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621767672, "uuid": "b40a5106-a4b0-4793-84ef-1804c58f1e41", "value": "19fd96a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeba737-bbf0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621792903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792903, "uuid": "ed0f5487-2ac6-4177-b147-fe0b3f6b3b43", "comment": "Malware payload", "value": "fb549418b65f78206f3df28a17605487", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792903, "uuid": "a167e961-1d3d-4f11-886a-2d9d82d68ed1", "comment": "Malware payload", "value": "ff99f840a27c2ec62e8152bd0275ad268ecabf60c2d38c12502df6a41247f55e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792903, "uuid": "a053ce27-2f44-4c98-b551-bad804eaba00", "comment": "Malware payload", "value": "983fc3ecf95125bd1eae96c42438bd36df52013f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621792903, "uuid": "9ebb4458-fb10-427e-83cd-ee133e6a97c3", "comment": "Malware payload", "value": "8aed711f6378f82da9fd72e5fc216a0ef151ae996e31a5045fa0b4ec5f5a38809d91c08b2a2b1b1003406a65549ef50b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792903, "uuid": "ece0747b-8dae-4ace-bed8-2bf0471a097d", "value": "F0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792903, "uuid": "9338e301-8d8f-46cd-a5e9-845c6f42866c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792903, "uuid": "323f175d-d064-432e-809f-d3f26ba1c014", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621792903, "uuid": "9a96d68a-7d43-4076-89a2-e75fc56bc5f0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621792903, "uuid": "58b545f4-5586-4c55-8bea-ccd1ede5cf3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621792903, "uuid": "04e7d3b8-a3b9-4f52-a9d3-0c01254d8173", "value": "fb549418_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }