{ "Event": { "published": true, "date": "2021-03-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-12", "timestamp": 1615655974, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1283a9a5-b9c1-4fc1-87a6-2898e98b7977", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0780bb4-832d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615551862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615551862, "uuid": "58cb8345-252f-4a92-97a8-6dd5e7aca8f0", "comment": "Malware payload (ZLoader)", "value": "1c6a23e3b7a6b7c070531e7c565c375d", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615551862, "uuid": "fc59a7a8-3579-4c90-b2b2-ff8e8cb7bcf7", "comment": "Malware payload (ZLoader)", "value": "bd806e43291f75946734571a96604b6cf5a8a44c", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615551862, "uuid": "56ef4c61-8da3-4e6c-8f71-f1e4c4cc4715", "comment": "Malware payload (ZLoader)", "value": "f917e0b86db55f3f81f05f7bc97ebed2e4ca7bff143c4df108c57aaf43baad3b1dfa4bb34b506b679024f56929d7bada", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615551862, "uuid": "e5cac627-ca5f-4a6e-80c4-ce2e59b40318", "value": "6BC2CF34E0616917E5ADC87F210914FBC10C91514DDEBEEA2B04CFA6324BAE6078F75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615551862, "uuid": "593731d8-6d4a-4346-9293-662b65779c85", "value": "384:lG3xyfiDVv1+6fJ0MwFgAk3GqaDq8RWXtyPKfctwBX6uUlM9zSwYICeZbP9bh:wBy6DVvByMx30W+uc+6uxDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615551862, "uuid": "d433084a-4cc6-4375-b00e-daf0c50f3342", "value": 25766, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee890b8-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565094, "uuid": "ba2ea3bd-0b4b-4514-804e-a511eb8d784a", "comment": "Malware payload", "value": "42b112347e37ce6e87fbeac6c51e5566", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565094, "uuid": "db2c8f8f-2299-48b0-8432-90bd3fe0b5c3", "comment": "Malware payload", "value": "11c7ab3288e24322ea636c1c27f9d9465a302cc0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565094, "uuid": "125af034-e937-40fb-8efd-86320c9e9307", "comment": "Malware payload", "value": "1aae106a7a96c9a0340b90b903a86dd4eff6fbedd8bbecadee6e6ca8a5b9447810c29d0ee8ca9cf3bcaf7081f09be483", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565094, "uuid": "6fabbe56-3413-4afa-9374-b7d06891175b", "value": "C5F2E1FA17FA33BDC58B189C09D420246AB61B4BA5F19BBB5B361548DB03F64B50CC4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565094, "uuid": "105b2e05-4399-4042-8de2-279fdba2ffaa", "value": "768:Mu5UmsgZ4Orp8jJQTS5/8OaWjnLvZmJ8h3tO0AvSu3Jcmf3IL1YAwk:Mu5U/giOlYJQTs/8OaQnDZmJ8bO0kBPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565094, "uuid": "5ffe8e88-a115-4bb9-9bb0-e24117e83717", "value": 34416, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc20d7f5-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615561304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561304, "uuid": "4b8aae6f-f107-493a-97f5-ffe9a138d463", "comment": "Malware payload (ZLoader)", "value": "e09992868895642c981e39c929e2e43d", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561304, "uuid": "186d69c6-417a-4ad9-b8e3-965f65395440", "comment": "Malware payload (ZLoader)", "value": "b1d206d5ad45e31f90fb1767433143d9e1fdf115", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561304, "uuid": "6bbbcc24-a9ac-4486-9d84-90e9df9af961", "comment": "Malware payload (ZLoader)", "value": "d0519a91db2ab33591602ef315c59807a88501ffb73b6e1742b9ad1ab134255800e971361ed4d942281733c569ced660", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561304, "uuid": "af59485e-8cdf-498c-a935-cd5cb2c71058", "value": "32C2D097AA22AE69C2A3093FD61500E1FA08B105734B24995804AB3F3943E631A467FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561304, "uuid": "a29ae76f-3b2e-4fe3-8aa7-107c355f0957", "value": "384:dUzGhQCuBsI8oQ3MN2Dau+p2IzkqthHJFhvLTy6VRUfUlM9zDHRjjs8PxOMw:SahQC9InIW2IzvtxfhxofxXxj9Ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561304, "uuid": "5c0e6a40-06de-4427-850c-36f85f45120a", "value": 25948, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eec4780-8344-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615561523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561523, "uuid": "556fb4c9-06a5-48e8-bf1d-97d6fd2f794b", "comment": "Malware payload (ZLoader)", "value": "b337c349b27bf4f1c13312c97ee9a516", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561523, "uuid": "bdec1236-845a-492d-9750-fd4809250cdd", "comment": "Malware payload (ZLoader)", "value": "989b07482c375a234a2df6cbfcd5a2baef408931", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561523, "uuid": "edede773-4e08-483e-9672-486bbc92b469", "comment": "Malware payload (ZLoader)", "value": "58608ebca100ce9ddad105d9f0b36b7dbc6a8206e8d96f5337d5d1046185602f41e3513c04fd5b5f2a3b9616fa6ad49d", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561523, "uuid": "114f0621-c2cf-4923-b68b-ce73c9971f80", "value": "A0B2D01FE0522972D6FADE7EE76D0461F25020366A5AB7243588D6E70A831F703CB74E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561523, "uuid": "f588bf48-2968-40dd-9be8-1a5c93f18c1f", "value": "384:ralJtG/CSEfR9VfgPLbjqpzDXV6ikZx1Qx3Y51/xmUlM9zSdKdpzuWHh:rGJo/CSEfXVW/jq9V6CxKBxmxPdpaWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561523, "uuid": "d78980cf-6fc6-48c0-8b52-d8abe7e2506c", "value": 25551, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed464401-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560903, "uuid": "2a73c0f6-00ff-40c6-80e8-65304ca210b4", "comment": "Malware payload", "value": "185e709ee33e3dbd5b2e3d49958636ee", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560903, "uuid": "f9884b99-200c-44e7-a1c8-6e6c0340cd34", "comment": "Malware payload", "value": "b1ecd3226b07ad3ce68f52ebd3b25be512d04c8b", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560903, "uuid": "1c52e382-e15f-4662-a9ae-43dcb1d6977a", "comment": "Malware payload", "value": "8a9c9ed0c5a0cb275383550566609d4f4bf5ce436f1bbfac6583bf7065af3d3f346a3c5a628b43e7cdf364097e1aa95a", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560903, "uuid": "083ca1b5-94e0-4343-ab40-02f785dcf918", "value": "88338A8CB385D46F4753EAB3EB51D4D0F713F00AF6C610C6AE813598CE6D512E299AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560903, "uuid": "466f8cc7-efb3-49fa-959a-4813f9c880c5", "value": "768:+T85l7f8POTeLfgiW07D0SDZLNYZ+pWtJAVRM4YxUtZYISn33IzC:x5iOgoSQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560903, "uuid": "47804ad2-cdb0-4566-bc17-53a661c35898", "value": 52181, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9dccef-8326-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615548822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548822, "uuid": "f260f2e6-5d5e-414b-817b-4f67bb21904f", "comment": "Malware payload (Dridex)", "value": "5863f7e290de755f5991639875aa4dbd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548822, "uuid": "2da437c0-6d98-464e-bff0-f8849310a657", "comment": "Malware payload (Dridex)", "value": "76d8cb0f23928716b96af29e4e488825e20e2787", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548822, "uuid": "bf989374-2e29-43b1-b909-8eb45fe3f812", "comment": "Malware payload (Dridex)", "value": "64bd09b367547b9dbcb2dd5bfd442116acf44851a23cfb6584ba1271e1c5da6d8ba24460680064b0c772e9a0dcdde71b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548822, "uuid": "47116be7-0799-4ccb-b957-5029c8392f98", "value": "F614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548822, "uuid": "5b49b1b1-97f7-4b7f-a40f-aff329c2d5bc", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548822, "uuid": "ce3ef25f-73b1-44bd-a109-cbbf464b390a", "value": "3072:Z1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:7i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615548822, "uuid": "533eb4f5-b4f9-4868-8980-44ea1aa2e257", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a30130-830f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615538855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615538855, "uuid": "1c1e1b74-cb27-4e09-a08a-512d8eb6091a", "comment": "Malware payload", "value": "6d7872bc672af98866a2a25384614d31", "object_relation": "md5", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "ole", "colour": "#C13DFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615538855, "uuid": "65c45dd6-74ad-4592-845d-592b4af2e76a", "comment": "Malware payload", "value": "2bdc996adf676aee54fae9f27c699ff07748f094", "object_relation": "sha1", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "ole", "colour": "#C13DFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615538855, "uuid": "7b4c1a4b-dcfc-4d2c-9616-7c1241019b79", "comment": "Malware payload", "value": "f636bf24fbd7dcc17750176c99686e726ad177c8d72b2060ceb0527d17a4d02b08a46b6df5877157db44a8e964fc6d65", "object_relation": "sha3-384", "Tag": [ { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "ole", "colour": "#C13DFE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "word", "colour": "#FCE996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615538855, "uuid": "67e9de5f-6bd3-43b0-938c-cb1c495bc8b6", "value": "D634236A8A538EA6DFE7847002942ED0AD9707807DD73B31AD07431FCB9A4D9835FA25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615538855, "uuid": "7514025a-9021-49a9-8c70-e4d83fb95678", "value": "6144:KRf4v7nzrBI17dTkA4q/qd7irBg7XP86gi:KxQzzrCdp6CeiAfei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615538855, "uuid": "b8571333-1b30-4e13-a15d-64a9079edb93", "value": 247816, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff01e9c-82cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (HawkEye)", "timestamp": 1615511408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511408, "uuid": "c20a2d20-56a3-4e39-adc4-a1cda0cb803b", "comment": "Malware payload (HawkEye)", "value": "4f0fdcac715b3d952ffab9e7d3ee86ac", "object_relation": "md5", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511408, "uuid": "82147b46-0dcd-422f-80bd-952e0031c00b", "comment": "Malware payload (HawkEye)", "value": "1079108984d0587302e2576c6e72c18a1021154b", "object_relation": "sha1", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511408, "uuid": "98388f13-4788-4c7a-87d1-ef4049c42bbc", "comment": "Malware payload (HawkEye)", "value": "62f030e3592564421d91750013bfa14638855b3cebed1a5691b29e469795b3523d133f6e40004e922d6adbc9bc446208", "object_relation": "sha3-384", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511408, "uuid": "eb72b954-939d-470b-b8a6-74b514f7c2b5", "value": "7C8512BC7614B6DECC2B893AC9A41C24EAB070A74707D74B90575AECCD0D99BCF250E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511408, "uuid": "715e3621-427b-43ff-a3b6-0c22d18dbd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511408, "uuid": "26b2103e-ae2d-4003-8d05-e2d3ae6c819b", "value": "49152:0cyb8nxp8HA+bY+hHUsP3DOl7ZUzsajRaWOegWb:BLxp8HrDHUsPJznjDOegW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615511408, "uuid": "315203bd-68f6-4211-9ce9-63864779c45f", "value": 1821696, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b365f1-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564543, "uuid": "ddd685cd-9426-4f58-af40-67384399c3e4", "comment": "Malware payload", "value": "23405a259182245b0287912d51eec614", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564543, "uuid": "0084ea98-30a0-49b8-bee3-af474f7d5f95", "comment": "Malware payload", "value": "7c5b4ccd8e05deb46ce31108747a4284c00dfe55", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564543, "uuid": "edeaaf39-39bd-4ce5-84ad-60cf9f918036", "comment": "Malware payload", "value": "cb2349e85a352a07e885040731a851ad2d7a9825c15ebc29b84298b1781b2d82a7803e64c7715cddbd13401386439637", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564543, "uuid": "12d2fd80-fe6c-4482-afba-b57c57d16508", "value": "81A4AEB8B6047DE63A6F576BDA96ACDD03B626239ACB94CD406477C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564543, "uuid": "65bd787f-afd6-4000-8cee-820bfae9942e", "value": "12288:V55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2eh1:lAIC9FkMRaN0cQ3S8wzHDFHz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564543, "uuid": "46051099-da59-4aa5-a465-2d6ea1924498", "value": 468774, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eae630-831d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615544669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544669, "uuid": "6dabdebe-f4c8-4aff-b3f4-1c6a00c9e2a3", "comment": "Malware payload (Gozi)", "value": "477145fc6dad603f4e3b2218c619b529", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544669, "uuid": "9e4084f0-e209-41b5-8e31-c2e2e0932ebe", "comment": "Malware payload (Gozi)", "value": "4ee92a74b0aecfbaa9befa1ace01472c8afdeef3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544669, "uuid": "0c84ce63-2bf2-4829-904b-7a10ea71890a", "comment": "Malware payload (Gozi)", "value": "f45c1f76127c19de0283b359889c9f55b025986fdf29cac4c613f048b10524a3b6f4603f6442811bbbea1199dc4d94c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544669, "uuid": "767b2b26-37cb-41f4-a206-18fbf0ff3729", "value": "B8C44A3176F1E136C021D034CC01E3DA6B939E2E0D3B29DB66F83A6F8AF41A4D99D556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544669, "uuid": "859c3c34-483b-4e62-9782-2ac0f4a47e46", "value": "2fd93fd87804550494e4c78628a6332d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544669, "uuid": "53e7122f-b28a-4f94-8fe7-d00af3a1cbda", "value": "12288:qk4mO6uu/lzsGqjV6L3hKkXHqb2NqFi3/BkldTdlX8A1:qk4Z6uutAGMVQRLX62wiJkldTP8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544669, "uuid": "5959d2df-36ca-45cb-b22e-979b03da18ed", "value": 577024, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1034fe1-831d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615544911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544911, "uuid": "36e0f73d-0293-4eb5-94b1-123a71dbd3c3", "comment": "Malware payload (Quakbot)", "value": "31a9651f386ed20b3dd3bda2d6177cca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544911, "uuid": "abbd6a4d-11ee-4886-bd83-10fff00d0d1e", "comment": "Malware payload (Quakbot)", "value": "92fb6d44f25339ae1f12c0a57071685b37d2f823", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544911, "uuid": "5bef8f9e-5660-466d-aee7-935131172286", "comment": "Malware payload (Quakbot)", "value": "62bc49332ee1091e36add1662ef29c41c74d3331ddf41ae388c933709923b3e1b7ee80290b6b4c11f82d94c163ff6abc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544911, "uuid": "ca6762a3-8b33-47db-9b99-a8bdde413f61", "value": "61C44A3176F1E136C021D034CC01E3DA6B939E2E0D3B29DB66F83A6F8AF41A4D99D556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544911, "uuid": "20572c2b-01fd-42ad-8667-6788dd136a08", "value": "2fd93fd87804550494e4c78628a6332d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544911, "uuid": "66ade3f1-6371-4b9e-8fed-93509b3ae861", "value": "12288:qk4mO6uu/lzsGqjV6L3hKkXHqb2Nqzi3/BkldTdlX8A1:qk4Z6uutAGMVQRLX626iJkldTP8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544911, "uuid": "99b09550-7c6e-41eb-88e4-0756dc68fa73", "value": 577024, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d0e60e-831a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615543417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543417, "uuid": "c882410b-2778-4a88-8636-ba0bbd48cc8f", "comment": "Malware payload (SilentBuilder)", "value": "1aa8b3abd339038569d7df4fd8e6dc99", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543417, "uuid": "feb2d311-8ee8-47da-8c91-571ab0aacf87", "comment": "Malware payload (SilentBuilder)", "value": "7bed8cddc2d7a354618bd4839fec50047a84c9b1", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543417, "uuid": "af06fe13-2ca9-43c5-be91-3ae4b9ad279c", "comment": "Malware payload (SilentBuilder)", "value": "45d48f4e256bd98ee1c6ba7d3ac7cbcb712f7f5a9ff08d1359003a8f98e6b4a05df4f2570cb67f9935ed51671c0a0934", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543417, "uuid": "1121b16c-b772-4f19-b8d4-7d33305f2d97", "value": "1DD39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543417, "uuid": "f431cbae-bdf0-4aaf-9fcf-55fa6691b7cf", "value": "768:sKdUd4TaBosDwW+u7p1CPVCmgUrNaQTZipEmhPYbWKYvdJkyyLefR2bMym1qIZiB:skUd4TaBoCf72ha3CbWzagJy4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543417, "uuid": "1b6a3335-1006-4ba1-a174-92aeb9a9b4e9", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a9241c-837d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615586174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615586174, "uuid": "05a42678-fd4f-4470-a094-9b14134642fd", "comment": "Malware payload (Dridex)", "value": "3b792fcb3be230d99f0b7544f85f37d6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615586174, "uuid": "25816a3c-2cf6-4513-9d05-82aac85389ab", "comment": "Malware payload (Dridex)", "value": "3e958fd3cc8737450541143ad3190caf2a0f50a8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615586174, "uuid": "cd3200e8-0f31-456d-9210-5242773cb2b4", "comment": "Malware payload (Dridex)", "value": "e744eec4d4b228a2e5604a596f255ef3fb0bf6dec34265a710b6f39f59fb78326fc35f663117c38f6c69d7b01f3a2cc3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615586174, "uuid": "4f5e9c54-b96b-44fe-a42a-ed41957a7f64", "value": "4C14BEDCD376F186FFD3CEF09519935656232D42861FE0A9A9C6A83F82BF90C045618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615586174, "uuid": "f4aea966-d486-4fc9-93dc-8b1962c0474d", "value": "554e238e1840919675ea2a74968f15ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615586174, "uuid": "28a71aca-1c3a-4776-a98b-54185fc7e290", "value": "3072:sTcr3VWYFcXTNZEjmL18zM7cXzAMsT7bXsObx7UpYN4IO6KMZJpSx:sTMFWYYTNKjmLyg7ozALzXsONUhIl/Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615586174, "uuid": "8468b31f-83d2-4ba2-b710-62b9b27f14ff", "value": 196608, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eae28c3-8354-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615568368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568368, "uuid": "4b62263c-cd06-44f7-b5ba-f0b364a9f085", "comment": "Malware payload", "value": "2a187edb88e21ce67a46a1a6a712c2c2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568368, "uuid": "ad4dcc9e-ae3d-41cf-beb9-c4d0178a1f80", "comment": "Malware payload", "value": "27985891318c1cc64761e86c4cbe68abcbee2210", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568368, "uuid": "45a50210-2e0e-4219-a0d7-80448949c70f", "comment": "Malware payload", "value": "814aecb4adbe1a81f762c8c6d98461b3af62af3a214fc393c49dbee2b3f5c213ac5abd85b780a5a38c123e5c4b785e2e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568368, "uuid": "66b3a5a6-b4d6-4a71-9894-298665b7ca67", "value": "6CA3E09B7A34E1C4F9CB503C52648BCE8CE2FF2159B358C660A9333927F6D799848257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568368, "uuid": "0bec4999-2f50-47cc-bd8c-e05e7298788a", "value": "3072:n//QQTNxFAQb13Eck4IoVqyzj3wUEsT0://PTNxFAkVNzj3x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568368, "uuid": "42d0ab9d-603a-4f6a-acd0-298448c34d5b", "value": 102912, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540c28df-8374-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615582121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582121, "uuid": "65c49af6-3bdc-4fc4-886d-18b20ea4db1a", "comment": "Malware payload (Dridex)", "value": "dd9d4a68b21faa67232c0fc47ad94ac0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582121, "uuid": "fec89251-46db-4305-a0d8-a67b4311fcef", "comment": "Malware payload (Dridex)", "value": "2ac2a1ac773af9bab97fc3e179693c3e2832b756", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582121, "uuid": "565b76d1-26a5-4367-a733-3c03d5995f0b", "comment": "Malware payload (Dridex)", "value": "164176481c113e0ece6e2035436bce6dc6882a9bd5b50dc0c103639d99520eeb2d8a07121d2c743e7bf21e4e76ce1127", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582121, "uuid": "ef099653-f167-4c42-a4a1-a318da871c4e", "value": "5D14AE9DD729E464FAF3D9F104359A1210BB6C48492F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582121, "uuid": "72518c61-f763-4548-8e94-78a23f5e7e68", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582121, "uuid": "cbebe7fd-d5e7-4a37-a9dc-ec2041929921", "value": "3072:s1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582121, "uuid": "3e31354c-46d9-4e4b-8c8e-f4acba842a64", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ede412-8338-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615556463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556463, "uuid": "f760ab1d-e2b8-418c-9c9c-cc1be7fe5835", "comment": "Malware payload (RaccoonStealer)", "value": "8f7eec9157231913c806559df872b753", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556463, "uuid": "ec415592-5626-4041-88ba-b28b75508170", "comment": "Malware payload (RaccoonStealer)", "value": "ebbe9faed343dbb2a176dad28c7ece90ff04e07a", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556463, "uuid": "a5e65cc6-2c33-4098-9ea6-ca08b539789a", "comment": "Malware payload (RaccoonStealer)", "value": "d08728fd9c8e49422f65a85e741a8be512f0d7ee9120b2bfe3a9472f9387c9529ea4f84d5ef1b8a52a28804f129c384d", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556463, "uuid": "c422ac2f-3e74-4221-86c7-836bc310197c", "value": "FB461132213CD70BC5E1853D8626ADF47DFA9D2EC9C19CB9E5DBF5C2252DAA09112F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556463, "uuid": "7c83855f-be90-4a39-be72-425215737358", "value": "8c972504d70884fca86dde20a90fe5f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556463, "uuid": "da0cb631-cc75-4f92-ba3d-4bb0259df3f9", "value": "98304:DTrrzhIZrmgd5T7cSkCyEF6MzchzvPgfAMgSwEmWvzQkT/PjMg:HrrqZqc5T7fTYNTgfZwEmEt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615556463, "uuid": "831c09a4-3a19-4d41-bbc4-7751f1e26f43", "value": 5420544, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878b70ff-833f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615559444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559444, "uuid": "3e45df7e-9c6f-4c50-bbaf-813f37230db7", "comment": "Malware payload (GuLoader)", "value": "6671acae6aa07632e9afa0fe46f7dd2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559444, "uuid": "2213fbcb-37a4-42a4-a99e-fcfbc82cd46b", "comment": "Malware payload (GuLoader)", "value": "a52360f1784256b6c283afe454ff118dcbd6ad50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559444, "uuid": "cd3ff62b-620f-4ee0-8063-262ee8d5a7d8", "comment": "Malware payload (GuLoader)", "value": "bcfa801ffa914bcebe3e86100620194c3b37b6d6b7d6dd304d1ec57ff82eeab2437ba19c2c6d6ff811920bb78823d503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559444, "uuid": "d9e21f3e-3a24-4889-bb67-a1d5dd7e66d8", "value": "DEB4BEB0319B0B00EAD1ADBCDB50D0DC0BD1BD67142E9BB7F4E9ADD3AB2D409915AD21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559444, "uuid": "13d7eb83-a826-4bb5-ae9c-d76d31ab75a1", "value": "b4c7cb5077bfbbf4ce55907dcd0ddc65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559444, "uuid": "342374c9-9e5f-446d-abd2-a7dcf0ab9cdf", "value": "1536:PrI0CEatfrRH8sN27Ged6J1bWpNkf5ikUs/0ugbFa5JqGedcRH8sN2BfEajC1u:h1ItcsN7FQuMkjtpcsNWMq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615559444, "uuid": "b30c89ea-4137-48a0-ad13-9b0f56160280", "value": 529520, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7e71bd-8329-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615550057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615550057, "uuid": "517283ad-6db8-4df1-b055-ae5e20e48880", "comment": "Malware payload (GuLoader)", "value": "55f9f745682ed08027e2dae87ab6ec6e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615550057, "uuid": "9e150132-0f45-4290-accd-b7fc166c0449", "comment": "Malware payload (GuLoader)", "value": "9a90a17738831d31c32b843223cba41a258976b7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615550057, "uuid": "7d80ec1a-0d21-4ba1-bdd0-9058b76b75cf", "comment": "Malware payload (GuLoader)", "value": "c3cc3a2ce8959eade297b211647dca78437a042777994ad2ce145b9eb276bf81ac734722feff13f6c8c2593c4276c03d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615550057, "uuid": "48fb609d-1d54-4bff-bbee-0d1eed02bfb5", "value": "D7932873BB98FA57E769D671CA3C22AC84A83C346700957733AABDDF4D78A844111387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615550057, "uuid": "fc11fec3-8173-4a38-9760-c49a1f65584b", "value": "93fc4349f7462612753fd69caecb7251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615550057, "uuid": "689ee94e-9b00-4fa8-bc7f-e32d28000c2d", "value": "768:PWOTjNbjXYatzv81GLobUJfqjWmFx2rLLggoK3HlA9ABSkYnHumLhBmBo:Pt3NIWg1NbUJfgW1v0goKN9m9BWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615550057, "uuid": "7733d703-5a93-4fb2-9109-32667f396191", "value": 94208, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3a544c-835f-11eb-abe1-42010a9c0039", "comment": "Malware payload (DoejoCrypt)", "timestamp": 1615573327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573327, "uuid": "52fc4edd-a36a-4590-8e77-0fd895ade060", "comment": "Malware payload (DoejoCrypt)", "value": "9f05994819a3d8c1a3769352c7c39d1d", "object_relation": "md5", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573327, "uuid": "5b47e265-0b34-4385-bd87-f47829c9f946", "comment": "Malware payload (DoejoCrypt)", "value": "eb2457196e04dfdd54f70bd32ed02ae854d45bc0", "object_relation": "sha1", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573327, "uuid": "f09a5cf7-17f7-46dd-900b-97aebd7d9cc6", "comment": "Malware payload (DoejoCrypt)", "value": "8e2700a40a5acbbb1aec5d2e1711b4414fe7190c32aa9e11728d0d7df7f82fc66815bba3e797dc9b4a9d5a9e94a41a4f", "object_relation": "sha3-384", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573327, "uuid": "34d41502-2458-4e96-9935-9e36aef2b77b", "value": "7955CFC3FAC248F2D846097951B3973B5F3ADA10832AC5C3DFA159A59C21AD1673E3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573327, "uuid": "22498717-a096-463d-a99d-7c29f4966726", "value": "f8b8e20e844ccd50a8eb73c2fca3626d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573327, "uuid": "ff18637f-042b-4f05-a2d7-fc67d39735f8", "value": "24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkzVZgMCST:L7XP7P9o5QzUtl1fpxkzVZgMCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615573327, "uuid": "c2f57fbf-cad0-4c51-b98f-25b5856b95b1", "value": 1322521, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1064946-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565070, "uuid": "1d8bfefa-527e-4d23-b1bf-0fa180c0e03d", "comment": "Malware payload", "value": "27ed5f508bcce6d565bfb4400b16c7bd", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565070, "uuid": "5d1cc2de-cc0b-4c7f-8690-8f9f7b9ede11", "comment": "Malware payload", "value": "4e238b3a4dcee27a5df5b8d7e31213435594e38e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565070, "uuid": "40b82870-29b2-4364-bada-10ceb8c4c155", "comment": "Malware payload", "value": "ecd4240cae3dca9f8268cb8605a6c664f7454315a3f9fbf3ce60434a07a7cdcbf93710fdd9e57b6df3fd52e01b4d6d44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565070, "uuid": "6b0a18b9-6930-4f87-880d-7d44e70bc883", "value": "53F2F1F1843E9270E1692CCAF8064C1883716C6FD730A855EB6A22BE7771D59B5CCC5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565070, "uuid": "0c37820b-c57b-402e-b4f7-5ac108397f36", "value": "768:Du5U5cWsWNeASqKisZrcvXEgrlEch2rpM7M0TvLeL9cxKQWd:Du5U59sWNeAnKiQwsgrdX71vLgcAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565070, "uuid": "02ecda1a-6a68-4251-9e91-e7f6799b4c02", "value": 34430, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d54184e-8353-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1615568017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568017, "uuid": "14df496e-d71e-425e-96e6-1070fa6a7c1e", "comment": "Malware payload (CobaltStrike)", "value": "71032e98341065c93f38a226de74d7a0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568017, "uuid": "a1daf9ec-c1d2-42c1-9783-de7ebf20b819", "comment": "Malware payload (CobaltStrike)", "value": "0d14adb6758998182b644e9f93e04117ba7457ee", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568017, "uuid": "8394f15a-3481-4388-a0e5-a5f6a2659341", "comment": "Malware payload (CobaltStrike)", "value": "0a788abf3661505c30574b11e57cf138c1a7ae96b6c20c52767835934b6ee35b63b747d160a833d7358dadde15e29176", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568017, "uuid": "8af71c92-3b85-4d79-8d3f-59ac0a9a4ace", "value": "4FC44A46F7F883B6D056D13AC5238F4AE7B1BC454A30938F42A1B76E5F33791582A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568017, "uuid": "9f2c8a8b-93d0-448a-b0d4-2505b614dd83", "value": "411ffb52ed1a3976bd3ea3da17263819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568017, "uuid": "db973bba-87f8-4ccd-b973-9f30ebee3464", "value": "6144:CWVo7375acQA6FmIiMNvCejvFQTZAnO5CrK4ZcPfCTo/tXq0T7+VO8Azg8Ug7mSD:CWVQ37UcQfcuCejviTA2SWkoMXVsvPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568017, "uuid": "bba520b8-d40d-4239-bbef-0e3f4050308d", "value": 584704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2170f8-8344-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615561544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561544, "uuid": "bc2b5408-69c7-4c8f-a99c-d1fcabb04c91", "comment": "Malware payload", "value": "58f3d7cec757e811a4b58ff204834109", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561544, "uuid": "88455bb2-6f50-47fa-87ed-768f094d3fe2", "comment": "Malware payload", "value": "4ef2aea90c222ae658566e77c9e5d9e5b3a1a017", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561544, "uuid": "aac45d6a-d546-4646-a8d2-6b082020774f", "comment": "Malware payload", "value": "bcff5c170d21f224e932a0a6481d141f3b10f48bad636a4a7ccb7b7d9a4e5082b2f27738af0780c4675fed730b7d0fb5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561544, "uuid": "ed7e503b-fe3d-4c63-b5dc-b4a71d1dda53", "value": "079423483DA5A171F87DB11F13622743F9010913B8F99A8EA8375AABC551AFBC237835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561544, "uuid": "a2c5e3a4-abb3-41de-8b79-5d63e00afce6", "value": "6144:5J2Yg6tPJpgRWfHuJUvCOejaC8nml5FB7UYH2N+FgUJipi4qrpqyYQ633:5Yj6tRpqwHuJwCOrC3FE+FgUJipi9KFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561544, "uuid": "9559b57f-a59f-4b70-9046-5aee4790585b", "value": 410896, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd21dfb-834e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615565843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565843, "uuid": "92289e10-ba6a-4fb5-a335-1f593b73e041", "comment": "Malware payload (Formbook)", "value": "0ff027abb20ceb734dabbbcb12fb1eb9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565843, "uuid": "6a8e4ba4-1082-4429-88ec-2e388ce2d678", "comment": "Malware payload (Formbook)", "value": "94faf66bbbecf7d6f452d2ead22204a5b7a37ed2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565843, "uuid": "93a2f238-a5d1-4e29-9a6a-54efb1905fac", "comment": "Malware payload (Formbook)", "value": "483a3da0903908ead5eb860c045489c5c4e6834a8747d8fb47e18e28c0d8563479a83ad75a79d9e1509ddaa5d1c3a025", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565843, "uuid": "dca0fa93-7c9f-4ab2-b92a-989aa423c9dc", "value": "0EC423DB1F9F588CC04E2BC49A89BC17DDBF64245ADE3101F7A81908463D79AAE8D347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565843, "uuid": "6b00a0f4-7530-47f9-933a-c00d35df663b", "value": "12288:gsur7LQrmZsqf/jLqtOJjpAsV+ZDR/5q4I+mHQVRJq8Sijy6:m/LQqVfHpAsVY9/5q4I+/RnSO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565843, "uuid": "c2bb6694-d7a1-440f-b7dc-00d0fcb0bd87", "value": 578155, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9528b468-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565050, "uuid": "52520095-ca4e-45dc-977b-285dbbc47a27", "comment": "Malware payload", "value": "4bbe527acb680a55d9641d9981713eff", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565050, "uuid": "02eaf8ce-cd9f-4d3f-bcad-a0667c14e405", "comment": "Malware payload", "value": "2d6d3127e79fb4b2efbe0c60cd449066b0c73eb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565050, "uuid": "b3b9d854-c975-4b19-a7b5-868ee6840f1a", "comment": "Malware payload", "value": "4c0416fca3024835d6485e299ab20236c13c812e65af9db03c28b132c42aa064e3dbe0d8496a0f42fa099f2a2db830df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565050, "uuid": "cbc7a4f9-b602-4b36-a8c8-a70c610bb69b", "value": "BBF2E1FB27FB23ECC5AF245C59D4202525752B4AD8F297B76B361288AB02F14E11CC4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565050, "uuid": "b86a76be-ff2d-4aba-af58-5d97f38b1bad", "value": "768:Lu5UmsgZ4Orp8jJQTS5/8OaWjnLvZmJ8h3tO0AvSu3Jcmf3ILPI42:Lu5U/giOlYJQTs/8OaQnDZmJ8bO0kBPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565050, "uuid": "c044cb7c-0c90-4b84-bc61-9dc5b893fb8a", "value": 34421, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ac21e-831a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615543376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543376, "uuid": "b1179c54-d135-4015-a0ad-e6d623e7f16d", "comment": "Malware payload", "value": "32af4934b0fe7f9dba7e84668685677e", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543376, "uuid": "7943d894-0000-4815-80b3-01e5d5e424c2", "comment": "Malware payload", "value": "53977c5441396089321ba656b6d5fdf2f64ecf54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543376, "uuid": "30287685-9e75-40b9-9e27-6e72da13aa78", "comment": "Malware payload", "value": "92a424d4f369e4463bb9c1590f2e5fe3e5cb5d330c0d6d39777578710000d8484791fc9088cb172f12de3a9d0aadcfdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543376, "uuid": "fa3a30f4-589b-4a99-b30b-1e8034cec736", "value": "16F2E0A0216D934DF3324406FD06886E145882EEE673A9D6EF8435AD9F0AC86E01CDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543376, "uuid": "0413b8a2-ed32-44b6-a2d2-dc690e5090ac", "value": "768:Ku5UrBcWsWNeASqKisYB6uDAgAihbXne3k+h6DmL:Ku5UrB9sWNeAnKi7cCN+hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543376, "uuid": "e93597c5-4dd6-47ed-9105-42d50f96a8fa", "value": 34421, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34d2963-835d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615572375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572375, "uuid": "2c09acbc-0775-4c3c-9f0c-32e8bfede871", "comment": "Malware payload (Quakbot)", "value": "00b3e93aa50b54e4370685eac11359e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572375, "uuid": "e9608474-bd1b-452c-942a-69439c8776e2", "comment": "Malware payload (Quakbot)", "value": "979caebf13a6a7bb3ce36ca4d63596bf98fe75d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572375, "uuid": "ddd4d233-d86c-4154-92e4-10126e9c904f", "comment": "Malware payload (Quakbot)", "value": "66be7f0098f7334bcf6201da09192d1e7411b8ba4106d0a4ca5e5e80bc7c090cc6f634145e09893c3032658b3f5b98e9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615572375, "uuid": "c447320a-b062-4ddb-afaf-863fd6393713", "value": "4054D582B112B125E1543F36E83E457C42E6EEAA7F68F18B2C0473B77B7A1D13E5051A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615572375, "uuid": "27afe4a8-722d-4860-82a8-86d87a1ade17", "value": "6144:oFyUkR0wjvF8W3I7qDGvJZqrlh8zOMqxK+XeN7:Qx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615572375, "uuid": "86109136-6f6a-4117-bec1-34fb6bd91bb4", "value": 287232, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a94dd6-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564976, "uuid": "31bcd2df-1d5e-43cf-9933-3d4e96ebdaa0", "comment": "Malware payload", "value": "2778b0a75a8b79777152d66052cf041d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564976, "uuid": "70db3739-df8d-4539-b1cd-4642c3f0fc34", "comment": "Malware payload", "value": "0ede784720ee3bea45ca96f6d7a6b4c42e3b2cd7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564976, "uuid": "0548b08e-3897-4f9c-b5a5-b25a7d4a60e1", "comment": "Malware payload", "value": "482c38ea08eacc597b87f89cb979339133fd6008f1d52a227c436480de79523a911b083be61a43b7faba4647f16e891f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564976, "uuid": "479be94a-6478-454b-9989-a7ed7a9a3406", "value": "9FE4AEE82E2522C4D7A702D85F0AF780B927F61962E0409C71DFE7BD27BE9D4E724458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564976, "uuid": "f1b5d8f6-702d-4d77-992a-0c8ca9a474e0", "value": "12288:J4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4//fIudz2:J4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4Y4YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564976, "uuid": "dfc1dffe-a5ab-46cb-a70c-e3fc4b2e65e2", "value": 704926, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50010e38-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615564934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564934, "uuid": "2111b473-37cc-4174-b8fe-11f7191ec0f3", "comment": "Malware payload (SnakeKeylogger)", "value": "f509ad3f4398f4e0cf0a2dad0c2b78c7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564934, "uuid": "13a02056-353a-4910-a6d7-69578fdf8835", "comment": "Malware payload (SnakeKeylogger)", "value": "247183e5cf1c7af5d7b6b166d99c7276ad284004", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564934, "uuid": "ddedb24f-070c-4076-b5a7-98cea39afa22", "comment": "Malware payload (SnakeKeylogger)", "value": "b2f93adca55b2eda49e1fc031410af28562e95b0122427a9b8fff0899712b75bec555ea37d649a1d5ea7f08903995523", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564934, "uuid": "508fa633-72b6-475e-be2b-7bdba0d1766b", "value": "F685E0E81D2818C6C2A037465F18BF066D0BF5917BE508AD356EEBF277BD0D0F66A118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564934, "uuid": "e9b3ca7d-552f-40f6-9d20-bd8b612c92da", "value": "12288:8/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/14/1M:MOOOOOOOOOOOOOOOOOOOOOOOOtsVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564934, "uuid": "7004f7ba-ae94-40cc-bc8d-138a01156da8", "value": 1732607, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca393ce-830d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615537817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615537817, "uuid": "94480a1e-3b4e-42b6-8e93-18c6a9a78665", "comment": "Malware payload (Dridex)", "value": "a45ed443810ecd14929a9d5e26a41bde", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615537817, "uuid": "33461580-1dcc-4699-8c75-3cf895642523", "comment": "Malware payload (Dridex)", "value": "36bb120ab71725fe7c09e35ab46d8c9101c96355", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615537817, "uuid": "b1bf4125-fb91-479d-9490-c90b5bc75d8f", "comment": "Malware payload (Dridex)", "value": "bf78f5053be27a6a4eb7845249c22dd58709a83f1f375b5823f54197415c7349de8b5d26d69661effd7298ca770fdd6f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615537817, "uuid": "2c005eae-232e-47a2-8067-465c21a6f2ad", "value": "E314AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615537817, "uuid": "4f89d5a9-f35b-4cf2-aa7d-acb86d2ca828", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615537817, "uuid": "0d8bc962-fb36-420e-ad31-ded200f86f6d", "value": "3072:c1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Yi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615537817, "uuid": "4d9ef898-084b-4bec-b350-7e17744e4cfb", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ce9bb8-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560909, "uuid": "57909e7b-541c-4b9f-b73f-99f5c26b3484", "comment": "Malware payload", "value": "bf55f87bd338d849a6485322eaebbc8a", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560909, "uuid": "fcfe3534-052b-49ff-9d8a-4c32d100ace8", "comment": "Malware payload", "value": "c2426bbc19d91d78491086baa62cb6c0b6ffc2ed", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560909, "uuid": "c26cd8e3-96b6-4343-a48c-fa2528b497fa", "comment": "Malware payload", "value": "dccb10fe5f04ff02c515ddacc95bc4426073df0b869f17e137e95d400f973bfa850839ffdb12055b0e94849bb5b07c1f", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560909, "uuid": "7429786e-c11d-43c1-846e-1d827cc41c6e", "value": "C123ED1DB184587FE716FE7BD735E4D5E991F01BFAC206C56E0873188E9C422C2EA6A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560909, "uuid": "03eb580e-d602-44c9-9ce3-f656fb6cc148", "value": "1536:63lJCFtiaBMJgK3j9LADVbDsiMds5Bpiz4xA3GzTC:klrauJgK3j9LADVbDsiMds5Bpiz4xA3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560909, "uuid": "090a553d-f44a-4258-b146-d4c9e1d9b33e", "value": 49591, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a5e93-8361-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615574151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574151, "uuid": "f9c24126-8789-4328-90e3-564b6e28a946", "comment": "Malware payload (ZLoader)", "value": "f04988dfb897ed46be8295b99cf00c5e", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574151, "uuid": "09e11a9b-2b4e-42c8-a22b-4fa27ecbf3b6", "comment": "Malware payload (ZLoader)", "value": "3735288a221595ef827f2725e12834bc3a93b941", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574151, "uuid": "120a71a8-8ead-494a-84a2-54fe7d5811f9", "comment": "Malware payload (ZLoader)", "value": "749dddf6d77301c4818036b7aa8ab4b4563655ba3aab214ca9b8beab029cb1ca687d5f93173a9781ea1a9bbc71df8cfc", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574151, "uuid": "747b605b-3ab3-4171-a0ee-3e780e51aafc", "value": "9D54B592A112B1A4E1543F36E82E457C42E6EEA97F58F08B3C08B3B73F772D12E41559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574151, "uuid": "567faec4-0543-4b66-98af-5e8e7ac537db", "value": "6144:CcPiTQAVW/89BQnmlcGvgZ7r3J8b5IhJK+nnug:wbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574151, "uuid": "f545e079-c3b1-444c-a6be-1a9b37596dc1", "value": 280064, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e572b838-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560890, "uuid": "18946e4c-dbf6-4b74-a24d-1f301541c2a4", "comment": "Malware payload", "value": "ca5b7763bd5def629651d9fd0710b641", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560890, "uuid": "74dfc7da-f36f-4a96-84ee-07440cec0f8a", "comment": "Malware payload", "value": "bbdc73ee4ccd9fef52873bb465550fb2818547fb", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560890, "uuid": "5ec1e5af-628e-44a8-851a-cec012b9481d", "comment": "Malware payload", "value": "a6bf2d0185d4b4197baa3774e0f1074ae53c9c1156ec7fdc159b73192c6da71b1de0d66155ac8e7b43bfc277fa008f63", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560890, "uuid": "783ef07c-2415-4028-846e-18b52a643b7e", "value": "9433144C7592B9BFA681EA77DB21B870E511F88EF7C614C5AC40275C8F58825CEC8BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560890, "uuid": "0daaa5c1-54d2-4d5e-a7da-fedb497b78c4", "value": "768:h3Wa55NjZYFxzlHX27AJF44baZ8QBuUqf16yrvZYULNoLRQwRX65r1eBUSMvlyrA:k0KJ3FNd17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560890, "uuid": "7d4e12f6-cc3d-4525-a57d-0d49fedcb85a", "value": 51829, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0113fd4-8373-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615581846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581846, "uuid": "6f2e7f26-8ae7-4612-bf2c-614eabd501fe", "comment": "Malware payload", "value": "5c89a20b6df9dd89ed15590490e93049", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581846, "uuid": "f1177b06-aebd-4a4a-a260-83b1fb82f8b7", "comment": "Malware payload", "value": "2884b8054dc725a4c09560b177b788ef426ca552", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581846, "uuid": "9a6615ac-e2ab-44c1-809a-d669879f3634", "comment": "Malware payload", "value": "04ff189bd607bd03642ffa7bf61a302e3266675c867091dae68efeb3a947dcfe112c175ad72ac0905b5646e7c5700712", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581846, "uuid": "efb4d6df-3921-4a6c-b196-d0c5faeec89b", "value": "E08194A173E0D124E040393B9C93CA98C12EFD61DE16A21737447B3E2D716852981615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581846, "uuid": "fac33128-45a8-4d4c-adb7-cc7179c171fa", "value": "24:re+sMl8cQ4l+xVDvLn8hHqwtcWw+5X4YdQfHPllL+uilt9A9x1qAVl+RvoBL/Ak:rV3YxCKwtcWwkv9lt29x18voBLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615581846, "uuid": "fb13d5c7-2aa3-4981-95cc-59fabb2aeac3", "value": 4096, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44288f09-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564914, "uuid": "a969ad39-7414-49a5-8303-bc7d02639f16", "comment": "Malware payload", "value": "db249cda662feb1ce88d58fdd33d4b70", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564914, "uuid": "65483b2a-0854-4260-bec9-09c5caf349e0", "comment": "Malware payload", "value": "5b44dec39ad6189396af16a015be839375c5560c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564914, "uuid": "8d9ee5f8-dae2-4361-b170-b76d6cc776cc", "comment": "Malware payload", "value": "d4e11a25941d7cdce6875caf13b37b815d4c70c7c79ac1dc017f059e8f3adc5041d7cb957bd614a03595484f9f6b5a8d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564914, "uuid": "8397d978-aa06-4cbd-83da-2d5c0ef0f045", "value": "1A24AFF8B5147DE6666F466BCA96ACD813B527338AC7A4CD80A4BBC30563335FE12C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564914, "uuid": "0319b9ed-a8d3-4b37-82a1-07b8d812ca87", "value": "6144:n/ePP3/5dWFbgvl0PG1w8P8FP0e4tLx+sP/R8:G33CbgOPSmD4ttZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564914, "uuid": "e84e07dc-8d5c-4ebc-bdad-e14079c175c8", "value": 224431, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cf69c1-8324-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615547872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615547872, "uuid": "18e4b294-9d26-44c9-b2c6-330619fe84b8", "comment": "Malware payload (SilentBuilder)", "value": "8ca40e8ffb40bbb82e77b32f513275d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615547872, "uuid": "694778f4-4f3a-48d1-9423-398fd8750009", "comment": "Malware payload (SilentBuilder)", "value": "cbba0b1b68e56e99036b8fca41d7c2e78ed87cd2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615547872, "uuid": "a1b37e91-5024-4fef-b210-dd9de1c76334", "comment": "Malware payload (SilentBuilder)", "value": "923cd6675c0d6c019fe232b64ae03ef7ef151adeec8845cb029425dd082368fff6886214d179e92c7fd4cc67fa82168a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615547872, "uuid": "335ed19f-de61-432e-afa8-54f2ff2ae0ab", "value": "20D39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615547872, "uuid": "8c97d3ad-086d-4a73-b8e7-29fb62883ac9", "value": "768:sKdUd4TaBosD/W+u7VVCPVCmgUrNaQTZipEmFPYbWvYvdJkyzLefR2bMqV7ZdGGy:skUd4TaBoBfv2ha3GbWYXgJqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615547872, "uuid": "59f4e300-82e7-4cb6-be95-0bbd887303f0", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b9d6f5-8344-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615561365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561365, "uuid": "8ddcc1d9-11fe-4f87-9f32-dd8e755f325b", "comment": "Malware payload (SnakeKeylogger)", "value": "5cc544ea19d43bcfc57fc2691d4254b7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561365, "uuid": "8cf2d621-541b-4698-bf04-ef9f65c3e444", "comment": "Malware payload (SnakeKeylogger)", "value": "10f813f34bbd4e1110606d29c625f924d71ad63a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561365, "uuid": "283d8d6c-faaa-468a-a556-1c77cfb5b3f9", "comment": "Malware payload (SnakeKeylogger)", "value": "13628e1082b62599a19a7b15cf06b86976bb4103e98f3d68503df632916d024b7af4dd2b37ddff28b949ba0e44c8d381", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561365, "uuid": "5ab9ffdf-a8c7-4c37-ae48-5bafae877280", "value": "AB159C652398CA48D3BE537DFC219A6043B02D32F667C619FED078EA3935391E61E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561365, "uuid": "3ba79278-7228-4d7a-9796-0e5903667a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561365, "uuid": "efac3746-a376-4137-9947-14153fb710f6", "value": "12288:n1wBlY3mbM/Z8ncv9hI0F++BwgvqhKmVdIQw0y82iQCFPGD9:mrKmgxH1FjwMWKUpc82BYGD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561365, "uuid": "3b0600b5-f4c8-4a64-aa3b-ba9e8bc69a29", "value": 892416, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b29b86c-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582562, "uuid": "9e57c7bd-17db-4166-970f-b12b97571f3b", "comment": "Malware payload (SilentBuilder)", "value": "049b4936a69c550eada3b931d7124e25", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582562, "uuid": "3011d761-3cf9-47b1-88cb-c0b3b8817234", "comment": "Malware payload (SilentBuilder)", "value": "166085d0c208891568b450fa1e6220025400fc31", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582562, "uuid": "14bc65b5-c5d2-46ed-8575-36af50cb1d98", "comment": "Malware payload (SilentBuilder)", "value": "902eafacec183b9658a0f4eda2d112db3acd6220ae11864b468097f86d7c4d2b2f4db80cc3a8cd15b3dd37ef077f47e2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582562, "uuid": "1b6df9d6-2279-4198-b6d2-2a691ac04a2f", "value": "15D39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582562, "uuid": "5a43d47d-b668-4105-893e-ad1cf0624146", "value": "768:sKdUd4TaBosD/W+u7VVCPVCmgUrNaQTZipEmFPYbWvYvdJkyzLefR2bMqV7ZdGGi:skUd4TaBoBfv2ha3GbWYXgJq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582562, "uuid": "e7a3e579-882a-4e1c-ac9e-6954dcf21ae7", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c66bdb-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560916, "uuid": "81fc679a-2afd-4099-98ef-8314838689d2", "comment": "Malware payload", "value": "2ecfa9f2ce97a3a2ab5e55d4eed0584a", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560916, "uuid": "253c5936-6906-4681-8d0e-8eaa8d7cbd17", "comment": "Malware payload", "value": "0349679dc2a302fa8c34e162dfc82f1720946f7c", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560916, "uuid": "17f736e6-c768-48d1-8259-c124a975f178", "comment": "Malware payload", "value": "54d259613ff66cd52aebd5f87412ba0a5897d68a0444014b4cc6033bcd61302292297efb0f9ef70bbc9d989d16a110cb", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560916, "uuid": "4ea81085-7df4-45b6-a4fe-2fb84f105a8e", "value": "7333898CB385D46F4753EAB3EB51D4D0F713F00AF6C610C6AE813598CE6D512E299AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560916, "uuid": "529ce703-0d35-471e-a718-2e9da0c8c967", "value": "768:+T+5vH38POTeLfgiW07D0SDZLNYZ+pWtJAVRM4YxUtZYISn33IzC:R54OgoSQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560916, "uuid": "a9093e6e-9d3e-4b34-a416-0051bcf31a89", "value": 52168, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020afc32-836a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615577688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577688, "uuid": "5a5141d1-322e-4ed4-9c10-47e9a0ea768b", "comment": "Malware payload (AveMariaRAT)", "value": "aaf2bc562f565342a8a779d3b5d796ed", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577688, "uuid": "f812a71a-ce4d-484a-a329-0fedf25c8300", "comment": "Malware payload (AveMariaRAT)", "value": "fecb4aaaed12fa79146db74053667cc9f4838fbd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577688, "uuid": "ad7bffc1-7f3a-4080-84be-0c2421f60d8d", "comment": "Malware payload (AveMariaRAT)", "value": "2ed01512ab79f5843985dd8489c570f38f2e0b77c06d88a03dd11f1449ac9ad755f9edd728b12997384a3d01993f660d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577688, "uuid": "eb903094-c844-4ac4-a5d6-660681868e03", "value": "2D83721A3842F117D6CB4D781820FA153A1CDB721C4E94A9E411956CEFA2AFB7C9CCCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577688, "uuid": "4373c67a-4f3a-46cb-a0df-514c0187befa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577688, "uuid": "2c0fd221-0c40-43ae-ae48-8152db7ba021", "value": "1536:/n4G7Ts17mPyIpfbK6iJd6QHhEV7zusNxs7B:P4G7o17mPl1iJ0QHqVmsNIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615577688, "uuid": "ac41b221-85bd-4b87-bf5f-38acb624218b", "value": 88576, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256d2223-82ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (DoejoCrypt)", "timestamp": 1615531792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615531792, "uuid": "fc6e89b3-db5b-4134-8e6f-ba85e0273466", "comment": "Malware payload (DoejoCrypt)", "value": "0e55ead3b8fd305d9a54f78c7b56741a", "object_relation": "md5", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615531792, "uuid": "4b03ac6c-28ce-4cee-94d5-dcd087fdf51e", "comment": "Malware payload (DoejoCrypt)", "value": "f7b084e581a8dcea450c2652f8058d93797413c3", "object_relation": "sha1", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615531792, "uuid": "0830b593-72c9-480a-9500-6916f763a082", "comment": "Malware payload (DoejoCrypt)", "value": "4fbe9ba0617d610459adcb3276146f67e4af35255fcc21df29c3281c9c67d1b0467a2ba47a543cafcf15da79bdfe350f", "object_relation": "sha3-384", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615531792, "uuid": "fcd5433f-5758-42c4-8514-57ba317cb790", "value": "1B55CFC3FAC248F2D846097951B3973B5F3ADA10832AC5C3DFA159A59C21AD1673E3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615531792, "uuid": "4c1c1006-486c-4039-be4f-6cdccdb65f9b", "value": "f8b8e20e844ccd50a8eb73c2fca3626d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615531792, "uuid": "d92fc25e-ea9f-4d55-9a27-09d8e3c9a824", "value": "24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615531792, "uuid": "da53cb03-fde6-4236-831a-28858823ebc2", "value": 1322496, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19068ff3-8355-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615568708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568708, "uuid": "ba5b5ee5-52bd-4fcb-bd23-2bfb8a700e98", "comment": "Malware payload (Loki)", "value": "279d63e9aa5dc17205c4b59937d16e14", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568708, "uuid": "aebb5cb6-7a47-4906-a3f2-87f28452c36d", "comment": "Malware payload (Loki)", "value": "7a2b8be99bc35b53f9a94ac72c213a2079c2d5d0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568708, "uuid": "6549203c-10c8-4a99-abcb-69a1e359bd2a", "comment": "Malware payload (Loki)", "value": "178a770a4aafab51cfc31a964b5a4796735a6702c0428c27a0905e75158fd7f98be88731880d62db6497fb0857ff4dcb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568708, "uuid": "971e7bf6-a419-4fab-886a-2e52a9e71bba", "value": "49C5330BF5D1AF0BC8D95DF7C0ABD29870715D8159AB0AE6264E3325503AA374EDB32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568708, "uuid": "974d744b-44f7-4029-80c7-12fbc5ce8b13", "value": "49152:potk+W88okZKWxytuNBezK+G/xE82lwagabmUfb/Mqk41H103uHSkfXB4xS5+:potkOJDKN8W+iG82lwjcb/fk41H2eykK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568708, "uuid": "f9abc4b1-64c2-4346-8f2b-856f28db5dc5", "value": 2565632, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74230b6-8345-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615562074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562074, "uuid": "e621e7ea-affc-42e0-82c2-66df1dd8fdb6", "comment": "Malware payload", "value": "44391d917c6ff2817a7b07f16b2d5006", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562074, "uuid": "228b8c31-612b-4fc5-a7b2-2f40ee136ed2", "comment": "Malware payload", "value": "4c73e9f6abc7491b650115870ca4c1a37d13b77d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562074, "uuid": "7efb5d13-8ab4-4a85-8fcb-cd25ac2e6f21", "comment": "Malware payload", "value": "bd7b47795cb6cc43190a341bbf7408738f6a2643f82a809568657fef66307b94dd43cec8510f9505f6a6829643e06773", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562074, "uuid": "c9ae41a0-aa7c-4c1b-a805-f7c640933e63", "value": "CF44235D348FCB0E5D5C3A4C7E92CB4EB817B646286E1616E938DD22BD851A23314BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562074, "uuid": "85a162ab-4252-4b38-8bd7-0607e7039327", "value": "6144:qIm1OjjSzpxVDADkJftp9QAmvdqANqpopVS3k9Z8TeptyUVZOvxoezRUM+iW:qJkjj2VDZJb9vMpE3kMT6yhxtVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562074, "uuid": "03abbf27-8d25-441d-b6d9-139546390b6b", "value": 272571, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f8174e-834e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615565859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565859, "uuid": "5a0421e7-f563-4e17-8afe-c0b5092661d8", "comment": "Malware payload (Formbook)", "value": "00ae2fda7c3aa47986ad97654a9de54b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565859, "uuid": "737a3021-e8ea-4c90-846f-22599c8d107f", "comment": "Malware payload (Formbook)", "value": "988d3338f225480f0b75f1fc5c01e3685c81f12c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565859, "uuid": "7a99fa8a-35cc-4017-a384-712c0207e895", "comment": "Malware payload (Formbook)", "value": "9fda4dc27ebbf1bfc72f09672c364f89b62e6f94d7e53a6c319009f3cd2c13e7cb8161faa1ad9777e381c87f990559b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565859, "uuid": "5f831670-553c-419c-b06f-8ac9bca316be", "value": "242422A59D2090B57603590A63FC4FF8393266FF1FA8E7B17F30452A414BADB98530A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565859, "uuid": "4e3722ef-f402-4d28-bc46-2c4b27cf2229", "value": "6144:ymJzpF/WZKzj/ko40NO58yWSJEA6H7CWT4Cvg4N:ymJlFeZ+kobu8QEA6H+WT4sVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565859, "uuid": "3c157bbb-2ef5-4f4a-985e-435f2a26661f", "value": 215379, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35bf0b0-834d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615565504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565504, "uuid": "35063db5-eb45-4667-aa88-732c5f283bff", "comment": "Malware payload (SnakeKeylogger)", "value": "7ae1028e7510a7a0014f85e65c4f50c5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565504, "uuid": "026f0c60-820b-4472-ad4d-d31ab68a106f", "comment": "Malware payload (SnakeKeylogger)", "value": "55fc111e17b09e98fb6db49d7a4b68033470b0ac", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565504, "uuid": "09e1d5d7-23a8-48f4-9da6-bd0e1287766d", "comment": "Malware payload (SnakeKeylogger)", "value": "9b85f9f8f4b1c77ac920fc6b850781a8077645ab1cd6f81e3156d9fc7462279e794b20d0ab796e7b8332fbe525552d32", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565504, "uuid": "d1706fce-c741-4eb2-9e1e-71331106af2e", "value": "B6F4CF69313C44B1F306263BE6AB9533BCD1D0E59AA5E8045CBCC242247633D56EFECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565504, "uuid": "10cc3979-6adc-4d56-ac84-070774da9ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565504, "uuid": "2a8bbc6d-63a4-4396-a35c-1bffa26b2551", "value": "12288:C++DAXmfBxMa288AM+tIJD3vBT/OER7OI3FFZx:X+D3imyZ35JpFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565504, "uuid": "db43092f-c58f-47fb-9889-54433f0cedaa", "value": 725504, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c384aef6-834a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615564269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564269, "uuid": "c46db934-6d6c-4a8e-8d5f-beda174eeb2a", "comment": "Malware payload (AveMariaRAT)", "value": "bc952e771bda8a30f9c1a18687037644", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564269, "uuid": "dc3911db-7919-4715-b91c-5c66f407cc57", "comment": "Malware payload (AveMariaRAT)", "value": "8601d7059905b79fd34eabc60e3e264ca9136974", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564269, "uuid": "aaea3692-967c-4a91-ad41-2187c4ecd4f8", "comment": "Malware payload (AveMariaRAT)", "value": "9e6a9c91182b03e0df8a88d214cd0c21f838d46f09045be762d6372706b03a8d103dafc7582b1c07e8154c8636b3d898", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564269, "uuid": "37635de2-1653-4fce-ad26-d526376ad7e8", "value": "FBD41B50FF9C9EB2C01602768CB6AB153237EF4847BE5ED7661A32141F322DD26749CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564269, "uuid": "43609eaa-37c7-44b5-9cf0-a3b2cb558bb3", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564269, "uuid": "46436ee5-a0b6-4986-a72b-49fb90fa79dd", "value": "3072:q3jqjLX1DLPcu2PIzuyMhVNgQMF9dhQpM1x2t+9Cv2KcD75YJ2hWXZj4MVcoJZ:qTqjF4PIaHptM1+pwE72Ra2hfMVcWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564269, "uuid": "fbaa0647-8a46-49cd-86eb-0b8d0be2a06f", "value": 603797, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1eaf82-8348-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615563262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563262, "uuid": "c59efac3-ff80-4022-bd47-592c8fef2f6a", "comment": "Malware payload", "value": "683afdce5fa632574608a4c5766e30df", "object_relation": "md5", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563262, "uuid": "e88030a3-bb57-4091-a936-067b99aa164a", "comment": "Malware payload", "value": "227ea6f8cc81f8c492fbcfefebff4e4e5b76d914", "object_relation": "sha1", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563262, "uuid": "2175d885-f2cd-4d2b-af78-a6f563ff9df6", "comment": "Malware payload", "value": "fe756c0b6603540962185bf03d20403f8ae82ad7faa56ad63abb2ce8c4790a352b9de55213864c4b2de8ed2313f85ac4", "object_relation": "sha3-384", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563262, "uuid": "8fe0f394-4f4e-4e32-859d-73c61eddb3c4", "value": "1CE36C07B3D14CB7F0F31B789D56B221A43A7D101E35934E2FA48A0D2E2EAD45A1D79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563262, "uuid": "b500a5d7-99e9-4740-abef-a7220a91f9b8", "value": "26ea1b45766fe26f9c40750d36f4cf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563262, "uuid": "03dd095d-99d1-4c1d-a506-def7f3343030", "value": "3072:1JVD1zx0HrJvtuKm8wVKQ3+nBgBD0QID3RjfpsY4iTWNLkkk9:jWFvSH50Q+hjf6Y4uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563262, "uuid": "91afb5be-7aaf-40e0-b511-fbf94e00e2fa", "value": 154112, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee0c9cd-838a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615591830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591830, "uuid": "6ab5461d-f886-4053-b2f6-df574f81ce77", "comment": "Malware payload (AgentTesla)", "value": "9f1eae3abdb4e936ad311d6dee1321f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591830, "uuid": "2cd63494-90cc-41b5-9da8-d10ceca8de92", "comment": "Malware payload (AgentTesla)", "value": "9ffe0c86a78583c63fab5ddafbea1cc11c700a58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591830, "uuid": "efb90630-e271-4f27-9ad4-cc5eae02c347", "comment": "Malware payload (AgentTesla)", "value": "ed63921cea2f800b66eb32e51a1f18a573607d3053d84ffda5f096f8991812aeb95f522f69e83267452455f5cc160aed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591830, "uuid": "dc6ad532-5f9b-449b-b158-f1d6526f5f81", "value": "C9D4CF193394DE48E03E977E902422A043F065D7EB57DB2E3EE090E91D27BA5C73A257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591830, "uuid": "97ea6b27-039d-47ed-a887-0d8f1520b1f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591830, "uuid": "c43b3373-7d1b-471a-9889-aa9da65ca8d8", "value": "12288:mVvbi5pHmbCNHSLaKjpUP9W6g3kv+4lCBsBDVw:KbiLHmIRKjpUP9W9U24YBcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615591830, "uuid": "dd43d335-2907-48e9-9584-e3eeb2f82156", "value": 629248, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d90af2-831e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615545105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545105, "uuid": "db85c247-d37e-4f63-b863-28ac3d631dc3", "comment": "Malware payload (Dridex)", "value": "de3414d1dfdebf075b69be5902fc3696", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545105, "uuid": "d91345a7-59af-4e70-b845-ed84c9e50a83", "comment": "Malware payload (Dridex)", "value": "868425f85b5a74519de5e94dd51d78e159cf1fc8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545105, "uuid": "4d3aacea-9002-4be2-8664-42ffd3e06e34", "comment": "Malware payload (Dridex)", "value": "802aaeb420f9cdaf052919d16e9f901f5895311f8e608761e17e429fdcfb421eb03512841f273e75d13fbff95ffda774", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545105, "uuid": "26fc55e9-4e7b-42d2-9634-bf739a3c9013", "value": "4F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545105, "uuid": "e915a724-c213-464d-b2d8-66273a8f1271", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545105, "uuid": "4a3b83e9-1bce-4254-a103-80ba65055e77", "value": "3072:D1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615545105, "uuid": "2217f0fc-dde6-42f5-8f3e-052833d58433", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fded051e-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615561361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561361, "uuid": "b3a7a34d-796c-42b5-b3b6-c34dc5ebeac1", "comment": "Malware payload (SnakeKeylogger)", "value": "6bf27cc62a19929acc886e7b02b0290b", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561361, "uuid": "99d2d268-7fbb-4db3-a7b7-6a145512f3c4", "comment": "Malware payload (SnakeKeylogger)", "value": "b6671f768aba516083064894ed7a93253e311049", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561361, "uuid": "cb480121-f4ce-4fb4-8997-adcc9542d4a2", "comment": "Malware payload (SnakeKeylogger)", "value": "3590a9d28ba7156e78edfd8a80391964bf612a4489aaa6baf6ac775da949ad38c7744c14a770005292980caa18f921fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561361, "uuid": "853c8ffc-24e8-4917-b57f-7c91498fb89a", "value": "89D433F047EE2DF076E36AE2FE6D26F0AE78721C6617700BD948C7B0C45A456958530B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561361, "uuid": "7da92b5a-90a7-4ffb-b30b-e87411dada1a", "value": "12288:cXHAb2QR4Ll/n8zavlPC0N+qBw43qNK0Ld4gwiy8UiYCFPyN4jMh:/RKBPPlNVwe8K+XM8UjayCjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561361, "uuid": "308dd0cc-d5ed-48f4-837c-92a53e6bf7f3", "value": 609677, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2650dd54-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615564435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564435, "uuid": "efd74260-bd91-4e23-9e35-167bf958b163", "comment": "Malware payload (SnakeKeylogger)", "value": "a52333de41461ba8228e3e157385b091", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564435, "uuid": "34f44dba-62a1-469c-9b72-04c964663cf8", "comment": "Malware payload (SnakeKeylogger)", "value": "e7da11006eb19702a869e5e88c96d52c7ec7f2fa", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564435, "uuid": "e9dfcb51-3997-4851-98f9-16ccab11319a", "comment": "Malware payload (SnakeKeylogger)", "value": "41045becb3447d4f86d8b3a8319fab33ea7f2f318a7ce5c969a28bc40fa0d024e8d79695cad3fdcf80a888c6ecfc23d5", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564435, "uuid": "4b97ff3a-0819-4efa-91db-ba182641dcad", "value": "58E571C4B628F1B0E79B8AFD6CFA485434C2DC5DB06E51D926C8734A2861B07C6FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564435, "uuid": "c4446284-f751-44fa-9531-08ed36ffc629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564435, "uuid": "2aabd60c-9cc2-4e2c-9b9b-dbca1e4d22b8", "value": "24576:J+928mcqWWrWWe4rEVJNawmNuWGjyF2R3NJb1At5X:J+93mCWr6VNaKQFYNJBeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564435, "uuid": "d32b5aa6-1eb0-4bc5-961a-d945ff04c6dd", "value": 3053056, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8823e3-8340-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615559912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559912, "uuid": "153f242d-192a-4f9d-bfab-126b51cbcab9", "comment": "Malware payload", "value": "3225822756dd898613e6b7d602816d87", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559912, "uuid": "3c350158-5642-404d-b8c2-afe2ec51ddb4", "comment": "Malware payload", "value": "1616f4bd42a38aad3068eb785fcd35701ae16c8b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559912, "uuid": "1e2a7ab7-134e-43b0-b072-93e71aa3a846", "comment": "Malware payload", "value": "9dcd10f8d8ad1dcb34d56be7243f1680ecf1e932c7cb85a55ab568bb1778ffff75300a7c0b0a5bd0e05f2b336da8dd28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559912, "uuid": "110bff77-3f5e-4cdc-8da2-63c720d0a5c8", "value": "98E4337BC5EA7DA2C73AA14F17CA58D287C78C49F28C51C05544CD88AE4ABE3CD991AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559912, "uuid": "393098e2-d3f7-4b2c-8ce2-0f34d9a9eada", "value": "12288:p7hjUCrrcRoRzWo2tR/sfpp0O3bB4h47LZci7BVcT9GwKyKDTCJy+xwZ:5hjmKzLyREIO1R7dcaMMXmA+xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615559912, "uuid": "f288166e-57c4-4485-9456-4a77af776eea", "value": 707228, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802df45a-8340-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615559861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559861, "uuid": "6df7ab40-296e-4631-9ea3-599aca25f033", "comment": "Malware payload (SilentBuilder)", "value": "aa1b2bdb5a705f127662601598408d07", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559861, "uuid": "5d54e408-9823-4d69-8eec-3edea6910365", "comment": "Malware payload (SilentBuilder)", "value": "ea76be5967dc202b6a2f0dd7b1ded3e0dd0b2ccc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615559861, "uuid": "b3525a29-18a7-4223-a712-6a99795797a6", "comment": "Malware payload (SilentBuilder)", "value": "cad69b7547795ce49a339047356784b103e882c39106b3d2dd137c86d36b688a3e0c616a8c93fc4e8891309146669763", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559861, "uuid": "69a4071c-722f-4f0d-86eb-4f150bf3ad68", "value": "64E39947DAEA862FC5A41B3A41F34A1632D78C484BD7424757D9FB2A6F7EB852E00DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615559861, "uuid": "665ae7a4-097a-42dc-987c-9b6baa96ed5d", "value": "3072:QVcKoSsxzNDZLDZjlbR868O8KoX5jSS7uDphYHceXVhca+fMHLtyeGxKx58wDCZ1:ccKoSsxzNDZLDZjlbR868O8KoX5jSS7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615559861, "uuid": "3e4de7ed-f633-4051-8194-fcabb78537b6", "value": 145920, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bffa249-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615560284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560284, "uuid": "8780b830-47ac-40f6-a4ac-cab5e1fbde56", "comment": "Malware payload (AgentTesla)", "value": "5554f5bc0c98a89d9b45673858e51ecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560284, "uuid": "6c6854b6-73bc-48d8-8287-a3e5381ad36c", "comment": "Malware payload (AgentTesla)", "value": "4dfcc2635e78a54bea0a94602615b8b3d267c5d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560284, "uuid": "41879bb4-6eb9-4c5a-bb3b-41135df0360a", "comment": "Malware payload (AgentTesla)", "value": "e45e0068e1eed08b79dbe81ef1aedf601e605022f1e46ebd61bf22a208b171ddb57522209dc047dc6debd25f40ef66f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560284, "uuid": "ea10636c-a6ec-4c83-9537-e1fa2f1f1b2f", "value": "FFD48AA1E6CF4F0FCC695E3A0E63C50392E46E11FAE1B51AF9CD325A0E7D980754A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560284, "uuid": "682762ea-33db-4f4d-97a2-f1db9fb1f31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560284, "uuid": "94adabb4-dc72-4a55-8d7b-672933819815", "value": "12288:1l0WjOYaqRTNRJFtuHx3wP9mUNGJwNPyOMU2Ck+0dE:1l0ymq3RJygFmJwFMU2CL0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560284, "uuid": "56bbfdd1-b59e-44ea-b041-d1143eeb4f13", "value": 646144, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c3f227-8361-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615574155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574155, "uuid": "30104336-7f65-4be8-baaa-0ab952b01ff9", "comment": "Malware payload (ZLoader)", "value": "e5103d329ec2923a5750dba94f223385", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574155, "uuid": "da733cb7-de76-42e3-8dfb-8365300301d7", "comment": "Malware payload (ZLoader)", "value": "a53215216e11c241a8fd925aa7282efc9e41444f", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574155, "uuid": "940bc145-c602-4040-8852-4683be9c7985", "comment": "Malware payload (ZLoader)", "value": "1eb17edcc667f5c4f1b2e3cd421bfe326219396416ae712e1dd9079c2be74c2cd32fbf73b991af254d9633516d4a2ff0", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574155, "uuid": "0f289e66-7302-462e-9977-32b938a8a2d5", "value": "0F54B592A112B1A4E1543F36E82E457C42E6EEA97F58F08B3C08B3B73F772D12E41559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574155, "uuid": "6865b4ad-3059-41ce-ab25-1dba5b7d257b", "value": "6144:CcPiTQAVW/89BQnmlcGvgZ7r3J8b5IhJK+nnu0:wb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574155, "uuid": "ba6385dd-b77a-4e87-b4c1-637d347f166e", "value": 280064, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565f50f2-8319-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615543041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543041, "uuid": "c4133b71-af2c-402a-a1ff-b5db4aca356a", "comment": "Malware payload (ZLoader)", "value": "65c035cbf062176bb796cccab12cb71f", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543041, "uuid": "5156f565-02e7-4b56-91c0-fe88abe16d3c", "comment": "Malware payload (ZLoader)", "value": "7850f7302be1794ad1afa5b75c3737de629a423d", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543041, "uuid": "4d40a7d2-aaa4-4926-a47c-312674f2aa5b", "comment": "Malware payload (ZLoader)", "value": "0b0a6672c0a91c0970f3484eecb446fd07d0ac66bdba3fd61fa4d8fb46d51ae8d0f6e1650873fbe8e206d7af5671c87b", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543041, "uuid": "3ee73200-7c67-4970-912c-cbac1a12365c", "value": "23B2CF28D0F5B4ADC514DB3ED46C01F3AB8EC0E3AF0AA4307D10CA876B4A9D366D52D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543041, "uuid": "c7500072-5eac-408b-9500-061799f15bfb", "value": "768:K8z2ni7JLqp0nKFwNW/B0zUqbUhkpE6/R48xctoi:VTLHnKFzVqoEZDxctoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543041, "uuid": "135d9e78-bb7c-40e1-882a-01d4789fb08e", "value": 25471, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4c502f-8349-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615563878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563878, "uuid": "df03e586-b5b3-4e09-8c78-4c3c10fdf6bf", "comment": "Malware payload", "value": "c5fcebfcb056030c84c80f29e49d497b", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563878, "uuid": "a547b7cf-76ab-49c2-b896-8e0987b1af20", "comment": "Malware payload", "value": "7bf67f61c332454d4f1c5905605d40e14628b52c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563878, "uuid": "0ef2ec15-73fb-451c-9fef-baeea8b7862d", "comment": "Malware payload", "value": "70aa29f470f8cd778ec36c53d132b6c4a859031dc83c41fa3af415d44edea15383b2c4a3b87664921500d9ef5434b1a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563878, "uuid": "fdcac62e-f57d-4652-8409-a97263f3d9fb", "value": "88229DA05941C8DDFA4B49BCBFF4548FEA10054E48DA47836F5028687A64F8EAC1AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563878, "uuid": "2dff5dfe-fb0c-45f9-ad96-78cb1ec3ca11", "value": "192:1Q4aAiBqNotH/dW1kJKkFBzAXFUPKdAn3YyVgBJuC1EkUQhfb9ZCa:NafBqNolznemP8XuKEkRtxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563878, "uuid": "8f416e07-af85-4099-838a-57eca15c1dae", "value": 10040, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744d5438-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564995, "uuid": "b466a392-6568-4d78-be8e-2cd9c05e983e", "comment": "Malware payload", "value": "6b81b62f57d5a2725d426177d03cb919", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564995, "uuid": "17bcfc86-9cc1-47eb-8c32-b675d0bb5c28", "comment": "Malware payload", "value": "f240c602e03a6c256090aab7fcd34e4c8c769fb6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564995, "uuid": "56fa26ca-e0e0-4597-9c42-180dbbc8a4bd", "comment": "Malware payload", "value": "8b4a89d18bf21d6136f9ff1e8c7e25146da6d4a29230045347db4594b0306a54d502984076f956f82356a24079707209", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564995, "uuid": "a2d1e181-daa9-4090-9985-5115f19209fa", "value": "D761F97A316C1457C88D81A3ED9ABD270B83F32E8ADB46C4717DF5F60B5B2D169A8402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564995, "uuid": "79903ec0-481a-4ff0-a788-0253055f3e8f", "value": "96:u0nmiMPW47VxAnwwNvs6xxHstzmqOv5dQiTFgO:u0miMO4Zxxl6xxCzmq0FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564995, "uuid": "a3772089-c1ac-48bf-9bac-bc269ea6eafa", "value": 3421, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fd3167-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564548, "uuid": "38090226-1fa5-4586-ab37-2620bf94ecd3", "comment": "Malware payload", "value": "fb871deb61ad117b1b0e425a89149e11", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564548, "uuid": "84ee2f60-74f3-48fc-be81-15feb3e815aa", "comment": "Malware payload", "value": "307407f41936a162cf33c8ae47adb257a481c8cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564548, "uuid": "c348d5d2-0196-43da-a729-297092f029f1", "comment": "Malware payload", "value": "35b0bb3aed9c934e0ba7d4340e2c83022dc6e96193590e847a0c40d63df6290fc7ce5ee928985d9d3e115c9c3b0780bb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564548, "uuid": "7246a595-73f1-4a1f-bfb0-a77c4d4067fa", "value": "5BA4AEF876087CE67A6F576BDA96ACDD03B626239ACB94CD406477C305A3335EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564548, "uuid": "08375802-e71d-4922-9e8f-6488d343c839", "value": "12288:Q55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2ehyR:yAIC9FkMRaN0cQ3S8wzHDFHz8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564548, "uuid": "a6decab8-e066-45aa-a77b-e2d0b3ff0b4f", "value": 471045, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf60fb9-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564956, "uuid": "b52d7224-d4ef-4d1c-815e-7dfcaef787f3", "comment": "Malware payload", "value": "1bfba90ca9369dd57b0c3437d205fe7a", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564956, "uuid": "4b7d6c80-393b-49f3-aba2-cd7ac01a9db1", "comment": "Malware payload", "value": "718d779c3d0644bb4aa74da4a776353afde0a069", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564956, "uuid": "232d92e1-b8d4-4d85-8851-2ce8ae055f46", "comment": "Malware payload", "value": "5895fa4cf95c46e92e1335c03cd0eba19e4a60185c29726c965c933b8f7e4f0083ac90e43b81d00e65f2f967ac5f5fe1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564956, "uuid": "00a34e5d-78b6-4a1b-9912-7e5e44839680", "value": "2C05062173A45F58F17AAB38A126554483F2FC07E725DE9DBDFD80D90623F828AA1713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564956, "uuid": "1c5fadb0-9577-4e2d-aa72-5344e64adacb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564956, "uuid": "93ed2716-ae00-46c0-bf6a-d47e192745e6", "value": "6144:tvRuBLNQo5GrThHCjmX7cBx2Qy8Pve4lby/xcJO6TApqnDeqNdGi69b2tIzyphVS:tnMmIn7ymbul6j3Gi69biYyphF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564956, "uuid": "7b6a0580-82fe-46ab-a5fd-088d421f1f0c", "value": 802816, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba7fda1-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615562484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562484, "uuid": "e0622528-f48a-418f-8b7e-1a0cbc37c614", "comment": "Malware payload (NanoCore)", "value": "db815909ae5f04e726586453218c22d3", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562484, "uuid": "1e9772b1-5d2c-4355-9ff5-b321afa5e408", "comment": "Malware payload (NanoCore)", "value": "1824c91adb4848ad09974b03cfb89190febe7d85", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562484, "uuid": "abe84c01-bf6f-46a7-8d82-8471bfa029fb", "comment": "Malware payload (NanoCore)", "value": "5492d77e3f2fdcab6964f59694a911c2cfa608a6939d4aaf4d28811ed0f3a157987025844d485f827be95b72f9d86cf7", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562484, "uuid": "f66b19df-0163-477e-8f71-319bd8a8880d", "value": "5CE4C040F598ABB7C41562F8D47BD67812376E6AD432C81D29EA7C8F24B334170AAD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562484, "uuid": "ce00b86f-255d-4300-a3d7-590072fc26e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562484, "uuid": "d66f5197-5182-42c5-aec3-3b6b2317812e", "value": "12288:9Vs6Qt5Qh5Wf6EwQtUoJGAiiwAx/GMJGs7vZYHlqCpppTpppgMpDp5pTpxhg:TADCWLzFizApdJGqvKoFah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562484, "uuid": "cf08fcc3-d34e-43cf-bd85-527520b06cfa", "value": 699392, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103b2a7d-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615560103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560103, "uuid": "956f8e3d-e9cf-490e-bfdd-dcc7964cb310", "comment": "Malware payload (SnakeKeylogger)", "value": "cb366fb4649dd14659ae42d56f716ff7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560103, "uuid": "2d65af56-9eea-408c-8d86-a240c1b89bd8", "comment": "Malware payload (SnakeKeylogger)", "value": "431f4cf550e2304ef9f1fee8e1bfed22f11b5e5d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560103, "uuid": "58c15d19-c6bb-437b-9090-fa2710746b36", "comment": "Malware payload (SnakeKeylogger)", "value": "9c0347dce1d0c3b211fbfe3d3b2e3c6322fd8dca86859e599931a6908fdb3d96ab860109b9929818e86c8feeb05358a2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560103, "uuid": "cee65e24-025d-4b87-a483-f05960767ab6", "value": "049423D87002D082A731673911E81D01BFA3CED15EDB5D32DFF19A41EA51B9EE41BB2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560103, "uuid": "ba011887-33e6-433a-bf6c-d9bc9e43e87f", "value": "12288:vTH2TANiKElDRvBCToyKLOLC1k0LnypSX8:vTH2OiKElvCcP1p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560103, "uuid": "ebf9ba12-c9ed-4e44-bd08-4a24b0ccdd88", "value": 445389, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f185d16c-8377-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615583674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615583674, "uuid": "a9b247ac-171a-4e26-86a2-f2368b627f13", "comment": "Malware payload (SnakeKeylogger)", "value": "19535f1b3fd6d4c91439a850f03d261c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615583674, "uuid": "561fb04b-4998-4116-aa70-de1625d7a048", "comment": "Malware payload (SnakeKeylogger)", "value": "2a8d28af33262bc301e5a7bc259646114a5df655", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615583674, "uuid": "935456b6-427b-4b6c-b03c-4e6b56724a5c", "comment": "Malware payload (SnakeKeylogger)", "value": "2886f1f7eb4fe14dd59698eacea5229ae5c86d288356f37725d8a9f7e47350d6a096a1f80b4149a93e36cd3a12b29ca5", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615583674, "uuid": "c1a3b520-5133-452c-853c-59f06f292f10", "value": "93457C2136A86F1CF07E5B3B89E86855D7FEF913A322CD6D3CE1128E4562F80C951366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615583674, "uuid": "8cd29146-1556-4bf7-9dd0-c78788cbfdde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615583674, "uuid": "e690c641-c563-476c-a548-fccf7dd2e34d", "value": "24576:0I/A3IP98FaBNudRWS157aYZhOALPO1CvoksXFE3oZx6I:0I/A3IP98FaBNudRWS157aYZgALm1CgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615583674, "uuid": "5275a72c-8145-408c-8bb5-7ca6401cb17a", "value": 1170432, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a182ab-8309-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615536186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536186, "uuid": "35d3947a-26ad-434a-be44-84476f877b67", "comment": "Malware payload (AgentTesla)", "value": "983e5e91016b2fc3d6aa2082e5fa7eaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536186, "uuid": "2542f5f4-f6d1-4d34-a6fa-f61a52763c44", "comment": "Malware payload (AgentTesla)", "value": "3269d1bdf60f3235bcf0c48332e4d7ba30ed49fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536186, "uuid": "6ed1409e-0473-490e-9c07-7f82ed81fa44", "comment": "Malware payload (AgentTesla)", "value": "51a06c066d94de704f094f2cdbc0f295ba5afbe3d23ac22a6651a057dce0b442db6b26cb907dac7cc45132ff59dccc55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615536186, "uuid": "102535e9-dcec-4dab-9828-7c7d97f6238c", "value": "B8D591C5B628F1B0A39FDAEE6CFA4D5434C2C85DB16E51D676C8638A1801B07C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615536186, "uuid": "3eb69a03-bc47-458a-966e-3d5095be3a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615536186, "uuid": "48e7da4b-fc53-464b-a712-5ee7fba5fdba", "value": "49152:cs4psNEZfN+w9u1mJLHEIK6n5N2lgWVfoUX:p4nD9LkB6+gWVfoUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615536186, "uuid": "d7224c34-77ce-454a-85b4-bc55dca07fef", "value": 2971648, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6797be-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615562489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562489, "uuid": "10b3c96f-d352-405b-8195-e5577d67d5f5", "comment": "Malware payload", "value": "1fdc547b223d435d96f1fbe257cad7c4", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562489, "uuid": "f579846d-6baf-42fb-aac1-c020bee0e67e", "comment": "Malware payload", "value": "9bb763e1f9e1c8fe989f81207181c638409ea99d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562489, "uuid": "63af9559-56e7-485c-899a-3f029ef4158a", "comment": "Malware payload", "value": "733f23d0bfdaf966b4f819c2e092e77d0b2b848cac3ed278dec16d5d5f44dae59482d60b82d80a7c2a9074e6ebace6b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562489, "uuid": "53f42c9f-d36b-404d-966a-7a8542a63209", "value": "13F34DDC8E5D05EFE2BCFB3490A11522AE6094FAE4004A1F4EB25DE3D456EDA28DC15F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562489, "uuid": "0087d1f1-3be3-4a49-86ca-bd856d01d320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562489, "uuid": "9a21e226-343d-4c0b-8965-c4cb752822d4", "value": "3072:nhB6SYfFpOVwxLPLhUk9Wudl1e5pI1H8LLCwr:neNd4VwxrLd9WAlreCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562489, "uuid": "4e29975f-53f8-4a87-8be2-305a87499f07", "value": 162816, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1929dc6-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615562494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562494, "uuid": "0ea8e81b-5829-4af8-9e21-fc547606e72e", "comment": "Malware payload (NanoCore)", "value": "27d4d7825a5b0cfafb0e5fe896c664ab", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562494, "uuid": "e795c1d1-c662-4e08-b0a7-36e79d61ab4a", "comment": "Malware payload (NanoCore)", "value": "b4bdd2ceda0202e6d1407da42f5b4da7432b4a97", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562494, "uuid": "5e049e07-fefd-4749-99f4-4517cb519835", "comment": "Malware payload (NanoCore)", "value": "f3fcfdff00027d6073d66ac390f354cb4a79377f64dd14c06753208adf9e7d262cb0b82d093e0dab57801e31817c4c92", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562494, "uuid": "1c4cb081-98a2-425b-99b4-2e524f2d4829", "value": "33158E419B91AF11E37C63BD281400916BF6C36EF3E8EB5DFC81A0F66A52E1446FD186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562494, "uuid": "ab9f14ab-66c1-48f8-bf89-9d6b022baefc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562494, "uuid": "f118dcad-290e-4687-b5b8-980369139cee", "value": "12288:D27WtYTUjDF/73FuFXOlVpzDN/neN6eO6oxa4WKu2:a7QF/BuUlVpnRPef1LKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562494, "uuid": "095ee7ac-981e-4c13-a210-d7223b9dd30a", "value": 941568, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f000ec5-831a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615543511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543511, "uuid": "f1004904-4055-407d-99d2-640d2cdc4ade", "comment": "Malware payload", "value": "5b3e5dda21908183fb7ac63012e645e0", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543511, "uuid": "82abef3f-777f-45c8-bbf0-536fb3416e1c", "comment": "Malware payload", "value": "ec9df297e7d7812df585483fabbabb1eaebb9928", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543511, "uuid": "746c022c-5307-4c54-a3d1-57ef29dbeda7", "comment": "Malware payload", "value": "4fd54b043019831c23da23fe22988a520f2806f12c0e22da5380c88be898481f4b329e0a5e929142454a798d70983ad2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543511, "uuid": "2e15b8f7-4143-4d89-aa3d-80e441ad884f", "value": "38F2E1FB27FB23ECC19F245C49D4202529752B46D8F297B76B361288AB02F24E11CC4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543511, "uuid": "684cedf8-28d9-4afb-93a0-4bf78c048d48", "value": "768:mu5UmsgZ4Orp8jJQTS5/8OaWjnLvZmJ8h3tO0AvSu3Jcmf3ILPIQH:mu5U/giOlYJQTs/8OaQnDZmJ8bO0kBP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543511, "uuid": "ec193d43-66fd-49e6-a5a1-cd0b2a63c94b", "value": 34421, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06de99df-831c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544196, "uuid": "229fbd72-9596-45a4-8a5f-aef391bd8075", "comment": "Malware payload", "value": "20731423bfd9787ef535ba25d7473f04", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544196, "uuid": "e4739806-7eff-48b5-97dd-59a9aad2126c", "comment": "Malware payload", "value": "0ffd4bbb14d3b94df29380de3061d8eaef672fa4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544196, "uuid": "0a9c53ae-145b-476a-b66a-a97093133ab1", "comment": "Malware payload", "value": "be05cf0d098baf5d8747527c3507bd939c997fb274d58f35327ee5e8a10304eb02b10fa1be9eafdfa74e702d62a7910e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544196, "uuid": "adacd436-7f61-4c02-8952-0a87242d4bac", "value": "7173F103CF669B42E56826BA7C0B1BE8BF0224299AC371DF46500B5B3F3533A5B5D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544196, "uuid": "642cc618-c651-442c-82cb-e40f24a10698", "value": "1536:T+qB7DfyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBswELfxR:iqBtZ1k8g05oyDJmipk4vykYARfWBswu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544196, "uuid": "270cfd3d-1226-4b9a-bef6-573a7b35fd26", "value": 77669, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9897ff7e-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615562479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562479, "uuid": "12d6919a-a8c8-4f91-a176-58df7a56ce3c", "comment": "Malware payload (NanoCore)", "value": "71cdc32604eacc15ef7eec89bad1c571", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562479, "uuid": "fb6f49d3-4a52-42de-967d-665c97cf35ef", "comment": "Malware payload (NanoCore)", "value": "85e01590c083fec16b54fbbd394bbeb1758342d2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562479, "uuid": "98376b07-ac50-4ca9-a515-26fce8d8b831", "comment": "Malware payload (NanoCore)", "value": "11bf76e6e082fb488b493f1352c6e0feea043a0c9b2263efca2de8198e263b0ebd200a6e58a0067405b6b0125f2fb642", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562479, "uuid": "972f2c31-0125-4d55-a077-f9a7621fd04c", "value": "C8F4F1216997D9B7C46973B84627EB3C43246EADD913C20E2ED47CCFB921B1A1CE0527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562479, "uuid": "4fd5c28d-e556-47d7-bc74-1756286e5666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562479, "uuid": "c163b5da-d0de-44f9-b366-5a0d217f98b4", "value": "12288:7g6isLXNz85SYkRKo0QBrfmx5Wfw5YFaPaEkYz8105EvRGyZQn:7l585SpDQUw5YFgTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562479, "uuid": "6a537831-c14d-4b06-9c47-03feca8de11a", "value": 733184, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4770992e-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582529, "uuid": "c905103a-fea7-4e43-999b-95057be9f264", "comment": "Malware payload (SilentBuilder)", "value": "4bb2e51c0f11c3d6d90a856c52e814bc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582529, "uuid": "12fc0f11-7337-4ecd-b8c3-3e4e335cfd3f", "comment": "Malware payload (SilentBuilder)", "value": "da6c0f17d7dbd1239c61c995c9a7fd9888eed5e5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582529, "uuid": "3aaf8fa3-ae3b-4bcc-9509-aeef80e74938", "comment": "Malware payload (SilentBuilder)", "value": "fc22864726b16e39732ad6c7bd2c1ce92f99d0285a306a82d2d3319eecca6c334c90c68657503bae1eaf45ae9639e9b2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582529, "uuid": "817b0f76-a176-4d0a-ade6-bd6b33581058", "value": "E6D39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582529, "uuid": "11a4462b-9f28-45a2-9a86-1946a6aeb3f2", "value": "768:sKdUd4TaBosD/W+u7VVCPVCmgUrNaQTZipEmFPYbWvYvdJkyzLefR2bMqV7ZdGGu:skUd4TaBoBfv2ha3GbWYXgJqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582529, "uuid": "4ad489e4-407c-4e3e-827b-62b7b04aa053", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2b8a36-8352-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615567424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567424, "uuid": "98b51354-fc2c-44aa-95dc-ae899fc2a73b", "comment": "Malware payload (Dridex)", "value": "4b2261c6a35c325f961a8ac0b3e57ab1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567424, "uuid": "3e067af5-8a29-4230-a173-4c510722a048", "comment": "Malware payload (Dridex)", "value": "669d80ddb7ec5d56289c0f218b79de65b715efc9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567424, "uuid": "9fe5d8b0-8461-4fd4-b63b-bb01e09b5178", "comment": "Malware payload (Dridex)", "value": "47d4a26130c4da574dea45e361f0e79f2951155910c0de90fc35a2bf3b8adc02be7860b7af0e296c2484f2a0e8476124", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567424, "uuid": "3a4a42d6-5eef-418e-9b8c-6eb00f8e27d2", "value": "EF14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567424, "uuid": "4b53678a-e035-4782-9f9e-506a33ae61bb", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567424, "uuid": "36a3add3-9343-449b-bd9f-caaec3b33119", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615567424, "uuid": "a2e39cdc-8311-4941-a488-52fcb4be2e57", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff39fabc-831b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544183, "uuid": "21adfc99-2d44-49f9-bce5-feedf3725e99", "comment": "Malware payload", "value": "761326326c2ad7cede992a236395502d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544183, "uuid": "922289f5-dcfe-432a-94dd-4094d5c4e107", "comment": "Malware payload", "value": "805f29ab028ddc767d6efd0af21b11d22d5751c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544183, "uuid": "a8e844ec-b11c-4c7b-9510-3cdb9d20ec59", "comment": "Malware payload", "value": "62d8c7c1fcd101ad5ac4093c00ab9168b16a89a1bdf2e30389f401959936413bab1cbea764f4482d166f498ca941b77a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544183, "uuid": "a2f98fd1-e4a2-48f4-9d4c-672e85e52c7f", "value": "DC73F103CF669B42E56826BA7C4B1BE87F0224299AC371DF46500B4B3F2533A5B5D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544183, "uuid": "d4e11a0f-d0e4-43af-82b9-14439a101b7e", "value": "1536:T+qB7DfyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBswELfxNh:iqBtZ1k8g05oyDJmipk4vykYARfWBswe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544183, "uuid": "866ac72a-2eb2-44a5-a110-d2916ceab191", "value": 77666, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becf6cec-831b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544075, "uuid": "b5218f1e-4a6a-4001-a050-bef0cd9b33b4", "comment": "Malware payload", "value": "ba4224b4b6239c4bb46d4d14da39a5bc", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544075, "uuid": "be7ad88d-fd56-43f7-bf7c-7179ab0c2ee0", "comment": "Malware payload", "value": "88390eb5dfad360b3657a62b181ee3666289d498", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544075, "uuid": "407fbaee-f54f-4e7f-9792-2adc447940c0", "comment": "Malware payload", "value": "d6b7d0a7a7b532f2ebf57fc5056740f6babe285e9e6c0346461ce71d29ef4d33a92cb2499ce136cf392a36af2ce3bfd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544075, "uuid": "3b10b47e-ac62-4490-bd2d-ccc4dc488ec9", "value": "ACF2F0F1847E9230E16938CAB8064C1883712C6FD7305896EBAA22BE7771C59B5C8C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544075, "uuid": "849e54b1-c462-4449-be47-284339838efd", "value": "768:Cu5U5cWsWNeASqKisZrcvXEgrlEch2rpM7M0TvLeL9cxKQWj:Cu5U59sWNeAnKiQwsgrdX71vLgcAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544075, "uuid": "92bcce7b-3c43-44f9-a89f-95f73837410a", "value": 34432, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447b8c8a-82f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615526260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615526260, "uuid": "e7d2ddc8-5be0-4150-b15a-881321e27638", "comment": "Malware payload (Dridex)", "value": "51ee897448a93b0dc92665e5a34f38dc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615526260, "uuid": "383b2d88-6067-4880-8a64-27a64e493a64", "comment": "Malware payload (Dridex)", "value": "efcba469ff7cb427728ade3dfa6df98315a5bdf0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615526260, "uuid": "e15e5aec-fe24-4097-8390-6f4eaa98a3ff", "comment": "Malware payload (Dridex)", "value": "437fd3d76c7f4fe2be2d379a8b7fbcb74e379db70b2f04fdd210f617b9e7ab34ad3bb0f5439d4339154e9a334d5b66c1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615526260, "uuid": "fffe7861-fe93-4c24-af52-b0c2f06cdfca", "value": "8314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615526260, "uuid": "4de1abb1-7fae-4706-b575-ca6f6c68ed5a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615526260, "uuid": "cd7df511-aa48-4447-b3b7-8e6a92bab564", "value": "3072:I1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:0i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615526260, "uuid": "8b55c8d7-4871-4f43-aaac-cf3a95e8d880", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45526d7-8307-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615535440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535440, "uuid": "77931ec6-9038-44a2-98d9-d6e371445f36", "comment": "Malware payload (AgentTesla)", "value": "5f3486f563cfa3c1883f59f45e74c02d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535440, "uuid": "d2cb6b35-7712-43fc-995a-38aaec404868", "comment": "Malware payload (AgentTesla)", "value": "e33258b4790c9f26c1a86dfa7acf27b8f196da36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535440, "uuid": "bafe7352-0f58-4628-9b91-ca9511057bda", "comment": "Malware payload (AgentTesla)", "value": "a4aa27c992fe773b0d84c874f4e04f3674e3f21d8e176b6d12f3dd79b37562d51885752866455add9dcf2150b8243ff1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535440, "uuid": "4086afd4-153a-42fb-8625-35b271b99f17", "value": "ED329E3DD94EE421C9B2C578709D12F6FB094206B252D12AB857F8E9C864977032EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535440, "uuid": "fe5ba5cc-1437-4509-8a88-681aad2d62cf", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCdVi:aNxUyn0i13LROEiOLkX6Ujnw+3AVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615535440, "uuid": "ae48f7f1-b54a-4d80-8871-b763bc7a5ac4", "value": 11723, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c90a620-832f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615552554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615552554, "uuid": "f7b3d2db-39be-4218-acbd-424c6c362870", "comment": "Malware payload (Dridex)", "value": "401bc9e31d69e2f8cdeb892c0407d7c0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615552554, "uuid": "dbe66ccb-b04f-4b09-92be-374c59a48cc0", "comment": "Malware payload (Dridex)", "value": "8389fa197a7f07bc5bc9b5c2ead1b687079d4b1e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615552554, "uuid": "d671209e-a6fd-44fd-9f25-1d9d1a6596d3", "comment": "Malware payload (Dridex)", "value": "d6258bddcc966ac64f75cf0bb9ccbccb770816695c0a57688c8ec761ad8788970cf4f57c8646b2a5ea10a0f8e789ead8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615552554, "uuid": "6b42d938-0347-4ae9-b84b-fc73d5c7512e", "value": "B914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615552554, "uuid": "0e31fff6-3db1-4211-adcb-7b0e72d3edb3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615552554, "uuid": "67c42350-2425-4d00-a043-214417e30f37", "value": "3072:X1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615552554, "uuid": "dc4bd466-fe98-4b68-979b-d5a4da59823b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9d50ab-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615561174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561174, "uuid": "766258ca-540d-4047-93db-47cd3fb47069", "comment": "Malware payload (AgentTesla)", "value": "f33defebbf974c4fe51639c851d42249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561174, "uuid": "afbbedce-bfb1-453c-a770-9b0a1f4dc909", "comment": "Malware payload (AgentTesla)", "value": "71a3266129c8101139c89ee91a34698ea6ccec83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561174, "uuid": "da86c5d6-2272-4ca0-a93c-3d26cfc6e764", "comment": "Malware payload (AgentTesla)", "value": "e5fb2636718ee67e9af0528072f5fd7df9e47761fa50d62c6f9d41eb965ea5ff61abb8811e76f7898b0b4c0c61ccab92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561174, "uuid": "fe291e2d-3f28-47c8-baa1-36307f994205", "value": "E3A40200B5AAAB72C9B437F41567E6BC17B17C59C027C79D1CC2BCCF3AA2B154690A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561174, "uuid": "513d194c-676c-43c7-a515-6039b4f25b90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561174, "uuid": "560ff82e-d3ee-4676-9386-53c540d0b455", "value": "12288:pF6nJR/c7LAYlKG8Zfjxhw9IDW9ANOc0XhCGa+hu/tM:pgR/6LAYlKG8Zfjn6GvYc8a1/tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561174, "uuid": "bae70003-720f-4014-a88a-c69706baa970", "value": 487936, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8013e2-8373-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615581840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581840, "uuid": "fb25da15-c5cd-4d0e-b6be-741d619e6d9c", "comment": "Malware payload (Formbook)", "value": "bbb95b7fa85fc8a5ed036b545d1818d8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581840, "uuid": "047f9ef6-c06e-4c9f-8fab-0be1ecdc8350", "comment": "Malware payload (Formbook)", "value": "17dc9d430af3f2a6d7b2f7e45845a25a85b10f96", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581840, "uuid": "31241190-badc-4516-a5eb-1649288b9f9e", "comment": "Malware payload (Formbook)", "value": "bd5b8a5a842be5d78302fc554f8f3d9b6b2928b10f554175987869ea72ded4885badd9b4e56ea35f4d0be768ebd77d59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581840, "uuid": "c6b17c22-0801-4075-9d33-cfe5ff7fe7df", "value": "A2E4AE3136EA9218F173AF751BE075819BFFF6237716D45D2890038A4722E81CE9277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581840, "uuid": "51cb8dca-57a3-46e5-a1b2-b6bd21cc70fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581840, "uuid": "d3cbcb35-afae-44f6-9234-0790aac85ade", "value": "12288:ylhLOX/o2sJco5rNYBxLCsnJxJy+yjzq17EjSg2YbVDwrytEK:yPEwM5Jby+yfqpEOwDp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615581840, "uuid": "8da3ecd5-7466-43c2-983b-6d7d16f9e206", "value": 691712, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f284257-8348-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615563108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563108, "uuid": "0adc2f60-bbfc-4de4-a525-f33ee2aea749", "comment": "Malware payload", "value": "2505a7597f78bc3bc2d57c1c0d132cd5", "object_relation": "md5", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563108, "uuid": "3c26c9fc-e04c-4f58-ba82-c204addf062d", "comment": "Malware payload", "value": "d6ce078278f5391e51dde55f83608df8e600e56c", "object_relation": "sha1", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563108, "uuid": "f4678da6-76f3-450c-875b-6c22e6a1b0cf", "comment": "Malware payload", "value": "ffdae82d33f5b0ed10a708fc6a2dfb0bfc999df867372f1ddef44e66fe7cae0ee97c30b520292b02348d535e9501fd23", "object_relation": "sha3-384", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563108, "uuid": "e98e5593-7eb4-4928-8ae9-47e91d76abc3", "value": "FBC302639871BE3E4DE334B896406DA83E7204BC481674F072F11EF05D676DB6A8978B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563108, "uuid": "4e2f887e-8247-4f7e-a149-7e4ff1934ebd", "value": "3072:q9JVBiYBHGdnvxzMLXePgA3DhWhoT12O5CDqpEQPTeC4JNUD66timUd:qpkYJonqLXruDhWh81EFJNkvtifd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563108, "uuid": "d525b5d6-7bf1-40c4-97dc-7398c8a4598d", "value": 119666, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fb2cae-8320-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615545904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545904, "uuid": "5225acae-b048-4e0e-82f3-5cc9913b885d", "comment": "Malware payload (SnakeKeylogger)", "value": "0cb0ce99b82727b4701d9aeab2aa4451", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545904, "uuid": "5a39ac87-ea68-48c4-b212-bb1772ee533d", "comment": "Malware payload (SnakeKeylogger)", "value": "7ed767e14229f7ea119af82caf433d10e4ab1aad", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545904, "uuid": "a1b9a538-f0a3-405b-9326-ea04b178ca52", "comment": "Malware payload (SnakeKeylogger)", "value": "b270e0ada60ac3482ce3fb0a419e63967d76e8110c17f5da1a8d037e825ecdacdee1b38233b09916a210b07347069572", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545904, "uuid": "c469083e-33d0-4515-868d-dfeb81fae846", "value": "51D570D6B628F1B0E38FAAFD6CFA4C5434C6D85DB06E51D536C8628A1811B17C2FBB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545904, "uuid": "49c6be9c-3d7e-43a6-8764-6780146732d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545904, "uuid": "dbab1eb4-9994-45c2-b2d7-0af32f4f0e4c", "value": "24576:t+k28mcqWWrWWe4rEVJNawmNuWGLynq6NlljpZ5X:t+k3mCWr6VNaKknqkljJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615545904, "uuid": "4c9cf63a-75ec-44a8-87da-c570ec7da74c", "value": 2826240, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5ebda0-82d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615514788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615514788, "uuid": "c7d9dd92-a224-4e13-94a0-50f22d8e990c", "comment": "Malware payload (Dridex)", "value": "ff639aca2920deb3982f1bdb21553943", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615514788, "uuid": "3c71bd7f-4dad-49bf-bf78-ef5236f8da16", "comment": "Malware payload (Dridex)", "value": "539537852e092341a4208dd5ec912f69398717d7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615514788, "uuid": "9d204ba1-c55b-4184-aa23-c283acb2b0f2", "comment": "Malware payload (Dridex)", "value": "1d0d3a71d4d664f755605e9350bd151527463370d6e5dc418be5c0caa44d95a88033c1ccda39269f20fc1092e46b1f75", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615514788, "uuid": "2643fc32-9245-4100-922e-d61b37c0931f", "value": "B014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615514788, "uuid": "f5985a86-9c9d-4ba0-b24d-97dc392362c3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615514788, "uuid": "6883309b-a51f-4482-b964-52352d3f2e33", "value": "3072:21i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:+i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615514788, "uuid": "35c74d52-5b65-4856-ba47-7235a00e45c6", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a523b199-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615562500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562500, "uuid": "b01db5a5-cf4e-425c-be56-8bf4b1ae967f", "comment": "Malware payload (NanoCore)", "value": "88337fa2c1ec7c16409a0235891272e8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562500, "uuid": "8d7e9266-b43e-4073-90f0-18a5434beb0c", "comment": "Malware payload (NanoCore)", "value": "2c1c3ccbb3084c314ddb31cde70e68ee52a25336", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562500, "uuid": "87db0a45-d5ab-4895-afb2-e3833de3d012", "comment": "Malware payload (NanoCore)", "value": "bc2f560a20942ce9c49b3a05b00efc1537aeabaa8148c58c0259ee9dff2c3dbc942ddea6f3e825e961b8147b9e14f685", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562500, "uuid": "3b0e03c0-2b7e-47ef-b3a9-6085c1b4823d", "value": "93B52226B759F7B4E5FE9A32205100D30101FAD1AED3D26FEF827E145D82A18295DBF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562500, "uuid": "1d47c4b8-903e-43b5-99db-b0f7ce35fbb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562500, "uuid": "7251feb1-46d7-4c63-b985-d3e96393ad0b", "value": "49152:gESneoyuzCwI0v0fEQ9VvNFowVEjXWmy8ZgsyCFfBNAI1cc:gESezuzMJfX9VMtjXdZgsyCFfjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562500, "uuid": "305cad30-a83a-45a5-9aa5-97a98a9297de", "value": 2413176, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e185c35e-8363-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615575057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615575057, "uuid": "110e2190-ec48-4b57-b83c-671d18a65045", "comment": "Malware payload (Dridex)", "value": "d464eca194d07646235c1974854d90be", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615575057, "uuid": "29eac867-8f38-4f12-b528-5b1496be9bff", "comment": "Malware payload (Dridex)", "value": "0317be0297e1a997ce6c8fd8e71c5cff73362564", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615575057, "uuid": "636eaff8-2344-4eee-8442-e5c0ee102731", "comment": "Malware payload (Dridex)", "value": "a87fa1bb7e9b3344f117d4907fb70f76ec083a56a035ed7c274ac2b9d8690ff0ae0ace1ae552c073b2d2039e979a672d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615575057, "uuid": "9903a287-86d4-4850-8085-fb0439f4dd2e", "value": "2B14BEDCD376F186FFD3CEF09519935656232D42861FE0A9A9C6A83F82BF90C045618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615575057, "uuid": "c64535e8-14fb-4845-ac03-806562b215ee", "value": "554e238e1840919675ea2a74968f15ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615575057, "uuid": "5cb53325-eed8-4d3c-9fd3-a243ac6606a3", "value": "3072:7Tcr3VWYFcXTNZEjmL18zM7cXzAMsT7bXsObx7UpYN4IO6KMZJpSx:7TMFWYYTNKjmLyg7ozALzXsONUhIl/Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615575057, "uuid": "72e75ed4-cde1-4909-9c9c-fa8b13cf47bf", "value": 196608, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785a3922-8304-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615534078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615534078, "uuid": "e6121e22-950b-4456-9d59-ba9fed5d7f33", "comment": "Malware payload (Dridex)", "value": "c970c06b08ab9ae2100160435a816882", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615534078, "uuid": "804c1da4-5bac-4193-a7c1-ff26c7af1a3a", "comment": "Malware payload (Dridex)", "value": "0bdc325770aa1ff84918297e09390eac96dd1703", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615534078, "uuid": "e98237c4-a9b0-4369-8dd1-0dff42d4d448", "comment": "Malware payload (Dridex)", "value": "6f2e6f9f5d1c06a509a1c5df55369c4a3db4b5d93cf62a4f9bb24fd7f3e2d1348910f6692590e1ef21dfc1f524f5058d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615534078, "uuid": "692ca1f2-6bf8-423c-b261-a6dafaf6ea01", "value": "C014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615534078, "uuid": "7ca1be75-5d52-4cae-9163-0271c1436014", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615534078, "uuid": "cbedde24-e662-495b-b314-bef2d26de185", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615534078, "uuid": "d8486a9f-16b1-4786-b196-5fa9a037a469", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a4f7cb-8361-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615574156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574156, "uuid": "f8ce4336-3dfc-411e-9f6a-9d079672ced1", "comment": "Malware payload (ZLoader)", "value": "a24d4a6805dd178271802efb14e94031", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574156, "uuid": "ef638053-300a-4bb0-b171-3eece8400463", "comment": "Malware payload (ZLoader)", "value": "bef7fd321933b3e754fd6ac444b4b9d08c8a9d3f", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574156, "uuid": "4f04388e-cb4a-43b4-bddc-a5dd0c1418e7", "comment": "Malware payload (ZLoader)", "value": "1b20184e31589ab3291b3117acd5aabd6e052df90058f930ca4811e81c926da399d8ec269910dc79a04d3dbdb4871bf2", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574156, "uuid": "531d3d9a-ad2b-46c0-b4c6-0784b5892258", "value": "1354B592A112B1A4E1543F36E82E457C42E6EEA97F58F08B3C08B3B73F772D12E41559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574156, "uuid": "14b19d58-7f52-4378-939e-c4be535308ea", "value": "6144:CcPiTQAVW/89BQnmlcGvgZ7r3J8b5IhJK+nnu0:wb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574156, "uuid": "0cd0311a-30a3-4b18-9376-4e53266ac5c5", "value": 280064, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d89c0c-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560943, "uuid": "445aa9ea-75af-44b7-ac50-2f1dda4fff63", "comment": "Malware payload", "value": "2bff5744a407475af55bd2b624f03a22", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560943, "uuid": "bc680acd-9343-48bf-979a-4af26eaeef12", "comment": "Malware payload", "value": "62c8a988cf5033d614b72812a8dd90b4af81a46f", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560943, "uuid": "b19d84f7-e847-4080-a4c0-2d12066f2d85", "comment": "Malware payload", "value": "9cfe349b1c138dc60a6b51abfa29199123b363b165293571fa61ae2e0fdd17a816ef35ebf1b8eb7e7f847b97863f90b7", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560943, "uuid": "5ddf0814-ead7-4188-a6b6-9e4c1a13fac5", "value": "4A33898CB385D46F4753EAB3EB51D4D0F713F00AF6C610C6AE813598CE6D512E299AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560943, "uuid": "2749d7fb-f7a9-4787-8088-63290c3354ad", "value": "768:+t059T98POTeLfgiW07D0SDZLNYZ+pWtJAVRM4YxUtZYISn33IzC:x5wOgoSQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560943, "uuid": "db25b2ff-6461-40a5-bf69-3d7ebd30feb9", "value": 52194, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a76db8-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565110, "uuid": "9428c18b-df0c-41d8-a49a-008bbc4f55d9", "comment": "Malware payload", "value": "05bd443b1bf6d65c830215f5791a682d", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565110, "uuid": "4c33d71d-9868-4951-903f-bb529b0d20d3", "comment": "Malware payload", "value": "506cdee582e775ba18d39102e0e2452c567b1a26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565110, "uuid": "7893b812-6f27-4cdf-a1b1-3f94fb7f8bcd", "comment": "Malware payload", "value": "4c7bedb6c141317d452b6a0c8ac951fb156c0e129f987b425e27456ea628328ae2fc060ea669ad1d6ac43f349e6245fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565110, "uuid": "c753db61-f0c8-4c01-88f6-fdb0ebe78a0d", "value": "BCF2E0C2C5E0E3B5D1CE99A4086EB58E02F199D1C4F478466EFF266887F05CEA2E4E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565110, "uuid": "60f10f4c-1048-4020-b1ff-08000a4d2e16", "value": "768:bV9yFtj1aUuL3K0A7d2XcuBPX8grlgcz2rpMiRK9xxb5ZxuP3Iao:saNK08WkgrjXiRK9xxb5Z0/Iao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565110, "uuid": "ad5a6b6a-ee6c-4d41-a790-95e374c0ded0", "value": 34450, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c675aed1-8325-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615548383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548383, "uuid": "f3ac5a58-64f1-4e4e-b026-875c6a44f9a9", "comment": "Malware payload", "value": "52a99fde4b4f1427821335f467b3e312", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548383, "uuid": "ee477e0a-f9a2-4f6e-b4b7-b160668854b2", "comment": "Malware payload", "value": "a89c779662883cef5878f97e5a2e89aa4191fd90", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548383, "uuid": "c7384031-8649-43cf-9173-0a15fe7722a5", "comment": "Malware payload", "value": "1980b01f4b5d30e77a2a5f4938d1ced8b06eb2aaa3fcb8bbfe2b75f05505136337aaeac4956b886f232ff17c251cd4e3", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548383, "uuid": "61c3ab5e-c6e2-46bf-a3c0-3f28d7d208bb", "value": "70F05924AC7AC3B30E323188DC09B1AA85B46862520B1039C710C48BA108B88936C466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548383, "uuid": "d31739cb-3dc4-4f36-a704-77dc000bb036", "value": "6:YhHW3HmSdRo+dcFehKBhcM25E3YRV3opedTnSv8SAFYDsokgxZJdmAN+2Ho6edjJ:YZSd4ehKB25d0aojj32RjFkKPn46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615548383, "uuid": "a89ecb81-459c-45e1-9a2d-5831c722e391", "value": 503, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b05948-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564920, "uuid": "ad45bf25-6c6f-4968-876c-b6be1443c5f7", "comment": "Malware payload", "value": "5805e72bffeeb3d01a5a919642a3c039", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564920, "uuid": "21c1ce77-5518-4856-8c98-24af3c3849b4", "comment": "Malware payload", "value": "1128ee1fa4df35f0f2c81eb01b626f346ef8300c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564920, "uuid": "bef7c7e9-b1bf-4ac8-8a42-4f769e0e33fa", "comment": "Malware payload", "value": "573383860f2a0467232496e5c204e4a6c2068edde23fdb2887f3b4ccfe3d8ed9a215349cf1760e9d2c941780c7495efc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564920, "uuid": "46e333b7-6304-4106-b2d5-7086744a78e5", "value": "A2812A7C26482AD1DA0694F396017EA28253F17696DB1EC1721DF8B00BBE66604B2B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564920, "uuid": "08a7bef7-d9d0-48e8-a924-b6ac9f82107c", "value": "96:FHIliJFEaZpp7YU0mUtPHu7id/1J8nYLHjoHMN2Ah:VaVaZatP18nYLcH3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564920, "uuid": "54fab967-027b-47f2-a325-ce8127702776", "value": 3996, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0ec202-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615561225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561225, "uuid": "ee227613-86da-4b5d-8c01-9851b685d714", "comment": "Malware payload (AgentTesla)", "value": "cb59260cbb6e403ddcb837a0d7967747", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561225, "uuid": "58d6c2da-6a5b-475e-81f5-0bdcc379d393", "comment": "Malware payload (AgentTesla)", "value": "71bacee167c2ea3336109ce27eaa172d4e9cec33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561225, "uuid": "c2eec2ae-d5c5-495d-8740-e750648f5996", "comment": "Malware payload (AgentTesla)", "value": "42de84f5b2891350c9d16e9c781051da25b361a2f60a0fa7542f6a738128451d8fd78f669ba50662a322773a81db4dae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561225, "uuid": "7bbe7f3a-a3ce-4c55-b364-77ea9d1e3994", "value": "B025E46E3E50758ECC66C972895CFD33FA606CAA720A9342D0133FD8B97D596CE141B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561225, "uuid": "6a4de413-337c-47d1-9e3a-6d35c23d50f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561225, "uuid": "d28b4fbd-c9cb-48a6-9c21-85e4ead51595", "value": "12288:yKUMZhfHX9RNMV/fSlrHoHClA3nmhLxiq2V2ae7Z/6il4RbWDJiroASZRDdOKydb:yKUMZhvX5M0hFlA3mL2e0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561225, "uuid": "65ec6879-1cab-41da-88f9-a6041e8b3335", "value": 1035776, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58584fe7-82c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615507396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615507396, "uuid": "077d3bf5-1157-4e45-8484-e0ce3c7e8f21", "comment": "Malware payload (Dridex)", "value": "124fb7d6f3eb55340c202174e1de260d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615507396, "uuid": "712cf268-4e82-477a-9637-4dbdf89f4097", "comment": "Malware payload (Dridex)", "value": "6b398b44d7cf48fbabcd2e69af951d8a56e0b46c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615507396, "uuid": "6764b72b-1f32-403a-bbae-d2c2d368dcec", "comment": "Malware payload (Dridex)", "value": "735b12deb43e6dcb87ed4df78123a6ffbbc99890fbd4f89ea13fc599a716606faa4437776124559f83a375daffe1feb5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615507396, "uuid": "4afdf8a8-d4b9-4504-ab67-c1de71d37edc", "value": "1E14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615507396, "uuid": "181924c3-1500-4ddf-894d-e7433a70d2ee", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615507396, "uuid": "ece0ba37-7273-4607-8594-5ebe0e90d9d0", "value": "3072:o1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615507396, "uuid": "bd693ed0-06a4-4ba0-8bad-853632f1d530", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc6b8df-833c-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1615558139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615558139, "uuid": "43f905b8-6218-40aa-b993-04da6cd88704", "comment": "Malware payload (BitRAT)", "value": "51d43d2127ed77d3067acd0e91c45dcc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "FoodLehto Oy", "colour": "#0728A9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615558139, "uuid": "9cd8f54a-3412-436b-80e6-bf39f2ddffeb", "comment": "Malware payload (BitRAT)", "value": "e9a007208d57a1645f6419be170eb976705a7c12", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "FoodLehto Oy", "colour": "#0728A9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615558139, "uuid": "05b8e91c-8e55-43ac-8626-5313d86bc65f", "comment": "Malware payload (BitRAT)", "value": "05212933599f613c1efa7062814b036a8ed4aea2fac5a94ab17063cfcf80d1a61d58bd96eb0b3234de2be86cbe923867", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "FoodLehto Oy", "colour": "#0728A9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615558139, "uuid": "c3e52cbd-81f3-4312-939c-37a82eea4e01", "value": "6D16DF11F6485866C5230E30FA49E37DB3BDA921CA3A41F71395AE1C6D32583F618DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615558139, "uuid": "b5cb2824-ccb5-43eb-baaa-6957b4419bbb", "value": "9e063f4c3ed14a9c5d231fdeccac900c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615558139, "uuid": "7213e632-ce88-4c15-b0e0-075a65b5e05f", "value": "98304:uyrSuQZ/PFqBuqLw1wKpR3srNW8/lfX2/KACiD7WI95XzHTrimWPuxy2F7zedxGZ:uym15wma/lfXkMPuxy+Cimx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615558139, "uuid": "26546b07-35d6-4d9f-ace5-a91de4ed5257", "value": 4058608, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dff413-8360-11eb-abe1-42010a9c0039", "comment": "Malware payload (DoejoCrypt)", "timestamp": 1615573645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573645, "uuid": "93553d26-68df-4457-824b-b9e14799b484", "comment": "Malware payload (DoejoCrypt)", "value": "654afdd7eec3b73a12b75266c47ee25c", "object_relation": "md5", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573645, "uuid": "325b61e9-a751-4613-89ae-5ec26be7c40a", "comment": "Malware payload (DoejoCrypt)", "value": "3cdc8b06d23203a9ec8b44f8445e3c8e3efb51b3", "object_relation": "sha1", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573645, "uuid": "328deed4-0ad9-4f60-9766-185bd68293c5", "comment": "Malware payload (DoejoCrypt)", "value": "14d16777ed1a1538210d92cdeeb4664e74175fdc034321caee4bfa207d516ae550fe73f63b0c22056b5c6d96d4249ff2", "object_relation": "sha3-384", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573645, "uuid": "d3e8d3b8-f8ef-473c-925e-25935c126cfc", "value": "C255CFC3F6C248F2D886097951B3973B5E3AEA10432AC5C3DFA159A59C21ED1673E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573645, "uuid": "dd2c536f-887a-4c8b-b595-5e14a360303e", "value": "24576:SU5NtSlp+uX0S9KICBwWBnMA0GO7Eb+KpPrhyoc3J/WkPfpxGpVZgMCSX:SnkS4dMLyTh6JukPfpxGpVZgMCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615573645, "uuid": "a04c7d5c-00c8-40b5-b7af-d06efcefa41c", "value": 1322477, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b2fd00-8349-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615563513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563513, "uuid": "d6f028b4-cda6-48b3-9a8f-cb471c61775d", "comment": "Malware payload (Loki)", "value": "41722f6ea28e5e10ed15d65752b84507", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563513, "uuid": "5100e553-36ed-47ef-9e4a-405d703348ce", "comment": "Malware payload (Loki)", "value": "05c73e502cd48881cd75466d4f16d3ad287a478d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563513, "uuid": "0ed1943d-cb14-48a9-afae-5702d8665e7e", "comment": "Malware payload (Loki)", "value": "f06d4efb0fae75f126b6462b61fc0e8c9de7ac9997e7011b41ebc313efa0326f7a4a33859cc80fdfe3c81117c7eadd23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563513, "uuid": "3898b8a4-14f2-4cb9-ad9b-7db175d5d99f", "value": "A384234BF171249AB9B42ECE263D7B6308FB0BA8CFC61854EFAE42CE125605744D948D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563513, "uuid": "757b787b-d6b4-4c8b-b740-6e50514cc514", "value": "6144:8wa/CjIRgHJBUeWMY7tN57FTcqlcq3qwRjpKeKRrE/dkTBQwyqMVexTKDVIQ:R0CcReLrnY7tN570qawRIRydtwyOTKDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563513, "uuid": "c25e2848-760b-49df-a8b6-c6aab759ceca", "value": 391884, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b94068-8352-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615567553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567553, "uuid": "6090708e-0df1-443a-8bf8-ebd0cb59328a", "comment": "Malware payload (SilentBuilder)", "value": "2739a59d758db92aafa95fa723456172", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567553, "uuid": "9f628435-3678-4c93-9cc3-632972da4906", "comment": "Malware payload (SilentBuilder)", "value": "5466fe009cf7ee11393085ebd99c16963d49eb0a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567553, "uuid": "3ef6057d-6d2e-4cf9-b998-d2e0cfe3227a", "comment": "Malware payload (SilentBuilder)", "value": "5666ce5fe454576206e20a23839d95e8cf13d4aa50c11e5f739a4164002d75fccae8e235a5081c34054f8d67484cb9ee", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567553, "uuid": "5fe7f75b-a904-4cfd-85b4-f04a86c34967", "value": "27C39D46F6F6AC98D71183341BE742ADA321EC230E6A17873258B311BFB95E00F17796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567553, "uuid": "e2152736-4043-444b-8e91-9981625ba847", "value": "3072:8Kpb8rGYrMPe3q7Q0XV5xtezEsi8ZM+3UBjyqgF2ikieW2DXewVZawA:8Kpb8rGYrMPe3q7Q0XV5xtuEsi8ZM++E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615567553, "uuid": "11658a6d-d27c-4cc0-93c0-9fc302e21d03", "value": 127488, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9b1c35-831c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544202, "uuid": "7b2f8c27-64d5-4cb4-b743-aa09e7f97f50", "comment": "Malware payload", "value": "eb5eee3c6d77942a0106ee55ff7c54eb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544202, "uuid": "925fdd80-2937-4563-b3ed-9cfb8e75218d", "comment": "Malware payload", "value": "75055bd884890bf61a37467d054449a2d5cb92b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544202, "uuid": "02db5f35-9663-4eca-a91a-23e81710f019", "comment": "Malware payload", "value": "9966f2cdc7873cfc5d5063a9af629e1b651023007877864f44f2b4bd480f76d0f2a5956072882c885e49730d19e2bfbb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544202, "uuid": "795399d6-183e-4c79-a5a8-e6d90d5c195f", "value": "4C73F103CF66AB42F56826BA7C4B1BD8BF0224299AC371DF46500B4B3F2533A5B5D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544202, "uuid": "5283ee61-14fe-4a80-9c13-ed581afbfa7e", "value": "1536:T+qB7DfyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBswELfxm:iqBtZ1k8g05oyDJmipk4vykYARfWBswL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544202, "uuid": "130e7323-dad0-430c-b333-9c15f52d1f0d", "value": 77668, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a77876-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1615562469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562469, "uuid": "d7a16af5-60ff-468f-a1de-b5cc278c689f", "comment": "Malware payload (AsyncRAT)", "value": "0e9c762f1aa7ef12b034e0f91ca30145", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562469, "uuid": "745b45f7-43c2-4638-a09c-656b35e8f1ba", "comment": "Malware payload (AsyncRAT)", "value": "1407f5d1177fa09555eb9a298e4164bbe5fc44b2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562469, "uuid": "63d29ac8-774c-4f4f-80e6-c719771f2258", "comment": "Malware payload (AsyncRAT)", "value": "0b94b5ff23b9da1871f233da73f37a96cf5dc632d03026c78c62b4f8cef56a0210bf159c65db943eb5d11e9b8ab72ebc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562469, "uuid": "fad4cfeb-4a12-47da-a582-323cc0c8b462", "value": "EE15E7BF316AF9DEC55399B18C541D6D9770E3EE12CE921270DF95A8C90CA8BCAD00E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562469, "uuid": "7ab11f37-ee38-4833-b448-c05679bd8cec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562469, "uuid": "bbf64cac-0c76-4dca-a728-656f64ad7d0d", "value": "12288:HAdjLaIHTOpTq9XsHPo4dFZJsI1b00g85jdh346Q+p2GdjXAtR6f8SA5V+PEwMGA:DIHT829XsldB1d00rptjvdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562469, "uuid": "d4290c2a-6dc2-4048-a5d7-e6c493285df5", "value": 893440, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f629ea-82e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615518445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615518445, "uuid": "017685fa-2de8-42c5-b073-2a761382384b", "comment": "Malware payload (Dridex)", "value": "e754c2647f56c4cb805817b6e9b0f173", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615518445, "uuid": "fb397906-d7f8-42d0-9b3b-0d7272461560", "comment": "Malware payload (Dridex)", "value": "9c76c53b619e4f2b55aabe3c2a907aab507bed71", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615518445, "uuid": "f6b0db98-9153-4381-b6fa-b5fa9103d3e0", "comment": "Malware payload (Dridex)", "value": "15722d14c819dc37755182e5500ca0ccccd99171a8d994708a5d7c88f073262c543363fd5d1fb74f5a69ba9529aaba3b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615518445, "uuid": "177c64f3-9e64-4f01-a457-f4672de29163", "value": "C414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615518445, "uuid": "bab68153-ec07-40d4-9bee-3218d7f7f2f0", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615518445, "uuid": "4326f1ad-8a71-41bc-bfde-e44787924f05", "value": "3072:21i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:+i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615518445, "uuid": "1761b5dd-e28d-4c1f-8753-6f1d5eb1d0c7", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739ed1a-831b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544170, "uuid": "8767d40d-f099-4a1f-952c-765667d59f89", "comment": "Malware payload", "value": "ccff11a06fd0bf7de414bec5e6f17e7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544170, "uuid": "da51ab45-70a8-4c88-a437-48687eb73fa5", "comment": "Malware payload", "value": "382cb6b008f21f182a79197a40c9bcfb4effed75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544170, "uuid": "708ec0ea-2ccb-45c6-a6e8-4d041353bae6", "comment": "Malware payload", "value": "9c61e42d6e8aaf4aad0af6281eb8143ee80cdf5a8694944404c86a0dec652199c27895627e36d3504620d00fedeb662a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544170, "uuid": "1dfbc8c4-f60a-4f60-81f6-6ff6f5dcad7d", "value": "D473F103CF669B42F56826BA7C0B2BE8BF02242999C371DF46504B4B3F2533A5B5D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544170, "uuid": "bd401388-2b9d-4128-b342-0eca3e97d68f", "value": "1536:T+qB7DfyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBswELfxs55:iqBtZ1k8g05oyDJmipk4vykYARfWBswv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544170, "uuid": "9bc270da-0ab8-4cc3-a049-c68f7f1f0166", "value": 77669, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66ddac7-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564650, "uuid": "148fc53c-c367-4150-852f-6415b17a78e4", "comment": "Malware payload", "value": "2174eb857f82eabe17feda47fcd88775", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564650, "uuid": "8686e25f-9d18-4cfb-bb5f-289cd1a31984", "comment": "Malware payload", "value": "9fa8796f0c93364ec07d0e2b04b63ea624a1f409", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564650, "uuid": "752a9551-db66-4bba-813f-42fb1f5221b9", "comment": "Malware payload", "value": "b065253ad7d4792e7779ca89f6ec0499eadc6f3a35f6a2d64c72d31c7dc381f4b9504a20c4b1c7b6c0af7fe0cc1fa17f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564650, "uuid": "e129f0bf-e347-4d55-a7d2-7d32e3cf8ff4", "value": "FAA4AEB876047CE63A6F576BDA96ADDD03B626239ACB94CD4064B7C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564650, "uuid": "f1c15ff6-515a-44d2-acdb-252d27ae4f7d", "value": "12288:P55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2ehU:jAIC9FkMRaN0cQ3S8wzHDFHzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564650, "uuid": "2980305a-1426-4dc1-9bd5-0d6278809686", "value": 471235, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b8c859-8315-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615541501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615541501, "uuid": "03feba28-2b28-4441-acb7-2f6193a091ea", "comment": "Malware payload (Dridex)", "value": "5bf24a96a0cf7609d1649f3b3015f369", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615541501, "uuid": "46ceee6e-99fa-4e43-883d-a9a0a9c44cf4", "comment": "Malware payload (Dridex)", "value": "e4d2df312569677be4cfcd0e0ec6c1e9cbe30a30", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615541501, "uuid": "9d844a86-ec74-4218-b6a6-9ef29883a6ae", "comment": "Malware payload (Dridex)", "value": "7be353bb22148074f23aa8fafd7b21c0a3956865f5289ecb3166a21db05ca7c389b83ab9132e88aed25ad11b0abdb676", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615541501, "uuid": "c43556c7-34fd-4272-b28b-e19b691fee6d", "value": "ED14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615541501, "uuid": "5c354c13-1ab3-4ab4-ab70-56e0e31c4c65", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615541501, "uuid": "800ae997-78ac-4272-b4e2-3fb982d91e69", "value": "3072:h1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615541501, "uuid": "e3e16de0-5216-4248-a01f-34c343313c3b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b106bdd-836f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615579932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615579932, "uuid": "c29673ef-1dc1-4f92-bf9c-4b79257214c7", "comment": "Malware payload (AveMariaRAT)", "value": "dce40fe214b73d0e6404ee8d25510cd1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615579932, "uuid": "40526e9c-f6e3-4970-b500-614911f5851a", "comment": "Malware payload (AveMariaRAT)", "value": "e6b31b3b3c8ad95554f63415f66ae098632c5a34", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615579932, "uuid": "37c3f136-922d-4e65-97d3-465c61273330", "comment": "Malware payload (AveMariaRAT)", "value": "8b331143ee24c1c658fd7c3700bd59a3e83293592b1468287d43bf502e18588e29473a3ee8cffbfdff905987c31f1e09", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615579932, "uuid": "648349d8-d9d4-4543-b939-ef48659416a7", "value": "FEB4CF40AE6AEB39D99637F45927DB7D0BB02D1DC093D60D29D1798B32E370204E6A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615579932, "uuid": "bdbfee75-144e-427c-81cd-f0bc5fb6d858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615579932, "uuid": "7c2ea4a3-9c53-4f2d-903f-0112c2501226", "value": "12288:4AP3x6UvW+5k0Kd9Is6kxxWlY3kf7PZAqFZ9t+nZYc:4QhW+5kvAs6kxxrK7REZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615579932, "uuid": "4a7ae450-ac3e-496d-8e1e-661d5929ffc5", "value": 516608, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a50d01b-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615560281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560281, "uuid": "ded1d8e1-ce25-42a0-b1da-351944a725b1", "comment": "Malware payload (AgentTesla)", "value": "0a6d07b4c470cb5cbb502486b735c19c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560281, "uuid": "a05ad854-e62c-48da-b5a8-72485f835c02", "comment": "Malware payload (AgentTesla)", "value": "f156619919c7c4d5a467673b4f543f0336499e7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560281, "uuid": "fee47680-6b72-4bfc-8719-d3c8fa3bf2a1", "comment": "Malware payload (AgentTesla)", "value": "18a6944b3e7371f6493311ff06674ca081522c548a38feb955d752d06652863236a955c39430cadfc2ed43f3999bfcd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560281, "uuid": "4d425c4e-30b3-4d92-8b90-f6034be6707d", "value": "C2A423D3EA31084AB51C7786F7C8B18D1279C29BAC4916DEB4F37658876000B7BDD91E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560281, "uuid": "e1ebbb70-439f-41d8-8615-5bff52026288", "value": "12288:UVbaQsHNRHnKh59xckjkVDmdS251eEm2Wh1/:UVb8HNtnKT9xBkZmdSW1E2Wh1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560281, "uuid": "c8d79c24-1a57-451f-ae26-fac0005ebcb1", "value": 458676, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11090122-836a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615577714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577714, "uuid": "3b2f306c-f08e-4dc1-a5fd-2756a6dca078", "comment": "Malware payload (SnakeKeylogger)", "value": "e5ac1ed6a1f096b7d16362595f913365", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577714, "uuid": "54b074ce-5d87-4a38-bfb4-31d028d92947", "comment": "Malware payload (SnakeKeylogger)", "value": "7f56085d47086da1d3f84a48479221471caea23e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577714, "uuid": "4936d5fa-1a2a-4a17-86d4-de669c39c779", "comment": "Malware payload (SnakeKeylogger)", "value": "d33027f292c7e49b08e1c9ff5d84d2d09c5495e2e7f49ace354b8a75fb38e4696cf75bda318b3dfe3b9d5a81c31357ea", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577714, "uuid": "2776d9f0-bf44-479c-9db4-e1ec9ac268f0", "value": "8FD571D6B628F1B0E38FAAFD6CFA4C5434C6D85DB06E51D536C8628A1811B17C2FBB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577714, "uuid": "cc6b4343-44fa-4ea4-a9be-9dfa76367d07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577714, "uuid": "0419fece-0355-493a-846f-b26a8650f2b0", "value": "24576:t+k28mcqWWrWWe4rEVJNawmNuWGLy5ZHfu4kupZ5X:t+k3mCWr6VNaKk5ZHfCuJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615577714, "uuid": "a4c5bcae-07a9-458f-8f34-1306bf8df45e", "value": 2826240, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a8cba4-8354-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615568299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568299, "uuid": "38b60e6d-6c37-4d3c-97bc-36bb7bbef2b2", "comment": "Malware payload (Loki)", "value": "d7aea0c7068c378d517f1b398f1d6094", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568299, "uuid": "1ecc3f00-d410-46c8-bf3a-5e9f011d5315", "comment": "Malware payload (Loki)", "value": "da6326cdf0bee53e414cda4ea6fc7d8e7cfae9e5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568299, "uuid": "0c8ae004-2291-4376-ad02-8674f91a2104", "comment": "Malware payload (Loki)", "value": "5e1c67cb966ce1dffacd11335fe5ae60a8384b890226aefde888deece55cf94bba1e54e1809a3125aa21cb3a4120496b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568299, "uuid": "91b7381e-c920-4107-8a6e-e06dd6066052", "value": "F4C533DB36D0CF24D5CE7370842302EC8CAB6E846F34A914A74ABA7171B367167D92B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568299, "uuid": "27276004-f17b-44ac-84f5-2d6dcf2d28c9", "value": "49152:i4h8xq/fGB3EIdkMfRBwiFnE+/cQwrBunYNufjtvmQuCMjJtux:Feq3mEIdkMfRCiBE+/cpr0YUtVut1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568299, "uuid": "3b5304e3-0813-41be-ba2e-378f45d25165", "value": 2592768, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6032e606-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582571, "uuid": "b9bf6e56-bad0-4cba-8791-621a598880a5", "comment": "Malware payload (SilentBuilder)", "value": "5abb8307c0d57c2ba30f26f71c1d0ac1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582571, "uuid": "0ad78ecd-57cc-4e6c-bc39-f17786d20de4", "comment": "Malware payload (SilentBuilder)", "value": "90b996dc1fb787d5bba8cbf9d96a7c9c503c30bb", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582571, "uuid": "505bfb76-907f-4b46-9d13-49d69f69349f", "comment": "Malware payload (SilentBuilder)", "value": "da2ec93f114fb82dd7b3b4080c8e070ec83606bf1a42ad9f009c1959a3245d01d86008b7939b78a087ee0ce44e5d324b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582571, "uuid": "14e5f2d6-c0a3-4770-9f3c-68d0ba586767", "value": "1ED39A47DEEB462FC5884B3A41B34A1A32D68C4C47D7024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582571, "uuid": "565d47f8-7471-43fb-8deb-84a00fdf45aa", "value": "768:sKdUd4TaBosDAW+u7LlCPVCmgUrNaQTZipEmcPYbWgYvdJky7LefR2bMyDeTZBGM:skUd4TaBo+fF2ha3nbWhfgJbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582571, "uuid": "6c316770-c9a8-4a81-a46c-d2fea4891053", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fc371b-8350-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615566573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615566573, "uuid": "6a180f1a-5e3b-440c-bdf1-13d0c320521d", "comment": "Malware payload (Formbook)", "value": "86b820d9ea72c63b583eac542a2d2ac8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615566573, "uuid": "bec522fa-722a-4a62-b4e6-62e6f9c651a9", "comment": "Malware payload (Formbook)", "value": "83f753b95746a64a39e265ba8be6d8ebc81d2ca2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615566573, "uuid": "33e7090f-7eba-4627-b8e3-8297538ce522", "comment": "Malware payload (Formbook)", "value": "a6347b1df93e69e911b1210d0b930bee78b6f71bbb243cea9840cc53acf5c6d9ac076b7b7ab7879654d8b404ac210882", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615566573, "uuid": "d4eb648c-baab-4c82-9018-bdff4885dc3f", "value": "7D646C82B8484859FD72377648275D3431AF6EE66636DB0F139737765FB32A2102BA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615566573, "uuid": "6371bb0b-d87b-4fc0-825f-5fec0131af44", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615566573, "uuid": "1be54dd9-864d-4ab4-a10c-77acf43776c2", "value": "6144:zT4Dt6iVFI8ELPxyYri9hMic6wWHbUd9LJ3A58hQ1+v:zTSo8ELPcYkhMX6w6ed31Q1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615566573, "uuid": "86965b45-90b0-4a19-b683-386cdc13ad00", "value": 314271, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2ad6e1-838a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615591822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591822, "uuid": "0016bba6-e5af-4385-9be3-a00b76dc2ad7", "comment": "Malware payload (AgentTesla)", "value": "e2dbdef7a9dbea9befda142e5150f0e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591822, "uuid": "9eb0d16c-4a31-4c62-b49f-bac22546df2a", "comment": "Malware payload (AgentTesla)", "value": "01646f932c9e0482d7f0138a8de4cf8aa69e82db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591822, "uuid": "6757e45a-4ce5-47d7-9a14-82cce2fb47b8", "comment": "Malware payload (AgentTesla)", "value": "0a703e367fb9b191285987fa35e7e1cc80b117830280ee628863954173f6f979929a86b2bb5f726f93630d677ca43a15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591822, "uuid": "f38f2d49-c428-44cc-9395-69861d71da93", "value": "D2E4AE3136EA9218F177BF755AE075819BFFF623B316D41D2850038A4722E81CE9277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591822, "uuid": "ef29125b-c845-4279-8eba-a25f74c3c5b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591822, "uuid": "0ab80e73-3143-4296-b42b-47158f2c985e", "value": "12288:VZzIHhVrX/o2sJnoiU/A6R2rHQxpTIZQA+Yl0i/MvWN5hFBoEg8tM0KQK:V9In0zU/72rHGq0iQa5hFBk8S0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615591822, "uuid": "41ae9a88-11e1-419e-955a-b136dfbc4fcf", "value": 719360, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9115cc44-835a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615571056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615571056, "uuid": "506a49c6-9697-4d50-9404-d0458a2b5590", "comment": "Malware payload (Dridex)", "value": "4d0286afb93f9f903e0cfdf11525d412", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615571056, "uuid": "412ac562-262d-445e-a663-ba0984089739", "comment": "Malware payload (Dridex)", "value": "4c7ca9b5ee86130ddda3fbf6e4e56cdb392d3843", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615571056, "uuid": "2e16b7e3-a2c9-4e7b-b1c6-3fb5611444bf", "comment": "Malware payload (Dridex)", "value": "24eecb404c5040a36f01cbbee347d8993e0408d0facd60e64c0ead56ca19f3a23d7c4f3f4d7cb74d0ca5f54d24cc2f3e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615571056, "uuid": "bcfa09f9-02bd-4c25-8abd-4d19f154b34e", "value": "CE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615571056, "uuid": "fe501690-55d6-4681-8b64-f9deb837e3f3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615571056, "uuid": "9fb34fe0-ec65-423a-ad16-04738e959558", "value": "3072:h1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615571056, "uuid": "a33934f7-4160-4a66-8f3a-86ed5988cd97", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bd5c86-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1615562474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562474, "uuid": "8d4e9ac2-ed6f-4422-b8ab-8cbb92f4b07e", "comment": "Malware payload (AsyncRAT)", "value": "4e082b6657e4f260a6ce05288004fffe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562474, "uuid": "c0655485-0759-4844-bc7d-17937bd91a9b", "comment": "Malware payload (AsyncRAT)", "value": "e161cadc10baedfbf66cfbb6b8d089213dc5c730", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562474, "uuid": "59d0571d-50d0-4cad-b3f8-f5302f420ab2", "comment": "Malware payload (AsyncRAT)", "value": "8c50be963db8b451c93ba4102c3c27ecb0a052c5bf9196ae6ba4c0a629790b04b38a788ea9362ae3f06982dedf0c52b9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562474, "uuid": "7de51010-041e-49ee-b63b-b3752c060fa6", "value": "F904022AA3C15C7BF5D351B20D7B3ABCFA3F524562E656878B610C761D225CBC30AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562474, "uuid": "2fc66e6f-8dd5-40cd-bc1b-3a8d94fb8764", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562474, "uuid": "3edc3df2-cf07-4677-ba02-a8d15a0c6e6e", "value": "3072:q3jqjLX1DLPcRM7FWAGNZMYq782ihTnKBSR3PzoxXkoCamj0:qTqjFL7cNZMJihTnKHxXkodmj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562474, "uuid": "37540fd0-c55b-4dfa-addc-0cd63c74816f", "value": 176616, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bc8477-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615561139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561139, "uuid": "c7148a6f-2395-4db9-bdc3-daf7c89d92e8", "comment": "Malware payload (AgentTesla)", "value": "11cb66a805c13f508a0ba465c5343529", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561139, "uuid": "3f21cbcf-51ad-4f50-9af3-496ef9137b95", "comment": "Malware payload (AgentTesla)", "value": "1f0f6e5740af90268378afb2c5f427afdff148ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561139, "uuid": "bc398dcb-c896-4a2d-a762-f96281285451", "comment": "Malware payload (AgentTesla)", "value": "d9458c6e5e3cef2696022da77a06c2a35a40b94ac75a85faa717ebf4bb002e9c3d41113705c86ea97670a60459cda5f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561139, "uuid": "a121041b-f384-4ebf-8c51-b0779b5822df", "value": "7FD4CF2963A08AD2EB7C6B35E1C3A10C137C9D63F97ACAC95EC0B7D66A35F891C0C415", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561139, "uuid": "f8b2a65d-74dd-4daa-b84a-cc89b479642f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561139, "uuid": "cab017f8-cb02-4a46-9f98-d0144672a99e", "value": "12288:Vw3ynRhZZJdIdE4/qTNEO7qRNATrnHYr+F2:V3nRbZ8ZuNN34r+F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561139, "uuid": "93a5df04-7019-4cc3-b79a-17d2def86726", "value": 602112, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf8fd15-831c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615544206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544206, "uuid": "4818f1db-4f10-4587-a24f-62ab7de98782", "comment": "Malware payload", "value": "7215d77c4318b94c526424a117b1cb06", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544206, "uuid": "675cc282-2e97-451b-8910-f287d3be5bab", "comment": "Malware payload", "value": "02c748758fe1ea8dce84a70c9817ea5a133458b8", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615544206, "uuid": "887602ae-48cb-4b30-84d5-16c3b8db36a7", "comment": "Malware payload", "value": "36dc21c07e4dddeb17eedce5bd64e39b9dd6d55cd3c86be3d4713a9ef11de478b654c8e3b0111bfa8f31695b8363895c", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544206, "uuid": "292a41c6-fa6a-496d-b3d4-86fb0529edcf", "value": "D77184B49B66963801430DA2186EE3FEF53403511EA2E8E3E2C0D8DC9655ED8F77ED90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615544206, "uuid": "77bd1f2e-7268-4a50-a1a1-f559c5f1afc9", "value": "48:1lA/YMaCg8K3Qavv40QvtOJ7he4lpBBpVLxDBlYnIJXZhN5h5VPfkYI:zEa8R30QvtOJ3LBrLxDBlY+ZX5ZhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615544206, "uuid": "8e31cde4-cdcc-424e-95a6-72279011e8e1", "value": 3600, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01aefeff-8325-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615548053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548053, "uuid": "6ce64449-7976-438a-89b0-2c0481e6a24e", "comment": "Malware payload", "value": "83a8c5c324eed728624fe1c9a50afe1c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548053, "uuid": "f29d880d-e276-42c2-af8f-66c7b58989b9", "comment": "Malware payload", "value": "7c1eb292b812801102e59f6317f0907eaa77e136", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548053, "uuid": "5c01550c-8f73-457b-b8b1-49be21847dd8", "comment": "Malware payload", "value": "c8625dfa0ea88c965104af1fe294f1de425565ba9d6fe03becb6e5a0770a0aeb9f42afa359933de7556796dea12c8a58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548053, "uuid": "a82e06da-610c-43e7-a38b-1cebaa7c9e97", "value": "8B73F113CF569B43F5A857BA7E8B1B987F01302889A3A4DF06500F4B7E213370A0D5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548053, "uuid": "7ed8fc2b-2419-47ae-a209-fb20e414f84e", "value": "1536:OYfV1PLB55+ByY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBskLfxw:XR5+vZ1k8g05oyDJmipk4vykYARfWBsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615548053, "uuid": "8c75514b-c22f-42d4-bfc4-61c34a0dd559", "value": 77896, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9633d697-836b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615578366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615578366, "uuid": "1da5b83a-49b2-4de3-ba7c-63de76db596d", "comment": "Malware payload (Dridex)", "value": "f0e1ed2ae606f1e1eff61f07e54ce2c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615578366, "uuid": "f0d234a7-a2a4-48af-81f2-0db36e7eca64", "comment": "Malware payload (Dridex)", "value": "55a955616b7baa5b69201983880939aa2768e9c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615578366, "uuid": "2c4b247f-27c5-4506-8e0b-30dd7919a9a4", "comment": "Malware payload (Dridex)", "value": "325594bc2feb654a3db1862b8736d8a463bdeb600466acb89d4e8622694ec51c7d064ab643aac37fe0940227ff47ed98", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615578366, "uuid": "de1954fd-a8a5-4802-ba81-390129f5cb20", "value": "6E14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615578366, "uuid": "cd5998a4-45e4-46c8-98bd-36942abbcd22", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615578366, "uuid": "05f71ecf-e247-485a-841d-24f1e03af659", "value": "3072:T1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615578366, "uuid": "bed677a2-ab36-4d02-ba33-53baad492ab6", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff555bc-8325-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615548399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548399, "uuid": "8c918659-977a-4690-9974-abab388ff4d8", "comment": "Malware payload", "value": "90ae8045e4a2f80e88571317238476bb", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548399, "uuid": "05d94252-bb24-46e7-9e9c-daecdb8a1087", "comment": "Malware payload", "value": "b65a9869174aebd484e7375ec6769c406118c185", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615548399, "uuid": "e9ae2b7a-542a-4e32-bd83-87c5acea9c96", "comment": "Malware payload", "value": "fa579dc305c9f0a3f63e44fb3c35654edea436b267cf8cfb572cf0ee5cc77989c20c19628f461def4ffd989ab73eb88e", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548399, "uuid": "a8c22060-0ba3-4277-a0b8-811f9776e8cd", "value": "4661757BFE62563C98891D7169BAFAB9782042040E47F95754D3FCCC4C22F9DA312985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615548399, "uuid": "2db86b38-4da4-4fd2-baa1-d8e05342db3a", "value": "48:1lHS80qQscfs2qvfJb82QQRXmRYyXa7d/Wv4Ayd4ngkl5aoxAcFimjx2Y:zYqQrU2qHJYVjRYyXa5/24AyGngk3PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615548399, "uuid": "6d9a2769-42ee-42f4-a23d-a98915522794", "value": 3338, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788b9566-82e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615522053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615522053, "uuid": "71cada14-5d98-49e7-9978-0b94b2e3c715", "comment": "Malware payload (Dridex)", "value": "6dc0e0986f7a44cbc43553a8d8831e9a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615522053, "uuid": "dd40185e-d8e9-449b-aaff-9f7089dd5a98", "comment": "Malware payload (Dridex)", "value": "f8b0a891f13d9616e9bbb921a0eebc3181e0a60d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615522053, "uuid": "3562f096-1298-43f9-945b-4bf70f57f111", "comment": "Malware payload (Dridex)", "value": "7000001e168d5e944d5e7e24fb6736665981171b4b567bff8534ba383efdb9431258865241c3f94cd6effa65ee3851ce", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615522053, "uuid": "3082cc56-8486-4bc3-8d54-6c238d520eec", "value": "0E14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615522053, "uuid": "2a81431e-5670-4c4b-b6e6-5cea8bc7a889", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615522053, "uuid": "3ce9e096-fcba-47d3-b1ac-fed8b9bb5e97", "value": "3072:b1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615522053, "uuid": "7e612f83-807e-45b1-8a0e-40ebb2fbe7bb", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321bd5a8-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615564884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564884, "uuid": "784a5a0b-b418-41ea-9fa3-ef8becff6d7b", "comment": "Malware payload (Formbook)", "value": "1911095db6f91a9074475b3fb785af35", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564884, "uuid": "9ba6421c-33d4-40b9-aa0e-b01f77d1ca75", "comment": "Malware payload (Formbook)", "value": "d5bacc5ba2ac282f13424a1475ae218be1d2b4c5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564884, "uuid": "72dcea32-5063-4cde-bad6-c68a646eeea9", "comment": "Malware payload (Formbook)", "value": "db42298177c6c3c8bca44d08e452a3a2a3afaa84af2b6b0b34e6aebb95563c8d46bac26e358cd5280aeb0b08f3b59ab8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564884, "uuid": "fae41ce4-3ed1-4804-83cc-01f864c5f6f0", "value": "5DB49A98A38E54A1CF89577752274D4802FD333EFB4510B8701CA7B537EEA7D8A098B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564884, "uuid": "09e404fa-f220-4f09-9621-e1945a010ec4", "value": "1536:RSNJuCO2jIbk1bQv/3QOh1eFSIqIYWM0eYaKMiYixAu0KewfwL707JyyExPfPvFo:RqJDSXQ6GRa0EXRtZFm/2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564884, "uuid": "06da7f95-756a-4798-acde-13e78ec2f580", "value": 515531, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b288733a-834a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615564241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564241, "uuid": "365417f8-b81f-4e9c-9ad8-901b0cd4b9eb", "comment": "Malware payload (AgentTesla)", "value": "2bb75a79a205701c93773e1bbd5a8c49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564241, "uuid": "28850b3b-8fdd-4edc-bd33-65e311f39486", "comment": "Malware payload (AgentTesla)", "value": "21ef9c1e486c19a0186ecff094efdcfa8eaf6b9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564241, "uuid": "b7c6be14-e37b-4d6e-97a6-bd63ae99c863", "comment": "Malware payload (AgentTesla)", "value": "26553a43a1e144b0c7a339b1a21d19ced06d02ef222ffeeac6ad62748be5753b2b70979dcaff76a5d18120ade0662d37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564241, "uuid": "a621387d-995f-4542-98a0-9a39decc5511", "value": "85D4BF243AFE9019F177AFB95EE074969BBFF6633707D41D2491038A0623E41CE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564241, "uuid": "148b5948-c7f7-4252-8b48-1f7007fe63b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564241, "uuid": "06c9f9e9-efc3-4ac8-a979-9d077f9702b0", "value": "12288:+hWX/o2sJVSFPfGqxq3GHZDcum653cGMGQRLz+bazAxbty1vqZR2+LZ:EGfO3mcum6eNMazA/y1vqZJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564241, "uuid": "514d372e-8039-4915-867b-509e26d4eb4c", "value": 645632, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c637628f-8361-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615574152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574152, "uuid": "eb2691db-4bc1-4584-be71-2f30ca87fb86", "comment": "Malware payload", "value": "5efc92bf4456378464c83394ae2657f0", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574152, "uuid": "eb87aa55-61c1-4414-ba56-2445a6db6994", "comment": "Malware payload", "value": "226aebce72508c35746e5669e3d24f49bf4627ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574152, "uuid": "7a0ed8c5-935b-46ee-8c49-0d56d32a6302", "comment": "Malware payload", "value": "849b4241d0fcbbd5d98f52f005f1b36a2d85a31fe53c8de687d53b0e212aa536af7ce91ce9fb70eec79bad9b397e0015", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574152, "uuid": "b322cc5c-8f1a-4a5e-a1b1-1fdc2e02478e", "value": "6273BF1BED458D83EA28C3B9BF030FCE9B09735D25557AF911B24ECA3F811960DAE059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574152, "uuid": "3f6b4548-707b-482d-b4f0-7cad06f65f35", "value": "1536:MuTxGP/1QbgQywBGmkla+bsaCaWyVvXmkXwhHh:xTc3ygQxFklapalo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574152, "uuid": "12b5ece4-a6ce-4f66-82d1-dff8b7da6249", "value": 75587, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3725866f-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582502, "uuid": "42995483-f853-46ee-8dab-907a67f66237", "comment": "Malware payload (SilentBuilder)", "value": "0d827c9386c0d1069ebb7e6e6bcd8a12", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582502, "uuid": "48c6b93b-13a7-4f3b-a63b-e20bcb39cd25", "comment": "Malware payload (SilentBuilder)", "value": "65dffaf4ba296a44df6eee7f3eb468a44eb703c7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582502, "uuid": "45f1df55-e487-45ef-a8ca-b367b4437fc9", "comment": "Malware payload (SilentBuilder)", "value": "36207db5c2ab0f0550a7939d7e875013b84656fb89fe7f226d07f282a2347f1a9e119950e1814da9c27a88cd1053f481", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582502, "uuid": "2f5e9b32-a67f-4edc-a198-653ed4cadc07", "value": "5ED39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582502, "uuid": "cc2a3416-f9d3-4375-a77d-6c5382f221ff", "value": "768:sKdUd4TaBosD/W+u7VVCPVCmgUrNaQTZipEmFPYbWvYvdJkyzLefR2bMqV7ZdGGe:skUd4TaBoBfv2ha3GbWYXgJqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582502, "uuid": "00411ffc-3d08-41f5-96f9-5b68c939bc90", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf9ba7c-8328-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615549600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549600, "uuid": "a473562b-a659-46a2-bb52-a81229e70ec9", "comment": "Malware payload", "value": "719f6991da0fe2f45db56b114dc10fb7", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549600, "uuid": "82477a6c-9b87-4e50-884a-ac24cf5a827f", "comment": "Malware payload", "value": "4336396113ac736c2a8c75ff6ec85e963c5b7964", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549600, "uuid": "12ae9c56-34b8-4ca1-9cd3-33836354fc84", "comment": "Malware payload", "value": "cb9904aa2fa6c69dde4d3247dfe7b705b78d0ac8a3ae8ce21d6f000216bc4a39a9aae21a97be17f300b96c5d0cb7f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549600, "uuid": "6ce24f2c-c791-4f32-93d3-9459d8164700", "value": "7B8302CDDF12339005BC9A700F25DD3B92898DF60F625C93767CD5A64CB65E01E938AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549600, "uuid": "50705058-9cb4-4469-aea9-affaa00898c8", "value": "1536:J9wBVicOwB/ooriYTKHTj11x6dbvaWsPL3xXXFocjl4RJkPfiRPOX1kAC:Uq8DTuTUgz8UHwPOX16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615549600, "uuid": "8935364c-b91d-45c5-8121-d651c4c39d02", "value": 81563, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65af8da6-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582580, "uuid": "daf4faae-7ff8-4cc1-863a-81e7a3de07c0", "comment": "Malware payload (SilentBuilder)", "value": "dd9935b1bee18e9c31106499f0fb1f5e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582580, "uuid": "97f5fb62-0db0-4541-acd9-206961d6b39e", "comment": "Malware payload (SilentBuilder)", "value": "a9caa0b8961e9615e24e2e8d41e76f03473643e0", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582580, "uuid": "1f5709b2-0d46-4d8d-b007-7bad68b15fd8", "comment": "Malware payload (SilentBuilder)", "value": "562779de61bc32f75e84729a86ab3583d12c96253133d7eb2d7285d22ba456acf29ea0c4e71a81bad3a13e610ec59b12", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582580, "uuid": "3d02c28e-ee76-43b6-9581-cc0d329ee814", "value": "2BD39907DEEB462FC5884B3A41B34A1A32D68C4C47DB424B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582580, "uuid": "af4ae3e0-3f9b-4583-91be-bee2edb4c0f0", "value": "768:sKdUd4TaBosDMW+u72nCPVCmgUrNaQTZipEmDPYbWdYvdJkyMLefR2bMEdu+ZqGl:skUd4TaBomfs2ha3YbWGkgJsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582580, "uuid": "113a4f28-fe04-46b4-84dd-f484a0f7105a", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeef3d70-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615564771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564771, "uuid": "a10009da-66b3-4e2e-950c-48bdefc0af91", "comment": "Malware payload (AveMariaRAT)", "value": "a62026bbe4adb6318f8a12c7ffd2a38b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564771, "uuid": "b2e1dda4-1258-4eab-b82d-f22937f91795", "comment": "Malware payload (AveMariaRAT)", "value": "41a2e600f3f947c41eaf1f62a31a8ad663d3571b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564771, "uuid": "15697742-7a4d-4a28-8274-594fc941dd1e", "comment": "Malware payload (AveMariaRAT)", "value": "4b71a83fd9939a56724df9e955240744b0fa4d8899ba61b9314db3799b778628de051116f7829e38a36246276607a967", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564771, "uuid": "241165d7-b20d-4eb1-a0f6-46f848c7bfcf", "value": "55F36EA8E8A18DD4CB8FC5D9490D7A992033FE7CC5C36C9A4424F6F50B9366F5A1BC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564771, "uuid": "3af43ea5-5402-43d5-a9e4-b5c709afcd2c", "value": "3072:dvPz6cK9bMlX8G5upbisxrQvDySFTlt9As94jankkwqvPX0gbNp7:N9KM5upbiKrgbT79VVkkwqXXB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564771, "uuid": "7d5fc8b6-60cb-430b-8ae9-41fa0ddf4d03", "value": 165831, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa225ecf-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615561354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561354, "uuid": "f665c50d-5aef-49b3-873c-c30de848017e", "comment": "Malware payload (SnakeKeylogger)", "value": "29a71b70a681f6649a3c7db6b5ba31bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561354, "uuid": "8840e1d1-6640-4717-ba55-eb7ba8b8b500", "comment": "Malware payload (SnakeKeylogger)", "value": "3b85e8b0c450dc1798aaab67e5fc19978fd6a870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615561354, "uuid": "192a7129-e67d-4ecc-9e39-5aa0e3c3b34c", "comment": "Malware payload (SnakeKeylogger)", "value": "fbe09d2cbc71f58fbbe77ac731b589c23a99df843ee5f3133bfe70b5d96ab1924c2443d99956f94abc4e763c90ddd46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561354, "uuid": "1e58112c-3dc1-469a-8832-1e49e6674818", "value": "34E571C4B628F1B0E39B8AFE6CBA495434C2DC5DB06E51D976C8734A1861B07C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561354, "uuid": "4d422c75-e22c-4934-bb26-73bb7edf8cf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615561354, "uuid": "80b70a83-298c-4522-a2ff-1b1e3a9e9a61", "value": "24576:W+uh0u1mJtBNk2E1WKiLbvdTO9Gh76E2R6yRmHrtpYEXaW5X:W+uh0u1mJLHEIK6n5N2RTEXa8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615561354, "uuid": "b3fbd00d-ec56-40c3-abf2-3267d21f4b7b", "value": 3052544, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2ebcee-8389-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615591023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591023, "uuid": "a5516f12-be66-4a33-8d2f-bc691deacc3b", "comment": "Malware payload (Quakbot)", "value": "e57b0fec2bcc5e65fd5afd5a90a07aa3", "object_relation": "md5", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591023, "uuid": "0fe85f7c-3915-43e4-bef6-032e60543575", "comment": "Malware payload (Quakbot)", "value": "696cd7d64807e7830943bdccd95e7a2663b44c80", "object_relation": "sha1", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591023, "uuid": "1832e216-6a51-4d79-8070-3e5ce460e193", "comment": "Malware payload (Quakbot)", "value": "b35742e2dc55a1cb6eadaedbb893b40b2be5c39957db0ff31e1d18700d475f7f2205bdc76463de11a945d2f42ed2c07c", "object_relation": "sha3-384", "Tag": [ { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591023, "uuid": "511ff618-9efb-4221-a339-158c6748178d", "value": "CA54D582B112B125E1543F36E83E457C42E6EEAA7F68F18B2C0473B77B7A1D13E5051A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591023, "uuid": "8aaef69d-5f3e-4550-bea1-81e935c8a743", "value": "6144:oFyUkR0wjvF8W3I7qDGvJZqrlh8zOMqxK+XeNn:Qxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615591023, "uuid": "f1a43eb8-c6ef-4f6d-9502-accf7ade048c", "value": 287232, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a33c80-8385-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615589338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615589338, "uuid": "e7026973-e6fa-4961-a63e-58d3e2fc70d7", "comment": "Malware payload (Dridex)", "value": "ba62441d4658d0d2064d0ada1ef98b8e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615589338, "uuid": "dd39ea92-5413-4218-93ae-4449aebe023d", "comment": "Malware payload (Dridex)", "value": "e08b18b7b5486878c0a89d50a8ee38419adf70c9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615589338, "uuid": "7e40b893-7ea1-459d-94fb-2a899960803b", "comment": "Malware payload (Dridex)", "value": "a4434dd15f285347f926e783847fdaf32f734667b977cdd4675ab732fa89535d9b582a303c2dc5bbff86bae4d8a5e741", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615589338, "uuid": "bc340cfa-9edb-4774-b49a-2ef1f2a7e56c", "value": "9C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615589338, "uuid": "3f3a7757-3fb0-454f-bb07-5dc469274b7d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615589338, "uuid": "33a31806-d97f-4c2a-b3ed-2b904e33a041", "value": "3072:o1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615589338, "uuid": "f4bcf919-d74f-4da6-a607-917424101026", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bab911-831a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615543439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543439, "uuid": "1edead0f-591c-4f70-a92b-de9236366a28", "comment": "Malware payload", "value": "c552b61d08cc54cb5d2fff6ae9d82493", "object_relation": "md5", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543439, "uuid": "0296893d-b1c6-4888-9d79-1d1277799fa9", "comment": "Malware payload", "value": "e4b54c2d3c76d206a1a64f4686364a0e7db6055c", "object_relation": "sha1", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543439, "uuid": "7cef4894-c3b8-494e-996d-cf1d7e93d34b", "comment": "Malware payload", "value": "4c1d8c295f41fba29d97ab4dd61cb1cef34ba9fd49ca7527982c06e7e237eb7ad86d6c302c3e5f455d9a138cc12e336e", "object_relation": "sha3-384", "Tag": [ { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543439, "uuid": "d5a38625-4cc6-49f1-bbde-dccbb9f99757", "value": "1D8302F71FF0BBBED06146B7EC4F7409850C5637724E07AB292E64C658CA12989FD186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543439, "uuid": "8546f234-9aa3-4472-a1a7-f8117ab476d5", "value": "1536:6TIjOHH+3OkXMxd0SLHRenldbGfsYct8dsyjRNuFkJWG1Ne8/p1sv6U:6Eie/wjediI2yyL2kJWPCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543439, "uuid": "d1c20bf5-8bc3-4377-8b22-9c5f2dee8e5f", "value": 84397, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d76f1-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564599, "uuid": "ff9af5ad-0fd6-44d4-b334-c175db604a1f", "comment": "Malware payload", "value": "f6103a868ee98af6d135b4b5c37b1bc6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564599, "uuid": "414788e0-0838-4283-a989-89730e95f02f", "comment": "Malware payload", "value": "c72ceeb7a8bc484a7a292fb74ec2694f99c98ef5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564599, "uuid": "19580af0-af37-4fa0-8ed0-f2fe79346ab4", "comment": "Malware payload", "value": "c8cfe5d840a7366997c24a7a90d269ffa8486ab748b69e7026ab94d389bd6335c890a3e2f99b0e161821094dc38e4a3a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564599, "uuid": "be3963e1-5ede-4274-9384-c4c3e4dd461d", "value": "FAA4AEB876047CE63A6F576BDA96ACDD03B626239ACB94CD4064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564599, "uuid": "fb103f2d-7425-447e-88ab-186c6517ba07", "value": "12288:d55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2ehL:tAIC9FkMRaN0cQ3S8wzHDFHz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564599, "uuid": "165f4dc2-5ea3-4e71-9210-810a08a40d22", "value": 468304, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad491837-8373-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615581841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581841, "uuid": "bb466ec4-adec-4068-a5ec-8e1caba4b629", "comment": "Malware payload (Loki)", "value": "c3477d94caf7b8dc32f26afa5fc908fc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581841, "uuid": "a4ca24d5-76bc-48a8-b977-854750fc35c9", "comment": "Malware payload (Loki)", "value": "79dd3082d2b313de5af02ba09082c6c78170598c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581841, "uuid": "07206d3e-495d-404e-8807-7cdff50904bc", "comment": "Malware payload (Loki)", "value": "6ac6047a389f7afd43f63537ec6401af6dfe8c0e6ccd77051ebf2710ec2b629fdd276da96d69e214b1254daed54fabf7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581841, "uuid": "0fffc6fc-1bc1-4cb3-9a28-abc0e4fc9060", "value": "B7255BA123949F1CF03BE77944B5640257F7FA0EDB11D90D7C816B8F2A22F41CA52A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581841, "uuid": "f7d0d562-5f9a-4bb3-a437-6547d9dd7052", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581841, "uuid": "7ebe218a-52c9-4133-8210-039c6fc10e10", "value": "24576:KeWJ3HLxnDFB+08W6rU395ckIow8l8PiLLquoRR3TFbd2A:KeW1HLxRB+08W6rU39563jPifLMhFR2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615581841, "uuid": "a8c9d323-4b65-4927-b0eb-b04c39d8a12f", "value": 963584, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3691736-8361-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615574147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574147, "uuid": "08f94563-191d-4d33-936a-517ab3262bf5", "comment": "Malware payload", "value": "2648b628b9c8fbd92ec6ed0a1f070bd6", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574147, "uuid": "47efad99-221d-4e38-9fe1-4717a7401d48", "comment": "Malware payload", "value": "31605af6cebd1c2c727556cc752250ec4031f644", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574147, "uuid": "6cadbab0-7324-4ec4-bf01-ffa8ef8e423d", "comment": "Malware payload", "value": "9dc34126828d40bc6778dc3acfa247c50246bac30b08766b0305c55e3dd25732daad3125945ebdb3013016fb5242efa3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574147, "uuid": "3f911d90-3af6-4e94-90d2-bdfd23c8be9e", "value": "F414CE10B5D0C0B3F927157148F9CFB609BABC994B2466CB7BC43B6A5E362D28636742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574147, "uuid": "8f1780bc-4ff4-476c-b76c-b2bca033c768", "value": "1232b3783645f8891e4e49e6d0b8d4c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574147, "uuid": "73ab93ff-cdc1-4960-958a-bbfba975d0cc", "value": "3072:lrko0okL8idCGjMoqROu2kx5aWmUb+YlFvCkTFq5vhj9:JRkL8id5YoQ59dQJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574147, "uuid": "d90ca146-275d-40ac-8d58-97ebc21cd97f", "value": 198656, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c50fff-8308-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615535651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535651, "uuid": "e43c548f-c2ae-48b9-afaa-0bf0273e1ced", "comment": "Malware payload (AgentTesla)", "value": "8479c3a09f75402c60b2e1e965c92c9c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535651, "uuid": "54621515-6f60-4097-8d34-56da4a650949", "comment": "Malware payload (AgentTesla)", "value": "7086f520242f92a49a66a7fa949125710daaa852", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535651, "uuid": "2308fd4a-d722-4c60-afb2-fe057c566b46", "comment": "Malware payload (AgentTesla)", "value": "ff9f9ff034b0a881b8b097def838f2b4bdc8e7dfc3d31f54f3353160fe4aebb59dd4107fefa5963436ab2beb67cb5050", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535651, "uuid": "eec4d1db-f2ff-4999-9b22-8a761b5907b1", "value": "72B423D4B95178C5A06ACA3EBCC4CFFE7B160A986477B83B43276BBB05204413ED7562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535651, "uuid": "819b27a5-34ba-44eb-88fd-0ceca960fd3c", "value": "12288:sPKlhQIuAGzASRrnSD70m6CBmO4j+F5MDMMu2kBZikr:NNubD0D5UOA+uLu2kP/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615535651, "uuid": "2221df9d-56e4-4a15-b3e5-2410b41f3b35", "value": 540526, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d702cf-82cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615511114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511114, "uuid": "13e7162c-226f-429e-893e-a2684f6208b8", "comment": "Malware payload (Dridex)", "value": "88cd00ec0493fa3976e552c864bd1b4c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511114, "uuid": "f4e40001-728e-4b23-b29c-b76aab56b794", "comment": "Malware payload (Dridex)", "value": "ed59067538d806e675299a709e48b71bf13d837f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511114, "uuid": "12136b51-920a-4c8f-b1da-860176f1b83b", "comment": "Malware payload (Dridex)", "value": "0df913485e27a1d1bda2e745ab5bac96490f7a1b14ee24d28993c32ddff3ebacd9e56a58ae5739614c59cb58704a6dc5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511114, "uuid": "7674115b-034a-4647-8389-160a6385343f", "value": "B114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511114, "uuid": "2324d0fa-fd11-47b2-bf1b-6333e795cb24", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511114, "uuid": "2e021a5d-4ede-4573-841a-15ac5f6eb18f", "value": "3072:T1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615511114, "uuid": "d03c4d09-8019-47e2-9c86-e82b10746d78", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aca7948-8357-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615569569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569569, "uuid": "8d58560f-0e34-4488-9366-e7a7cf40ebc2", "comment": "Malware payload", "value": "003f68d0462e6eeca8572254920f262b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569569, "uuid": "3cc80e42-e69f-473e-8c53-824978e63f00", "comment": "Malware payload", "value": "6a2ac779935d89fd855778f31c5a1799b311d712", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569569, "uuid": "0f263857-7c9c-46a7-a601-c3c9463d42db", "comment": "Malware payload", "value": "2fd1ac8b6134d33567d4d4b1e362d6f24fe4d1ee33bad1c79748ff24aceeb34acc245a11320f6cea11b320f517589532", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569569, "uuid": "af5c0c3c-92a5-4e3d-90c1-27f54556a870", "value": "84C5331C5CD1CA1BD579DDB8C4A3081863B3AC309754A917276EBE6D6E3BB3043D262E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569569, "uuid": "b973060b-2204-4c71-9136-ded806768592", "value": "49152://YgFw9vYHeTFwJdy81c2wNMpr8kesfPzgBeNRMP8urc7O3hvPQwpOCXffwT8aUd:Y19vYHehwb1c2wNMpr8kesfPMBeNRW/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615569569, "uuid": "9f6c9dc1-0f30-4122-bb6c-911aaaaf3f87", "value": 2675200, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f51fa1-8343-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560936, "uuid": "038c9a52-14d6-4a98-9c1e-6bcf474ef661", "comment": "Malware payload", "value": "e0bda44134718a9b44a3eda74c66e210", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560936, "uuid": "c07f2cba-4261-4c48-85d3-2d26e3407238", "comment": "Malware payload", "value": "2da390f0f3667d440820534e62c4ba6dbc55924b", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560936, "uuid": "3b818fa0-6c8c-4ba5-b073-179a390cf581", "comment": "Malware payload", "value": "e38357cc5032ff7da605540772334ba9856f27943c367393a9aa234e85c12232534d8f06c4d8d2b950df028a16f4000b", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560936, "uuid": "701778af-2f3e-4fbe-9a80-d07765cb25b2", "value": "B023DD1DB184587FE716FE7BD735E4D5E991F01BFAC206C56E0873188E9C422C2EA6A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560936, "uuid": "a8105ef2-eaee-402a-84b0-1c86f79294a2", "value": "1536:63ll6FH0aNMJgK3j9LADVbDsiMds5Bpiz4xA3GzTC:klBaaJgK3j9LADVbDsiMds5Bpiz4xA3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560936, "uuid": "d2c62251-5a9f-4957-a4f1-b398878f8227", "value": 49583, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106d6e7e-8357-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615569552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569552, "uuid": "e20ea474-6249-44a7-97fd-b6dbff555e08", "comment": "Malware payload (Formbook)", "value": "365261729133b1401e40330f88054159", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569552, "uuid": "1988ec38-e628-4b7d-8731-0088875a0713", "comment": "Malware payload (Formbook)", "value": "4754feabb281eb752e8c26126040035f8cd62e9b", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569552, "uuid": "02378051-5d77-4e29-8006-2b5395ad00ae", "comment": "Malware payload (Formbook)", "value": "7313ff107cfd59764893401590d22e706cb7d3d63e2c82051e3608f172cd89c231401f83c60b7bc267b54824a1872bf8", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Santander", "colour": "#FE8BC8", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569552, "uuid": "ea0775be-febd-46eb-8a7e-94077c3fb9b0", "value": "8A152344F194A653F9B125B3482BDBF1815ADD683798C35B23483E2EF0753223BEE15A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569552, "uuid": "1520a49a-e227-46a0-80e5-31372d930a8e", "value": "12288:TCXvg6S4J7KkZgf9nrpdXftNYV8RnbqFm45GNBCbVz5O8+gTj54V/2MAM8DTWXjC:J6S4ArhHoa0m4oNBCb+rsj54V/skC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615569552, "uuid": "d83ceee8-9870-4ad7-9a87-e4b5f35a1dda", "value": 883200, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ee2272-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615560159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560159, "uuid": "24c301c6-ee29-4d49-980b-00c080273c7d", "comment": "Malware payload (Dridex)", "value": "91eb17958ebe4e226c6a4663e6efce7b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560159, "uuid": "43946901-86ee-4899-99e8-19bcd22f8f2e", "comment": "Malware payload (Dridex)", "value": "a689c2fb8775f45f28bab0a151d6564080e60bad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560159, "uuid": "84ec7470-be65-4a24-8103-b1a8f25c20c0", "comment": "Malware payload (Dridex)", "value": "c2ac02c5352c73ef45117f40d8840155a065dd65066781f41d48ab8f9344cc75fd019e434520c694fbd4322bbd2fdbf0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560159, "uuid": "a8f5683e-9507-4847-ab32-9eba7733b97f", "value": "CE14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560159, "uuid": "412f5262-f554-4ef5-b395-80e820912afd", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560159, "uuid": "8eed4a0e-c6c5-4ea3-9ef2-8ba84de4c29e", "value": "3072:31i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560159, "uuid": "c4e76bbe-112d-4366-8398-77a272bf6a49", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b1be53-8363-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615574710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574710, "uuid": "2b82b875-88f5-4c25-9f3e-4ed668e9be1b", "comment": "Malware payload (Dridex)", "value": "4f66308f340b3b40c2554275b663431b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574710, "uuid": "72725c09-9807-47ba-bb62-f136c4a8bd7a", "comment": "Malware payload (Dridex)", "value": "4fd8d045db41c438e5b19685f8931d55db53194d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615574710, "uuid": "75481792-66a1-4e8e-a5d7-fb1c7f10924b", "comment": "Malware payload (Dridex)", "value": "3a1415878c2d057eff7b7ff15f197c88fb776d27900ca02638633fcba46a490eb1ce2a3cfe78fee1f3bc015749ebd8d5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574710, "uuid": "cd41f4ee-5ded-4f1a-b65a-c7e27183386d", "value": "9014AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574710, "uuid": "2bbb453f-974e-4d74-afef-3732a6e30dfe", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615574710, "uuid": "80c524cd-dda4-4b99-946c-2caaa1ef0193", "value": "3072:j1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ri78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615574710, "uuid": "4e4761ba-0e30-4bdb-95c0-50ae9642eb48", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde284dc-837c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615585734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585734, "uuid": "856c9711-df9b-4354-a5b5-42a7c60b05d0", "comment": "Malware payload (Dridex)", "value": "f0df99f7eb053fb7f8febeb08b99faa5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585734, "uuid": "7550ded9-ae8e-42aa-9925-e63a781b61b3", "comment": "Malware payload (Dridex)", "value": "060f02c7ba1d6c359afe68d846a1641951a3867d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585734, "uuid": "bcd6fc29-b8b8-4fd3-a0af-68451a7d6e46", "comment": "Malware payload (Dridex)", "value": "6c3c68dafc5bfc0d3e703aa9fc26f3f7b8d733d2ab00c32af10ab449855c96f6ef3184c17a56cfdbfa16270d7f1ec7e8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585734, "uuid": "fa8c6389-1499-4982-829c-00677ddb34ed", "value": "7314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585734, "uuid": "fd71688c-edb0-476d-9586-3fa62810f661", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585734, "uuid": "86a34dcf-2b76-4864-bd92-6297be49e4ea", "value": "3072:z1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615585734, "uuid": "3caf36b4-baaf-4c6a-90ac-77c68322107b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e9bbbc-8327-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615549264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549264, "uuid": "64e64b3a-9b5a-4b47-9af7-182873ce7636", "comment": "Malware payload", "value": "ebfe3cc196712a6c4b09fcc2c9790fd0", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549264, "uuid": "af5262f2-c5de-4cb3-a1f2-c3902e0b644d", "comment": "Malware payload", "value": "4d7ff94ed182398b2d7d80cbb74dee383011276b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549264, "uuid": "37a18242-119f-42f8-bd48-98855385ba32", "comment": "Malware payload", "value": "9b9c32db5a76b9b967831e089d3cab662d5fee92587d676adc1cc29242f8057f09debe4aa8861e2950caa61e88cb6357", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549264, "uuid": "e34c8017-e5e3-46e7-bc32-e50b8299f5b9", "value": "51F533155749C4B7F0BA8B391D58869EC7F77A1005781FA6B39C1AFD33A19C8C92C38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549264, "uuid": "563b105c-113f-457d-baef-15d7d09eca7b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549264, "uuid": "afbd9fd3-91a0-4951-8e71-3c2d5a5cf548", "value": "98304:S4H4DAQUO0GkALWUzDdfWISzjhGTdPi1TRJ:kDAQUO0Gk0WC5Wp2MTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615549264, "uuid": "2f29f2f8-a9ba-44c2-890c-e2292b8d5b07", "value": 3438092, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c127d5-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564491, "uuid": "ae7c7b21-4207-4adf-aa56-4ac98c236f14", "comment": "Malware payload", "value": "88fb2c962d8027721132b6707ca2f05a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564491, "uuid": "0fbfcb02-88d2-408e-8284-33c8c7d71cb9", "comment": "Malware payload", "value": "008e00ce5aae149243c86892903e92c9e0a0eee2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564491, "uuid": "fda86df8-a324-4554-b0a7-7c448a3cb2b4", "comment": "Malware payload", "value": "f2555cc52b16b4492d263f8c3390a220ddf0ed38471de1381dcc45b046662a787f32056ee8b3191f9bd40d82590f8d3c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564491, "uuid": "5e212107-47ef-49d9-9aa7-d89a70c4b1d6", "value": "FAA4AEB876047CE67A6F576BDA96BCDD03B626239ACB94CD4064B7C305A3335EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564491, "uuid": "1a775480-a4ea-4a56-b2e2-b0a4a27514c8", "value": "12288:g55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2ehr:iAIC9FkMRaN0cQ3S8wzHDFHzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564491, "uuid": "7f587853-2fa9-459a-bf12-af90b16b4b4b", "value": 469634, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9340116b-8311-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615539707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615539707, "uuid": "a26a84bc-9529-474e-9ccc-48a1427c22b2", "comment": "Malware payload (Formbook)", "value": "24a1e388b631a8e65f138a7c34c4d724", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615539707, "uuid": "a7affba2-c3d7-4242-a898-6c034902eabe", "comment": "Malware payload (Formbook)", "value": "892e16ddf9fb5f48fad982e534be167ebda0f567", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615539707, "uuid": "a7ad600b-51c8-4f21-a94f-da2511463742", "comment": "Malware payload (Formbook)", "value": "1282d538657a019d37af4ec03b1e3aef72fa3913633d648842ea195d8cb633eb546477fb6794ea7d99f8eeb68c5bfd8b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615539707, "uuid": "a66ff3c5-d323-4e41-be13-4e7165a3da17", "value": "0A05287B21BFCED0E1736BF41D802D6E8775F3EE26C9911834DCC26AC211E8A99D1169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615539707, "uuid": "7f10daf1-8806-4d17-ac7e-aa3c9590894e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615539707, "uuid": "1a96c135-9cef-48d2-8921-7535ca6ca91b", "value": "12288:P/yMfyw2OrKlEqyg9+nNxIfXr82OtkImEMRlZplOBR7o6jOX/o2sJ9R:njfL7qyuVr82I7MPZp0BxPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615539707, "uuid": "35ec8fc2-8c11-42d2-9692-befe04056b6f", "value": 866816, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ca317e-8357-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615569593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569593, "uuid": "c7b10b88-8d20-4368-857c-758d80621938", "comment": "Malware payload (AgentTesla)", "value": "1f253b6f5cbe8cfc134068375f1e3af1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569593, "uuid": "931346cd-6dc4-48e4-a004-6394546ea029", "comment": "Malware payload (AgentTesla)", "value": "1b69b7b76597dbb5e546d1224e8c3564e384a5a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615569593, "uuid": "e0e3e374-9cb1-41f2-a78b-8c800619c2b5", "comment": "Malware payload (AgentTesla)", "value": "437fb9e84034f0f9c9b942b271541d22f3eca5dfbff2923c31a1b2f557167c2cdc43a92517283d0fe61eee8c1c90c298", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569593, "uuid": "6d060b88-de10-42d7-9a3b-21e0ae909fdf", "value": "64052376F9DD0B6BD0F326B4292FDFB4560CCD141609CE22A202761DAA33376A6F0759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615569593, "uuid": "452f1fd3-21c2-457a-95d9-824723c386eb", "value": "24576:SyerzIGXIic7pqBP7PkILK4PrkUAgWd8IHMg2yH7:AzQjg7KlgWSIsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615569593, "uuid": "cc3360ab-1e05-4230-b3f3-9d5f24078535", "value": 841216, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4beaaf60-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582537, "uuid": "bb5cea59-6e72-4a41-b7a8-20ad4ea9afb8", "comment": "Malware payload (SilentBuilder)", "value": "b5e91e716e503c5e5d445656e5368ac5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582537, "uuid": "c3e386ae-88db-43a9-b7de-8598f845d24e", "comment": "Malware payload (SilentBuilder)", "value": "2e18724490e26f691f63566e0790a954ea804df1", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582537, "uuid": "fb0aca2f-0bff-4f5c-aa08-0ff468fe80ad", "comment": "Malware payload (SilentBuilder)", "value": "467b053a198a97b9fe579a7daab62480503da1fa46c31545b2679b44ea5a7360c053f78555e14eff1dea61858eaaad23", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582537, "uuid": "b00246ea-cd33-485e-9d51-b603d3ceb966", "value": "B1D39947DEEB462FC5884B3A41B34A1A32D68C4C47DB024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582537, "uuid": "34830ff7-535c-49cc-ac6f-fa0d7be1533b", "value": "768:sKdUd4TaBosD/W+u7VVCPVCmgUrNaQTZipEmFPYbWvYvdJkyzLefR2bMqV7ZdGGu:skUd4TaBoBfv2ha3GbWYXgJqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582537, "uuid": "65416ec3-3edd-499c-932a-a890786382f1", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f7c58d-8349-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615563520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563520, "uuid": "338f90cc-cee0-4ce2-b99f-445fe01bd159", "comment": "Malware payload", "value": "9ddc8687b740cc8995928ff6f6ac9d4b", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563520, "uuid": "310d220c-53ef-4636-a788-2bbae537b34d", "comment": "Malware payload", "value": "8c5dddb0d75e378803b1c338b1235b04f26d836c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563520, "uuid": "ac46b367-f17f-4b80-ae62-06d166e47d59", "comment": "Malware payload", "value": "e910b4bf196f8a3e22c7581a2fdff8fdb49fca291addbf6e592c1bd437b163b3004c6dae474c936c981fa9dcd3936a78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563520, "uuid": "265d08b7-8a2c-4a74-bbe3-7f50d291a7b9", "value": "C10149829444989ACBB32180BA30D058DF7826D760647C9CBDAD01924FB39DEC54725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563520, "uuid": "8742cb28-cfe9-4140-a390-cd81d8eafdd9", "value": "12:TMHdakCG7/aJd5uSGYCz0uZtdzfdRfVIcoi/hMr1+9Bm:2d8G6GYCznzDNU0MrAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563520, "uuid": "d56f13e0-87ce-4804-b71e-67f84794c078", "value": 674, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df8403d-8379-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615584366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584366, "uuid": "c0b5e1e6-360f-48df-9a1a-e08663dab1fc", "comment": "Malware payload (RemcosRAT)", "value": "4ec47f55b6048f999d083104079213a8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584366, "uuid": "4eb5827c-bbcc-43f7-8294-60dadf60841a", "comment": "Malware payload (RemcosRAT)", "value": "8b4bc2b5a348e81d907ea29fa42886ebf02a3b74", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584366, "uuid": "b93ec9e6-a5cb-489b-9423-7d5455793ec0", "comment": "Malware payload (RemcosRAT)", "value": "37a334f0cd2253dd787ed76cb3a8f8261aa86c8e305ae9d4ed479d1029961beef2f50e36727498b71e197cb9044317dd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584366, "uuid": "3cde8f68-2f24-431e-83fa-1ab7c29c6c0e", "value": "F3D423723FB616930A2C5708307561EB64E1A80165A96F9E2FFC96DF3788F3392525C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584366, "uuid": "94ea5c7a-d46d-47b6-8379-76a1c5f90df0", "value": "12288:OHB1ASItuZkITJ0vbV3QvCVM3Bw+BI1vBTfH7JzUN28:gmJtcpmJ0CS3DI1vBW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615584366, "uuid": "b4a4202f-c5c6-47c7-9857-00dc534b1f22", "value": 641597, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03d6369-82f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615527810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615527810, "uuid": "76df21b4-6bbb-4f21-b5bc-a6ae07e1e76f", "comment": "Malware payload (ZLoader)", "value": "5b07166d4e9d0452250371025dc303c3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615527810, "uuid": "53e08bc3-7d14-462a-8d15-5519dd616f42", "comment": "Malware payload (ZLoader)", "value": "c6d2a19e6f83d20978332db21c56e7f15c8647f4", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615527810, "uuid": "bcde424d-acad-4442-bb12-dfd370415515", "comment": "Malware payload (ZLoader)", "value": "9aeff6b35eebd66424fb62d3d31d1dcce76bbd71a2f0d1d727165cae4a0a2677bea9e05e922ea41c6edbcd8bbab49c64", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615527810, "uuid": "b71d9bed-cb15-491d-b6c6-5a316eb4902f", "value": "87C2E20EA15279ACC757153DD06F02F2AA1C84513D256D527482A14F27D38EB33CB67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615527810, "uuid": "a90822a2-f785-4003-a32f-3effb4fb8412", "value": "384:AvjlNG+Py8UKXzkQIWOQ77lj9Sc4rSdJeh68P/9l9okQ8JIrlUlM9zZP0JGd8GJ0:J4hJhvlj9SPr+S/9bfQbxlP0J7fLrcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615527810, "uuid": "af379412-d7f2-4b40-8c61-fd7e04cae1f3", "value": 25756, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb84ac0c-838d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615593032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615593032, "uuid": "aa73fbf6-73b7-4981-82d3-0f4bb9adaba2", "comment": "Malware payload (Dridex)", "value": "5876bc7506ef58ecee56ab8bcfe80793", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615593032, "uuid": "ae5c4da5-9cfc-42d7-a541-998dd11920ff", "comment": "Malware payload (Dridex)", "value": "2c1c4982f91eff3411545cfa5f9b24a0fc84a664", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615593032, "uuid": "720620e9-3787-4a4a-a544-b8564fb3c517", "comment": "Malware payload (Dridex)", "value": "b8ca92cfd15a597a9b875f8392b32a2e0e6fea63a3e96a63d969f8ac2b77105715cca9e2c0b6e3d0d04928b1da67fd65", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615593032, "uuid": "9482d9c9-6cd1-4082-b916-b4e448eb782a", "value": "EE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615593032, "uuid": "814b3db8-ecd6-4b2c-9dcf-de05c002a512", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615593032, "uuid": "8cc99fb0-b0aa-40a6-905e-c8ada4e83d2d", "value": "3072:J1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ri78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615593032, "uuid": "d299a9b1-b05d-4f27-9f3e-8d56d73ae90b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a30dfe4-8348-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615563153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563153, "uuid": "ccb19a64-6528-47dc-863b-88dd8a98e6fd", "comment": "Malware payload (Loki)", "value": "08a0a05307e779ecce678b0d056d41d1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563153, "uuid": "9d43cd73-fa46-4ed8-abef-6511c62d3dcb", "comment": "Malware payload (Loki)", "value": "edc0d2163cbd26824ecdfa186241b6deeff728c9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563153, "uuid": "a2101212-2c36-407d-9e97-9a01742f028f", "comment": "Malware payload (Loki)", "value": "a279330fa116446debaa580ff1767c0e4608697c21b3fa2db5e517affa0c4c37322e2775ec25ca58b8f32e363db9a1ef", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563153, "uuid": "7f943326-72bd-4d21-b726-62984a709de7", "value": "A5E312AEB05748A7D3A730D1EAEECCA9C3804B34526DF5C0EA6065D7E4970BE5C8D718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563153, "uuid": "2cd1b577-794a-43b3-882d-cede93fc1a5e", "value": "3072:DyDO/5Sdra3GH4zL3jRVHdquiOG8aFAUIfotNuVb9uTdpDLKlLdJP:27dW9TGZqVb9KdtLIJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563153, "uuid": "170a0404-6d46-48bd-bfa7-a9686653fe8a", "value": 152487, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c821e5-831a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615543436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543436, "uuid": "86b32f42-fd62-4175-9622-32ecee446bbe", "comment": "Malware payload", "value": "12d62888e14432cd9c6e09e13ede91c8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543436, "uuid": "46fc20d4-1696-4978-acf3-957f5e7eaf1e", "comment": "Malware payload", "value": "78086c8357c3bb40d2771a9da512e9d055497405", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615543436, "uuid": "07c4df8e-1585-4511-96b6-ab52061e16e1", "comment": "Malware payload", "value": "5507a0fbdd0e89465ce1613c7bc896009eb506fab20072d9ae5d6a0ff2b26de7b38c59402b7458771b9a3df3950ec24d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543436, "uuid": "e7cb64cc-cf48-4368-b605-156d63661cf7", "value": "8873F103CF669B42F56856BA7C4B1BE87F02242999C331DF46500B4B3F2433A5B5D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615543436, "uuid": "ef98a805-de4e-4a50-abf8-45b23851d183", "value": "1536:T+qB7DfyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBswELfxoKe:iqBtZ1k8g05oyDJmipk4vykYARfWBswD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615543436, "uuid": "47412e14-0eaf-41a4-8efb-2d6103a97c30", "value": 77668, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220243e3-8336-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1615555408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615555408, "uuid": "36a8f957-8f78-4019-87a4-da644991a2b5", "comment": "Malware payload (IcedID)", "value": "6dafdbbcce799f332033b3498aebb8d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "gziploader", "colour": "#4BBA4B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615555408, "uuid": "32a10ede-7661-4da1-ad91-d2e8697004a2", "comment": "Malware payload (IcedID)", "value": "a09e3c1b36e0c543d64c1417c070b011d0b6eb23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "gziploader", "colour": "#4BBA4B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615555408, "uuid": "0ec0e9b3-b8fd-469b-bc4d-02b7aef4bb6f", "comment": "Malware payload (IcedID)", "value": "61730212ee8e3a4be7a1b4c43d5a1aa75ed27c7faebfb667cef6f903f71d0383556acea5fa45077bfd6524fa7975a5f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "gziploader", "colour": "#4BBA4B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615555408, "uuid": "0c24294d-794d-4c8a-8306-e9f636d646c9", "value": "01F3AAE4BA87475EC6A3532E4E5F222C8B6B7FF438991267D449B4B2231C9C493E710D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615555408, "uuid": "e7b1968b-690c-4cdd-8899-7e4cfc97c56b", "value": "d14057461eacb743f435ebef80e56b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615555408, "uuid": "fbf56a41-86bb-454a-b34c-a8f9849484b9", "value": "3072:VycQnMgTAfxzmMsMSMRtgxStChixNfpBFTK:DQIg6ChiDhBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615555408, "uuid": "fb20f9c1-797d-4e6c-b3fb-49f2cbdcb657", "value": 159744, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afb02b4-835f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615573140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573140, "uuid": "d1562922-3fb8-42bb-a704-96ffdb53f2f8", "comment": "Malware payload (SilentBuilder)", "value": "87fc72adcb395eb083e076dc1cfa20c7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573140, "uuid": "16c8b2f5-5354-4e29-b129-2f89ce882fd9", "comment": "Malware payload (SilentBuilder)", "value": "67ac98ed09742ddb0a1ab68fc590c73cb2f79b1b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573140, "uuid": "112a7991-a885-488e-a3e4-76b7784756c3", "comment": "Malware payload (SilentBuilder)", "value": "5890a996fb22af4aa2865e2f98cb90f41dc7268addac1aa7c28cc0cd7c82e576b1531edcf3e49c5e682ec2fd1b05df59", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573140, "uuid": "b6e2a575-b76a-462f-90b9-57da33e6c2eb", "value": "2DC39D46F6F6AC98D71183341BE742ADA321EC230E6A17873258B311BFB95E00F17796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573140, "uuid": "64e00fc9-b4aa-4d22-9f1b-4d82198e2747", "value": "3072:8Kpb8rGYrMPe3q7Q0XV5xtezEsi8ZM+3UBjyqgF2ikieW2DXewVZawQ:8Kpb8rGYrMPe3q7Q0XV5xtuEsi8ZM++U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615573140, "uuid": "5a1a8c38-fd36-4e21-ae72-ff68f181336b", "value": 127488, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98639ab8-8338-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615556466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556466, "uuid": "375deea2-3e41-4eab-b777-88074f2b1943", "comment": "Malware payload", "value": "f25640c927b6685a1fe08dc38f454318", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556466, "uuid": "28c66244-9ca1-4781-ae75-992a72e2898b", "comment": "Malware payload", "value": "d8b10abe9b3c37e400541755a81a0110b37afdcf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556466, "uuid": "de086a83-85ca-4af6-a6ce-d1a4c5f7293b", "comment": "Malware payload", "value": "4c2947d5ee0502528d820af6f926acd32813754e2118618d8df01c208e034b044b7102bff997815a82163c5bb7ac270a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556466, "uuid": "a3a85531-c09f-46df-8c8a-8255b7317714", "value": "93341240A5E859A7D3920BB2DAFE1DE8350613578FBD9AF7F14879A08F449C588FA240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556466, "uuid": "d425f785-f2c9-4819-9093-bc4cc49a645b", "value": "e9d449f6096771e97dd1ec928d3007e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556466, "uuid": "ec7e6408-e2af-4571-bfd9-5ec4cb534afd", "value": "6144:Yrem3ER88oSJz42KXZ4dkWY4GBOm39H54urP:1/Zo720Iw4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615556466, "uuid": "0a239eb4-f5b1-4352-a034-29f1760b76c4", "value": 234496, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f884bd05-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560922, "uuid": "773c02f4-3d42-4694-880c-03f5a53e0fc8", "comment": "Malware payload", "value": "22b41a91ee7fa726de23a301d9443cf5", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560922, "uuid": "f3713c7c-e964-4b23-b8ed-6bc7b19f7178", "comment": "Malware payload", "value": "e76111e4a48a3d11c41fe7b5af916e5e0022d947", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560922, "uuid": "d7904276-b081-4f7f-82a7-593d48e1c4b4", "comment": "Malware payload", "value": "d260c14374741c767c1d2285ca44d8175de7ec844c7ead0ca9ea8e4ecf2d81644045aa14384e1ba3fcb532f7b96b4104", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560922, "uuid": "3c11c888-2bbb-4b86-b19e-e4f2803aaf47", "value": "C433898CB385D46F4753EAB3EB51D4D0F713F00AF6C610C6AE813598CE6D512E299AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560922, "uuid": "e88faa03-3a69-4a7a-bac4-eace9a8e8bb5", "value": "768:+Tm5vH38POTeLfgiW07D0SDZLNYZ+pWtJAVRM4YxUtZYISn33IzC:x54OgoSQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560922, "uuid": "4ed6474c-ddce-4eed-9560-e44cfb468720", "value": 52168, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c0a4aa-837b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615585244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585244, "uuid": "a68279c8-2cf9-4b3e-8a74-8abca15eac26", "comment": "Malware payload (Quakbot)", "value": "9e26842ba409e75c39530bab8090c877", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585244, "uuid": "c1492875-53ec-4899-aadf-3a138585fd32", "comment": "Malware payload (Quakbot)", "value": "efef96c0d078c363b62c77bb94e2cae6b4777c2c", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585244, "uuid": "cfc48d23-d2a7-4f29-abc6-06b66148d1f8", "comment": "Malware payload (Quakbot)", "value": "ebe71d11015176861321cb02d1b5a7b5d8e3630f09bf074037028e54173f765ee8a7d6463ca6179bdb08964119e3305d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585244, "uuid": "770c4f93-1b4e-45dc-8d7e-d46df6b40ad9", "value": "DEE4AE76F2C0C837D13336389E5F5398AC39BE503929584A2BF42E4C5F79B813A65297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585244, "uuid": "f2e2164c-def6-488a-8c2c-ed2bb533c610", "value": "4e9f3e18e004e6d20398d8164f8a5a15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585244, "uuid": "a41b34e6-1352-48ff-8130-d8b1a178934e", "value": "12288:t5udlKZoeTeV0hYpp7zXQeJAuPbu7W+uD2gresPfPVUBAvLk:tMzKVTfkX9AuTquig1fPAIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615585244, "uuid": "21eca0b0-2236-4d1f-b4b6-326336b473f0", "value": 714216, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01305edf-82fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615530442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615530442, "uuid": "a697af75-e22a-49d0-af0a-0bb00b97c66a", "comment": "Malware payload (Dridex)", "value": "5afb6d76c3bcd1f6370ee9ad3257b096", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615530442, "uuid": "2dc045dd-1580-41e8-abd7-af4b2e150e78", "comment": "Malware payload (Dridex)", "value": "d8667a560ea016928b3ed1c4554ffd862e956a1e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615530442, "uuid": "8a03a02d-39d0-4271-ad66-7e1bde80d7bb", "comment": "Malware payload (Dridex)", "value": "a1f0600e53fb1af253d96ed14e6e065463e0ea0f08ff85b388afff42c8b0d86e8693d4face56936365b5898d69b1d532", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615530442, "uuid": "22a15eed-4440-4675-9b68-deebc807c138", "value": "2F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615530442, "uuid": "dac91c62-3722-4dc1-8f6e-379fcd044fcd", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615530442, "uuid": "916ce398-b5aa-4ca1-9edf-3de0531bdb6d", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615530442, "uuid": "d8c5fa16-3208-4a97-9fdd-91153760f6de", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6277ee-836a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615577706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577706, "uuid": "10731325-1317-4f77-b796-fbfd950e9d41", "comment": "Malware payload (Formbook)", "value": "2ba1022a54bbea2f9f692bca6db317b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577706, "uuid": "2278a0fd-16ea-48e5-8b5f-5954bf172a63", "comment": "Malware payload (Formbook)", "value": "9aaa3841471cdf38ee047f73cfabd2929443a7df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577706, "uuid": "1742f6ba-13e7-469e-82b6-40e4282a1e01", "comment": "Malware payload (Formbook)", "value": "1b2c48480afdebf9e07ef6f6f6867e57f078f16436f068b52b52c8dd358bc8e02fc7e35122bc61ff53ab7dddafcdb434", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577706, "uuid": "4c98cd36-b9c3-48f8-a2c3-7693a3dd7d49", "value": "72A4F010A9AAA331EBA477F45917DABC1BB47D66D133D75C0CC2BCCB3661F0A4980A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577706, "uuid": "7b7d1388-ee2d-4e80-936e-6f7a2e62acfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577706, "uuid": "f79db47e-763d-4046-a1dc-d65cc7c2b8e0", "value": "12288:mcN16VUF15I5hidf0vDbblDPBrT2i5QGVv6p:mc8O15IsdcvDbb1PBXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615577706, "uuid": "3e42eaf4-dd18-4db0-aac7-097adae35384", "value": 473088, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4088c367-8353-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615567915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567915, "uuid": "a955c56e-e4ba-45bc-a1cb-5cf7c3c1cfad", "comment": "Malware payload (Quakbot)", "value": "6450467822867ea3e304b627fd409a26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567915, "uuid": "057718ae-e387-458e-856a-debede2f1949", "comment": "Malware payload (Quakbot)", "value": "99468fc2ec15304303a13440e408a29c57e68f46", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567915, "uuid": "d508cd36-30d1-4422-905a-461554103a16", "comment": "Malware payload (Quakbot)", "value": "b7876e69f9e6c193785a538ba18e98df84cdeba1f029d88630250749cb1c9ba3e103ae1026fe8861140f60a7cca040fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567915, "uuid": "4ead3393-fe63-4f17-95ac-92041d7167b4", "value": "0B42C0AF0015FB96DE32C8ED51C7472DCB7E6155831C9A3E05B130677774B634803A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567915, "uuid": "38ecff3c-3b9f-423c-b67b-2a4f703377aa", "value": "192:YPgJly4P6ZO1Qc+LwdBI3TQe7fihXdk7fAEJN76MYUQbTl6otN5ejLBXEMWbuCEy:JJC0x+LmBoUeWhXsRDbiT7tvcljmQiA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615567915, "uuid": "b58a7fdc-8f1c-4299-8261-08d8369c6675", "value": 12111, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d601eec-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565064, "uuid": "8f6ef524-779b-47aa-b127-f62c4bec640c", "comment": "Malware payload", "value": "2f9d38c5f8c329686e4aaa2692f03f3c", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565064, "uuid": "e26f55fd-b68a-4552-b870-159ce1096ca0", "comment": "Malware payload", "value": "c63d05a6746f1bbe20072aedf3896f9e12cb17a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565064, "uuid": "0c4a7d36-4a14-43ae-a1f3-03d58c632676", "comment": "Malware payload", "value": "a2e8cd6fa7a4168031d863f36d085f5c29f198190409469ce96e95c1ee2f4ea4d69bd165e3f572555af20dcff9dfa82d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565064, "uuid": "f1891882-8056-41df-9ed6-764eca4a7e46", "value": "46F2E1F0487DD3B0E26A58C6FC164C4983B55C5F9B306855E76B12BE7331C59B188C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565064, "uuid": "a6e5ba0e-f4d2-4548-b46c-d7dc1cb67d3a", "value": "768:Gu5U5cWsWNeASqKisZrcvXEgrlEch2rpM7M0TvLeL9cxK/FHQT:Gu5U59sWNeAnKiQwsgrdX71vLgcspY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565064, "uuid": "ffd5e7a2-1e42-446a-8be7-0f6bc4909a0a", "value": 34428, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2691847-834d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615565502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565502, "uuid": "beca7b52-754f-4add-80af-18da79a5df4c", "comment": "Malware payload (SnakeKeylogger)", "value": "6ca6859c5bc6b275258ec99eb9ddfadd", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565502, "uuid": "8bba9da4-2c96-44cd-8965-9fbc508077e0", "comment": "Malware payload (SnakeKeylogger)", "value": "82ffd70162f91764510496434db35ee062c50b7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565502, "uuid": "6df65462-1034-4362-bf91-bcc56365b115", "comment": "Malware payload (SnakeKeylogger)", "value": "e62f35ea524aad8139a453c867be0f54564f6e8570d3bbe4f1d662312a728e390dc507a15d38792e691d6ab4632e0a62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565502, "uuid": "b8fb775b-149a-4fda-9c11-38f1cc54846b", "value": "41A423A91FBF275C2EF471CBDE8B260ED759374C87E81E08A056052543E14E68AF77A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565502, "uuid": "6d7e4407-080a-4888-9be4-be2604afcb9e", "value": "12288:csypObpYeLG2IibOtIJl3MyBTwkajSVB6/A+34pB:cBpOSe9IjyX3MUTwklK/8pB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565502, "uuid": "eac8d3ff-56b2-4fd3-b834-1c08445726fe", "value": 450207, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dddff8f-8355-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615568716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568716, "uuid": "d168c44b-c04b-48ba-b4b4-5c845310b8d9", "comment": "Malware payload (Loki)", "value": "2d0d6a843ba8ec728885bfbca1170fb5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568716, "uuid": "674c2969-738a-4d91-86a9-524874732037", "comment": "Malware payload (Loki)", "value": "59fc77efbd459fa0f94121f0e8f9b730e0d9d6fb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568716, "uuid": "90036d9a-3df9-4b49-844e-7a0a78209f46", "comment": "Malware payload (Loki)", "value": "155e7bdfc1e392174b000c63467ee933c0a6fbd092c529cc1e7e60ab5cfff3985cc3062477aee9ba081785f27b09e631", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568716, "uuid": "0586c0ce-3451-49ec-a57b-1b6197a2b359", "value": "54C5335A6982FF83D4096DF492EE6018F0287CAEB911D9027029B25DF1F35B126C7F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568716, "uuid": "d17be3a0-c519-4c13-840e-928404718d1b", "value": "49152:3qtUzmZ5/5nXYrllxNJh0RNsjWSok7qbxtOPKN8rUqtmtB3sJhlyS4j:3qtUqZETx7YSLstOSNSwtBoUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568716, "uuid": "0dac5a20-048a-453b-86f8-d1bc70e6c8dc", "value": 2553856, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81277599-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615562440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562440, "uuid": "f763fb7f-e50f-4352-acee-a1012013931f", "comment": "Malware payload", "value": "1b8cdde8b4af51b557323f059ca954dc", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562440, "uuid": "48c86122-1f32-4aef-bf23-ff03a738a856", "comment": "Malware payload", "value": "a5962f58aafb14a630b8d768d43f4172175d48aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562440, "uuid": "8ec5bcca-f783-40cf-b8fd-28ab7871070f", "comment": "Malware payload", "value": "8d4c19716c8fbd693a668955ae0af2ef256d0c01542ec7c2eebb74d6b06b48f41363c61854a018a5b07aee107cf90224", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562440, "uuid": "0b21f715-9f8a-4bef-a14c-33a33a4360e7", "value": "76C4233415D5ED488092EDBD1E84E32543E3D2A11BCA5AE1E6315D72AE227FB8B1CDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562440, "uuid": "96cd0077-bfd1-4db9-9a7b-1e3bafa84ab0", "value": "12288:qOACf/rCy+dQLZt4LGhf8IQhDMu/yLL6eCcT5Lv3JxT:qOAC7C5QLgIfRQhYlH6s1L/TT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562440, "uuid": "ac93a01d-1955-449a-9c60-81002aeca1c9", "value": 552273, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1494523b-836a-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615577719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577719, "uuid": "5c2c4823-fce8-4235-a3c2-485b94ae3c7e", "comment": "Malware payload (SilentBuilder)", "value": "e090402a8daf077e501420ddb825fde5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577719, "uuid": "8b8cf7cc-3c69-4975-8724-2db36594147d", "comment": "Malware payload (SilentBuilder)", "value": "1d18d06935d7f16fb2008599b4c607b7f341ebc4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615577719, "uuid": "902c9327-5156-41c2-bd7d-4e9101b515c0", "comment": "Malware payload (SilentBuilder)", "value": "56fc15398de2eac257452fe00bb4a0a333a022c7bfdf0bb45a3653e44fa0031b578bf19017d0b05e34f77723f0ac59f7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577719, "uuid": "bf9f2478-4a14-470d-a7a3-3037022985f9", "value": "DCC39D46F6F6AC98D71183341BE742ADA321EC230E6A17873258B311BFB95E00F17796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615577719, "uuid": "ebc64f99-1d85-4cf2-9680-c6d20d307575", "value": "3072:8Kpb8rGYrMPe3q7Q0XV5xtezEsi8ZM+3UBjyqgF2ikieW2DXewVZawU:8Kpb8rGYrMPe3q7Q0XV5xtuEsi8ZM++Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615577719, "uuid": "1c7c7911-7a58-4cb2-9ad6-b80ce6318a2f", "value": 127488, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a038a2c-8353-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615567931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567931, "uuid": "18d58a53-a899-471c-a877-75b44f386ccd", "comment": "Malware payload", "value": "74e80f7279a8ae7f91d4aa2e3b3c91ef", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567931, "uuid": "7900d82b-493b-4b6c-81ee-b77a563d3812", "comment": "Malware payload", "value": "4bb8b38437b1fd62f999b1af33dd8173296db842", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615567931, "uuid": "ee7d424e-ebe2-423c-81ec-6dd818c5c2e4", "comment": "Malware payload", "value": "cc86ec672b6d7468c9ef75d8288bc2873d7aeae02b898708ca8d189139a22a080c44f7732386578228a119e978580221", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567931, "uuid": "397862a6-bb59-4d77-8fa9-58c9abc1b591", "value": "9E62D1F279297032CBCC559F8652DB4EB016BC1BB085BE1B536D799E53DCA92002FB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615567931, "uuid": "5c657ddc-bb23-4c45-8272-43913be907df", "value": "384:81+rjI63tFPM9IU8tJgn37OOuw7owYDx04uK:vrn3tlyIU8Lg3wgiuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615567931, "uuid": "ca5c3138-fe19-4581-8444-1121218de323", "value": 15199, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d4aa24-8328-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615549613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549613, "uuid": "137e41f4-fd61-4764-8746-c2502ea9de54", "comment": "Malware payload", "value": "e893a72af3164dd85551dd6616571243", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549613, "uuid": "96e2619d-f800-4bca-bd01-01a65e168c0e", "comment": "Malware payload", "value": "d4831b3aef665d8bd9c7ec772c9c3f2c86c22c53", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615549613, "uuid": "b44f8e72-e78a-46fb-a22e-835425623ef7", "comment": "Malware payload", "value": "4f7d46bb7299d386adebc73995722f3b00dcc6fa68975421ec4a5d1dba1ca2228458bc65d1ebbb7ff7a58d1845d153df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549613, "uuid": "02e57f37-b6e6-4e4f-9b07-a7fbe1cb97ce", "value": "4973F113CF55AB43F5A856BA7E8B1B997F0130288AE3A5DF06500F4B7E253370A0D5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615549613, "uuid": "efaea93b-1257-4cc5-8ff2-b7bf7bc43a15", "value": "1536:OYfV1PLB55+ByY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBskLfx3:XR5+vZ1k8g05oyDJmipk4vykYARfWBsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615549613, "uuid": "4b6eaf63-8c18-419f-84ff-5da543c9a018", "value": 77897, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d93c25a-8338-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615556475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556475, "uuid": "1a3663e5-e0ff-4d39-aeb0-18254d018aa3", "comment": "Malware payload (Dridex)", "value": "336ea3b48becd5a3a2c5e3b7f7fea052", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556475, "uuid": "a0856700-b35d-4f38-a2af-3bd0637c03a0", "comment": "Malware payload (Dridex)", "value": "c1326ed421bc91c951c064303351e4865cf76bdf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615556475, "uuid": "14581672-928e-409d-9ba4-66ea70345f99", "comment": "Malware payload (Dridex)", "value": "9f1b52558bf89829e22a4e739e929157e0f5d4c00211ea671e5cff5f6e35d0351442d5883e651a89aef4b801d869f64a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556475, "uuid": "f6609864-a8b8-41c4-98d8-c4b0f9d289be", "value": "9D14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556475, "uuid": "98e09f5e-e3be-45d8-87d6-b15d4d16304b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615556475, "uuid": "45fda374-67ff-4e25-949e-5b9674955cbd", "value": "3072:T1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615556475, "uuid": "8d229a32-68fd-48e9-b00e-27a3ebf26d6b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c0832b-8355-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615568734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568734, "uuid": "9c0fe084-50e2-4a2c-aca5-c7b4b756aead", "comment": "Malware payload (AgentTesla)", "value": "1b1fd9624cf383ef02d4a06c0af70410", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568734, "uuid": "0e5ae1f4-f595-447d-a5e1-ccf8b74ecc0c", "comment": "Malware payload (AgentTesla)", "value": "0eef885b05847a39fa9751e2f7de0347508a43b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568734, "uuid": "77ec1de5-d305-4147-a657-69245824813f", "comment": "Malware payload (AgentTesla)", "value": "0de6e52c0e52fbbb0ffe71be55c2f6f1961757dcee73eb4a5e7c7bf707b6dc3d3b37cb2f1812349908e477efbcddae07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568734, "uuid": "71138299-ff5a-4cba-9496-9303d6b63b65", "value": "82B4229036CE4F93E99338795D6D0B4AA93FEE095F8BC867D22C740E61F07779A16810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568734, "uuid": "0c731ce0-5f50-46e3-814d-90d464c4ad83", "value": "12288:NCRvqeXbmLIxQmkhLxXBcecDvBlLfAcD8xl:sZ/mIkh4DZSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568734, "uuid": "495fadb2-3a21-467f-ae40-844738998644", "value": 535552, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbd6207-8379-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615584261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584261, "uuid": "f7a06b66-4a88-4c04-988d-2321f5dc1458", "comment": "Malware payload (Formbook)", "value": "4f7e8ca16a054f3669cada845e9adc6f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584261, "uuid": "11536c4b-8c22-418c-acb6-e5e8eb1dd8fd", "comment": "Malware payload (Formbook)", "value": "cd81cdafa53ddda950084d18b0e461459b97bbe3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584261, "uuid": "31bc4c07-c7b8-497e-8411-68dbc702594a", "comment": "Malware payload (Formbook)", "value": "057f53bf36380d877a00d5d3831e918a75779651b0e1396a2df965ac569308d27163c986d003f8f423259e8e94c56947", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584261, "uuid": "ce79c47b-70e8-4cf0-8b63-6f1279ec652b", "value": "CE257C1127986F18F07EAB7B89D868019BFEF913E322D96E3CE152CE1561F40C950B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584261, "uuid": "12201a49-e072-43df-b685-ad4d81058fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584261, "uuid": "a5dd44ad-c725-4d75-9dc7-3f67b00aa656", "value": "24576:5TqKcle2hDGP0vsTnpSE9GVcoKbxi4hch4hAqIdbihbUP:5TqKcle2hDGP0vsTnpSE9GVob44CVqI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615584261, "uuid": "b4aa008b-d6b9-49de-b87d-5a280b0f1739", "value": 1041920, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af74708a-8373-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615581845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581845, "uuid": "4603a78e-3442-4264-9425-e2c515fd6de4", "comment": "Malware payload", "value": "06a26618d2de0866e7cc1d177daf253a", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581845, "uuid": "dfffcb78-3d8d-4a96-b084-02b864b6827e", "comment": "Malware payload", "value": "197898ba22e7eaf4d1e099aae619fef65a759fd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581845, "uuid": "c4027f4e-40aa-4fed-9831-4e4c54a52172", "comment": "Malware payload", "value": "51aca161c52b8a39171f31fc826fe00c2f2413410d89bb33bbcfb6f64a1580491008409255b15a8b53b3b1b0830b7716", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581845, "uuid": "6fdc1b39-e1b7-474e-8cae-6a9b7f42bb93", "value": "F665AEBD8C0A52C4F34F42A65350F0BAA6F7F15625C84E16352EF1B613EBA56BCDC086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581845, "uuid": "75b4eff1-f208-4aa9-afcd-f832d43a86d8", "value": "24576:tfS3CzMhCl0dWBar2HSvuD4PoDmTiXiKOXYXcnm7W/yr5OFmPsJsB63lq:tqywA+QQCyW8w6WyPosmCKEAUew4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615581845, "uuid": "ec5e4313-a1a3-41cc-bc85-1c6b92b01cfd", "value": 1453340, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80020fa3-8354-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615568451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568451, "uuid": "aaaa98e3-1c07-442c-a9dd-65b8e819f7d5", "comment": "Malware payload (Loki)", "value": "bc45a034880ebf20815c7a8ec345e8ba", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568451, "uuid": "35548cc1-50c6-40a0-ad54-901fb781618c", "comment": "Malware payload (Loki)", "value": "f7e67d0463d61ea9d36dcce12d00a4d952305339", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568451, "uuid": "f1ea434e-2537-459f-8817-2511c857909e", "comment": "Malware payload (Loki)", "value": "d882396d7f1f4a101de68d92431ca6870dba6a00549a0c1f0a4c25384eb4d15a7b51944e02dabd6f84cf64339323367c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568451, "uuid": "98be0631-ed79-4aec-abed-9ae8f526cc4b", "value": "90B533607ECB5F17E39A7B36ABD759248268CCF4AEE14D07E20D321359725B05AC0A2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568451, "uuid": "6d48554a-3f17-43cb-9565-bf90b5a285c2", "value": "49152:7HQl8DC9wf/xOvLMRBhLlAARTV05wnzYeLkfJjPPkvRYZyCWxMQqyNzm90:jQli0w0LMR3L2x5wnzotkvRYhQbNO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568451, "uuid": "d66e1295-8900-4cfb-bd0c-453cb88c0e48", "value": 2390528, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40741279-8382-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615588101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615588101, "uuid": "a734baad-18f4-49db-bf1b-20b4e5a1b577", "comment": "Malware payload (Dridex)", "value": "63aef159c66cd637cdaddf52cc41cb56", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615588101, "uuid": "ce45fbcb-11ff-4707-bd76-e9c6d3dfe470", "comment": "Malware payload (Dridex)", "value": "6bc871de3bf9ec5b2835c7f9c3741b91c93b8b1e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615588101, "uuid": "69031aa8-f467-4aed-95bb-6733afdc33a5", "comment": "Malware payload (Dridex)", "value": "c4bb482a75560feb3915e9d6ec9debd1c528a87a81d8c5c1ca6e248f70d8462db7025aec1a4e65467d26172972d0857b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615588101, "uuid": "94b66d07-1fff-4210-83fe-0f6959d39419", "value": "C014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615588101, "uuid": "c064e4b1-56b4-4d84-8e74-b9f9f3b368b3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615588101, "uuid": "bb04e7c3-6197-47d0-9505-c392b25e413c", "value": "3072:/1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:di78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615588101, "uuid": "8c65d23b-63c9-45f3-9955-977e841c4b5c", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56209551-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582554, "uuid": "ad25560a-73ea-4409-b998-42a2dd6d48fe", "comment": "Malware payload (SilentBuilder)", "value": "6c87d721511475212b2aeda5636e34e8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582554, "uuid": "ba6d7bca-3fc6-499d-98b9-ed2887714031", "comment": "Malware payload (SilentBuilder)", "value": "08c219a973dbc94e64a4587c7881a8fb60e6ac54", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582554, "uuid": "9abc653b-d2ce-447a-af3b-100c3963959f", "comment": "Malware payload (SilentBuilder)", "value": "f4168ce166f68bbb5c02aa36679b8965768270e8e1765b4c494018b6293931db9d74a041931a90ae2e36c03b9799c8e3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582554, "uuid": "904021eb-d4f2-45ae-b921-6bdf04f17925", "value": "A4D39907DEEB462FC5884B3A41B34A1A32D68C4C47DB424B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582554, "uuid": "34c72a09-f4e9-4aa1-9a56-09cae4dde925", "value": "768:sKdUd4TaBosDMW+u72nCPVCmgUrNaQTZipEmDPYbWdYvdJkyMLefR2bMEdu+ZqGV:skUd4TaBomfs2ha3YbWGkgJsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582554, "uuid": "29bc2d48-da43-4f2a-b80a-9e71afed47ed", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52c7910-8349-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615563816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563816, "uuid": "da34899e-6447-4f99-9e86-68536e064be8", "comment": "Malware payload (Dridex)", "value": "3ebe6357914fd599328d06a35f1b6c71", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563816, "uuid": "fbb71472-6a36-4cbd-aef5-8a1043dfbd4e", "comment": "Malware payload (Dridex)", "value": "389520c654bff7fa449daec1f3c18c8219694746", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563816, "uuid": "7b55d343-9317-46f9-906a-f7fd3710c63e", "comment": "Malware payload (Dridex)", "value": "b5a5b45622b8ba3bb43544df55d84f6017e4e5225be8b266c37254f17182b876b7b46932b2664fe4909960feb88ff321", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563816, "uuid": "76b77189-a24d-47af-9d99-ceac1196db21", "value": "FA14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563816, "uuid": "2e3c0de9-7e1c-4435-8b49-8800598b7133", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563816, "uuid": "c1d48878-fb92-4637-8d19-da25a08952d3", "value": "3072:u1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Gi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563816, "uuid": "b3b23e32-fa83-4bf8-9361-b43134e0951b", "value": 200704, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d1e1a1-8308-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615535659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535659, "uuid": "c4449dce-e6a6-4d6e-82ea-0a75628e847b", "comment": "Malware payload (AgentTesla)", "value": "5fc863a1c8b32ebeda3cdee060b85db1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535659, "uuid": "bab187ee-9f98-420a-83b6-a4676c16e936", "comment": "Malware payload (AgentTesla)", "value": "2783120ce91eff5704a101dcc4bff3cf54da10c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615535659, "uuid": "69291b92-e007-4a89-bddf-77b605212f38", "comment": "Malware payload (AgentTesla)", "value": "f654046412d0da6eb6f0d94ae754edae5cce519e576a39460257043e6b4bd5b9f41ab6073912f0f50c316ce7001475b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535659, "uuid": "e8266a1c-351e-49d4-b2a9-bdf56cf64cba", "value": "BBE4BE343AFE501AF177BF795AE471969BAEF6733703E45D2890038A0623E41CD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535659, "uuid": "264eb946-c60f-41e1-b857-a1f03b691764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615535659, "uuid": "af2c6d38-f134-40fb-a85c-68b58f21c942", "value": "12288:539X/o2sJkqzF2oBTgtWJM5N5Wb8QA7+mnT4J7pemZ2o5GWGJS0ni:ihVgtWJMUhCt4HeM2o350i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615535659, "uuid": "22cb6035-59d8-4018-bac6-13727bee8474", "value": 659456, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ac777a-834d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565315, "uuid": "82c3aa74-3db9-4558-a646-d8b935962478", "comment": "Malware payload", "value": "d12a5958caf8e7c013d8293b69fc9951", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565315, "uuid": "a2cdfa88-76a1-4ba3-abb8-77e3b54e9852", "comment": "Malware payload", "value": "7facc541293993aff65ce3b3d305097c18c09aa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565315, "uuid": "3a12f8fe-c9b0-4b54-9bd6-9a206fb4aaf6", "comment": "Malware payload", "value": "ae24f7577b2a9dd93fe8db47928bd585363e4d84c0b2b7bb4f86f8bf153fc0b72753762d0a59bad6fbeeb061781dbfdb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565315, "uuid": "916d723a-2b68-4ca1-bcd8-5655fe72b300", "value": "B464232165A0E03D274F8664AF1FD6D8EDD7EF4227581B0E4EC425F27C9803995F621B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565315, "uuid": "ad46217b-f6b2-4dcb-bc32-d600c5c90cd3", "value": "6144:ZPGlp5Pbc/z/WSvOEHTm1/G9Igpa6Cc0F2yjJFNpoH1CQGHTLLS7dqdIN64z:sC//OZ1eJa6Cc0FnjBaHQQILLSwdIN6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565315, "uuid": "921a3ba8-6e06-44a0-a895-e7dd5228e8d4", "value": 321965, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5882a2a5-8309-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615536172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536172, "uuid": "561216c2-c625-4101-b6d6-81a6ce740d7b", "comment": "Malware payload (AgentTesla)", "value": "1f6cab7c2b8fed5788077d2e5ccf4031", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536172, "uuid": "213943e2-3cf9-4346-a24f-b3b373bc08b4", "comment": "Malware payload (AgentTesla)", "value": "f11b518584267631069cc43d572d479cc9e18631", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615536172, "uuid": "765a8dea-6506-4c4a-9e71-f3734986a744", "comment": "Malware payload (AgentTesla)", "value": "01b37f1c430bbc06cbe363cda99479825c0b418c1bd9901db027c7a5999ace62979b8f2b457b9932cbe565d9bb16ce88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615536172, "uuid": "633961c5-9440-4ce2-84bd-607edea9e019", "value": "655533DF691AAF31A91338C51C0BA405B071874E6F939DECDA71F7B216A9EC108972C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615536172, "uuid": "7ada0799-ff5c-445a-a5dc-a7cb7c9d4581", "value": "24576:iJ6MgyQ5weBZfUHYc9kDSFOQENiInHPcWIEj6iDIRlqfupvI2OP5O/rOm:iYMETZfPudEwInJJDIRlqfudI2KJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615536172, "uuid": "c817f7ae-5d32-4d19-937a-7de755a31ca0", "value": 1326773, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95eda4f4-8379-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615584379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584379, "uuid": "04019ee5-7ad2-44bc-bad0-80f8e3180316", "comment": "Malware payload (RemcosRAT)", "value": "79aa90ed35ca21801adec4b390dbe5a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584379, "uuid": "52b5d042-df6a-45ac-affa-a897eae29dde", "comment": "Malware payload (RemcosRAT)", "value": "931171a80ac30024fb4a4e088be9139f5e470443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615584379, "uuid": "5cb01a6d-e86f-4d4f-8244-29002b029b73", "comment": "Malware payload (RemcosRAT)", "value": "62c723559e278570e88ff9ae5f297e39da1e0ca0fdd248bcfd7986a881c29e003c405dcfef27a07355ab537b8fd68a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584379, "uuid": "d4f323f8-0b5a-4a8e-8707-4a90ed0bc4bc", "value": "72E401207AB6A772CA6837F42567E2BD17F07C16C427DB8D1DC5BCCB3A91B128580A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615584379, "uuid": "edf5c42f-ae0b-4747-a67e-dd0ad7517429", "value": "12288:+26mrASG7MJYmZX0bL99Qlspa37KG5IbrxftJJZJoN2:+gE17gbkL+ss3pIbrxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615584379, "uuid": "855cdf13-6792-4069-94a7-a4307ca57be7", "value": 702464, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d9cd37-831f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615545773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545773, "uuid": "99435605-6db4-4e90-8145-41202bbb2712", "comment": "Malware payload", "value": "02b8ba227266dfcefb5958f7dd2fbeaf", "object_relation": "md5", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545773, "uuid": "953bffdc-2858-41ee-87d2-e5614cec9db9", "comment": "Malware payload", "value": "5dd79bfa71118e9dec11ff65d37dfa0254e6c536", "object_relation": "sha1", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545773, "uuid": "39f9457b-5011-46f1-ab5a-0bcd3fd1b414", "comment": "Malware payload", "value": "aac8f3f8593e83b4ac751ff723a8e7d3b8477ebf4f615b553d7eac3335d90b8160216f93d6087b5b42ef4dfb8d85d9a1", "object_relation": "sha3-384", "Tag": [ { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545773, "uuid": "01d96c08-ec87-4f00-be5e-18abb2ff767c", "value": "18352218B1529E3BDA0396F8968B7D8E791ABCE614C9013626F577D2CA387D0440FF4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545773, "uuid": "0370002d-aec7-42cd-aabb-1dd6741ce1e4", "value": "24576:0aJ5IxsCxSjnd/loqeIwLrNgn9gdzft+is:0aYxjxsd/loVrN9dMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615545773, "uuid": "00f54e3a-b839-4857-84dd-9ef13e0707ed", "value": 1116709, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7d9f48-8373-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615581843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581843, "uuid": "c25e0a25-8f16-4d23-904a-b25105d4fe8f", "comment": "Malware payload (Loki)", "value": "d06fb902ada1dcc76a186526c8db519b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581843, "uuid": "fc9f68cf-dd57-4850-823e-79b5b48cc964", "comment": "Malware payload (Loki)", "value": "60284a925fd2cf6506549e964064e048bac61a66", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615581843, "uuid": "62e1e549-23ca-47e1-b787-7eb7e3b7a59b", "comment": "Malware payload (Loki)", "value": "dd2c8ac3b3fb63f754581edf8804aad6344bf9704b447e71d8662db7424b63b0aa6dce3f0018e7eb70b6402def6bfc2e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581843, "uuid": "3c166c5d-2f01-4e12-9573-27d166bad90e", "value": "D7F3022731E1DABBF5E7897019F273AEC6F784040050A5874FE5293A977A6831B29287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581843, "uuid": "519e4607-e627-4396-a3da-e1bf89b3f029", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615581843, "uuid": "6a27d620-956d-410d-b346-f957b3a7fc2d", "value": "3072:rPKubXVLcIcEYcyMXrvp7hduCAlFyvRJlcGRprOr8aqhGn8CQZ0Kip0Yt:rPKyLLLXrv4KvRPN7OrzWtZFip0Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615581843, "uuid": "b448b14e-a78e-4c66-9cf4-e0a68ceb8ed4", "value": 157741, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9186ea61-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565044, "uuid": "111d0e0b-ddbc-4d9f-a5ab-6d2c2286a8e6", "comment": "Malware payload", "value": "756886f6cbec5c6a2f0ad6e15844037c", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565044, "uuid": "1f3e55e8-9266-460b-8d88-4dd083b46e7a", "comment": "Malware payload", "value": "29f7c4ac53a6d84a2128117dae469934095dd435", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565044, "uuid": "fe459bca-accc-432a-971a-dfad20adc6d7", "comment": "Malware payload", "value": "ad90013be9d44932a126976f606ddaa2b51d99c72744e3923703e8b09bd4830aa979f52308224f0ba97c373a1867b25b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565044, "uuid": "486f56c9-19c8-4f42-8098-41e3178bb29b", "value": "21F2F1F0887DD370E2AA58C6FC064C4983B55C6F9A306865E76B22BE7331C59B188C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565044, "uuid": "b7801ce6-f430-4c5c-aed4-f1cd4a960da5", "value": "768:wu5U5cWsWNeASqKisZrcvXEgrlEch2rpM7M0TvLeL9cxK/FHQI:wu5U59sWNeAnKiQwsgrdX71vLgcspP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565044, "uuid": "7f33619c-272a-4251-8b6d-8b4217dd017d", "value": 34429, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b8d48e-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615564993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564993, "uuid": "593b72a6-75e7-4107-9fa7-19c5b47a16c9", "comment": "Malware payload", "value": "5de8ae67614305518a61c5e509c7c713", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564993, "uuid": "9277fac3-6d4e-48a0-8d69-29bfc80b630a", "comment": "Malware payload", "value": "4a8c000d24e679c0e2c73572021083128fe443a1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564993, "uuid": "838ab542-e883-4a82-8a95-b10bd601a423", "comment": "Malware payload", "value": "b04de14d90d0143007c88d379aeecf3f50ceddc85bd72df04179fb6ed515665b2db9b5fe297857fbd10d094094cbc037", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564993, "uuid": "feeca103-4d13-4050-b12e-d0c94223d2ed", "value": "8984BFBC76147DD62A7F176BDA96ACED03A627628ACBA4CC406477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564993, "uuid": "14239b8e-1458-41a4-a638-37501aad689c", "value": "6144:F7TKMI8Wo+Z3I+E70hl6IxEi2m4UNbWM7xsRslpacKCPnrYebDwS7VuILzanGjWq:F7ml8Wo+Z3I+E7Sl5xTceWAlpP//1VjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564993, "uuid": "c33e1b12-ea1c-49d5-8fb1-854b4af7afbb", "value": 388382, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980b13a1-834c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615565055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565055, "uuid": "2f8e91ff-6c59-4031-ae83-4b5b5b04f3c4", "comment": "Malware payload", "value": "9a089a5d12805df7e0fd12535709cb2d", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565055, "uuid": "0152a615-8ee9-4e79-8637-ac3e09995466", "comment": "Malware payload", "value": "e0f7503314dd5b9990de21a65238164051b501af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565055, "uuid": "b6dcd73d-814f-4806-8866-97ccb958abd7", "comment": "Malware payload", "value": "7ebd72fe525df9e885098decc8c98be8b1702c4e825b96f3b85628a5d631d9bdc28dcb498257b76f70538a7be0127679", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565055, "uuid": "240d7cea-46a9-47c1-8dc4-295e9f5a1a6c", "value": "41F2D0C6C5E0E275D0CE9AE50C59B58E53F1D9D280F838066EFF222887B099AA5E5E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565055, "uuid": "6c1f9b6a-1abf-4a8d-8286-3ee2f36fad87", "value": "768:cV9yFtj1aUuL3K0A7d2XcuBPX8grlgcz2rpMiRK9xxb5ZxuP3Iju:/aNK08WkgrjXiRK9xxb5Z0/Iju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565055, "uuid": "e0186be3-a775-4ae6-bd0e-f39616c41016", "value": 34454, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99d3cbf-8347-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615562991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562991, "uuid": "daafd2ff-1a4a-49be-ab00-f76cd40bfe2b", "comment": "Malware payload", "value": "091d2029fe85499fd2b50e288de73008", "object_relation": "md5", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562991, "uuid": "36f70f17-2662-4c6b-97ef-031aaa18b431", "comment": "Malware payload", "value": "086597c4765bb6dc916ef0dfabcde10d53f96a18", "object_relation": "sha1", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562991, "uuid": "0682a172-5b2e-4617-88be-bfc6db7ea55f", "comment": "Malware payload", "value": "fcae10b29c1d75e54873a74f02542d67080a5bd1380c5008a878044b5d028277cbf524aa84a77723435f85a2cd163a6b", "object_relation": "sha3-384", "Tag": [ { "name": "covid-21", "colour": "#2B7EC8", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WobbyChipMBR", "colour": "#F385B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562991, "uuid": "19965275-eebe-4ae2-8796-c1760be74a86", "value": "A2C31397E0C42B7BE49081F8E96F6D742FA693592BD1C3B4D2E13B7C1D60202495D35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562991, "uuid": "a256f8f4-d801-4047-8b2e-06f656a7a8d3", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562991, "uuid": "09a7badb-61ff-47db-83f7-de709cf2631d", "value": "3072:LVZ/VGS7rN+dilE/aQSwa6yPYdCKWAdIecout:LV28odiHJwTAKHI5oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562991, "uuid": "bde36b4b-01f6-46b3-8af0-4c343994ac17", "value": 122368, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc14325-831f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615545709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545709, "uuid": "7bed7c98-1596-40a4-b8ee-361a4dc0de5c", "comment": "Malware payload (GuLoader)", "value": "c7a140fb0830ad0d0d9db01af55f38bb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545709, "uuid": "abc7ef86-7dd6-478f-b943-98e89c41d465", "comment": "Malware payload (GuLoader)", "value": "09865ca6f7c9e8ec297c1eb05dd23ebb76abfd80", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615545709, "uuid": "35b5d28f-d8ed-42b9-89e9-0627faf32a96", "comment": "Malware payload (GuLoader)", "value": "7bf3ae477fba53a4623631a05c4b31bf3c21224e1deaf190a109e8949ffda1cd3d063da95db75cd3c15ff47c099d994e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545709, "uuid": "56ed5f04-c82a-44f6-aabf-bcd93e3a19c5", "value": "1C932A63FB89E577F3358330D91D569C60857CBA9E209927BB8E37CF0C3964144623AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545709, "uuid": "1d03f767-c913-420c-ad3f-960884568eb2", "value": "93fc4349f7462612753fd69caecb7251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615545709, "uuid": "ebb2f8aa-16e3-4747-b7a7-e57c00e8c035", "value": "1536:HOKAI6Zgsa2Le1VQZWovgVPHINYLVXYGLD2Oq:uZhZgP2C1VQDeVXYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615545709, "uuid": "bd6df53f-78f6-4297-bdb9-ac2eb6824d2c", "value": 94208, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e701b2-82cb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615509626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615509626, "uuid": "0b3246b0-4dcf-49c5-962f-7de114023a03", "comment": "Malware payload", "value": "61353afaddee7b4436b2bbd75831b68c", "object_relation": "md5", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615509626, "uuid": "da76f154-1534-4296-9ad2-f310cb92d0c9", "comment": "Malware payload", "value": "69928a496ef1349577f275d1c7358c4370313e75", "object_relation": "sha1", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615509626, "uuid": "fe6dc21e-d9ea-473b-87a0-e707a4f71e4b", "comment": "Malware payload", "value": "9f118c284592b838c0246b577c1ed5503fc21377c7ab7e9a26a9fe8b191b8522db541abfce78c984eee34d263edc0905", "object_relation": "sha3-384", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615509626, "uuid": "e940dd0e-c306-40d5-840d-ab090bf5742f", "value": "C5B33B4937992A01E17D9EF944B2B12656F2EE664762CB4C5DC670EE0AB33824703F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615509626, "uuid": "0bb9fc47-ae6a-4389-83eb-b821b7f72b7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615509626, "uuid": "f3ea7a76-b3dd-4ebd-906b-f82628d9ed96", "value": "3072:nWj77FkVnwjHBJ7/FEVTBKDxn5J5c2cd4yJy6B0wy/B1oAdNVsDs:i5aoZfEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615509626, "uuid": "34bafb3c-4b2c-4189-9026-9531cfae7595", "value": 117080, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab6bf73-8354-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615568281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568281, "uuid": "21516134-8c33-4089-9c75-7884857682a3", "comment": "Malware payload (AgentTesla)", "value": "5fe394100179215220cfbd901da97cec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568281, "uuid": "6964c974-ee09-446b-9a66-c490659c750d", "comment": "Malware payload (AgentTesla)", "value": "13dace270a12b2665494b465cc05475b55561226", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615568281, "uuid": "3f83ad3a-be19-42f5-a791-8afccec93e70", "comment": "Malware payload (AgentTesla)", "value": "4f32ab0227cc5cd0a48844a46596ac37d8250b0cedd6b5d53835d8d10e06725f7d359169523db3373336af99c4eb2064", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568281, "uuid": "d63551f7-9a16-43f0-8b4c-6c554152f0e5", "value": "31B5332A99DA9E09EA9E2D73C9CDC53C2A750C953B059E1EB7467233243BF1056C234E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615568281, "uuid": "e9357534-e819-4760-8192-19d13edbe244", "value": "49152:jGFQb9c44qNBBocx4qcSaZ9RhsM5fiPDYI1Hg4HujY:OT4DNBB1/0Z7NKDNHAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615568281, "uuid": "81a14ab1-1ffe-42ae-8a17-46b32914771f", "value": 2331648, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7484c140-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560271, "uuid": "bb1790dc-69cf-48d2-a8e6-78e2bf013ac5", "comment": "Malware payload", "value": "47b87eac20052f76f8914c0988960aea", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560271, "uuid": "02489cf4-b911-4c96-a527-66470bca917a", "comment": "Malware payload", "value": "65694af5d7027c4f242cfc220113104ec6311c88", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560271, "uuid": "161a8854-734b-43c2-ac7b-09d1e9859673", "comment": "Malware payload", "value": "c328ea526059de8373ed22ea33e4d188ff74a3f1e05bd060e0fa13d046a339e7751fe1d3c3c54bf7fb270abdd8e49601", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560271, "uuid": "f4ad2571-a15c-4786-8acd-1d09b0c2df7e", "value": "1D235DACB590E55F8342F773EB55A8F0D711F40BFA8610CA6D472158CD688E8E6D8BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560271, "uuid": "54b73bb9-a3d1-4806-b275-236f2a6ecc45", "value": "768:5tG+vEGsQ0AcW2TBRzV1xalhAGVWOGzw6gxOWfoV/Pn3emReUY:2dA0c2ND1xX8otemReUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560271, "uuid": "e1c788bc-c3c6-443c-a889-b5f15a725434", "value": 49663, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409f45d-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615564565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564565, "uuid": "92e2316a-4085-4f73-b5db-c99f84f06a75", "comment": "Malware payload (AgentTesla)", "value": "ceef832537bd67ca740458be92f9e107", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564565, "uuid": "3ef9f5dc-2ee7-4366-b8c0-e11f512e0053", "comment": "Malware payload (AgentTesla)", "value": "d399ff8f58ff66966b9544935801a10b79aa96a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564565, "uuid": "b50f8aff-a4af-4f2f-861a-8eee4e30dc1c", "comment": "Malware payload (AgentTesla)", "value": "4890905e267c2c1d0eb662b1d38fbf1ec7322acaa952df97061bcdd7e66242dbc7008cd3df9ee5f0cb15503c41f40264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564565, "uuid": "f1827440-5753-422a-944c-7b515d57c64c", "value": "0A64BEF872047DE6766F426BDE96ADDD13B6262399CB94CC80A47BC305A3375FE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564565, "uuid": "9898b1ee-3f9c-4826-84c9-c7996d6fe7b0", "value": "6144:q6LYrUVjkXdCfWd5ppJI8L4s5kSFxNPnfokdH9jGIWmiKduNNZJRfFsZM:sBCfWdtJf3/dYkdH9qKd8DsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564565, "uuid": "fa44d79f-e18f-48bb-a138-c9e267929fe2", "value": 320646, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42620c91-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582521, "uuid": "82367b8f-1d4d-4c18-9910-8e3cb233378b", "comment": "Malware payload (SilentBuilder)", "value": "f5ee428d9e8a0775a2589b5d9e8bbd76", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582521, "uuid": "5ba74da8-87ca-4f8a-bf97-b38efa9a2ab1", "comment": "Malware payload (SilentBuilder)", "value": "7f19c82ca70376110ae74dcd3c65f1ce204b6a6f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582521, "uuid": "6d35783e-3d81-4226-a0ad-97fd3b6a8dc0", "comment": "Malware payload (SilentBuilder)", "value": "5077135fe90d174c9efaacf9f55754ce4074b7bf536e0fcdf7b18ca1365a88c0899e6b27f84b1c4b07cf9205a29c01ba", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582521, "uuid": "a7ecf975-7304-4b09-b17c-29e4a174d3a9", "value": "C1D39A47DEEB462FC5884B3A41B34A1A32D68C4C47D7024B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582521, "uuid": "184c448d-c0dc-4d44-a080-881ecd08d2aa", "value": "768:sKdUd4TaBosDAW+u7LlCPVCmgUrNaQTZipEmcPYbWgYvdJky7LefR2bMyDeTZBGQ:skUd4TaBo+fF2ha3nbWhfgJbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582521, "uuid": "17df43af-8857-4586-a22d-2ee83c9222c9", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83b2911-8346-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615562613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562613, "uuid": "f6566f43-2c65-45ee-a066-632bf0e29491", "comment": "Malware payload", "value": "f19b821c2d8447e1774582d3985e02b6", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562613, "uuid": "d603b3f3-b174-4248-a191-78fe1b65562f", "comment": "Malware payload", "value": "9677f67300f2e4d26539baa1d250f9a8602b4ebc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562613, "uuid": "3a4cfa30-daed-4509-abab-ddd0082991ea", "comment": "Malware payload", "value": "6a8c3cb84d965ac4b2eb881a6930093a8d11d7205f98dc51b0682a14751c7c6582bf443c52cb98a2c848f084d09fe240", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562613, "uuid": "ae5ad97d-842b-458c-965c-9e899a80cd21", "value": "4EE4331DCCD7FB813E5790C7C9AB32851076AB9324236DE7D692FFA818C05A12799339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562613, "uuid": "1f6d538f-3df6-44c8-a214-9837788381eb", "value": "12288:uoigiXhh+jLH08ibzr25ilJD+aES0OprgH7oUB+Q00jHBbjh9V/ybEumjhD:uoidhh+jLysiLT64wxB+QZdvvumtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562613, "uuid": "5494c0ae-9e73-454c-9fc8-34e5bdef483f", "value": 691090, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98314e5b-837b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615585242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585242, "uuid": "352bfafc-3d87-42d5-8f9b-c64a90da7454", "comment": "Malware payload (AveMariaRAT)", "value": "1f60feb520cf25858b4c777d9e590d32", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585242, "uuid": "36996b05-821a-4930-8c94-798d286979a4", "comment": "Malware payload (AveMariaRAT)", "value": "2cc18ada30aaab7abe0c9df1c94339f01dde3b4a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615585242, "uuid": "9194032a-ad11-4ecf-ba90-b2696eae912f", "comment": "Malware payload (AveMariaRAT)", "value": "fb46a08b546672003ad45b8485c1869365260849c0135da6ae0b358e4463bdd50d667318b50e86ec983d4b2fc451ccab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585242, "uuid": "5e604538-5750-4243-aed6-e9fb3f0a500c", "value": "FCC54DC5B628F1B0E38FDAED6CFA495434C2C95DB06E56D676C8638A1801B07C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585242, "uuid": "0f7fe8c3-bf77-42a2-93e0-b3742732444b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615585242, "uuid": "3f454860-8da4-406f-96bf-49f18ebbbd69", "value": "24576:e+u28mcqWWrWWe4rEVJNawmNuWGOy/j8UdM5X:e+u3mCWr6VNaKv/jxcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615585242, "uuid": "3cf33f49-54c0-4b12-b7a9-d80085a92c86", "value": 2532864, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e564bc3a-838a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615591814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591814, "uuid": "c3a2ea4b-da1b-4adb-8396-3480b58f7636", "comment": "Malware payload (AgentTesla)", "value": "882c41f6adf98401ce59b81f57f83f84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591814, "uuid": "2fb3aa79-bad2-4ece-b0f6-f91290489be3", "comment": "Malware payload (AgentTesla)", "value": "b1c641d8f188fa4dcb61fdb8d443a5f4118b6311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615591814, "uuid": "a3fba97d-5fda-48a3-b2bc-9264ec65764b", "comment": "Malware payload (AgentTesla)", "value": "7c62d3da9439f7eba511b5f9d43314346a0dff50adf40de0ecb73d08691b62f99c870fa39b516a2de6f82f08c8ebcf69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591814, "uuid": "0b0616b6-e584-4013-8078-9a619c43ae76", "value": "BCF4AE3136EA9219F173AF751AE071919BFFF6237706D51D2850038E4722E81CEA277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591814, "uuid": "e962164f-7d89-4d75-bc43-8ed382b0f701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615591814, "uuid": "55014448-b481-42df-8bbf-3c8be85ff815", "value": "12288:3iX+hLXX/o2sJkoTgvUME5yXgmML2TxBU377iQMWZb0m/yp3ibmfxlax1RZYcaUK:3iorH8MEkBU3HiQRZwBcm/HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615591814, "uuid": "b7a5acd9-0f4b-4eb7-95b9-b8e56ed45e77", "value": 730112, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02702939-8349-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615563516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563516, "uuid": "b4a4eebe-5094-4c1a-8df4-1a8161c8ed93", "comment": "Malware payload (Loki)", "value": "27d9624767d70b249ab0718af1151f69", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563516, "uuid": "29ed5e3f-267d-48a6-9e65-3c86c2c7fe1b", "comment": "Malware payload (Loki)", "value": "91efbed90bee15747366ca0b4c37edaf00ffcac7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615563516, "uuid": "54fbb4fe-1ec2-45fb-be82-b37cf435137e", "comment": "Malware payload (Loki)", "value": "aced80468c5246e2b2d384e4ee29d4eaa0bfbce4cab7981ae2012fea3a994f58a7d248146b8d6e76147c47fa18759c8c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563516, "uuid": "edbdde07-667c-4c49-a716-228df1b42030", "value": "E5E45A652394DB08D3BE537DAC219A6043F02D32F663DA29FDD038DA3935391E65E293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563516, "uuid": "e667fdeb-1638-4621-9707-27c2942f118a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615563516, "uuid": "578cf3a4-c2d4-4031-8c37-2ecae481668c", "value": "6144:iJZWcTJ9azGXtB2KWNDciZxr23e4lby/oANTOolcqdg97ogOTtOeKRrK/FOTBQrY:iJV+tcUrPmbrAaqK97fVHRYFbXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615563516, "uuid": "e7ebdbb7-65a5-4381-93ca-861256f6047a", "value": 673280, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767023c9-834e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615565858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565858, "uuid": "ff26500c-e7ee-42b3-844d-096d4f50a261", "comment": "Malware payload (Formbook)", "value": "ea4e28ba48205647ea5c50b9767dcaf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565858, "uuid": "2e0c270d-4171-4682-8022-93528d21a203", "comment": "Malware payload (Formbook)", "value": "893da1c93ba0ac1edc4d856712d27edb42594daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615565858, "uuid": "95759935-2db2-4011-85ce-9f0e3e28a452", "comment": "Malware payload (Formbook)", "value": "4d135e84406e2770f9220f8b5c959a4aa6a591e42933d63b1f8c129ad465da7be08ad188b0acba840ef519eb1047d733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565858, "uuid": "be9a4a22-0659-4edc-add3-e0735e2c4693", "value": "FD156B1133E96F1DF03BE77956B4240557FBFA02E311E94EBD95028F1622F80CA91B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565858, "uuid": "01f43717-15d7-4171-b2c8-e575221382b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615565858, "uuid": "0ec45be3-0a73-42c0-a158-4bdeee2259e6", "value": "24576:sSRQCDoR0hbnwfJvsU7wZ0sLIoxMxpAe5YH/5qUI+sESW:sSRHDoRgbnwfJvsU7wZUS48/5RIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615565858, "uuid": "3be764f8-2cb4-4a5d-b787-566456e69454", "value": 949248, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910539ce-835f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615573204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573204, "uuid": "906ffc6c-e2fb-4f60-b577-0decd6fb41c0", "comment": "Malware payload", "value": "29dc57817104bbd649cf224dbc16f553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573204, "uuid": "13b26ee9-1256-4a84-81f9-bf85040ec099", "comment": "Malware payload", "value": "b3cbcf1f45dc8337078808f4440d21b6fa38e0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615573204, "uuid": "95b1e82a-10ef-4c4f-a484-279ea9b62796", "comment": "Malware payload", "value": "2f82795a003bfa9005732c316f5235d581383db058f329fcc644a29befe382b062872e6c49ea279a5439f2c36b8de6de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573204, "uuid": "fdbbfb8a-f19c-4718-8733-25db5096e36b", "value": "E335A01272A38876C9771676DC3B82B43A2AFEF05A1860453BEC397D9FF53512C27246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573204, "uuid": "6a01d105-adc3-458e-a16c-b050d408e4bd", "value": "a2c20e2b36933a27474c5d0e0c8f4655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615573204, "uuid": "482015a1-8ac5-46ac-83f0-611aa079e609", "value": "12288:juJ7UcZhoCBjsQcIbgU1ZSziDGgja/A7CPbp7Mvzc7++FbCHlWvmlS9Cl+rRi:juJ7UwGKlcIbgcSWagjct4o++FbCFZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615573204, "uuid": "6dc4ba4a-7927-40c9-98d8-d73bb5f51c46", "value": 1143288, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e9252c-82cf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615511116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511116, "uuid": "2ae72a52-adad-48e3-a5f3-b34a768839bf", "comment": "Malware payload", "value": "4d6c844cdab0fd43f86b1a3dfc708ac6", "object_relation": "md5", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511116, "uuid": "9df733f2-4629-4b31-8458-ee768066e82f", "comment": "Malware payload", "value": "18c9d0d81ef6133d63d3a68e5e33cf088c93aad9", "object_relation": "sha1", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615511116, "uuid": "b27b98ee-4099-4603-ae4f-c445e327121a", "comment": "Malware payload", "value": "a386cc010b1d95aaef8901ac6396b5c3138b384dc04e06c281ba89ca1848b766c6891909e1f1bb756248fd3af1b96dad", "object_relation": "sha3-384", "Tag": [ { "name": "c#", "colour": "#6E65B2", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SpyGate", "colour": "#F7A23E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511116, "uuid": "a2001d81-73ce-468a-b6ca-010e10bd177f", "value": "A4637E08378C9743D5EE1EBA44B3621122F6DE025222EB990ED7B1FF2AF77810553B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511116, "uuid": "47f07ab7-59d4-447a-b2d4-3725696e82bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615511116, "uuid": "5bec6a9f-912a-458c-a927-01e1f01e3677", "value": "1536:JnmbYOU0fBexdyhP9reUIcyWihATZc96Uws5Yw:VmbYOU0fBex0r8c5mAdczfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615511116, "uuid": "400b2fcd-6515-4c4d-bb0b-7837580c8ffc", "value": 70488, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7db8e1-8375-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615582511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582511, "uuid": "fce84d1f-e3f9-4fc5-8488-59066ac6cc1d", "comment": "Malware payload (SilentBuilder)", "value": "b1a3d8f090e90e5845c2b7077e2f4789", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582511, "uuid": "5d115e5f-5592-4feb-b365-7801fcda8d94", "comment": "Malware payload (SilentBuilder)", "value": "6614439ad4720ef66bf09e915f86c3013ad65ee4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582511, "uuid": "38ca2738-09bb-43fe-b3f3-1090f07c4139", "comment": "Malware payload (SilentBuilder)", "value": "1432a0b0740a976dd659442c437947e71ef7fb68f40fa0d1e109b855410c6d52f9657193b46c32e405470571f462a357", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582511, "uuid": "d383ce0b-1829-4610-a11a-01aa5bf25bb7", "value": "40D39907DEEB462FC5884B3A41B34A1A32D68C4C47DB424B57D9FB6A5F7EB852E019C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582511, "uuid": "4d8c265f-5e15-44bc-b8ae-af3151f36f78", "value": "768:sKdUd4TaBosDMW+u72nCPVCmgUrNaQTZipEmDPYbWdYvdJkyMLefR2bMEdu+ZqG1:skUd4TaBomfs2ha3YbWGkgJsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582511, "uuid": "fa4d6fb9-4b24-4a74-a056-f067c4d9004a", "value": 141312, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d1dad9-834a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615564238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564238, "uuid": "b23640c7-923e-4ef3-94b9-afcd892e4df7", "comment": "Malware payload (AgentTesla)", "value": "a834ad58455631fc2f507c736ce2557f", "object_relation": "md5", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564238, "uuid": "ce0aaa2e-cabb-486c-9cb7-d0639651810b", "comment": "Malware payload (AgentTesla)", "value": "7dfb3c18e1066eb7274409e69e825bf5fff3d432", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564238, "uuid": "2124cb43-38c4-442f-ac3d-0b30b23ad953", "comment": "Malware payload (AgentTesla)", "value": "17f4af369bdfb1e89f8b03a2d977bafe4a927eea33837174a13b88c293e9e8a90812a0feb41a873626a89341a7b19d64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564238, "uuid": "632ea120-b687-4c86-bd44-f14a9d2c70d4", "value": "DDB4238E92B869CFDCD6019FF88751BC2CBFDD118076A26A7F9799280CD250DDE49D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564238, "uuid": "b8fd80b4-021a-45e9-9efb-6358c5298570", "value": "12288:+eEEzEXMpSFjfgexq3SHZjcum6hDcGMGQPRh6ba3AxbZu1jqZRMUrG:+ejEXTf+3Gcum6uTga3A3u1jqZLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564238, "uuid": "858f0a05-8535-4a92-b119-808f0dc654ab", "value": 532400, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91f4ffc-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560896, "uuid": "d301e624-fbe2-4c96-98d7-8087a71259cf", "comment": "Malware payload", "value": "d425ac2b53bb0f9e07b05f90ba1f66e6", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560896, "uuid": "c056c531-03eb-44e2-a298-94672f29c0b8", "comment": "Malware payload", "value": "29935b33018f1bebfa4413a95ffbd9f433a7841e", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560896, "uuid": "d59db223-4134-439e-a27c-c2f9995268da", "comment": "Malware payload", "value": "c4b5f3edd5912600c015346f7c94b257ab390de0ba1c5dd9bd6753050bf54fc7e3de3298c000a8cecb464414267c604a", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560896, "uuid": "0539d5e6-4dbc-4232-91b2-3bc9d04408a7", "value": "9933044C7592B9BFA681EA77DB21B870E511F88EF7C614C5AC40275C8F58825CEC8BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560896, "uuid": "a38ef5c3-2e10-44fb-baf5-5fd0a908b84d", "value": "768:h3Wa55NzZYhFRPZ/327AJF44baZ8QBuUqf16yrvZYULNoLRQwRX65r1eBUSMvlyk:keeNl3FNd17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560896, "uuid": "be3a8632-470c-4a7f-a012-cb4b65ba7e93", "value": 51827, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3a4255-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615560930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560930, "uuid": "d3615fba-2719-47d2-a805-11679a76a05e", "comment": "Malware payload", "value": "2cb49be9824208f7669e30ec93fcb218", "object_relation": "md5", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560930, "uuid": "19f14a93-1384-436a-ba2e-293c17aeac6f", "comment": "Malware payload", "value": "1e0f0690a76946725ae73e86713ac23dd9c9e9a2", "object_relation": "sha1", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560930, "uuid": "830df5d0-3af7-4f8d-a8f2-2121b500275d", "comment": "Malware payload", "value": "8e3f11ec433119a93ba573a103a7794de2ff0bb1b34dfc0f6ccef5e90972631c95d1c1295a71452422379ec3b8ef526d", "object_relation": "sha3-384", "Tag": [ { "name": "necrobod.top", "colour": "#7B6D04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560930, "uuid": "eafba337-4613-4371-9c4a-54885e0e316c", "value": "5333898CB385D46F4753EAB3EB51D4D0F713F00AF6C610C6AE813598CE6D512E299AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560930, "uuid": "c2938b31-8070-4e4e-8261-340fe8f10a85", "value": "768:+TS5PB38POTeLfgiW07D0SDZLNYZ+pWtJAVRM4YxUtZYISn33IzC:z5iOgoSQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560930, "uuid": "1dc5c09d-4bac-49e2-a1f7-0e8c9dd75258", "value": 52197, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d11fd6-8347-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615562906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562906, "uuid": "2aa0492d-4610-4c3c-b597-b1ee21328200", "comment": "Malware payload (Quakbot)", "value": "8432ec3b0604d96a7ec137b80ac050a2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562906, "uuid": "1d976a66-b3be-4027-a1c2-1606f8dd9fc4", "comment": "Malware payload (Quakbot)", "value": "63dfe8269e0451a0a54d91706d85132f50188ea0", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615562906, "uuid": "f3992ebb-6570-44cf-8897-5b70b4a811e6", "comment": "Malware payload (Quakbot)", "value": "a0eb1bc59bf3cee0c0a72d7576639c4d21566aaa057ab08e717401e80090c47abe87b1579418a35c116ff60eeafc52ce", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562906, "uuid": "b349d554-fd4d-46b2-b3bf-022de542eaa3", "value": "EF54B382A222F120E9583F35D83E44FD02A5FDB92E58F2A73C6473B72F3A1D5AB40515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615562906, "uuid": "1ddc3c94-e993-4892-b84c-d06dfeb49eae", "value": "6144:oFyUkR0wjvF8W3I7qDGvJZqrlh8zOM4OK+p3My:THy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615562906, "uuid": "4df211a9-e137-49a7-a68f-d52c312a781f", "value": 282624, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa73ad38-834b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615564657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564657, "uuid": "36e69001-ea77-47f0-aaef-3438f61573c3", "comment": "Malware payload (SnakeKeylogger)", "value": "ab8c927fef01c470fe7206a0b043d763", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564657, "uuid": "ad265026-8f1c-4c2f-a18e-2ccf322f1cb1", "comment": "Malware payload (SnakeKeylogger)", "value": "c9420088ea76d0bfdb831d244f248c172eee69fb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615564657, "uuid": "b3aabda3-5eb6-4211-aa25-3f6445d6a012", "comment": "Malware payload (SnakeKeylogger)", "value": "00bd122468c036293b612721c60ed65ecb06a883cb073e923ddbb12bbaa8d501a6f75e3fc93fac506e372ea18f7b7a5a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564657, "uuid": "32b07d46-83f6-4169-92e6-bc3997885e1b", "value": "AAA4AEB8B6047CE67A6F576BDA96ACDD03B626239ACB94CD406477C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615564657, "uuid": "280f9549-6a7f-477e-b2e8-2affb80b611a", "value": "12288:E55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2eh+:WAIC9FkMRaN0cQ3S8wzHDFHzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615564657, "uuid": "a49d894c-b7c2-4062-8272-12eefe35ad50", "value": 471883, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb42a50-8342-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1615560874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560874, "uuid": "d14e4266-49fc-4905-8b85-cb6ee51bbd3a", "comment": "Malware payload (ZLoader)", "value": "724290f49e016fd2d5bd84396f9bba85", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560874, "uuid": "092f49ee-4d7c-412c-8868-35eb6a90acca", "comment": "Malware payload (ZLoader)", "value": "e07802321d84cc1c601615318f6eef6ec90366d4", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560874, "uuid": "e72a5e52-9df3-4753-a75a-c826f4a30be9", "comment": "Malware payload (ZLoader)", "value": "783639a15daa684d7f5e78af6df4b053dd3e1cebe0689b5772d38d207ce93d93412d2ad90642e16119a6ba03ff2a5a7e", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560874, "uuid": "b4cc76f1-0e1b-489d-b525-fd6fa9d35bb6", "value": "C3B2E1257B366898D2768A3DC10A44FA861D20B07747B24D79D4F7C732C227E175A29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560874, "uuid": "4ddc85c5-9380-4ad3-bfb8-b91006680231", "value": "384:JjQKG9UYaSAHcr7AYaEpkdKUxdFnS8YaBrJTmGMHWQla50chUlM9zZc56Fwr3M:qP9aSyuhMdZ37TmGMHWZhxlc5Rr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560874, "uuid": "29e64f03-53d9-4702-a61f-adea41140c36", "value": 25603, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11fcdb4-8374-11eb-abe1-42010a9c0039", "comment": "Malware payload (DoejoCrypt)", "timestamp": 1615582358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582358, "uuid": "621e1d46-e914-4c34-84c5-0ac09e35438f", "comment": "Malware payload (DoejoCrypt)", "value": "6be28a4523984698e7154671f73361bf", "object_relation": "md5", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582358, "uuid": "9423c641-f066-43a6-8e73-d4cef9c15567", "comment": "Malware payload (DoejoCrypt)", "value": "b974375ef0f6dcb6ce30558df2ed8570bf1ad642", "object_relation": "sha1", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615582358, "uuid": "24adc34e-d258-472d-93d9-9102d67a4bbc", "comment": "Malware payload (DoejoCrypt)", "value": "cfc71a6d743247532d85a248163fe924ea7117ad607b130b5778cc4fe1d5549db89e828e80dd240d5fda1acc035f6275", "object_relation": "sha3-384", "Tag": [ { "name": "DearCry", "colour": "#76ECC5", "exportable": true, "hide_tag": false }, { "name": "DoejoCrypt", "colour": "#292A5C", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582358, "uuid": "84c726ba-530e-4062-bfff-a766ffccbcb3", "value": "8155CFC3F6C248F2D846097951B3973B5F3ADA11832AC5C3CFA15DA59C21AD1663E3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582358, "uuid": "3afe044c-bb77-49d7-8b93-c31f28b215fe", "value": "f8b8e20e844ccd50a8eb73c2fca3626d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615582358, "uuid": "0142b55f-0e7e-4df2-82c4-66940b9c8a9a", "value": "24576:C5Nv2SkWFP/529IC8u2bAs0NIzkQS+KpPbEasBY2iKDl1fpxkLVZgMCST:oB70s9yjE62iIl1fpxkLVZgMCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615582358, "uuid": "7d96b647-204a-4728-88b4-4833935119ed", "value": 1322521, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1224cf87-8341-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615560106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560106, "uuid": "7be9164c-d3eb-4238-8a15-e5f4e6f990eb", "comment": "Malware payload (SnakeKeylogger)", "value": "77f24624bf6f0bd7bbdc4654d872b7cc", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560106, "uuid": "3aba202a-4132-493e-aae7-78246bb8545a", "comment": "Malware payload (SnakeKeylogger)", "value": "44110504edd0d58f884672519d688b780b114f1a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615560106, "uuid": "269d0072-a399-413a-b162-7846bde83279", "comment": "Malware payload (SnakeKeylogger)", "value": "03ceaad67b5a24bdd2e13dcae0d76c6f0217096c075f802819da05e4176ef9654f2caaf6f1cda97ea6963ad80813162e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560106, "uuid": "0a1a3f2c-da6d-450c-97ed-28184574e76b", "value": "1F05D0B077EF7442FA468F7B3231C0219D070E591496D92AE98D3D662A3A37D01ED78B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560106, "uuid": "2a7d3fc6-0355-407b-99f8-912059acf883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615560106, "uuid": "d5c19b66-dca1-47f4-a453-44bef066b4ee", "value": "12288:t4+1gb10QmhH0GEIGx1kn3ckjgeEdPvrGzWatupcBNt8/:u+46AfoMkSrGzLupcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615560106, "uuid": "82aecead-73df-41f1-8cc6-3201e18e40ac", "value": 818176, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d767b57c-835d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1615572463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572463, "uuid": "fe17c586-cb2b-42df-8766-72e4592ca977", "comment": "Malware payload (Quakbot)", "value": "2a4480ac07ecbe8d0671ec947c1b84c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572463, "uuid": "7a7bb5e9-6485-42f7-9275-06ae2c0bf2bc", "comment": "Malware payload (Quakbot)", "value": "0402ab7b5665b4d2edfc39091ecfe57e8b64bce5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615572463, "uuid": "4de91cc5-1c4e-42f5-86b5-d2ebd030dd93", "comment": "Malware payload (Quakbot)", "value": "3947002c9279b6cec2e091464ea65ba1a30d1e4be0c7873884e8c301d296ad9eacb126c4e4109b153935c56ca6cffdd0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615572463, "uuid": "1d5cbdef-2b48-4de9-8aac-98af187c7ae6", "value": "5AF4BF26F6C0C837D13335389E5F4398AC39BE502D2998462BF42E4C5F79B813B66297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615572463, "uuid": "a86b6b7b-c687-4c67-ae4b-590194a659d4", "value": "4e9f3e18e004e6d20398d8164f8a5a15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615572463, "uuid": "5c123905-7913-46ca-8c3c-afeb7939d3c1", "value": "12288:g5udlKZoeTeV0hYpp7zXQeJGuveKGyrYfv1PShSJ+qUBAvLk:gMzKVTfkX9GuFrWv1Gs+VIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615572463, "uuid": "8d5cc605-d2f3-4480-9392-cfb2cd580114", "value": 738280, "object_relation": "size-in-bytes" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }