{ "Event": { "published": true, "date": "2021-05-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-04", "timestamp": 1620172981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1e130840-f17f-4bcc-9265-a3823e0372e8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894070d8-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093644, "uuid": "ecb617d6-68f3-48a1-b5c5-0e4fe343c849", "comment": "Malware payload (Dridex)", "value": "d8d7c8a4393fbef5c365aa3714f3527e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093644, "uuid": "7d7baeaa-f8de-4c39-8cb8-f4cad93084f8", "comment": "Malware payload (Dridex)", "value": "009fad6032e964858242eac90dbf532d96c5b07efc379c8afb159bfd52487d31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093644, "uuid": "de84572a-8dbb-497d-ba45-1b478c2f0178", "comment": "Malware payload (Dridex)", "value": "8a70eddb905cdbd19c3cd472b84cd9be1fd76aa0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093644, "uuid": "2065820b-d360-4faf-91b4-fbd63e8e9623", "comment": "Malware payload (Dridex)", "value": "2d96e84c8c7940abd4bb49a606231a9c43b714a176615a2d5fc271987789e97ef8520baa423317e3c5c6e695a47cbb34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093644, "uuid": "6d44f04b-9dd0-40f5-b549-b47a2d9b5a51", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093644, "uuid": "0f6f029b-cdce-4092-b95a-c96d191c0e02", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093644, "uuid": "12bb9796-dbef-4450-8b60-7350e6c6d476", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093644, "uuid": "656fcc11-a3a7-4366-ba15-78b951dbb76e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093644, "uuid": "505cb25c-95a0-458f-8bb4-d50644cf0656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093644, "uuid": "54bb25b9-a8a4-4b53-b625-9f937b962b20", "value": "d8d7c8a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fec28b9-ad11-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620157570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620157570, "uuid": "bfd83133-2db6-40b6-a0a2-bef255d22034", "comment": "Malware payload (Loki)", "value": "ccbaac21998647eeb529e92304a52376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620157570, "uuid": "37c87c45-95eb-4d1a-8102-ff5a274c45db", "comment": "Malware payload (Loki)", "value": "00d85645f31e24758d0042ccb93b14e6f4a286fc499f9595e6d95d6d53a27cde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620157570, "uuid": "d0367425-9cba-4d89-b6a9-c7c832cf3401", "comment": "Malware payload (Loki)", "value": "43305cbd8a1551b5577ad64ec5d1b1791768d7d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620157570, "uuid": "839789a4-5afb-4be2-bfaa-6b28dca6354b", "comment": "Malware payload (Loki)", "value": "f9bca31964fcd93ceba39faeccc8f289f53521c315a760ce3231624d367f81f2dc7de458edf01a9057e56ad4f64ab3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620157570, "uuid": "e1698dc1-e672-4385-9da6-b9499ae7e0d8", "value": "ACD4125827D8BF65E43D377C2479130063FA7817E336EA2D7ED851CA6626B828B42353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620157570, "uuid": "746b6910-5a09-4612-865e-4363dcfd0638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620157570, "uuid": "1c315ec2-c16c-41d6-aa21-45e4fe142a99", "value": "12288:4HeMEOdSdh6mp35tkSYESCZOTuqL0BVz1NdY6SM+WU2ZRiUqjzEcP8Q11M:NdoG3YSYESJBQ/zvdHSbMZRiUqlNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620157570, "uuid": "af1e3d46-427b-404b-9132-7badecc27bdf", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620157570, "uuid": "fb3194ed-5e87-4d89-9013-a0593a0091c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620157570, "uuid": "bea8f504-805b-47e5-b4fc-891cee6472ad", "value": "ccbaac21998647eeb529e92304a52376.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920768b8-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111697, "uuid": "131568b9-fa38-4e10-94cb-aac4e7928462", "comment": "Malware payload (Dridex)", "value": "2dc106fa948ffd549f15b4461f01be3b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111697, "uuid": "989248f8-b6d8-4a78-aaf3-68295603956c", "comment": "Malware payload (Dridex)", "value": "0250160df769fb2634616982476188a7ca4d58cc89e7cc1e81bbfaccb7582d28", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111697, "uuid": "4b874d78-95ff-41bc-a716-6fb272ff390a", "comment": "Malware payload (Dridex)", "value": "9dee5892e50e488f516d634c8f77047f258d3bff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111697, "uuid": "068c759a-9b8b-4de9-9f5a-554e9859434c", "comment": "Malware payload (Dridex)", "value": "be70faac40f103fdc44bbe4e2b7a21ae88c8645266f0f8ee1f1c72525beaf8b8fa84927e3517f180660f65e73c134e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111697, "uuid": "76b805aa-5370-4d9d-9606-00847281bab4", "value": "2FF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111697, "uuid": "c7b8fedf-4ca4-474a-bf98-69ea4cf5ef87", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111697, "uuid": "a3388d5c-9e4d-4a1a-811b-247ffb206c18", "value": "3072:eWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:e42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111697, "uuid": "6b8dea33-ef1c-45a1-9e22-ea49e8bbb28b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111697, "uuid": "8cc412b9-2678-417d-9510-708eba81fec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111697, "uuid": "51befcae-0716-4ba1-b341-d4c85518f024", "value": "2dc106fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2316c8d7-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090036, "uuid": "d0f84d49-812b-48a0-ac64-03f44ef15854", "comment": "Malware payload (Dridex)", "value": "86efb32bc39e6adb44258214438129c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090036, "uuid": "9bcc6dd7-9dd3-476b-afec-896d3b206474", "comment": "Malware payload (Dridex)", "value": "03c021907556c7fbf3b214582c7f077c4708b2680cac9357a67cc68ee9b4a890", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090036, "uuid": "52987191-8dfc-46ae-adc7-35ae710ef84c", "comment": "Malware payload (Dridex)", "value": "b6a3212527241924725dd8cf21f6db9e49f774bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090036, "uuid": "8be79041-fd6a-47fd-831e-3279e0389325", "comment": "Malware payload (Dridex)", "value": "257cd2540705d8d33bcc2bb99eafc630c9ea68d158899c520f293dfd564ad03215932d70616ed715d94de70e9dce472f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090036, "uuid": "2c6cc5e7-8191-4ea0-a08c-a12898ed05c0", "value": "99F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090036, "uuid": "e3c4b36f-8afb-4e90-b6f2-33757db3eaff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090036, "uuid": "01c7227a-ca07-48db-bb99-de9a0c0ea5e0", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090036, "uuid": "f42df260-e778-4cb4-ad9e-0ed4b2768930", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090036, "uuid": "e2f4ca6f-7eaf-4e5c-bb4b-cc12d533b30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090036, "uuid": "71796f26-d972-4c28-b486-f6a00f9ddceb", "value": "86efb32b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699cd784-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126233, "uuid": "415fcffc-b298-42df-b749-f3b222101e63", "comment": "Malware payload (IcedID)", "value": "cd5e9899a7fa08e45309f4cf728bedf5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126233, "uuid": "e0b10938-ad68-41a5-ae28-16479353a50b", "comment": "Malware payload (IcedID)", "value": "0465986113ca6df44638d99a67706662f7336e90c00d981666ba22217cefcfb5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126233, "uuid": "2d93378c-c6fa-459f-8c88-aac076abb84f", "comment": "Malware payload (IcedID)", "value": "a8671b54099e2d201660d220fc5652d3576bd5e6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126233, "uuid": "8e37ce5b-2d21-4280-97ae-d92070bc0017", "comment": "Malware payload (IcedID)", "value": "24322c6065748668377e61887f9f922fde004c5c95bdb581afae6349aa86101d22ee165fbbb03e2e30fd9bf849c07204", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126233, "uuid": "f7521df7-91ea-420b-bc1f-49b721f1a043", "value": "EDB3CFBDD502E4E2CB69DC3DD1167412AD5B91877F0FE61F208621AB0803DA76E352AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126233, "uuid": "70045e72-22df-4da9-8637-7989fb906269", "value": "1536:cutuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:ckuocrZDKGopH8x+8HdoLqp6vif+zUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126233, "uuid": "ecd8f504-b6b5-4322-a2ba-fc1e065c3597", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126233, "uuid": "7d3aa53a-57a2-4fc6-a30a-8c74b9246ba0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126233, "uuid": "7bdee3bf-2b69-48f3-a71a-ef72eab5ac83", "value": "statistic-207394368.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307de819-ad1f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620163503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620163503, "uuid": "8b9a1443-72e7-4a40-b604-f933bf0f6862", "comment": "Malware payload", "value": "5c009b59ab107344ab53728699f4d1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620163503, "uuid": "3991914a-6fa6-4c22-984b-183366a317f4", "comment": "Malware payload", "value": "04c9ccc533b33d9eaa98a4f82f32bcd142c1228492d195ab5335c094643b7a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620163503, "uuid": "7f15dd5c-55c6-4576-9618-8aa37a5fdd52", "comment": "Malware payload", "value": "8c4b3a8f1a06691434b57753cd858d551ef8f19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620163503, "uuid": "d329d035-8b64-44ba-85c5-1877493d6bbd", "comment": "Malware payload", "value": "5e45f49d893234aaa6eec3e39c39b0fd7d18704865a7ecb63182dcc3a1aa8ebb6953bd8abe3a16c39280adeff576d12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620163503, "uuid": "869b9a31-f7fa-4eb3-b39a-e25b625c4d36", "value": "1285FB9597F3CAA273D1EE570FF4B347290B33B3A538B1AD0891439087195CA82E67B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620163503, "uuid": "a957723a-660b-414b-8a01-56a95e751f50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620163503, "uuid": "2c25912a-a538-4347-8a38-f842c20defb4", "value": "768:vnu7bU/L03i6sEN1N00KVU1QKQR5KnpZS2GYYF0INsF3qvhpoXuX8KQP/K3CEo6x:vunq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620163503, "uuid": "15215ce9-6ece-4ba2-ac79-90b8091b26f3", "value": 1777664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620163503, "uuid": "5d43f0b8-30da-4df8-9b56-d387b1457cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620163503, "uuid": "e4c6f95b-df6e-4389-93f5-161239decd55", "value": "DHL_Feb 2021 at 9.10_8BZ590_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f9ba19-ad03-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620151674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151674, "uuid": "5093be93-c2a9-4900-86ee-1d29c721386e", "comment": "Malware payload", "value": "9c9832e06aa6a6fe0388987dd4522856", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151674, "uuid": "7770d575-b8c0-44aa-9e32-c304a3c18c00", "comment": "Malware payload", "value": "05f3bea11ad39cf1c466b94506339f12cd5eb604c42d59cd4c552857b8d92085", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151674, "uuid": "b369d20d-c564-4ab2-b3ac-e6ce6db78e10", "comment": "Malware payload", "value": "0c1e00c1bd3d1f92e17a54fea1855f79d9b8c9dc", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151674, "uuid": "27e1e776-1ddb-4187-a2d6-cd662c0ff1a1", "comment": "Malware payload", "value": "40007ea181985717e773bc1d3655ba842de481cde49596b6e4890cf78c5285c5f4b3abc8cb4e3ada781b2dbffb44b38c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151674, "uuid": "a256b05e-0e85-470c-aa5b-6c69001a7b6a", "value": "A1F53335B4FB74742642DBE25718CC3267F6D30A3A6A37264FF9A88F911450BB6B8148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151674, "uuid": "b1fe9748-88b3-4067-8fd3-cb05d87c08b8", "value": "98304:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HVCjzrbXbe8gGjAc:KnD4Yqqvc7hvLFOMojzrbLVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620151674, "uuid": "09476f86-c4b3-4396-86f9-e8dcd93674da", "value": 3604480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620151674, "uuid": "4c2290b4-6918-42bf-b061-451368dc50c0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151674, "uuid": "2456af12-099f-41a5-862b-4c27c54b8b14", "value": "05f3bea11ad39cf1c466b94506339f12cd5eb604c42d59cd4c552857b8d92085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daaa5e7-aca4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620110777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110777, "uuid": "58af4160-87c9-4541-9048-beb4fa0dae3e", "comment": "Malware payload (Formbook)", "value": "f19e6012ff248b9b380bb420080258ce", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110777, "uuid": "cff40ab4-ce2a-4bb6-a209-0f559f66715c", "comment": "Malware payload (Formbook)", "value": "069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110777, "uuid": "881193d5-1709-4783-8446-4d4b5e8090cf", "comment": "Malware payload (Formbook)", "value": "317ee43a8116aae39f3de3279620ecff4ac05b2c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110777, "uuid": "47c37176-a6d5-431f-a59f-ea2e69d42acf", "comment": "Malware payload (Formbook)", "value": "6044f256844f906231457212bc4e4482e503ff4753f0fcb7340e81b29ce33cfb16ce55c16b7222d9b92609ad719c3981", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110777, "uuid": "4f758caa-033f-4d8b-8380-85cc2f3a8b45", "value": "18E6BFD42A52DE79E8920BB1DC25CA124EB04F9C81D5660E77E8772573F378314EFA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110777, "uuid": "9e9e1e76-7188-4327-a659-dbaceb1b07e6", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110777, "uuid": "7f7ad801-36c2-4c96-a4d5-674b0b26d77d", "value": "6144:2PXF9XW/sQjFKjwpmGyt/4RQiTf9d03rFxJn:EXGj/wGywQiD03v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620110777, "uuid": "eaf2e2f4-f619-41b9-b071-f94b8f136798", "value": 14050919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620110777, "uuid": "957199fd-834e-4046-90d7-4deb00c515b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110777, "uuid": "c3060bb9-c22b-4f84-9199-c8217facc4a3", "value": "SWIFT 00395_IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758e4abd-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142573, "uuid": "b8351e7d-24d3-45bf-b030-ab945b3c471f", "comment": "Malware payload (Quakbot)", "value": "5ac72cad6c794e97474276ba534aa095", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142573, "uuid": "1b0e3fcf-1fa3-40d0-8543-d06a3ce95ff3", "comment": "Malware payload (Quakbot)", "value": "06b4a994cc6b9629775ebfcf818cd44267af85d7515980d4edc3c174ac47b6da", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142573, "uuid": "960d356e-338d-41ef-9591-d87fb937e8a0", "comment": "Malware payload (Quakbot)", "value": "5236650b529792d7aa754c62e1db170a62ecc13d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142573, "uuid": "7c1298d7-4b5f-4282-acc7-b8a0be29bad5", "comment": "Malware payload (Quakbot)", "value": "1502ab59a1ba9d72d03f277d055dafb9d59a6e6268c42039aee62fe13b5a5de10ff8d67658ea8a9d9c424e44608b33dd", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142573, "uuid": "dbf88287-fc85-45ed-8386-393bfdaf7737", "value": "1FB3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142573, "uuid": "4c84e7ef-ef32-4869-a142-a4b4e856aed4", "value": "3072:1kYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:WAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142573, "uuid": "0aaae27c-3b99-4861-ae6b-018f6aa3c304", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142573, "uuid": "595dfd92-628b-4f8d-8ad9-8fa659570fa9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142573, "uuid": "96eef8d6-5818-4e2b-99d1-94ffd3e509b0", "value": "Outstanding-Debt-1754918061-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3dc6ca-acf5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620145407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145407, "uuid": "304b3d97-d6bd-4362-ac51-c30751d6247f", "comment": "Malware payload (Quakbot)", "value": "0276be45120eeb640587451db55759cb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145407, "uuid": "6aa2998f-7bdb-4367-a477-4603958d0be3", "comment": "Malware payload (Quakbot)", "value": "06c9a8f5da75ebc77f7528ceb2797050ba17cc2c7e36467b0d259d4f48dbbcbf", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145407, "uuid": "90db581d-b315-404d-b35f-d51534a6ab78", "comment": "Malware payload (Quakbot)", "value": "51424cff72ecb039f78d5005a03ec2882a96d7dd", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145407, "uuid": "0b62bc00-7c2e-4462-b362-30102f38e585", "comment": "Malware payload (Quakbot)", "value": "9295d8dbe2a70e9dea5cee96808d7b9a7d048acbde7d2948efc4e00c38cacec743bca7f2b33b59f7b0a548dc2668b57d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145407, "uuid": "f0b192ef-12af-4456-a588-cdcc274971c1", "value": "ACB3AC0BCC488AC3C02E93FE7D074DF86E4E5719D8966FEF05212F893A665631D4B46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145407, "uuid": "6a8c30b3-4b79-4d91-a480-4548de74db1d", "value": "3072:zvKINbjvw548LMb/oqKO8NnS8+60KcplBO:+AbT648LM7D98Np+EeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620145407, "uuid": "757e0e30-c71f-441a-9378-e413f851bf47", "value": 116888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620145407, "uuid": "3ac87415-0dcf-40b8-8a86-5927f231d6d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145407, "uuid": "9d947a6b-8c8f-4976-8f9c-63b724c88532", "value": "Outstanding-Debt-1840996632-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698cd5de-ac9f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620108623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108623, "uuid": "e93bf9ac-1802-4500-990a-48fec8a55de3", "comment": "Malware payload", "value": "45960c1eb58c8aa329e17ca2026112ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108623, "uuid": "f0ce9ddc-39e2-4cea-b751-34a0bce5da9c", "comment": "Malware payload", "value": "07d5d1f729b12cdea5de5325869b60b4403b5ea8f21dde456270579be0928c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108623, "uuid": "266ce947-4170-46a1-a044-a4aea633e8fe", "comment": "Malware payload", "value": "919906d9d593bc16c79f2e0a09f5f7fbe43eb1e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108623, "uuid": "dd4aa1de-a60a-4b4a-8aa1-4c94ea0a3cf7", "comment": "Malware payload", "value": "1ab136e71f31f4f6f5145f812a0de78d8badceb964d570c579f347c7d7d2a15a58923059f1f635f2cc639f06a9c567f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108623, "uuid": "dd417753-2ed1-46a0-9b27-cffc51f7fc35", "value": "C3B533957EF8C975E1C10433CF6DEAFE6EAAE17A180048777BA4410DAE78605A640CDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108623, "uuid": "1cc3291b-d457-49df-ab17-a992f6d1511c", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108623, "uuid": "1c3146e2-ee28-4b02-8f72-ba83a794e9a6", "value": "49152:rLActJg3mgLwHCdtNriF97XIII3siNUMH4uS4SRv5WzhGMf+:rLAcjvVCTNGf77iaMH4R3fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108623, "uuid": "8a29dc5a-fdd7-4de5-b95c-9f2db93efb51", "value": 2284142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108623, "uuid": "8c1fc02e-c4ab-4568-a381-dc83063307d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108623, "uuid": "90985139-0dd3-422a-95f4-47b9dc9d3ac6", "value": "Clinica160100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6807cb4a-ad04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152000, "uuid": "b5f7a813-f95d-42ae-b858-6657d937fe2b", "comment": "Malware payload", "value": "6e87c1cc76a7ce1d3d982fb41d0ccac5", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152000, "uuid": "0d9d66dd-a5c2-4eac-8f49-3d3febc07580", "comment": "Malware payload", "value": "08a47feee2a517f51a0648569f970e4a234179ce9a02a98fb508e9a3eca12817", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152000, "uuid": "a35ae2b2-0720-4337-a6a3-2f7c95720ba7", "comment": "Malware payload", "value": "3e3e0a4b73760d3f2510f6631fb8d2b06b077a1f", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152000, "uuid": "3503998f-560b-4da3-a424-7c06da850a82", "comment": "Malware payload", "value": "9a41b919d94cf145ff154435b38030d8ef1e2c9567c7bb6b9e735c61582b136c8c72e24ded4f266573c75f5c5c933521", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152000, "uuid": "bb378ab6-f25a-4212-b2b1-238955ba43d0", "value": "9DA1E850112C1AB17346597AD26FFA52B50EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152000, "uuid": "7856e2f6-5a9d-4ae0-80d3-f4a495c71e19", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152000, "uuid": "23e605ad-998c-4fc2-b702-6990913ce201", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152000, "uuid": "8ca2f392-b770-45bc-99fe-af224a493cf5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152000, "uuid": "96aa0895-4ae1-4781-a3c7-a254896b2780", "value": "08a47feee2a517f51a0648569f970e4a234179ce9a02a98fb508e9a3eca12817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31990ee6-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620103805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103805, "uuid": "529e496c-cbeb-48a7-b751-90c38c98de97", "comment": "Malware payload", "value": "58528ce962742b9d9699e7d7ba533a02", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103805, "uuid": "6f07c894-7846-4b08-baec-2b7c19a95dc4", "comment": "Malware payload", "value": "08d79d59664df638c6f0d29991c1bc88410c5b5975724709d44fd3b578561ba2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103805, "uuid": "eafb063e-7bbc-4c15-b1fc-fb167bdad78b", "comment": "Malware payload", "value": "b3c94828a7f42a65355b717db94a669160a694ab", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103805, "uuid": "aa471e88-4906-4c73-9d11-97479f186717", "comment": "Malware payload", "value": "f369ca6defa5583c3436fabd4d6cee88f4f981c93bd2991199811f3a7ce0b60c3391830d6a2467b1bed380fe12cb417e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103805, "uuid": "e1c3d450-631f-46b7-87aa-0cf99d5a5dc6", "value": "E88423A0641F8850E5ABE802E66791156A5CDD31FB870D3DCB97364FCB7EF0C49902AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103805, "uuid": "062b6ed0-3955-403c-a6e3-dedef89e51bf", "value": "6144:H1fU97UpRukmupkp1Xb/n4T2wdWbOGGnRiF1kaaAtuM9lPOQQG:FWqWMkp1AT1KOGyctuM9RPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620103805, "uuid": "33d1d1a7-d19e-4bff-90f8-8e57260718ce", "value": 392692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620103805, "uuid": "8e99e34f-0447-4d0c-98d5-5e69c0a22124", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103805, "uuid": "3120bc15-02df-4a73-acc6-e63781c99069", "value": "RFQ 978002410.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a602dc66-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620111731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111731, "uuid": "6c75d388-7388-4ea5-9ec4-d2606bdb7375", "comment": "Malware payload", "value": "4807de51d4e79f4f00c72bbe8fda93c2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111731, "uuid": "70ea3d4c-8166-4569-a011-342d3f7e9be7", "comment": "Malware payload", "value": "093a65f30e9340b2a0e27228fe678426295ff97b934024eda5b8d080a8987d3e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111731, "uuid": "a2d63e86-dfcd-42c1-8862-312337a420b4", "comment": "Malware payload", "value": "4127a83ca90d142234e00d5b931a43506e190102", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111731, "uuid": "ae1a48aa-bca9-419d-8042-71887d6ec77f", "comment": "Malware payload", "value": "450e854cb543cda008521e3b2d8af076d1a1d1d1c768f22670e6f2b5d9ff77bafefde0fee7c42db2718a6b2966f8b78d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111731, "uuid": "37a4b4f0-d0b7-4e3c-b39f-c3cb196d288f", "value": "5F16F18BF704A86FC4B7D2325276461656474E298B83EB834AA4753C5DBBDC04B4BECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111731, "uuid": "afd9c3e4-cfd4-4d9e-b085-788cd34e1f4a", "value": "98304:01i6nsNhVKiYQxxXN8Y/Pj+ZNZuBzAstEl0GjRrQXnuc:01i6nstvYQbd3XiZNZuBUYElQuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111731, "uuid": "5231c52b-eb35-4625-a0d0-b99fe8823dc9", "value": 4189640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111731, "uuid": "9b9b262f-978a-447c-b4b6-3affc89a6437", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111731, "uuid": "91381f9d-9e4d-4026-8454-9bef17be0b65", "value": "093a65f30e9340b2a0e27228fe678426295ff97b934024eda5b8d080a8987d3e.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5269db6-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121635, "uuid": "f95e098b-1407-4b5e-a27b-99d049f013d0", "comment": "Malware payload (AgentTesla)", "value": "8b52d04793b3609e8de185680551d8c1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121635, "uuid": "5a3859fe-ae75-4dd1-9437-721100e0a3bb", "comment": "Malware payload (AgentTesla)", "value": "099eed2872cdf692ed40c7c7e4d760adb3c390927b72d4a332572f7ee6147ddf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121635, "uuid": "c0775025-3186-4cb5-8801-d5e04f58d8d1", "comment": "Malware payload (AgentTesla)", "value": "8dc4e34f6b1a405b2e8dce22329e4f8fb50f2719", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121635, "uuid": "37717390-7282-4ab7-a773-38c1fac357ea", "comment": "Malware payload (AgentTesla)", "value": "ff15f50cb79b0ee84d80d2fb12f3a4d1758ac2376bedfddfc7e43b02d4249e29d0cb58c836e9c668e76c0647bcfebdc2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121635, "uuid": "fa114d3b-0809-4b37-8daf-293b88f8b0e0", "value": "45D423E34D05677E3E3BC1BA625D424274500038BF6EA7F5E9CE8E498F8689C5DF1624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121635, "uuid": "5e2b83ad-c4ff-44f0-9b92-bab01955acff", "value": "12288:7ICbhGrz3Lh2I2EneE83u5sqq864OvUyNb95UupyVMpB23j:zbwrz3lNXneeq864MHauwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121635, "uuid": "be6318de-8d0f-41fd-bf57-696cfb66df70", "value": 629463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121635, "uuid": "a5abc0a1-855c-4eba-958a-0d307f18c98a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121635, "uuid": "f716043f-a07f-4df8-8cb0-aded93da96ae", "value": "STOWAGE PLAN AND PACKING LIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c497c5-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095227, "uuid": "da80421a-c84f-4f1f-bed2-d98a8d9cd3d9", "comment": "Malware payload", "value": "a6ab80c040b1fd782d96413a7ec2080a", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095227, "uuid": "cf1b8f33-299c-4030-90fe-33331962d323", "comment": "Malware payload", "value": "09a3ad2b284b46da2a2dea8213992997b5bdc7e7b1407bc32088cfeafb749eae", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095227, "uuid": "28ffc31a-5714-4a75-abfd-f95ea865ec8d", "comment": "Malware payload", "value": "c4d3c9d7694ca5ff9c4bc73108d960f0b2f91f9a", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095227, "uuid": "6a099a5c-e2b3-48ed-ad70-bfa5944ad0ab", "comment": "Malware payload", "value": "e52b735d416dc1c309d7698902c35446b100ca5156b7286da9cc916f11e5450c34a3e48ea7f4378857b559634cefd7d5", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095227, "uuid": "3aabb187-1c2a-4c2e-b03c-d0bf6d08686e", "value": "1E451243B3499D9BC2CB893D0CD9DD290758E62E4911C6A231B67DB7F8AEF930C0D5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095227, "uuid": "50e387d3-d144-4de0-891d-d0493d5ce74e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095227, "uuid": "8780746d-c15a-4f1f-a2ca-4495efa549d8", "value": "24576:xyBX0y/vDw/a0H7espu4+lhhv5VLsuAKZ6MNoC35j0En/:oBkyT0agispu4+jJDAKAMNBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095227, "uuid": "f570bda8-134f-43ff-9c5b-df5a2aa803c6", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095227, "uuid": "4f692f4d-898d-445e-9b52-37c4e1beb15e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095227, "uuid": "bfe69a42-7501-4579-a7df-8369280a740a", "value": "AstarothSpammer orig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fbcc84-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126087, "uuid": "f5edaace-63b1-4020-8bc5-856fb398e21f", "comment": "Malware payload (Dridex)", "value": "df024c6ef90acc061ecb06974debe370", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126087, "uuid": "d7aac9f1-560a-44f5-a103-7214dbb590f8", "comment": "Malware payload (Dridex)", "value": "09c3cf8f9a16cd1ec2ff5fa9263b1cf00eedbb8f4f08417f972b099da52d887d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126087, "uuid": "e22ab551-08dc-45ce-af70-197f639bf0c3", "comment": "Malware payload (Dridex)", "value": "ffd08fcbff2adab9d019f0c528cf22370e32ce52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126087, "uuid": "6c65ee19-bd59-45ab-8cf7-d5eeeada29a9", "comment": "Malware payload (Dridex)", "value": "b32e2a028e33aafd15dee311e3d11de1ea5e1fc5af4d4663bb10d9ab07cd4ede8a2a59d90cc04cee1748e4603f3820a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126087, "uuid": "18a3b343-1b7e-4df5-b45f-8d19ec076224", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126087, "uuid": "46043217-2a4e-494d-ba35-ffd0907b3eae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126087, "uuid": "9db468c9-e3ed-4db8-a26b-0e137dc28cf1", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126087, "uuid": "45d478af-8cd5-4bcf-a54f-a371bb0d5189", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126087, "uuid": "13248ef4-e6a7-42ff-8db9-ce670f3abb42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126087, "uuid": "823c534d-daf6-40d1-9ce3-92e180092927", "value": "df024c6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60f7fd5-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152614, "uuid": "b1699d4a-abc6-41ba-b54e-859688f043d8", "comment": "Malware payload", "value": "30ae5c13b98824f902dd3ce08ab1d177", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152614, "uuid": "6707d04a-7495-4482-85fd-7175293f5ee0", "comment": "Malware payload", "value": "09d83e6e97e5056d40bb9731b5bb2db3f9dd0946273fe7ca0362cf8ec5c2400a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152614, "uuid": "34c6418c-a79a-4a08-9298-50eba6025832", "comment": "Malware payload", "value": "91d47d05651473bf6b9ad9c6e527d6c72d038195", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152614, "uuid": "aed0e462-bb82-4323-9fd0-c2f72b9446b4", "comment": "Malware payload", "value": "b2d0c7bed40a6210dae76b065fd3b74c3f71532a633c4161cba8d092aa9b4f69fd38c81bcab7bc6f4073493f5e8cc704", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152614, "uuid": "76e475cb-3348-4429-a5e8-61c576c570d4", "value": "2C4633086326F8FDE8560A2927234AF1C5E012E4198115F28F7D7008597EAFF5BEE973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152614, "uuid": "8ddf0b8e-7f48-47be-b76e-aac51b3bcdf2", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+p:0XSxVJG2fLAqFOfT9sMYNM29SAFN25K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152614, "uuid": "5dcf322c-2fb2-48ec-afdc-0a11fe04040b", "value": 5406720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152614, "uuid": "f4dd1dae-727a-40be-b664-459df75c9efd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152614, "uuid": "884bf4e1-72d0-48a9-9ec2-d4da772bf2f5", "value": "09d83e6e97e5056d40bb9731b5bb2db3f9dd0946273fe7ca0362cf8ec5c2400a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdd9280-ad04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152196, "uuid": "ea36c02e-f908-4df1-8568-7ebc3cf8496c", "comment": "Malware payload", "value": "340db4d281b18fa5e76af4bf82408348", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152196, "uuid": "b145fe73-1dc1-4ac2-933f-9f3d58209a90", "comment": "Malware payload", "value": "0a4d3a1df1d79db297e109a9e3f177398882ea73bdac0c36cbb10b5653c9bd09", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152196, "uuid": "8b30c64c-2b67-4a5f-8b6f-d5a7223a772a", "comment": "Malware payload", "value": "72a196857253665c7fe977c9e15dcf7b8e315315", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152196, "uuid": "28a78cbc-8c1d-421f-bca8-ef207632f20a", "comment": "Malware payload", "value": "bcd841546a60f627f78b64cd0e9d61dffd6d5bff1e538741b7ad68ce17f5b51c657fe3f8bb5be8dcf652b2a37b19ba73", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152196, "uuid": "c7d06632-682d-44ac-ba72-21eaa225216c", "value": "2CA1F750112C1AB17646697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152196, "uuid": "f4c58189-2729-4594-a59c-b3fdfd171e35", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152196, "uuid": "8969dffd-badb-4f1c-b1ab-ce5508ddac5c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152196, "uuid": "48c62257-a18e-42b6-ad83-2eaaef019674", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152196, "uuid": "8b888a8e-a56f-4918-88a6-9be6c3b64b37", "value": "0a4d3a1df1d79db297e109a9e3f177398882ea73bdac0c36cbb10b5653c9bd09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a69eac0-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620108168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108168, "uuid": "8b2590d9-c8cf-41fc-a80e-9fdb0d514d7b", "comment": "Malware payload (AgentTesla)", "value": "cfc994a8e53da8a4c8e4bea0ea0b5e5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108168, "uuid": "a32320bf-f70b-45a0-a96b-4c11374f1820", "comment": "Malware payload (AgentTesla)", "value": "0a7f4158d2a840454636e357821e3f34901ec2017ba5ab2a53dabfcb8289b0f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108168, "uuid": "31fb30e7-e300-4532-a863-0058f8970875", "comment": "Malware payload (AgentTesla)", "value": "4e440067b1f0ffd0e9d717f348e4b89fd4f10ba0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108168, "uuid": "f5e300bf-6617-4900-b3fa-ac945e8394ac", "comment": "Malware payload (AgentTesla)", "value": "225c649509a0c2a65436308093a2e65c65b70eb25b4a5d5824b867ef19c429634ea6d4389fea25a91ade50ab322e44a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108168, "uuid": "317682c7-3c11-48cb-909a-5b8aceb51524", "value": "E115E05D23985BD1E93FA7F654A0414303F7AC02BB61CB0DBDA47CD67972B880266B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108168, "uuid": "141146ce-4ec0-4d16-accd-1f957adbcf0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108168, "uuid": "c6247c4f-4a1b-4842-a9cb-06a4d13d9e54", "value": "24576:uT1dLbOQncuS/f3s+RdYkUMFmzGQYaWpQuXG/A:uxdiQnef3s0OkUMFmzGPauQxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108168, "uuid": "a9df96bd-c3dc-439e-b4f1-946d78fd8979", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108168, "uuid": "ddd51d1b-b77b-4809-8106-4f5a8b9608b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108168, "uuid": "19d00def-822c-4cd2-b8bc-34adcc56387a", "value": "Receipt 309210k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bc7cc2-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093656, "uuid": "b1b594da-7761-479f-8953-6c4cec225462", "comment": "Malware payload (Dridex)", "value": "e859a261c977e6aeb3e3e720f3009b25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093656, "uuid": "115eb2c9-38c0-4b56-92b9-00a7df7401a0", "comment": "Malware payload (Dridex)", "value": "0ac9b3b11f5a1ad7da158b6087b0e89c48a0343f58c743e65d10b26705c509e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093656, "uuid": "397e9823-9e2f-4681-99c1-205d72181738", "comment": "Malware payload (Dridex)", "value": "7fd52fa71798680daa388a0f98149e55b645bda7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093656, "uuid": "8a110c99-1a7a-416c-aa92-4e7a816f2dfb", "comment": "Malware payload (Dridex)", "value": "daa65a5ac5ac5d20954b4d4d0dda34acd3533c44a8fe9b8d00a1bb47f3f95c9f81b9be0b6dabdc1d916bb499c2f7fe6c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093656, "uuid": "87814f76-1392-45d8-9bc1-654c8d00f96b", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093656, "uuid": "99ec8973-76c4-4353-8d68-184ca28e0d64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093656, "uuid": "74b3e1b6-c07b-47be-9845-04a17017bd75", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093656, "uuid": "2dff3132-a845-4e90-b3f1-70daf804bc7c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093656, "uuid": "e613f37e-fd0f-4df3-b7e6-a5a7e62c75a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093656, "uuid": "1b7b83cb-9c43-4aa3-a3bc-635bf4c881f6", "value": "e859a261_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0304203-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093736, "uuid": "c8bfc03e-ee61-4415-9b3d-5c27df987425", "comment": "Malware payload (Dridex)", "value": "abbeec35bb3f40f0ba161277b11aede8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093736, "uuid": "d3eda12e-9995-4a05-8dfd-01928977da19", "comment": "Malware payload (Dridex)", "value": "0b437e6593f2e347b2af0279bddce378d3f7e834046056a4bdfb0e9be23b5d96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093736, "uuid": "4a0d0f6c-b5c6-4d53-9269-19f62134f31e", "comment": "Malware payload (Dridex)", "value": "d28a25a178bc72bd7ef44750a2f043f98d1fddb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093736, "uuid": "272e5b24-3275-4fdd-a48b-64b34a82cd50", "comment": "Malware payload (Dridex)", "value": "a1615208addfb0d2360ffeaa6389dd3eb71e9224e1dcbd8927d7ff60250c8cb0dfdf14b0b3e6f55d0b3716e79d77ff28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093736, "uuid": "9a31ba85-90bd-4327-8825-13524f4d2208", "value": "3CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093736, "uuid": "b5e9c6ba-2de2-4619-9e83-a5873d2f9e6d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093736, "uuid": "1fa23f53-8e4f-4d71-93c5-aa7667674572", "value": "3072:rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093736, "uuid": "29b6a38e-b0a0-41dc-b5f0-2da31cda93bb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093736, "uuid": "19d94e05-516b-4722-a10f-50aef4821146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093736, "uuid": "cb84bd11-d31d-4761-8f43-b244e61f0a3d", "value": "abbeec35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb9848a-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095237, "uuid": "e71c216a-673f-42df-aa8e-949ffaab07ca", "comment": "Malware payload", "value": "c2661679cc0273ad0c2335ed3d845193", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095237, "uuid": "b693fbff-1aec-43fc-926c-76253e347ac5", "comment": "Malware payload", "value": "0c32eb10e9d1898d20ee3c62d4da8c395440a0440cf522f71a7045d5dfe1f468", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095237, "uuid": "4b50cbff-a654-44d3-bb60-19a99e8cc73a", "comment": "Malware payload", "value": "ea55466e599ce1fc33f6c85a8ddda1e7b134b022", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095237, "uuid": "ff28a402-05dc-4bb2-ac98-f71a81903b9f", "comment": "Malware payload", "value": "7d97c1161f5126a4bb2a5aa2a66b59428196472f6c474b99ee1bb1ff85f5d9c92c2293cec15bb68b7782ecedd966d670", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095237, "uuid": "a1949ab0-50b5-485c-81d3-e59103213d13", "value": "7A06D64549BFF2E8EF4D431C437804ED5F824E3668A7BEB517AF7EA2852731E0009A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095237, "uuid": "8ebbb2cd-e4ad-40fb-87ed-4670c6857d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095237, "uuid": "e88e7b65-2493-4849-a0c8-92baf140916e", "value": "24576:rvskUg7Iek0MtzPE8x6WsV2Id+TiXtUwQB7c/cfzgR25uAYHLz:r7jIr0Mtzj6Wpo+TiXyNxG28hHLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095237, "uuid": "1eff3e73-c1e4-42c9-916f-111a8cda6328", "value": 3683344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095237, "uuid": "4976f17d-caa3-417b-a49c-58afc6a6a2f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095237, "uuid": "eab49ea8-a1da-4ea8-b8d1-bdda1daf6ff9", "value": "AstarothSpammer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f2e154-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118901, "uuid": "b6472b73-162c-4af6-ac6b-cf5d393ad4d5", "comment": "Malware payload (Dridex)", "value": "42fdd888c6c0244366110b08d7c0f66e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118901, "uuid": "58ebaf01-ef4d-4658-b08f-ef0d55bde694", "comment": "Malware payload (Dridex)", "value": "0c376b081c647bc9a85f2bd37ec670cec8119a9aad96a1b943ae616293d8600e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118901, "uuid": "cd8997c4-93b4-41cf-9fc2-07b3cec58dc9", "comment": "Malware payload (Dridex)", "value": "d5e1c0abf5801b566bd2a1cef9b9da394e671efa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118901, "uuid": "0728ba19-d996-4c6b-bb18-20d770757a4e", "comment": "Malware payload (Dridex)", "value": "344fe65af9acc5046c3b8f2aaab5ff61e95fd27594a62d4e0374c6e72425eab56885fa51b665216316a598fe928ae369", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118901, "uuid": "2793117e-86ab-416e-89be-30a18f6f7e53", "value": "21F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118901, "uuid": "23bf15b3-0510-416b-b0b5-c1c1a7ce18da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118901, "uuid": "1db70003-5d67-4a47-860e-d9f23ebf1622", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118901, "uuid": "1df40fb8-1065-4ab5-bf34-f19f95e3f661", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118901, "uuid": "7ba3ddf1-1a1d-4ac3-acfa-947093e362d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118901, "uuid": "b402450d-8bd7-4858-aef6-d8331126d4a6", "value": "42fdd888_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1379f46f-ad01-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620150569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150569, "uuid": "63a34756-a535-4a83-8371-e6d85d7dea7a", "comment": "Malware payload (AgentTesla)", "value": "d0a8c2403c51ea96d820dcd443f1aaab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150569, "uuid": "0571536d-c6da-45f1-8813-9b1b476c4c90", "comment": "Malware payload (AgentTesla)", "value": "0c397ebc470f59440b6a317a88a2592c0b05057cea1ff2f31b9fdde549971aee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150569, "uuid": "dbe6de97-f689-4dbf-be35-a4dbe2eb78b6", "comment": "Malware payload (AgentTesla)", "value": "825a057b9218a956a632bdd563056be37bfc0c10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150569, "uuid": "9d37c06d-aeb9-4e30-b369-b789aba807b4", "comment": "Malware payload (AgentTesla)", "value": "849499f447cf22d9d11bb5742065d8bb4b3d293f9b73a9a1e2ba57de75520c05bd468ac83435cdafb127c01f2fb43a3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150569, "uuid": "e5253b8c-46e9-4ae4-bf7a-3883f987ed81", "value": "1B742207A390F5FBEB3B06760F35265B6FB6A51004E6039B7340BA2C77718D1152ABDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150569, "uuid": "d563b617-ccb8-462c-8b09-0d37a5d18b9c", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150569, "uuid": "8b4a55c5-5846-4535-979c-b4567b500948", "value": "6144:lPXZLwfTl4lCmjw3FYlbB231/KtItPfiFtDMFTDb+AqTfu8cxFdMACKtee7o:TLwl4dw36lyKtBgFMfoFdM7tGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620150569, "uuid": "9a301e6a-2ac5-4ec2-a680-f9734d36de0f", "value": 348416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620150569, "uuid": "50dd153e-4b19-47f1-8594-0b3725e0c20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150569, "uuid": "83da7033-3213-4676-8eeb-c3e5b2265102", "value": "d0a8c2403c51ea96d820dcd443f1aaab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9466f1c-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097268, "uuid": "a0727b4e-cd4d-432a-835c-04aa199b21d3", "comment": "Malware payload (Dridex)", "value": "c5429f1f70b63bd52ae3ab407c0cf3ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097268, "uuid": "c73fabcd-1dab-492f-871b-402d15d35ace", "comment": "Malware payload (Dridex)", "value": "0c4be37a1c689f32d0791df784ad23a02c19478f334009e96d49175ca9c6128a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097268, "uuid": "61135011-2ac5-4dbd-bbdc-1ff242a8390a", "comment": "Malware payload (Dridex)", "value": "780ffcbabc6f051e83e690e9ffbe9f776adb51e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097268, "uuid": "505e9f81-3e21-4609-a2ce-1fa92d11da8e", "comment": "Malware payload (Dridex)", "value": "a9d574118901713b06e43038916179b750e54d7252b1fb3fc9924ae36230e336afde2e1e7b98223637518c2f1e20ebac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097268, "uuid": "0ade1882-5619-482d-94af-ce2b780a795d", "value": "D6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097268, "uuid": "eb758e94-6e94-4164-b01a-773e04799d52", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097268, "uuid": "ef04bfd2-eca0-4bae-b42f-6052b583ecc6", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097268, "uuid": "bf6f3329-f6f6-4fae-a370-aa2ab772f179", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097268, "uuid": "81fa4561-787b-4b03-abe7-134fd9c96a72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097268, "uuid": "0aca449f-9d4c-4f63-b92a-e8411cc461d5", "value": "c5429f1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a75188-ad04-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620151858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151858, "uuid": "50c465a9-2105-4892-b16c-5f08bcf74abd", "comment": "Malware payload (IcedID)", "value": "332edf085c2c8819770c4bf594054d74", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151858, "uuid": "9c08e0d1-cd69-4a3e-9235-6cfd94f4282d", "comment": "Malware payload (IcedID)", "value": "0d86edb7aa59fbad6bde28032d001ed6cf4a5a2878e66ca1d5fbbf2e03e3a946", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151858, "uuid": "5d5b61b0-0b63-401c-9db4-61a878a5ff1a", "comment": "Malware payload (IcedID)", "value": "9457594dfa050e1f9d7ac2326714b665a36deb56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151858, "uuid": "ce21e950-30c6-4eb9-ad45-5fd0d9446487", "comment": "Malware payload (IcedID)", "value": "2869a81331dafcc59b8f98399e7596ff7db1bbfc4aa16b487104b9a8739ee2c17a0832d85b7b858f6fc68d57b8dcf03a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151858, "uuid": "6f7501a8-8e6b-4656-be04-9dd91acbf194", "value": "C7434AC2A784B2F1EBE56F7590795A2C86346390DE83307BD09C7227CF7225B072275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151858, "uuid": "0870be3b-0255-4c8a-b1be-4ece61e4a2b9", "value": "cfa8dd488fd4044f7dbcc5838881a33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151858, "uuid": "51fa74ad-10d5-4f88-8a6f-7fde360b5014", "value": "1536:dZoOQeP15YCslCvzF757+Rcl/K5InG4XD:A6fslCrF7QcNqQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620151858, "uuid": "db35fcce-ae55-4ccb-8b33-5d25f6090be0", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620151858, "uuid": "7da96d3b-b138-42fe-a08d-da694fa97025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151858, "uuid": "dd5ed62a-b242-4f73-861a-97566d9b2348", "value": "332edf085c2c8819770c4bf594054d74.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f050bb-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090033, "uuid": "f02348e9-96d4-43a5-9d59-efef1df71fb2", "comment": "Malware payload (Dridex)", "value": "65d2550490351532ec1e443008eca81c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090033, "uuid": "6d1842fb-ca0f-45aa-b6d7-70bef0f951c9", "comment": "Malware payload (Dridex)", "value": "0d91d1bb2c4e11e263e65cd30c72323dac6d9562b7df4712230535c0d58e336d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090033, "uuid": "7ca0feda-fc08-4e3b-8732-634ddb30129d", "comment": "Malware payload (Dridex)", "value": "a9f21820340a2bdebd7753d27c937492f48dcd4b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090033, "uuid": "9fff8937-24c8-47ab-84ea-a6fdab9db711", "comment": "Malware payload (Dridex)", "value": "0cef33a6f3872437338095c1a2e18b250d736959faeb728cb14bfc6276e1b4d4431adf872e8302a8434db3007776a301", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090033, "uuid": "494114ca-a80c-47c7-8064-ab62851890ab", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090033, "uuid": "c750c932-df95-4af3-843f-6cb03a829752", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090033, "uuid": "d6a21c0a-ad17-445e-85a2-9feaa1ce5d6a", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090033, "uuid": "841be0b0-2175-4786-9c12-8c62b8ea4d6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090033, "uuid": "42a92e6e-ff24-479b-adc5-d441894b0291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090033, "uuid": "39e5c439-ae3a-4414-b54d-716ac0c5abec", "value": "65d25504_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f2ce5a-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152637, "uuid": "95e1b630-0993-4fd9-a6e8-88dda1bd6999", "comment": "Malware payload", "value": "b715431ec47c2fa6c8d4bfd83afbbd79", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152637, "uuid": "a3cd0d85-f0db-4cd6-91d4-ec3df5e604d9", "comment": "Malware payload", "value": "0e03f58e495e2dc26dd496c23dd404d4008437a4587b4d4eb1c2a45c4838ef72", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152637, "uuid": "fc19f122-65e2-4a92-a14f-814349e0151b", "comment": "Malware payload", "value": "ded16072ec0d46797085bae9167a7e067b390768", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152637, "uuid": "3047f9c9-8661-4d46-a98f-0c112c5ed209", "comment": "Malware payload", "value": "1b9a0b5335f2a485c1c13880c4030c9b4e49a599a3d1fdc0ea02184bcacce0bae1e5da85880425afd926e055aa15cdcb", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152637, "uuid": "da5fa2ae-dfdb-475a-a611-ea56d3350fbd", "value": "F9D5331099D116C8F198CE2F1B9CA536147FEFCA78A4ADE7C2D38BF1100FE859972564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152637, "uuid": "fb886629-d7c6-44d5-88fa-1aa65a1821c2", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE97:G1wwAjzIQOMK2GNKslgus10YO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152637, "uuid": "2d46660b-0b66-4f1a-9d31-f4818869731d", "value": 2977792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152637, "uuid": "236a7818-0bf4-4a78-815a-d80327224835", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152637, "uuid": "aca99a67-cc9d-4e5c-b128-8cae345f0b57", "value": "0e03f58e495e2dc26dd496c23dd404d4008437a4587b4d4eb1c2a45c4838ef72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dcb140-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620142386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142386, "uuid": "72c61a90-c9c6-4b14-897c-4d19605521a0", "comment": "Malware payload (IcedID)", "value": "3d951c2791557496dab9d8cc62a1b6aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142386, "uuid": "04a1f7c5-d1fe-479f-8969-e81bb4d3acf4", "comment": "Malware payload (IcedID)", "value": "0e30a88438ef52e6323a75e2284c1145051c85651a7dca59f59f3315d7845f4f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142386, "uuid": "e7f3f0c9-8c7d-454c-b440-00bbc28fb361", "comment": "Malware payload (IcedID)", "value": "34f71eee1774ee49c1e69598e084bfd845c0f5b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142386, "uuid": "5c778fad-d72d-425b-9173-32fb1a2be852", "comment": "Malware payload (IcedID)", "value": "81ad096a0de4fe6bce17f49c4c2fb3c49c2978d0e28644b814d5c9577514ae224128f51de3167f63e345aee5c12bf650", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142386, "uuid": "531593ef-b726-4a36-b3ea-5e389f4edd15", "value": "700462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142386, "uuid": "de552550-3353-4716-8021-6db46cca5895", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142386, "uuid": "20ef2449-e6be-48d8-b4f2-014edb6b093b", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142386, "uuid": "31caa7bf-e86a-4c04-888e-fe0d2bcf83c6", "value": 182731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142386, "uuid": "91396184-db2d-4e0a-92fc-5c900443a8a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142386, "uuid": "294ca90f-1613-47a8-971b-377221be55d8", "value": "3d951c2791557496dab9d8cc62a1b6aa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97c8ed4-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152646, "uuid": "84486c06-f111-4fbe-a020-319738278ec9", "comment": "Malware payload", "value": "3abea70c8a08d6f11302b0b19af1f441", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152646, "uuid": "62a8b725-1be9-472c-a0b1-43bbcfae59c8", "comment": "Malware payload", "value": "0e4e701a939f1d0479b44a05be3109bbf3b9a6ffee9f6d8c04568a2917880561", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152646, "uuid": "e6d94400-fb53-4f37-8248-6cfa914ad13f", "comment": "Malware payload", "value": "672add38346a57349211b181cdb82eab6abcf715", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152646, "uuid": "f5b98654-c6a5-4402-9812-4556408ab896", "comment": "Malware payload", "value": "3586c090e5c66b669120e157da42e26b2be0fa005ff98d757bf126a525edda7cf9175e4e2e2bd6bea485c501d9d8e692", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152646, "uuid": "3a8d8c6c-0bb3-4a62-90c4-898a55ab50db", "value": "7DE5330C52EAB8FCF8A94529376389D085E852F1E88265F2D77C15980C3F57E1BDFA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152646, "uuid": "413f0250-5185-455d-bbfd-5305693d6226", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmK:0XSxVJG2fLAqFOfT9sMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152646, "uuid": "85ed11dd-3379-4384-b4ca-a8c26a3525de", "value": 3174400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152646, "uuid": "0782b20e-c707-434a-b90c-1cdef855797f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152646, "uuid": "d7221368-ce78-419c-ac8d-f1e5e418f857", "value": "0e4e701a939f1d0479b44a05be3109bbf3b9a6ffee9f6d8c04568a2917880561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b2b563-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126063, "uuid": "c3e287c4-23ed-4d23-a1b1-c2a9be5e89e5", "comment": "Malware payload (Dridex)", "value": "b16d05fecfe06fbee3ab24f64531dc46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126063, "uuid": "e8af3459-ecd4-4a69-8ec0-bda90aa659b1", "comment": "Malware payload (Dridex)", "value": "0e776cfdef12f1b758b593437376aaf14fc7bccdb43b23aab65bbd5158ea551b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126063, "uuid": "20faf7f6-77e4-4491-a3b4-a5ad5386009a", "comment": "Malware payload (Dridex)", "value": "60ccd80cbca59af4ab3ebcc53ef8b64cf103dfed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126063, "uuid": "058b29d9-d015-4cf8-8ae9-d1b50c528857", "comment": "Malware payload (Dridex)", "value": "899b836b3f628ae2a28a0ff53984913b715fbff64f678d7affe0c18c7686f1be5e6635e24de3f58c4856b039efff106a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126063, "uuid": "5cf1e6a0-6dee-46e2-afee-f13497b6770e", "value": "60F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126063, "uuid": "8bf2a5a0-0b70-4959-8b14-41f0f4dd68ec", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126063, "uuid": "3073a451-c702-44b5-a967-2671a2c6c678", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126063, "uuid": "e81a76ea-ee00-4b78-817f-9b8d1b8ce931", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126063, "uuid": "014d23ea-d0d3-46a9-ad59-98ae862062cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126063, "uuid": "6f98d6b8-f51a-4569-8eac-54550b8cc735", "value": "b16d05fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab3adab-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152648, "uuid": "74904ab0-17eb-40cb-b2b2-5d3ad128e368", "comment": "Malware payload", "value": "4b5a584b85f4c789cf818a7640a4d7aa", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152648, "uuid": "4f492c5c-0274-484c-8f51-becda42ae574", "comment": "Malware payload", "value": "0fcb7d51cede6fd20c93b9c831cebfbf45a25e37a20089d25f604727ab68dcf4", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152648, "uuid": "763cdc36-9c04-4c41-8ea3-676236ddfb88", "comment": "Malware payload", "value": "b99842d92495770997b7e4b10f9cb758adcfa5d2", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152648, "uuid": "41c5ab18-d27c-4cee-92b6-1cb4df245ce0", "comment": "Malware payload", "value": "d5e8de0ed1307b20cf55500abda0bf8e0a00dbc61171acfa0be019487a62efed8d548b0cf9fdd9bc4e7c6ef1707c7bf4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152648, "uuid": "c8a474b7-061f-4fe1-a6cc-301832a7c341", "value": "0DA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152648, "uuid": "28623146-607b-4c81-b892-4696aa3a4b89", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152648, "uuid": "3b7dd485-cdcc-424f-a293-eaa5023efb4e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152648, "uuid": "5c214579-25c4-4205-a627-c542ebc681ce", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152648, "uuid": "6b240c03-4fda-459e-a3e2-7fcab8845b8d", "value": "0fcb7d51cede6fd20c93b9c831cebfbf45a25e37a20089d25f604727ab68dcf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455c4735-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100831, "uuid": "e21f2e69-29be-42de-8eac-fcfdb2a5593c", "comment": "Malware payload (Dridex)", "value": "f3180228b0707462d2cc38b7c9def92e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100831, "uuid": "f4fe2ad2-11d5-412f-924e-51ce724a6452", "comment": "Malware payload (Dridex)", "value": "10e64371c7b2573f5395ac3486db23293151aba164f7b72b8c9bf7ca31c3f199", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100831, "uuid": "5c427b71-5984-441f-b350-378ffec33227", "comment": "Malware payload (Dridex)", "value": "4530c6219e00bb48203c5921446181a588e0a5eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100831, "uuid": "6a3685d3-2886-45c9-8cbe-3c463529414d", "comment": "Malware payload (Dridex)", "value": "a0be62c25d402ca457057d00afc6ae031f503b7d7e80a4a65f107a803cc812b1c78d5b5c3c43d6c6303b97660b9719c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100831, "uuid": "3d94fcb1-71a5-49c6-8aaa-74d15215038b", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100831, "uuid": "179767bb-76a7-4d72-afb7-f6f3625afc84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100831, "uuid": "c017a813-5d6f-43a1-bf87-97a435580736", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100831, "uuid": "426a5a0a-ac96-4199-b0eb-192b88992ac2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100831, "uuid": "22a90388-06b7-433d-aacc-4c2d66fe7ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100831, "uuid": "6030b1ae-cd80-4a50-a1f9-b0a40379d7bf", "value": "f3180228_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c02ae9a-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090051, "uuid": "3d15655f-d8f9-468b-81b2-e9c95706e016", "comment": "Malware payload (Dridex)", "value": "13da1eb39cd72455f41f7e128f62d3ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090051, "uuid": "65e87c5c-1b2c-420a-933d-015626b0a87c", "comment": "Malware payload (Dridex)", "value": "11292dc11637095d7dd9831ed6298b075b6c970ef3d1d4944c372816dc346d35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090051, "uuid": "6e44abe4-5e35-450b-8533-137fdf6703f2", "comment": "Malware payload (Dridex)", "value": "3061f504b25369b32bfa6e068844097ed8b99522", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090051, "uuid": "44d3ef71-7980-4645-81f5-5dd70b18b6ee", "comment": "Malware payload (Dridex)", "value": "02a61e79cc44b4aa82d35c4c76111ba35abf04db98661149c58d1e33fe6c7f67bd5d7b2ca696d78d68754084aacbbba9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090051, "uuid": "7631402f-69d4-4807-969e-dfabed3aa84f", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090051, "uuid": "eaca3427-b550-48bf-8e32-6977d447997e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090051, "uuid": "33a062a8-86f2-4645-977b-921f4215de3f", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090051, "uuid": "e90d094e-b38a-4328-a050-d29770b9ccc1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090051, "uuid": "0a56a50c-c227-4dcb-8451-ee2cf6bdcce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090051, "uuid": "ad93b316-0daa-4078-922b-0f86602d0966", "value": "13da1eb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4cc76b-aca7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620112096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620112096, "uuid": "008d702b-8df6-4458-847c-7083f31a4788", "comment": "Malware payload", "value": "9ef2ba87815a01b87bb0ea478ae36aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620112096, "uuid": "f266a124-8b92-411f-9d61-af40d9f9cb1f", "comment": "Malware payload", "value": "1148fd37dc6b17bfa963b36574154079f8876e9bd06f40a6cedfa453ef299837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620112096, "uuid": "da7c6da7-e0f9-4d5a-bc8e-0cce157615d8", "comment": "Malware payload", "value": "fe4985f4bf4831ef6067f5eff5d55d912fd9df68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620112096, "uuid": "fcca5c3a-23ab-4de3-91fc-1ab38912c483", "comment": "Malware payload", "value": "f76aa8e0e0ed778234f126592cb89a6d4ad1015684e8414451a78de45ec9664a127a20b8ee81b8ef5ffb1152468db06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620112096, "uuid": "8086bd9d-43ba-4662-a0b7-1d3fa75f62f2", "value": "C4223B0ABFA14832DBD80A7856379566CE797E301B4173E3ABB34AAACD740C5D83405F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620112096, "uuid": "f663b3a6-15aa-4258-a9d8-51ce8b785281", "value": "bc5e164052d58865ca49de78ceff6ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620112096, "uuid": "1f903600-dbc8-4be6-959b-717606e4fbbe", "value": "192:n/xQCaglMxEUVUuXHkVJFgBukUoaQyIbSZkaQyJv3o97E5pz6h3Gy:/xQ1IMxEUDXHkVjg8kU/QyuS3Qy9Y97N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620112096, "uuid": "2a2a1dff-cc7d-427b-ad09-0a2bb50e37af", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620112096, "uuid": "93388d56-334f-4e08-9b9d-519549dc7a60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620112096, "uuid": "a410f8df-0710-4bc8-8d6f-49b334285db7", "value": "Readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec58a0f7-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152651, "uuid": "6816c32a-5fa2-4830-b11b-9aa129ba3775", "comment": "Malware payload", "value": "0c805a0029c6358a96acfd0d44505e85", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152651, "uuid": "5a34438e-e23e-4f3c-a151-10f6de0fde9a", "comment": "Malware payload", "value": "1195bf300357a2227778fd66f0f62c5882dda5f917db4669d53287ed56e83f38", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152651, "uuid": "bc581b4c-db3b-40d2-8f0e-cb51537829a1", "comment": "Malware payload", "value": "5ce3e037e2d258ba77ff2b4c4f2c83108c038ca9", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152651, "uuid": "7dda1ba7-faaa-40ec-b5b7-046b46bad454", "comment": "Malware payload", "value": "ec683eb52849d0433d20f44543d16510cd3680794097e1f6bff2ac3aa74a5a04a7c11bb1138ced5c3cfbcd6e01144880", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152651, "uuid": "0b3085c3-8b57-418f-9314-a06ccf0aa654", "value": "C0E312394BE00EB631BA567ADFEEDD2E210DB9CD00B6C540C7C900AF1485969FA937D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152651, "uuid": "68b06930-70ee-483e-968a-f877f2087349", "value": "3072:buoJVo+C7X3UxKHMF/B+TajcmyvPdl6MWg1T9+xtMJyWRa4:jJm+C7X3cXB3cmubZW/xtwlRa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152651, "uuid": "ad509ad5-5fa1-4518-ba11-6ea8822852c2", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152651, "uuid": "b0e96471-a190-4484-bb2b-f6dde4a25ad1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152651, "uuid": "1a49c0fd-b095-42fb-a0f7-1b0ca395134f", "value": "1195bf300357a2227778fd66f0f62c5882dda5f917db4669d53287ed56e83f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b03deda-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118880, "uuid": "7d3eb2ee-18c3-48a1-b35d-8201476d35dc", "comment": "Malware payload (Dridex)", "value": "e6084538d050c0bb825f676a7f3ff484", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118880, "uuid": "c66925de-bed4-4100-aba4-0dc9bfca11d6", "comment": "Malware payload (Dridex)", "value": "11fd309d4769ae8405081978d06c5e21dfd384faf6a363f723b9de986feca2be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118880, "uuid": "e9e2380a-f9ed-4df4-a917-3cbc63fdcbd6", "comment": "Malware payload (Dridex)", "value": "c8bbad27f9c43e6b46045283a7b97320b80e7d11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118880, "uuid": "b7b92988-4c19-4b38-a939-ea2038751607", "comment": "Malware payload (Dridex)", "value": "c070c52e333d469cfdcd10084547b9ce19817414eb5c1398326a73fdb67c50b0ea0474be4e4a21009154b1b17c584cda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118880, "uuid": "6fc4b490-03c2-445b-b2a0-1d725ae78a28", "value": "22F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118880, "uuid": "16066f35-3ea0-493e-96b4-21631dce0ece", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118880, "uuid": "f2fd9dec-e112-4780-be0f-fb52e6597e63", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118880, "uuid": "f5fb4a3d-1e26-4691-9f06-07a9eda160a5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118880, "uuid": "7ac1b749-1814-402e-b3af-b0462555fd58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118880, "uuid": "455dacd8-97fa-4d8c-a118-0153e6b07780", "value": "e6084538_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab1bf61-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100867, "uuid": "08a56f48-fdb8-40ab-b07f-8e8400d75e41", "comment": "Malware payload (Dridex)", "value": "b15eefc585f1279f5dd34b8ba0602fa0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100867, "uuid": "70560a5a-d790-4989-ac9e-411a2fadbb4f", "comment": "Malware payload (Dridex)", "value": "120832050bff552cc2e2cb9ccc22ab17629f28c003401cdf7527700966adc20c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100867, "uuid": "28994471-d9bd-4015-8b62-029db3fe7a43", "comment": "Malware payload (Dridex)", "value": "cdf5f5a45384e31693207aa77b2209a1b714bebe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100867, "uuid": "a67dd76b-aaec-4e2d-8ab9-c8d91ddc3563", "comment": "Malware payload (Dridex)", "value": "34cd230b4f712bb487c5709c57bf01a01b44ca42abe30d0be024bff58a2b8408f31e39ed9cf36943d6308087b78e470d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100867, "uuid": "2bdb9d5c-f48d-4f86-9115-d0aae8a7c02c", "value": "5EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100867, "uuid": "f4289942-724a-4f70-a868-904f6c8fabc9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100867, "uuid": "48f246f8-7eb2-4c02-93dc-07c5a2b96222", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100867, "uuid": "8da932c6-9208-4b2a-87c6-fc74d4d8566d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100867, "uuid": "4f3a695f-7f6c-44c4-828a-21df3d3766c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100867, "uuid": "d2ce6acd-9d34-40da-b6a8-c0f15ae61b09", "value": "b15eefc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de5a41e-ac99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620105946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620105946, "uuid": "9f6eae31-7483-44ad-8480-77641911e695", "comment": "Malware payload (Loki)", "value": "30e97352af5c2d4dc09a085d7f8e210f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620105946, "uuid": "9a9a56ba-491f-4a5f-bf7d-da48f47b970f", "comment": "Malware payload (Loki)", "value": "12758eea50a5f2637e5588c99cfe1ad7408b5214d952ef41cf186e0dfcb56dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620105946, "uuid": "e876edf8-2ab8-4e18-8512-1c55c103fed4", "comment": "Malware payload (Loki)", "value": "b5cc7bdf0632240ab74326b668cbd701c59cf277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620105946, "uuid": "301add8f-40de-4a3e-9fb0-d50c0aa47efa", "comment": "Malware payload (Loki)", "value": "3b43f05acf45045c59b785c4182cbb0ceb836d74118c2a4eb3847e040a0d9b2d805f3527c3f15b16a89fd8958721270f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620105946, "uuid": "8bd2cc8d-268d-46fa-8189-3f64dfa53fcf", "value": "99A5295163A86E45E93E57B48731441847F6FC17DB72DB9EA884B0891FB3BC08F1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620105946, "uuid": "3a5b8960-7ad7-4395-bb6c-d56e7672b51b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620105946, "uuid": "3b14e99e-b812-4efb-b827-39882e7dacbe", "value": "24576:+mlJCQ79J3ZE1Xc5SwWOqG9Ay+McUHPBDmIw:+mlJCm7au45gv5ced", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620105946, "uuid": "b8fb16e5-7730-451f-9143-203bba5dfeec", "value": 2215424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620105946, "uuid": "b3d6b80c-5b9b-4199-9e12-c87531116c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620105946, "uuid": "e0299c0c-7762-4a2c-987c-90e059f74c0d", "value": "APPOINTMENT LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be207694-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086431, "uuid": "4fe1c811-8c77-407e-9118-da3207464735", "comment": "Malware payload (Dridex)", "value": "8b6c0317e5456feda7844d23012aeb4b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086431, "uuid": "a943a936-dd90-452a-b2c6-0895cfbcea4a", "comment": "Malware payload (Dridex)", "value": "12af6e830bdcfc11236e2b26e0820de1fa6fe7b3adae257185685980b49ab9ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086431, "uuid": "aa9357d9-e370-4d8f-a563-744173959089", "comment": "Malware payload (Dridex)", "value": "bb070475d19c5ddab0bde427f7be6a6ea34e5595", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086431, "uuid": "d2f7ff17-722b-4928-a835-acdbd6617bb1", "comment": "Malware payload (Dridex)", "value": "d57cb4bdfd2446a2a6f262a024ff6d61acccec218b3e1ead7b2f593b36ecca2ca08db6691e7239c989ba354d00becc70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086431, "uuid": "2332522f-e5f9-44e0-8e39-a0cc2e2ce64c", "value": "46F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086431, "uuid": "01674af4-fcff-4e8c-84f9-f3fd607ba2f7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086431, "uuid": "7463bb1d-7f0f-4fa2-a508-021c919d0e7e", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086431, "uuid": "7ac872b0-2724-4979-aae2-ef2280b65f94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086431, "uuid": "7fef3237-ce72-4232-8810-26e929d4fde0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086431, "uuid": "99fd9e1d-5c16-4a7c-8232-97e642671651", "value": "8b6c0317_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24e7795-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086492, "uuid": "f6e6f616-ed31-4376-b75f-58da885e1dea", "comment": "Malware payload (Dridex)", "value": "e709666b2c80baa9fad8a861cd3d5a5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086492, "uuid": "14b202eb-cece-414a-a58b-d2d7e21c1df7", "comment": "Malware payload (Dridex)", "value": "133231eddf89b84a017a1da5d752543e9c1a5ba2906cb097180a6d53d9571c43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086492, "uuid": "6a396741-3889-490f-acde-aa418eda8c18", "comment": "Malware payload (Dridex)", "value": "f2e98ef4a39da32434bcf15ccd5a7ce6857065f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086492, "uuid": "2fb30019-593c-41e8-8c3c-a303f75b29b1", "comment": "Malware payload (Dridex)", "value": "524497232c76bbf028bb06cee3b2da397de71c44b74765cc51dac6002664d4909ae1dc07df5572f0414128dff582177c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086492, "uuid": "75328822-ae9d-4f2b-aefc-84eefc850fb9", "value": "24F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086492, "uuid": "0a325f5f-e04d-407b-81e7-298295fc98c6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086492, "uuid": "664afddc-9b00-49fd-aa7b-85a21581e57d", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086492, "uuid": "331b1178-72d9-4712-8b4c-4221f2d4f3c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086492, "uuid": "8aca3933-ca4a-4184-ad3d-cad6ba7a24e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086492, "uuid": "a967ead8-3bd3-4d76-b8b0-786a35cae2dc", "value": "e709666b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070df8cb-acb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119195, "uuid": "0fc51adb-6e22-4b12-9958-d27827187b8a", "comment": "Malware payload (HANTA)", "value": "e4aca1fd0c358f31752ee47a8706c7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119195, "uuid": "ccec229f-7d66-4f31-836c-5fb4191bd5a6", "comment": "Malware payload (HANTA)", "value": "13449fb24d735a4847dd174860b5a6cd033c11d8bb1faf76b47dee7301a78ef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119195, "uuid": "711f2274-33ae-440e-a3c2-e4d4f46c4e84", "comment": "Malware payload (HANTA)", "value": "f6e98b705943c00079a8205d82568aaf754fe045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119195, "uuid": "eaa4d155-0396-47a2-b6a3-625d6ff822fe", "comment": "Malware payload (HANTA)", "value": "36de86c48198db52086a6a6a882c61978563d253302d042cc101b4b089730de215fffbee7f6f426a85545abca88e4d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119195, "uuid": "8d6306c3-02f5-4986-93f6-67f105ac720b", "value": "C90512B7406541E6C49A2B30F5690F4F3678D2344581F6A8F00FE3E9DD1DA9E8AF8768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119195, "uuid": "681a78ba-57a3-4705-9078-5a0ce5af1987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119195, "uuid": "2dbb896b-5d2b-4e29-9810-8fc96578ac10", "value": "24576:wAHdWiI56OxTWrBhQXvkvpHstEkENdO79Tq1:wA9WpFsBGXvAOu5OB+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119195, "uuid": "1077903b-8383-44d1-972a-714e991f9fc6", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119195, "uuid": "77ec18b1-c313-4f59-a707-7fa7f500cc06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119195, "uuid": "eed7eaa3-829f-4e1f-89de-883906b64fea", "value": "E4ACA1FD0C358F31752EE47A8706C7D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbd1da8-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095420, "uuid": "34e01bc1-2e12-474d-a21b-a99896116666", "comment": "Malware payload", "value": "c9e4e976be4e3925afc7be8ccefe9aec", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095420, "uuid": "e4d8d5f5-503d-435b-9b10-abdd9d594be0", "comment": "Malware payload", "value": "135573df3da9686274ab1136f6d15add8303c7db6c786dca480b0e85a477ef43", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095420, "uuid": "289de2b5-097d-4133-812c-c098b98d5558", "comment": "Malware payload", "value": "6be03ce737a2cba9f3ef56f106218f2cd59c2f88", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095420, "uuid": "766c3478-ef05-48af-aabd-89edd2c25b2f", "comment": "Malware payload", "value": "bcc4500245edd7fc6d8bc960d3446afedeb8c64184b33b588f4ffe47aa304a34bff26c03b85a85dcec6383a6176e8545", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095420, "uuid": "743a75aa-ca70-4cae-941f-1d1e15b40246", "value": "17D4939D721075DFC89BC4768EA85D68AB6474BA431B4203A0271DAFFE4D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095420, "uuid": "ecee1400-237e-4afc-b08c-cdda376c1e74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095420, "uuid": "31e643da-c276-4a6b-a05b-11bc906e913e", "value": "12288:s74X9N4xzuKVVRRagg2XwaFXBvhJel7cDE+RECi6fJJ+CaKcViKpivfCpOfVl6pu:sMXH4X/7FV0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095420, "uuid": "6d70688c-f587-408f-9d55-71bc1a63efe3", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095420, "uuid": "51094617-7b91-4851-9dfe-6c2d8624255a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095420, "uuid": "50974a9f-5ca5-4900-b06b-c261fcc7387e", "value": "135573df3da9686274ab1136f6d15add8303c7db6c786dca480b0e85a477ef43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef34992-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121436, "uuid": "8d68e361-8579-4604-8c1f-eea505331144", "comment": "Malware payload (AgentTesla)", "value": "a7bbf20bb9283bb9a70bd83e155d87a6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121436, "uuid": "8a961722-76d8-434a-907a-ae8a982ce9f0", "comment": "Malware payload (AgentTesla)", "value": "1356a10e485bf49fa802c0aa41ff3882b0af019b873111508ca193e2059ae1c4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121436, "uuid": "fe902881-511a-4151-bbe2-ac73ec5debe4", "comment": "Malware payload (AgentTesla)", "value": "6c9934cb65dbe8ca340449c8124b4c95c74897c4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121436, "uuid": "f654a573-6f9a-4cf4-b915-88f6aaa2c181", "comment": "Malware payload (AgentTesla)", "value": "fb6f54a98ec4310f419a87464deab566abab2f33de1cc7c4d57e5fa8335dcc2f5de76941dc33732d6fd22102905a4760", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121436, "uuid": "e680a51a-13c8-4504-93fe-c8885c505a6d", "value": "E25533CDCC63F23E097975FC1D47EA269635C35440372945B8289BC9DB9AB9B308CE52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121436, "uuid": "9beecf59-53c1-4ff2-8933-66d2025c909e", "value": "24576:fdHvS2GvyGZOWrKdQuhMDmi9sY9MJ4bfttb4MDxjTbxu0ixzbdwJZx5RGk:fd9GvFZOzJDi9XYwftPp/OxCrRGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121436, "uuid": "6d2f6bed-9261-41a7-ae87-249fd5ef4b08", "value": 1284749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121436, "uuid": "74e2a2ef-cb96-4545-9ee4-0797d86bd424", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121436, "uuid": "0eb42ce6-4a1f-495c-8605-180e4988f730", "value": "Proforma Invoice.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef08ca07-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115289, "uuid": "6f18f4c4-3a50-4940-82e7-c6fad32825ba", "comment": "Malware payload (Dridex)", "value": "8784a7ee979244698ccce78096801205", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115289, "uuid": "65101e4a-0ced-40a8-ac29-eae763007b4a", "comment": "Malware payload (Dridex)", "value": "13657a97cdd2afa1ef41de470ce4a24b4ace308337a748c5381faa16bbd45101", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115289, "uuid": "ac80411f-36e6-47b8-987d-8b8eedad3769", "comment": "Malware payload (Dridex)", "value": "73d7ad9ec494bb2c2eadfffd4c3841c34e0b47d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115289, "uuid": "a539a11c-aa8d-49d0-836a-70aa75173e1f", "comment": "Malware payload (Dridex)", "value": "f7b6f8c1201ee7ada99162c0cddd84e882ce99def1914801880a0e2fb78fefcbadb5f6a21befdb177cadc240b1726750", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115289, "uuid": "9b2496e7-720b-45cf-8935-b5c26147ce8c", "value": "40F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115289, "uuid": "2a7078b8-a876-4426-baa1-b1b83f4d56ed", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115289, "uuid": "2553b0a0-54da-4844-b6a3-399b2925a834", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115289, "uuid": "b2240d31-ee59-4544-b414-544afd5a89da", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115289, "uuid": "9b0ad1cd-1b22-4ba6-91b8-5ae8f42beda0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115289, "uuid": "8eee7414-4644-4b0c-bf75-509675cff675", "value": "8784a7ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74f3133-ad0f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620156938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156938, "uuid": "4947a47f-72ab-4008-8ed3-9a7ae2be4418", "comment": "Malware payload (AsyncRAT)", "value": "59c8e27d2d81f527f9ddacf055b28c50", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156938, "uuid": "d42af4f0-6f33-47ab-abba-84c09ed090e8", "comment": "Malware payload (AsyncRAT)", "value": "146f7a39df033afe4bb001da5b4a6eceb89f9efab5538c470b7f7f3cb4bbd15e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156938, "uuid": "d2f397ce-a339-438f-bb84-56212c4b8683", "comment": "Malware payload (AsyncRAT)", "value": "91755680598d3a93fcc0aa57d1760703c5480b00", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156938, "uuid": "45deaf59-7597-4713-91ff-7d47f156eaaf", "comment": "Malware payload (AsyncRAT)", "value": "02a9207296a053f26095695b413c365c2932bf4a9885f035802c4ef05c350d7d727109ba8e01a8512df267e26823674d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156938, "uuid": "9b8967af-10bc-4132-a22d-f4b54ab77d5c", "value": "06231B0037E8812BF2BF5F78ADF26145867AF2673A02D54A1CC451D75613FC68A42AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156938, "uuid": "a4cee42d-22a6-49d8-a64f-801fc47b413e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156938, "uuid": "8280972b-afa8-48ba-b3f5-5191875ac1b5", "value": "768:nuwCfTg46YbWUn8jjmo2qrdo6kztBO1PI8zjbggX3iyvXBs4cKzHBDZKx:nuwCfTgp/2io6Af83bHXSyva8dKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620156938, "uuid": "8855d765-46f3-4cab-b37c-05a6ea87e39f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620156938, "uuid": "6ec1ef82-e4e6-4203-8b3a-40661d81c2a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156938, "uuid": "06dfe1f2-f31b-4032-a67f-f6a22420bf92", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce67e0a-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095824, "uuid": "c3f42027-a6c8-438f-8e11-f7b4ad4a2c3e", "comment": "Malware payload", "value": "49473724a1ca54216739c64c8e2c257a", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095824, "uuid": "b1eac973-051d-4a18-a4f1-b2fb225aeb9f", "comment": "Malware payload", "value": "14de2d20ec55c420fab3e599525a1d5c5d18484a843cbf868bd945f5cfcca435", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095824, "uuid": "9ba380ce-ef8b-4f98-91fd-ced07f30b51b", "comment": "Malware payload", "value": "9819648ee9f7e9824462a1f2a15c3dcf8b9bc079", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095824, "uuid": "2595448e-dd6c-4bec-9861-4518c523f704", "comment": "Malware payload", "value": "aa5fbbb11daeec4a805094e7f45e7176dcf2a9a7cfe46c971456c781b8904cdd104269b393d27036bee37c16d2eef072", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095824, "uuid": "cd7f129c-5d4f-4df9-abb6-34dc8c0740cd", "value": "419533F23F1E82EC2681E10BA4304D56E3F57577888A257A7E92DBF5E8BC087C85641D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095824, "uuid": "ee72c65c-d1d7-4c22-9ffb-9d9fb976cd05", "value": "49152:7jkV8AjIOQzoOmCN8aT9vnVBL+P877dMZxLsYzoW5vUxY:JAkOKsopTg27difoWmxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095824, "uuid": "e14cc5d6-8bed-42ae-b4df-59e3939cadda", "value": 2021187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095824, "uuid": "486ff104-32f6-4119-9a80-a2960619bb9e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095824, "uuid": "893b73fb-649e-46c2-993f-7dc830a51489", "value": "AstarothSpammer (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f770c338-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097265, "uuid": "2dd74316-df6a-4205-b0d6-eeb7b387c636", "comment": "Malware payload (Dridex)", "value": "5627f715d6af7ef4deea0fe169e31203", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097265, "uuid": "250885a1-c3c4-4ea7-a712-957998f7eeaf", "comment": "Malware payload (Dridex)", "value": "15c72fcf17a950911db754f4996626c9ef121ebe911cfc87ea33b78c15bcd35e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097265, "uuid": "326e04d1-7041-4da3-8095-9374897eedaf", "comment": "Malware payload (Dridex)", "value": "d9b630a053c3aad21e5d3a27cf22cd42ae92e775", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097265, "uuid": "6b8bfa10-c4e7-453e-8de7-73b411bfa5cf", "comment": "Malware payload (Dridex)", "value": "51d1b0afb2fa4a54820f4da18e9da117bcbdb8391ec773f5019c804a3ad987dc25e15feb07d8b33acdb85e7a8edd17ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097265, "uuid": "6200a027-0b48-48ec-8c20-73e17f6c18ff", "value": "6BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097265, "uuid": "5b13ac53-8006-4175-bada-641a5c53a358", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097265, "uuid": "145e999b-55ef-40ef-a7b4-4f72116b82fa", "value": "3072:xWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:x42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097265, "uuid": "36666d1d-03ab-43b5-a3b7-e21a935bfb6e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097265, "uuid": "bff209d5-3393-4511-a6bc-af6843f3f4c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097265, "uuid": "0ff4b07f-6843-4c91-b13b-6c34ad3a296d", "value": "5627f715_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb7c060-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Snatch)", "timestamp": 1620093675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093675, "uuid": "15437180-cfd0-4029-9aa9-2451a18dc0be", "comment": "Malware payload (Snatch)", "value": "1b0c57b4b2f28b92d0fa8b71b2f1bce5", "object_relation": "md5", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093675, "uuid": "dc2ee877-2b92-4a35-ab8b-b4c00aade7ea", "comment": "Malware payload (Snatch)", "value": "166eec273d472577682b777f9e12b63697db76c21823abf8c228a8b8b506a4b8", "object_relation": "sha256", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093675, "uuid": "076d51ff-d0e6-4ddd-8a77-b3a21a4fdbeb", "comment": "Malware payload (Snatch)", "value": "85c495a2c17dc5e8fca669c346ab5ec2560853db", "object_relation": "sha1", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093675, "uuid": "a463dbda-c922-4097-8580-7b332c15fef8", "comment": "Malware payload (Snatch)", "value": "0c9287722cacefa9c36b555e86b62034ee6d291ad28855c655d4d4b001775eda18185fe0193a753dec9e1f138bb78de1", "object_relation": "sha3-384", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093675, "uuid": "8612c6e2-1462-486d-9341-9a55d23dfa56", "value": "15B5330FDAA77A8AE0155D2C8765F5E45909B6320BC939F14E8BCDACEC3B0D0B4F4496", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093675, "uuid": "37ab6dae-eeda-4722-b424-ccfa16a24a25", "value": "406f4cbdf82bde91761650ca44a3831a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093675, "uuid": "5b56f683-bc31-4350-b115-3885b4adc183", "value": "49152:X+x+r48w892b5w9e5hTHmg5/cZngnGireWKiUQ4cD0xt8azk0BWyQB3wEVv6bfV/:Ox+U8T0b5qsRlSngnh6WKK0xmazNBrQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093675, "uuid": "dceb481a-3c11-413e-a2b6-fd1b7dbe84f5", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093675, "uuid": "5b0604a8-064b-4121-9c83-95c81933d9f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093675, "uuid": "1c91fb33-c5f5-4fa4-bb50-2ad3650b1546", "value": "1b0c57b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4731d86f-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100834, "uuid": "982acf68-2df4-49f1-b7a5-564a96f1de1c", "comment": "Malware payload (Dridex)", "value": "8fc582932b1cea5d721eee1822a6e92b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100834, "uuid": "93a1e281-43bb-452e-9484-9e68d705f37a", "comment": "Malware payload (Dridex)", "value": "16e64377315a366c1878420f4184b2b24be20602579da88523023d3fd9e4f6ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100834, "uuid": "b5b05963-afed-4ab8-92cf-c7e1198eea99", "comment": "Malware payload (Dridex)", "value": "18c361cdeddbaa1b557cef2b253bbc00972c8560", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100834, "uuid": "902ea8c4-5506-44f9-8471-594e14520c59", "comment": "Malware payload (Dridex)", "value": "d686a6bf0934915a4aa723ca24952c5d6d32498b35d68ae9356ded4a9d18d97193e977e2aa37fc28e7bcabfa79fbd934", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100834, "uuid": "338cf68f-40ff-4290-88cd-ba4ea7e128df", "value": "39F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100834, "uuid": "f523faa9-9f9c-4a09-a0f3-5aae03bb948b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100834, "uuid": "81cc0ec4-6dc5-461a-872f-b3b8000fa230", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100834, "uuid": "76eaaa69-79d3-4a28-ad71-b49f67f4284f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100834, "uuid": "cf45a1fb-a693-4bd0-8c53-34e756dc0985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100834, "uuid": "0484ded1-99fc-464a-820d-c0cbc442fd76", "value": "8fc58293_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d55d1f-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620126060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126060, "uuid": "50d8a506-617c-4078-a04d-52b74b0885d0", "comment": "Malware payload (Formbook)", "value": "089175069d5c095f078b7f8a3b28a22d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126060, "uuid": "d1881f8e-aebb-49da-b98a-c12230d1aaa3", "comment": "Malware payload (Formbook)", "value": "173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126060, "uuid": "7b4ed14a-bfbe-456a-824a-711ead5c2b4c", "comment": "Malware payload (Formbook)", "value": "a563615dfe562e7a11c2b7f21dcfcd412594eeee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126060, "uuid": "88d452d2-499b-4ba3-bf36-923c7ce1ea4e", "comment": "Malware payload (Formbook)", "value": "5c50316ff8c9a87fc5afddd30335507437a2b5ab8969b1e7b12f3058f7059635a2082797e7e8be13265b9c4d64715a00", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126060, "uuid": "fcebf89c-0f0e-4e24-a364-e2f723f3dccf", "value": "F8E4CF233294AF69F1BE973940225600B3F1B507E763D68E7D9645CE0AA5FC0C362F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126060, "uuid": "765993a9-e57d-42ea-895d-6fa6e1f8f145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126060, "uuid": "f2cae034-da7c-42f2-8c92-5f0917ba797b", "value": "12288:ZEs0fKWP7eUMU/5r1Dss1duGwRIoX9KFm2ZNQSIpPyK58yP:Zz0TeUr/rD8RxX9K8aNQ3yKuyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126060, "uuid": "0abe20f6-c407-45c7-b588-629e1ba45ced", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126060, "uuid": "f232d330-fad4-4df5-a4cd-9f67158d4cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126060, "uuid": "8e5ce92c-a2bd-456d-b00c-04cda6f93001", "value": "08917506_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52f0700-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122494, "uuid": "30be9e31-9e97-4eed-a067-afa1f9368138", "comment": "Malware payload (Dridex)", "value": "586bfe6f66bec7bff529c9df199121b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122494, "uuid": "ac1c61f7-8b07-412c-b908-59f2dc9f5ee5", "comment": "Malware payload (Dridex)", "value": "173dcb8d2e096ee3ac1f1d3195eceeef4124c282452e4859281afc597e664a20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122494, "uuid": "d9696a30-8a92-4c07-a907-2594c6e2efd0", "comment": "Malware payload (Dridex)", "value": "f5e1e7c35ff3d316b76acf640b3d0193b38f9e49", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122494, "uuid": "3d45ad42-6599-414c-bcd2-5700b1b72c17", "comment": "Malware payload (Dridex)", "value": "dd874f019747baa4b092362c36b5e39e53f63b13a25694955fc06e5be54a39639cc906c2994f8c22fa51fbcdae0bc655", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122494, "uuid": "c7e3f3b8-e3ab-4f4d-aa84-489dbbc899ed", "value": "BDF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122494, "uuid": "a751253d-3fa2-4620-ab38-6085cf5ce989", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122494, "uuid": "ef328f28-f9b2-44a9-b773-2d6baba84420", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122494, "uuid": "e489357f-33f7-4c12-8ef0-7fd228302ab8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122494, "uuid": "b927a706-90b4-494e-9659-52f913c1b2d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122494, "uuid": "338b18e8-411a-446e-8da6-fd36c8674242", "value": "586bfe6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223469c4-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133414, "uuid": "6abf7190-8cef-476f-87dc-3a541aa37b48", "comment": "Malware payload (AgentTesla)", "value": "2ad72a3933556e1d30a06ae454a17d54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133414, "uuid": "ffdec57a-a3e8-4751-8717-133ba4d2c2c1", "comment": "Malware payload (AgentTesla)", "value": "17d2636add9f6f880c490347fbd54ed7f054eb37954eadcd04992efdb81d9204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133414, "uuid": "c7a66792-395a-4695-a232-7ee6db27a079", "comment": "Malware payload (AgentTesla)", "value": "0e175a0e16cbd071c5d84bbef369586c49b67446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133414, "uuid": "a4e68160-8c29-447b-978c-68d69bbdc5c2", "comment": "Malware payload (AgentTesla)", "value": "49585fc4845f90c6e99ba7c2a4b07936036cc61ba49d509ba8db4d53ea7fafcd80003d801d0eda3050b931a99e445980", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133414, "uuid": "3b16660a-59e4-44a7-a9d2-6bef7ffcf09c", "value": "C0E4CF223384BF69F1BE973980315600B3F1B506E363DA8E7D9645CD4965FC1C3A6BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133414, "uuid": "99e6a7fb-2114-4e78-b41d-8242680586ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133414, "uuid": "bd0a73cd-e41e-4b05-b25c-80113cb25f18", "value": "12288:q0d0N9mLOa/eeUMqcQAUT30F+J0GExKRc7quVXjGbqm2:q60yOfeUOQAUTEFedAKsVTGbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133414, "uuid": "9e490be5-3adc-4047-87f0-245f5475f02b", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133414, "uuid": "a5ef166b-1252-4262-a0ea-85ef07539082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133414, "uuid": "aeb1d51d-64c1-4d29-9b29-ab2419934e9b", "value": "Order Request .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08b8591-acd8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133331, "uuid": "d63ed924-de03-4396-8e47-ec067558cc2f", "comment": "Malware payload (AgentTesla)", "value": "b647a8fd6ee1bf9e5db31683f9eb54c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133331, "uuid": "5b1d7157-63e7-450a-916b-c55cb3169a39", "comment": "Malware payload (AgentTesla)", "value": "180688c5883698ccf8bb7114a6f5ba5f2433cbc6604ba785ddd102f2db89f9bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133331, "uuid": "58901c21-d334-4c78-b1a6-cc736753772a", "comment": "Malware payload (AgentTesla)", "value": "4171996b6299ac356f2dc6321398fdc40f6e43c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133331, "uuid": "3890dba5-c807-4cc8-a3b1-94f75d2b322c", "comment": "Malware payload (AgentTesla)", "value": "3da41ef752dafe75fc38cfaaeb9f0706f1c45c9007dd0aafe927112a97efb462b31fb9a70571ae80871d5b8be881a6f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133331, "uuid": "57738f77-07e4-4fcd-81d8-70f0ae9cdb31", "value": "C7E4C06233E4AFA8F07E9B7590245700A3F1B50BE721DA9DBDA510CD4CF5EC583627A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133331, "uuid": "3c326839-be15-4568-9930-2e1dea6b6dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133331, "uuid": "4697a399-aa31-4975-be9f-d1686e7480ca", "value": "12288:sogtrcvUIcOKMrzar1JM/xjC/H8J91pzR15H/S1zKWmaKygC/TJIT:bgtuUjOKKg1Jkxufsvpzp/kVmaao9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133331, "uuid": "26f62a1b-c4ab-43a1-9050-b7da374b150f", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133331, "uuid": "2c84e1f3-3436-485a-964b-fc7c25b1b4b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133331, "uuid": "e12d86b5-4ffc-40c2-b374-9d4f0f762ace", "value": "DHL Shipment Delivery Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881a00ca-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620104379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104379, "uuid": "df18e0ae-b328-41fc-9868-c91f8a1b6a85", "comment": "Malware payload (GuLoader)", "value": "e8d0b4855440c422e297cb1c56aa8e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104379, "uuid": "0f510833-d1f0-4d9e-8a76-1d31c1994222", "comment": "Malware payload (GuLoader)", "value": "184676b18d687073308c791c9145f0b0c8bc6a75fd4ed7aff7803381701c06f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104379, "uuid": "12c91ea0-c2f0-482d-918c-9c11f8ddfab7", "comment": "Malware payload (GuLoader)", "value": "d60b74f3275e6d3ab7657aea53e8f606595808cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104379, "uuid": "3180479e-14a4-4901-a594-4b4c12d3a92b", "comment": "Malware payload (GuLoader)", "value": "0139cfc243e4f4411df426c83d3547ec7ab511ee7995f07505ff9770856c1963fecbe3901ae61a121d14683e06deefcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104379, "uuid": "826f8662-8f49-44ff-ad41-066eef023934", "value": "A104F7326E04949EE9AD2A70A415C972F3162C1471092E5F7EA1FFB137F26836DF5E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104379, "uuid": "34b7a06f-1781-4ba3-910d-33eb124fdbc5", "value": "880cafba8cacb137a97f861a2c726b62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104379, "uuid": "a18c2f57-d05f-4ea0-9f8e-4fbe5f6cdc01", "value": "1536:6V2p+voOGIhkbIVb2ayvnF7lJswgtzz2i63kmA7Gw4mDAI16luJ17hH0SPtnw2i6:6bvozICHDvBJkzz25aPzAcHj9w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104379, "uuid": "dccebd7b-4c3c-4135-a0b1-e2e20bec6ad1", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104379, "uuid": "99eda4c2-5710-4410-b113-6bafbde0db58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104379, "uuid": "ab32bf05-9bb8-4864-8ffa-6f7d9a1caa53", "value": "SPECIF~0.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7b8f19-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100848, "uuid": "d5c37e70-798a-4718-a502-a7706d80c2a9", "comment": "Malware payload (Dridex)", "value": "1bc4fa275a6b5b3d7bb017038c1b2918", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100848, "uuid": "3b879ef5-64dd-44e4-80ef-f7f07fcc7582", "comment": "Malware payload (Dridex)", "value": "185b6421d0fc0f445d759bdc3c50d631d07ba5c1752e4f9435fe89c695d14bd9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100848, "uuid": "aa66a863-26f0-4119-9664-fa500a16d734", "comment": "Malware payload (Dridex)", "value": "9c6e4ee78195963a5922e710b3a4015abb53b20a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100848, "uuid": "405406ef-0c63-4722-a68f-06e9a966ef07", "comment": "Malware payload (Dridex)", "value": "19dcb4461d45a17f2258733349a14c61cdc9fb8f05de50e3e43d7aae34a01cd7bdb361aa4c114e79df93eb68f111ed6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100848, "uuid": "43b0f97a-3983-4f67-9479-249e31137199", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100848, "uuid": "ca91a049-065a-48b0-9120-bd92dbc80e96", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100848, "uuid": "b551d2a4-5585-4885-8581-889129738290", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100848, "uuid": "676dcba4-7b15-40ab-a656-090daa3aa77c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100848, "uuid": "0aa22a9b-a05f-43ba-a08b-41297b17c0c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100848, "uuid": "0557b20c-39bb-4ac7-8d66-b8d50c644567", "value": "1bc4fa27_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc81894-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086483, "uuid": "1c2e32a0-8314-4731-b27d-df3764d8944a", "comment": "Malware payload (Dridex)", "value": "a484544e68f82b798a541e1aad727eb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086483, "uuid": "1bbde7f9-597f-4afa-bb85-b16d3a474b9b", "comment": "Malware payload (Dridex)", "value": "18a19492e9958ae338b4bd66f801a7e100b4a53cc1bd1aefd8d4fa78c696a9ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086483, "uuid": "78e72ca4-f1d4-4f6a-8660-a6a2aec674f8", "comment": "Malware payload (Dridex)", "value": "f8cc785b1435d8c15589749c9dede65d4d7f9a8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086483, "uuid": "2413d44a-f03a-4132-ae14-d6dc81ba6e7d", "comment": "Malware payload (Dridex)", "value": "c32e1bd61bf018fe1be070f5084212f4a31701b7efc122a44ff3431c60e37e805280cc97a8904b1c01fdccce98ea312d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086483, "uuid": "e0e0862a-62a6-4a87-9656-0374bcfbc656", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086483, "uuid": "adf89dd0-1b5d-4009-a24c-f00beb32ca9a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086483, "uuid": "56a68e41-8149-46ff-9996-6ac170fbb278", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086483, "uuid": "bc316d2e-36b6-4f8b-a8f7-2dc7ec10a74b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086483, "uuid": "75e429af-7c99-4125-979a-c7ac5bddebb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086483, "uuid": "84e09676-eaf4-447f-8037-5bbedeaa46e0", "value": "a484544e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1add82-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126072, "uuid": "388d12cd-1d4a-45a7-b2b1-e71a122cbe23", "comment": "Malware payload (Dridex)", "value": "57e4e9e92fc6d56d7ced1e313fba716e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126072, "uuid": "1cdfc15c-f450-4d7b-9ee1-edaae3d23dff", "comment": "Malware payload (Dridex)", "value": "192faf53303349e73bbd1626a193216467e546177fd0259ba5570316bd1aa785", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126072, "uuid": "9d90139a-e43e-41ed-a060-8a481394dbfd", "comment": "Malware payload (Dridex)", "value": "48a54837d479b7a91f65b78d7fea4da15e1b8274", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126072, "uuid": "f3952d10-9c75-4f3c-95ae-9fd3f48a2d0b", "comment": "Malware payload (Dridex)", "value": "f8b814cd2c1f4339d7c204c40abbfb2d9b0eaad8d2a52529593fb723e8e048012d040ae91588ead847f60fbc447a3d17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126072, "uuid": "d859ccc6-273a-4830-880a-44c7a96938b1", "value": "D4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126072, "uuid": "1140556d-4120-49a5-99e1-8dcac9b2a1e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126072, "uuid": "16191523-64e3-451f-ac42-28b66fd455f2", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126072, "uuid": "c65c2181-a139-4b05-ba64-b9fccc56c51e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126072, "uuid": "d1735715-e2a9-4451-997c-0f66bbb60921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126072, "uuid": "cb7cfca0-fd9d-4f37-8888-92e372b67423", "value": "57e4e9e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddbe997-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108067, "uuid": "2415cbe9-2345-4cf5-adbc-cb07196971f0", "comment": "Malware payload (Dridex)", "value": "742af224fca94f75c79c8730161542e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108067, "uuid": "399be23f-5391-4af4-9422-f30d7e0b3e28", "comment": "Malware payload (Dridex)", "value": "1972e00fc705e55771dfcaa0a289dde44e46a2503d092c4df40f35166ecef075", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108067, "uuid": "78cea0a0-ee48-4638-b6bf-606ab5cc79a1", "comment": "Malware payload (Dridex)", "value": "8dd9fae429b664d4f30662066d3684847e86726c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108067, "uuid": "d1a0b630-cfb5-4813-adab-41eb0be6c526", "comment": "Malware payload (Dridex)", "value": "8cd35ce6d3bec566b6954e37b6f900da889ca02152c711a35685c2d5b50a83784dbab68d3f53d0c0bce0452d02fbbf7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108067, "uuid": "6bdd825f-5f94-45ae-a849-94158c668b4e", "value": "8DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108067, "uuid": "c97b3229-7037-4c40-b48e-e71fc4d2865c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108067, "uuid": "60c84616-f1a1-43e6-9475-3d85432794d0", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108067, "uuid": "952211ca-8e5f-4fbf-9013-88a05e0013a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108067, "uuid": "f3c60a01-267f-4742-9600-45acbf73ebdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108067, "uuid": "8e445abc-3fe8-4538-953d-26e985ee2bbf", "value": "742af224_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3b522d-ad12-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620158260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158260, "uuid": "d005b2b4-2b7f-48fb-806d-9506a95d326c", "comment": "Malware payload", "value": "db5198ea4d04bad9c91dc04ba2033579", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158260, "uuid": "0df7fbbf-a7e9-434f-bfac-8e2161f4a1c6", "comment": "Malware payload", "value": "1998849026d2d7f4c307bef0a8f2de606d8d4c5966d8963a2592d107be4dc15e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158260, "uuid": "ca301103-34c1-4a6f-9af0-4848ad95d991", "comment": "Malware payload", "value": "cd5a840885c8d5fb2ca02bd502fe22201f53437d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158260, "uuid": "7e742b82-4bd5-443c-abb1-e8a524fdc850", "comment": "Malware payload", "value": "cabfc515ea81dc2f2e06a1089301013756d7f2df3fa895b46435521899f553f429a7b2b6a85403d257e097684cd9aef2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158260, "uuid": "bc69a9e8-7d92-4dc9-96b7-061d13acc333", "value": "E216237322690189E4D6CC354A37FDD172F2035BEA82FC7DA9DB68C520729A8E353953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158260, "uuid": "7379c02a-4ab9-4374-bf01-9fef50124b1e", "value": "cae381e7af492d0839f28f8b1a4c21b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158260, "uuid": "8879e866-c4c2-4f54-a1ec-582ce5b8a25e", "value": "98304:m6h30YoT1QMYT17A8iwHbv33nnRNW3qn9wWZGPDxx+L9Vu:mkkx/Ubv3XnR069RcFxC9Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620158260, "uuid": "df4cf32d-0dac-4344-bcc3-2b4811edb80c", "value": 4230656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620158260, "uuid": "2e2a9147-1e31-4033-a729-2b47705ddd27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158260, "uuid": "e8aa0ffc-931d-41d5-8243-b08c80440ea9", "value": "SecuriteInfo.com.W32.AIDetect.malware2.26563.20103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9fbcde-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086509, "uuid": "2f4380e2-f1e3-402e-a18e-3baf9bb9810f", "comment": "Malware payload (Dridex)", "value": "c62dddc0ebc5fe81bb3392316f4fdec7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086509, "uuid": "ff2c403e-d9ea-42eb-b0a2-c7e9260e4739", "comment": "Malware payload (Dridex)", "value": "19c7dd402f4d647cf2760a3d0b12709ee12a456bb39d69745237680d6e5b6b18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086509, "uuid": "f623d560-6d51-43a8-bea2-73824f421274", "comment": "Malware payload (Dridex)", "value": "6a394f2a136f9a8322ff7f0606fbb4daab0a3ffa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086509, "uuid": "6ed61b5a-426e-414e-8248-19f4b93ee7f4", "comment": "Malware payload (Dridex)", "value": "bc8bcb5d9d7d6e7680b1209f1ea766c4cb3e6e7244860c53d85dce8b65f9872ed5176b5b9d855cdf86444176816d8b41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086509, "uuid": "b9d28581-01bc-4633-a6da-d908eb250539", "value": "45F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086509, "uuid": "fb644314-31b7-4e8c-8cde-d6e41a81ef75", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086509, "uuid": "7499f592-6e40-4cb9-9f38-e392c461585b", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086509, "uuid": "373a048d-8ec7-41d5-8cf1-3a2e6d8da2fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086509, "uuid": "0958f1cf-c783-404b-9567-b9c305292c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086509, "uuid": "78f1f6d2-fe71-42e8-9ca2-47980c98ba6c", "value": "c62dddc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7271396-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620115303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115303, "uuid": "04106dc3-229d-4f15-aa5f-1a0e38d83398", "comment": "Malware payload (AgentTesla)", "value": "85a3f6aa72c0c0a6ae58c45a32958185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115303, "uuid": "5cdec9ca-66b1-4230-8199-1e6c3ac642ca", "comment": "Malware payload (AgentTesla)", "value": "19ede468da200d63efd0acb085e7ef3a36dd3eda5d40488d2570eaae7041c5ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115303, "uuid": "c85ca88a-d4a4-44c6-afa1-e7ac71bee37c", "comment": "Malware payload (AgentTesla)", "value": "f6ddf2614fa4ffb7cb69e2f7faf2ea0b42eca02d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115303, "uuid": "00b1f858-34a9-4c23-8379-92497aa853b1", "comment": "Malware payload (AgentTesla)", "value": "72649e32ec84b2b4345e765ebf2c7541bb9967a242e6773200227dabe19624582031b7c9ed1ea7db05fca3b00b7da287", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115303, "uuid": "ebb34337-8d55-4859-ab32-a9ba24c0ae3b", "value": "3A76AFF876047DE6266F576BDE96ACDD03B626239ACBA4CC806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115303, "uuid": "a05db2bb-007b-479c-878e-fa2fcce404e0", "value": "24576:/G2yQBeorR7+zaXS+RtJqIjtqu+jITy8jRI1Qw8bl2jqPujL/NQa/w37o+GGdNr1:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115303, "uuid": "a5603c01-8111-485f-9b2c-8682f4b45a0d", "value": 7123722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115303, "uuid": "7a4c8cfd-62d4-4d20-9edc-888360b136ad", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115303, "uuid": "599ff664-7f76-4843-b105-2a668846fee1", "value": "85a3f6aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8f08a8-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152653, "uuid": "d000158a-74f7-4f2e-a35b-884924f915db", "comment": "Malware payload", "value": "9936cdaabeacabfd1927ba8afffadf7b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152653, "uuid": "c76e1b2d-dde1-4c19-b31c-cef308fbf0fa", "comment": "Malware payload", "value": "19fe432df435f2526bf12ca051d9c705b198ff459d5bf2bcabd1165954078bc9", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152653, "uuid": "02a3206a-3e4c-4e04-ae88-6f66842fb851", "comment": "Malware payload", "value": "4f0cb9754a27bcb8aa170596ad523915f12c008e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152653, "uuid": "cc9666ab-f7d4-4502-8925-71917501d0f7", "comment": "Malware payload", "value": "7ad57ca55c2b20d51770cb2222cf49f3b57ba3a9835a715cc8a0ab01398e3805d1d7efdcd6bec603498fc3e415422e32", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152653, "uuid": "d736f805-81a4-482a-a09d-eae5d01f7fc3", "value": "12A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152653, "uuid": "bbb83e56-aa68-4e1a-ae7f-a1262e788278", "value": "96:SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152653, "uuid": "ea5ffad3-53a8-44fc-8f4b-afcf109e2284", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152653, "uuid": "105749b1-5488-4887-97db-d3321b98def0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152653, "uuid": "6f0caf03-d792-4e4a-a8d2-fc480b151772", "value": "19fe432df435f2526bf12ca051d9c705b198ff459d5bf2bcabd1165954078bc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc67cb14-acd8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133297, "uuid": "d0346c5b-d78d-4bdf-af6d-a319e9bb5cc7", "comment": "Malware payload (AgentTesla)", "value": "8e6ca3bd2855438188bb22fdbb73a712", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133297, "uuid": "01e66488-8d4c-4b70-beb0-608290f39160", "comment": "Malware payload (AgentTesla)", "value": "1a0b85e94b4c6c47e743b96560b09aad2194278caa770f27ca2e85ad69b62e93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133297, "uuid": "85c9671b-99e9-4826-a757-fed177132620", "comment": "Malware payload (AgentTesla)", "value": "c2b8c77e04998e04a15ab61d5d7557864f9ec7ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133297, "uuid": "e383d4c4-9f0f-4fc2-8932-3351c4530251", "comment": "Malware payload (AgentTesla)", "value": "76339dd286d730a4262fa780558ab7505d4b7153768388e3dc39bdc875c3546c695a0cd84ba7910966a43067cf437b0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133297, "uuid": "686e64f3-eaa1-4ed6-8756-aee33f600d9b", "value": "CD952756CE458F4FD82D13778061474692F9ED2122F9EBCD6CC9B2E8BAF77814B09422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133297, "uuid": "4fb618a9-98c1-4bfe-a3c0-509674269c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133297, "uuid": "45a4a8a8-03cf-49d0-9853-6ebc3ff3b9b3", "value": "24576:ot4mJMUxwEFn1ncbbAT1JWGdXDsUjU2B0JFpyFEPBDmIB2NlbWhr7UI768:otbn1+b0pJZrFEpycdB2NEhUI7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133297, "uuid": "3a14ea7c-34ec-43b1-a8b2-c07d36ce5221", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133297, "uuid": "e2cf7ed8-25b9-48aa-b2a1-c5ddecabfafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133297, "uuid": "550f9362-026a-4220-8026-a0bfb0b4e303", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb91b505-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086507, "uuid": "dc861683-1071-4a35-b53e-5db18f087726", "comment": "Malware payload (Dridex)", "value": "32393080786741c658d87d80c76185b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086507, "uuid": "cb688719-a896-4a2c-aef7-f8dedca1f59f", "comment": "Malware payload (Dridex)", "value": "1a49cc409e7cb70da72f2ec635b416ae3f2f64c2ed063d9e569ebf51f58495fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086507, "uuid": "0c7fe84a-3ef3-452b-aa24-452405448e6a", "comment": "Malware payload (Dridex)", "value": "066937d3f59cd513fc3b253cbde4c0cad7f54b14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086507, "uuid": "1197722a-6c5f-48ee-a391-2435a6b0a9ef", "comment": "Malware payload (Dridex)", "value": "0911c5c243150cea3458b4a971c05f2e0e2650331fac5817641f3027138d542c89f1c930313c9a68178e0141e1628d40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086507, "uuid": "a8f419cc-bbc9-4164-837a-486fc7eaccbb", "value": "F3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086507, "uuid": "2244dccc-19b0-4fba-b44b-572f83a928f1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086507, "uuid": "65111cb2-ebee-4fdf-8ed1-a8d69e68415f", "value": "3072:rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086507, "uuid": "1bab1847-6dc9-424d-a26b-0a7a84b77578", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086507, "uuid": "26056d71-6d87-47ad-9c9d-b60885a3db2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086507, "uuid": "b097d021-1acd-4001-86bf-3fb65f161fd8", "value": "32393080_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c9df02-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086436, "uuid": "3ecc7ac7-3076-49e6-81b0-e34ea713e573", "comment": "Malware payload (Dridex)", "value": "33e765410ed12ac2bdb72a7a9467e75c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086436, "uuid": "177d0d0c-6432-4b60-a0ce-d7f9f29d4a76", "comment": "Malware payload (Dridex)", "value": "1a911f3dd08b22a31a7f3a2abf15e3b569e6c46683a6173255ca6f264ecfb7ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086436, "uuid": "e3d12fc9-760b-47b3-a88f-72f92d91e4d6", "comment": "Malware payload (Dridex)", "value": "67866a38d956680c304ccc97d8f9c317953d5a28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086436, "uuid": "cf5c0eb6-d730-47a2-bc0d-0ec52b515818", "comment": "Malware payload (Dridex)", "value": "af07d9f203bf0e0b80adbeb252583018dc519462a4f46e4af7f37ab92b1e3fb5b24a0198af80c058ca71ec8c2cabe169", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086436, "uuid": "ba710749-d388-42b1-8f94-870939368f2a", "value": "D0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086436, "uuid": "aa900e33-972a-4a30-86a7-492df202e8b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086436, "uuid": "1e71bc1a-07f8-4a39-9dff-01fcc0b470a2", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086436, "uuid": "03032f85-7d36-46b3-bb9f-98944aeb0b58", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086436, "uuid": "0cc51b24-656e-4971-9c6c-8a5c20994d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086436, "uuid": "dce17497-05e7-4b25-b44d-5b06620a1534", "value": "33e76541_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2cad7f-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160811, "uuid": "a4f23409-1edc-4598-9e3e-7f9757775b58", "comment": "Malware payload", "value": "117c68e21ba21239c7495beacb7f0fc1", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160811, "uuid": "dcf1a556-467c-4b6f-be56-a7760ceae1b0", "comment": "Malware payload", "value": "1af899670f85d50514253a9b427178dbf96018f49e502994e8a0d209b1db085e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160811, "uuid": "358a6cd1-716d-47c4-b082-c7fabd3695db", "comment": "Malware payload", "value": "b5e3b644d9e22f75a9ddcb8dd60204ab3755d191", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160811, "uuid": "9f687036-66b0-4034-8c1c-a41ba9959c44", "comment": "Malware payload", "value": "b758d5fc05a8bc7c7d0312d76df671326607e993f893893e2e52ae2a8ecf07a47402a1ba35cb675758139c162d986de5", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160811, "uuid": "22f3e966-1a4f-4f34-b680-88c593965294", "value": "443183B71DC391260312EAA2B741082CEB25940E9E47240CA5DEC94DB1E0F936FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160811, "uuid": "c2856d7c-29d6-4be7-afee-40accfb16932", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWpGPSqBJhZbxIzCyyD++ETTTQ/TvLE3aXTD6SEpy:GEXfhexTvrtWoPSiJVAyrLMXH7qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160811, "uuid": "b821cb51-307a-4c42-bd97-1b012d0cade1", "value": 1670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160811, "uuid": "441e881a-6bf3-49f2-92d2-02666e46e1e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160811, "uuid": "559301b2-b10d-4d12-8fa0-62d88857629f", "value": "tzETMW43.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f355d1f-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141677, "uuid": "e31e7501-29ec-46d4-ac4a-a229bacd0ac3", "comment": "Malware payload (AgentTesla)", "value": "3dad3d4918e28ded77c3e2e93a42665f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141677, "uuid": "5873b879-6061-4535-9739-0a70bd6f14cd", "comment": "Malware payload (AgentTesla)", "value": "1b61b157db50652678e1e288cfce86f6c74e40f50a468f6d04d0010c84235210", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141677, "uuid": "987bb765-1951-42e1-b472-9b22fa7a222e", "comment": "Malware payload (AgentTesla)", "value": "8b16dba4992b75a303f63a09d8a41ac99f28ce5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141677, "uuid": "efe93235-735a-4bd1-94f2-9494869f9935", "comment": "Malware payload (AgentTesla)", "value": "884f899a3239108ae702f5856e702f93d2996854becd845ab58a3aa596edf450de7a3e43e263de3263602890dca9df11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141677, "uuid": "4973385e-b8fa-439d-bb29-e5d556f182d3", "value": "76B5395222A86E45F53E5BB49730041C47F6BD17DB72DA9EA984B0891FB37C0CF1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141677, "uuid": "84f413ba-ae99-400d-b244-6097cb69f9f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141677, "uuid": "c920083f-fcf6-4ed1-a948-7b0aab97476f", "value": "24576:sPlzZc9mZUzZZE1XcEoLfOo5MkdoG1eJk14kocZmPBDmIO:sPlz2tZauEoL3McoG1gcw3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141677, "uuid": "c13ba452-d659-49fa-aaec-22b86deaf705", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141677, "uuid": "1447c91a-9583-49fa-a7ce-3b26a46d9e7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141677, "uuid": "88e8ef10-be20-4688-825f-167f9b460e88", "value": "pd9EeXdsQtNb3dQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfac529b-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122565, "uuid": "e528d20e-b6b3-48af-9c1a-50f7f8c372a4", "comment": "Malware payload (Dridex)", "value": "1ab9401ddf4b73fcbdc5c26301208d0c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122565, "uuid": "8b1defb2-505e-468e-a4aa-fd25910b6b15", "comment": "Malware payload (Dridex)", "value": "1c073c9be6f9072b7ca5e290d6f4d2f91fce2256905a05f3eb9ab51d82627a40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122565, "uuid": "f9ea3219-24d4-44a6-8f2d-7b5094722e4c", "comment": "Malware payload (Dridex)", "value": "ffcaa268ab19dab7ac4f1923fa5ebeb2973c5209", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122565, "uuid": "c5f34c69-12b8-4dfa-9fa0-7e41e606499f", "comment": "Malware payload (Dridex)", "value": "eb6283cdcf542044fdeae2b3f8a845dfb6fb1c4b4cc38c28f05bbbf04eda34dcec1fc44dad7c9005647c8b5fb1446751", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122565, "uuid": "1508d5d4-ad6f-4caa-aca5-bd0e629ce9db", "value": "67F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122565, "uuid": "66aac49e-1a4c-4377-a083-0c149e12e68a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122565, "uuid": "80fe99eb-99cc-499e-9dba-e99fb67897a1", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122565, "uuid": "687d3797-e150-40c8-a8cf-289e88d141a4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122565, "uuid": "1f20e5d5-e23f-42be-be7f-3cea470b5988", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122565, "uuid": "644a066c-0f69-49ba-a13b-7c71ede0ce40", "value": "1ab9401d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b98eb-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111671, "uuid": "bd37e245-269c-4ad7-acc5-b66825fa2e8a", "comment": "Malware payload (Dridex)", "value": "ab50b30c607abb1e1945b72d828be72d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111671, "uuid": "9a5228e4-d4c9-4f7b-8872-9b3b6fbeb4c9", "comment": "Malware payload (Dridex)", "value": "1c12ce9660120105c11712c013e608e149e97b7ad3c76b416dcabbeec1e52579", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111671, "uuid": "113e49e1-29fe-4a44-8545-7cfa721713c1", "comment": "Malware payload (Dridex)", "value": "d6db2bc939af896eb10bd3b22850388ad3954f35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111671, "uuid": "2a6ecb5f-47fb-4030-be14-0fd73e881765", "comment": "Malware payload (Dridex)", "value": "a198c20c1352f6021a97d9052f3b475e71165c77a3307da1b086a4bfbcf0adf5976aae243e59e3cd0d61fcaf686d9b24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111671, "uuid": "9fea2123-830f-4339-9ffc-33bb4c11bd16", "value": "0CF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111671, "uuid": "a912049c-1050-43f3-ace3-52a575ab431c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111671, "uuid": "87ee486c-2102-4d32-b76f-a2106a73f345", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111671, "uuid": "cbb0babe-4d5d-48b8-85d6-59ceae3632d9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111671, "uuid": "df023d07-427b-4da4-986f-1c6be2b46d23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111671, "uuid": "0c09a236-d5fa-4060-88b6-b627a9a7354e", "value": "ab50b30c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96436323-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093666, "uuid": "6765f2db-cdeb-4f65-99fc-0d7075cab882", "comment": "Malware payload (Dridex)", "value": "3cb8d84fbf2281599d5c172c0a44632e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093666, "uuid": "abb85ef5-966a-44ba-b812-70bfe658c14c", "comment": "Malware payload (Dridex)", "value": "1c3ec8ad111988dafb7292236477580f3a5d646c264d1048f9cddc7f48bfb045", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093666, "uuid": "e9cd4783-b93c-4bbc-bdb1-50e1f83ec6a7", "comment": "Malware payload (Dridex)", "value": "6eca739238fa5ca87c736ef4c0e4585fe19010b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093666, "uuid": "ae03aef9-a3cf-4586-a923-724e2b8589ee", "comment": "Malware payload (Dridex)", "value": "4a0f525f884991ff93638e80ae941c132b8cf8a3b661b28deedbcd99bde46296c0e6ba4e78d984a6b8e122744dfaee63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093666, "uuid": "dfc96dbb-47d2-4043-bfdb-dee9cd524416", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093666, "uuid": "924385b4-4467-4557-804a-a189189aea14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093666, "uuid": "85de8bc1-6d16-4e3b-8063-2324052c6b30", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093666, "uuid": "c10cd03b-dce2-4772-a968-6b670d926ce2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093666, "uuid": "17e0adf2-b7f3-4fe1-83ec-7877dbb52aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093666, "uuid": "747f3f8b-49d2-4f3e-92ba-363957ca844e", "value": "3cb8d84f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e1258d-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121450, "uuid": "bd43e9ba-9c6d-4fc5-8e4e-533ee19fe1dd", "comment": "Malware payload (AgentTesla)", "value": "4024dc34dd7ff5b3064067a1180cc3ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121450, "uuid": "671d003b-49e1-4c80-bacc-1cb3c76b97bb", "comment": "Malware payload (AgentTesla)", "value": "1c4cbe5a3adfa0a596eabff32c6a43fe2f5fc2be1dcf71bddbd0c1200d7451a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121450, "uuid": "10e3824c-773f-4edd-a389-eafe1341d7c4", "comment": "Malware payload (AgentTesla)", "value": "cac610e01fb334795b885de65a7658d9b873c956", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121450, "uuid": "cf74d82a-6569-49c5-b868-b7e7b1ee816d", "comment": "Malware payload (AgentTesla)", "value": "f08038f21ab5a6c45ab3555978f193c0968e3ae5232440ea1c5d8360ef08522850ff2a4289c0f79cf6339442dc5ce3fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121450, "uuid": "1056f46a-f524-4f61-8a85-a8ddd7705899", "value": "9DD53C02A6D8AF24E97D0733C5B5481087FAFC02DB72C55E68D478CD5EB3BE58A1A712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121450, "uuid": "3732eb2f-a097-4683-9636-d040a5239041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121450, "uuid": "8d2344f6-bc2c-4e58-9ac4-72e4aadd4392", "value": "24576:AjSEpgTxenwPL68zTG1lcgjbftR4yD5jTb7I2iETPBDmIHw32Rqyz:bOgTxenM6TYKbfhh/SYdiEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121450, "uuid": "62fe2ae3-b50f-47ac-9d53-eee33c928e52", "value": 2948096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121450, "uuid": "e393bdb6-d6e1-4488-b5ae-82c27d9c4804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121450, "uuid": "b2eaef57-c740-43b2-bfbd-fc2b0d180698", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2a4f2d-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090048, "uuid": "1d65c16b-a843-4f1c-b235-26ae5f8c38eb", "comment": "Malware payload (Dridex)", "value": "a50130982959f98efa473f617903fee9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090048, "uuid": "d14fa471-97e2-4790-898f-4f725feaa61c", "comment": "Malware payload (Dridex)", "value": "1cb7dac9d8a9b0fc0a8fae1a03ce420edefcf2939525e774fbb44f6442ce0e75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090048, "uuid": "ffbf81ef-0d8c-4be6-885b-125d1f97fbde", "comment": "Malware payload (Dridex)", "value": "2d01110062e44aba50b4351d7281884642725068", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090048, "uuid": "0c934d7e-a022-44e4-a7ea-1a3e65076828", "comment": "Malware payload (Dridex)", "value": "dc59e14025611951006ea8b3f36dedcc4c0afa103f0a5224591e04e19d2a3e875eb6747b8daa78e07d7b25f00d87d847", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090048, "uuid": "0aeeeead-ec13-4624-b38b-a6a2bf4c5a99", "value": "6FF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090048, "uuid": "2f806a94-a8ee-49b5-8ef5-cbe7b0995659", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090048, "uuid": "fe2ac85a-ccce-4b7d-ba18-08cdd73784f6", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090048, "uuid": "3edebcc2-6851-4b89-a1fc-94cd13cbe3bd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090048, "uuid": "4bda9563-9e09-4aeb-8630-534706d366ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090048, "uuid": "8e5f36dc-6360-4b0a-b88d-8e672a4515d4", "value": "a5013098_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a56535-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152667, "uuid": "4ea56bfa-bc36-423c-8e7d-70eb1f024b3d", "comment": "Malware payload", "value": "6ceaa8ffee0bf20ee1f5e2216fb9f99b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152667, "uuid": "c3312187-f37c-4a06-9dbf-4307d91f706e", "comment": "Malware payload", "value": "1cba580448a1b0db34f60241160b5864237eac5c8a8735869f88b7b3d53320bf", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152667, "uuid": "0ee1aa38-131a-4bfb-8e7b-7b871c9290d3", "comment": "Malware payload", "value": "f7d03036dc7a00a80963c9b93ca96c07bf5b8712", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152667, "uuid": "fee27010-ead6-4a64-8a8d-065a4d2e1722", "comment": "Malware payload", "value": "d4cb360078383cf2fed108cefa5614b5d4ea494e9f94b42bbdf56a833e676bc4748d340797cefa4f637558da8fe961c5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152667, "uuid": "f080dd29-63d4-4702-aec2-49d4d7d1ad0a", "value": "A106337CF0E939EF83946B72A6EFEF30201A29CD7051D3915DB7A586081A274D4EAD1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152667, "uuid": "1be81fa2-4db8-48ae-8396-11f4346e5c3c", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgE:td69Qg/JFeQ5x7bhE8SSdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152667, "uuid": "6304c03f-f092-4eef-b531-17cc8c0f600d", "value": 4014080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152667, "uuid": "ff331fda-35ad-4fb8-9b52-af26e2f560c3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152667, "uuid": "e599b297-fc34-44d6-a26f-8ea7681060c9", "value": "1cba580448a1b0db34f60241160b5864237eac5c8a8735869f88b7b3d53320bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9dc186-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152682, "uuid": "4db5bd8d-76ae-4a84-8967-e397d2754606", "comment": "Malware payload", "value": "5dd9810d64d4b83cc87afe4f05cb2978", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152682, "uuid": "ffc6a627-b8d9-4e23-80d6-dfe835a1a38d", "comment": "Malware payload", "value": "1ccac072c8a8cb40c6b326cd42db2be3a2f030a91c5e31be4846a5443245dd2a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152682, "uuid": "072ef2fb-03ad-4a37-94d2-f65d5fd073e3", "comment": "Malware payload", "value": "56b1916965b945dbe48294ffc6422f126db9f10e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152682, "uuid": "3fdfbe6f-f069-4e55-8571-c698df95c221", "comment": "Malware payload", "value": "5f111b67baf4c92749ca93316eddaa3df603237a0ca9a42c08d2d1f37c08c5700f7883c304c1ade8be36f441bd4a20bd", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152682, "uuid": "130b5aab-95af-4197-a022-116e43bc8c0c", "value": "1F16331045D122C6F6D4DD1E5B9C2AB5413FEECE28A8E9E3D6D3C3F4000FDCA9662A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152682, "uuid": "1e283b91-aa0b-4cbf-af6a-e2297612467e", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVdw:G1wwAYBr21uQsJ7vTBAlYVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152682, "uuid": "95303e51-8f54-4f35-8ec5-8908bc133884", "value": 4382720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152682, "uuid": "2172a1e9-795c-4930-9054-993ef228326c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152682, "uuid": "96ded1ee-7062-407c-989d-fa283a0d8cce", "value": "1ccac072c8a8cb40c6b326cd42db2be3a2f030a91c5e31be4846a5443245dd2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e59763-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100879, "uuid": "0c55534b-2343-43f4-90ac-7ea4695b956a", "comment": "Malware payload (Dridex)", "value": "b0944aaf7d41e4a2b24e1d5c95c392f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100879, "uuid": "e871739f-1ecd-40c8-8348-4d48ec001ad2", "comment": "Malware payload (Dridex)", "value": "1d78931f4071d7f66223182d96f0dc12bb2388d6157349d0b3033474c56f9a7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100879, "uuid": "619eb2eb-6ab5-4ca3-8df4-dedf8f45fe0d", "comment": "Malware payload (Dridex)", "value": "c82bdbd623f29e56883de563587569472ea23b29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100879, "uuid": "3d3a7d5a-cdfb-4926-a4d7-d93367de3778", "comment": "Malware payload (Dridex)", "value": "55b15f609e0ada32b119197738225c5a92410dd518263e86c60df17a78111d9d4475e6b8b5b878f3185238bcaaf4bc86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100879, "uuid": "4f0ca3ce-9965-42d6-866e-c5ac48004b45", "value": "30F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100879, "uuid": "7c1bf143-cb5f-4831-a091-f641178c7c94", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100879, "uuid": "c11a50a6-69d5-4953-b092-c2fc81264dc7", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100879, "uuid": "cff03d2f-e8bb-4002-8404-2a73557e2155", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100879, "uuid": "8674a1d2-5c2f-471d-99f0-3ffc6defb801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100879, "uuid": "c2cde29d-c20b-40bd-9195-eeeaed5e3c94", "value": "b0944aaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4e1b14-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122536, "uuid": "4e30a9cb-f573-4a06-abb8-ed1dc4e3a519", "comment": "Malware payload (Dridex)", "value": "0d81a9af0a36e33141a0c58f22716c29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122536, "uuid": "ab06d711-1683-4820-bbdd-2c9cdd867f58", "comment": "Malware payload (Dridex)", "value": "1e5af00689e36685bbd31f744b64bd8425ad3409865483d5fe8a1a1f8ac7d666", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122536, "uuid": "4f646ed4-116e-4098-bc6a-9411482edd0c", "comment": "Malware payload (Dridex)", "value": "77003163648530797866e3ed08e77fe53ca8b0a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122536, "uuid": "7250b7a8-f77d-486c-8f11-9e82f0d99899", "comment": "Malware payload (Dridex)", "value": "e9bafd2245ec6abf8bece8ee1bf228fcf40579bee15a4c35370e0c97a5a8ad4f563a4a93591cc4f72a93d0c76cc1d13a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122536, "uuid": "ee16671b-0d65-422b-8427-77b2e69131ea", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122536, "uuid": "16b19348-61bf-4076-836e-93801f18395f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122536, "uuid": "1cf8a868-e499-4017-be1d-2fa8628e6e17", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122536, "uuid": "ef7b09a6-c058-4564-a3fc-aea4fdcaed66", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122536, "uuid": "78f4c629-709e-426e-a993-fbbc79c8b27b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122536, "uuid": "08ffb546-2541-4371-bbf9-0b84b2694c0f", "value": "0d81a9af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30f098f-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620141791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141791, "uuid": "bae1e610-a315-4b91-8fdd-a9b90745d11f", "comment": "Malware payload (HANTA)", "value": "ba4def106cf0f92b51e258529ed6b486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141791, "uuid": "ea882c90-30a6-4ffc-879a-faaace6189e7", "comment": "Malware payload (HANTA)", "value": "1f040903902ff4b2e84299d82124035038d5365d31a97a3fdedf964a4775be48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141791, "uuid": "9697901b-ba20-41be-be2e-c7313fd05cd3", "comment": "Malware payload (HANTA)", "value": "481625bc584494c3124555ae185ebe6503e08080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141791, "uuid": "17e0c411-d44c-477d-9da2-5fa19380b7ac", "comment": "Malware payload (HANTA)", "value": "49b88757325f7ef5977f16065af811722e783aaede398883c84548d14b264cf085788929394726a10a28828e0d50fab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141791, "uuid": "4d314e82-e3af-4328-ba1e-32da30608d54", "value": "D405027B006254A6D0482334E4652F1B367CC6780680B5E8E44BB3EBDD4F69E9EF87B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141791, "uuid": "0433fc7a-2f83-4add-b119-3cd350ac44e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141791, "uuid": "6002fcca-25aa-4d8d-bed5-5df71aa0a585", "value": "12288:UB8Ht6b4zlSyVYlO2B22WbfSIUYmlhENdqyuuRD5MZ+7XZ7tFq8FF7uzJ1PKG49k:H7SyqlbsI1rhE3u6B7wK780G0+Wn0ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141791, "uuid": "95a3a291-bf39-48e1-b552-a1f771cc90d5", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141791, "uuid": "1dfef7df-cf51-4adb-8d98-9fd2b82fc3dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141791, "uuid": "5a263f47-c592-4b47-bc07-39dfabf02c75", "value": "h2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56cd3ff-ad03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Babuk)", "timestamp": 1620151727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151727, "uuid": "6eca23f5-2f29-46c1-b48e-e556ef00056d", "comment": "Malware payload (Babuk)", "value": "f0d4c7d334633a72a3c7bd722e12c378", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151727, "uuid": "05457049-5efe-4153-93b6-2bf2e35ab2ec", "comment": "Malware payload (Babuk)", "value": "1f2edda243404918b78aa6123aa1fc5b18dd9506e4042c7a1547b565334527e1", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151727, "uuid": "c61508da-c989-4f5f-a00d-9c63d2986e2e", "comment": "Malware payload (Babuk)", "value": "5240f71f60c473b5f9ba100d2ce1d6effdbc08c1", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151727, "uuid": "69054927-b0d8-4647-be10-92e5577b5119", "comment": "Malware payload (Babuk)", "value": "60a9cf2ec8a512d04ae53f80c50a0877a66241072bea3b6a9f2e78f909518e03c4c4ccce1a66dca7020313f32bf6fa7c", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151727, "uuid": "18511786-d97a-42f7-9565-82000163be4a", "value": "EA83E7116D44D2B6C5D16231D157F0AAC13A19F003B5A28B63C017AEFBD0AA8E67FF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151727, "uuid": "e0b0a477-40dc-40f0-b7bc-9a5d0339bf2a", "value": "202fa14f574c71c2f95878e40a79322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151727, "uuid": "911c61db-b679-4196-9047-03678678ca44", "value": "1536:jnphiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4:jnPiBMAqeyXBsrQLOJgY8Zp8LHD4XWah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620151727, "uuid": "afbb6296-691c-4cb8-977d-fb6e8c038319", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620151727, "uuid": "e6301f41-60f5-4462-9f06-553733a0a553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151727, "uuid": "37e0fc7d-ec7d-4536-9fcb-d2e96bbcf300", "value": "e_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd65499-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152684, "uuid": "b4def9ba-381a-4075-a6fd-92c77beb8838", "comment": "Malware payload", "value": "6698dab7d68df2ebee9634557235ce0a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152684, "uuid": "c1626767-7ee5-42f1-8142-450e373dc785", "comment": "Malware payload", "value": "1f64f6c23146ff798787428a2bf4be6b9579c0f44eedc2866b581564908a4c3d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152684, "uuid": "a5e02f62-5309-492c-bd20-e2a8e5c988a8", "comment": "Malware payload", "value": "0e4f5e53eb015fa4af306e9f2990058142c2f904", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152684, "uuid": "985d5f0f-5996-47ce-b286-1500539fddf8", "comment": "Malware payload", "value": "1a9a5ec0f0d67e4b552303ed1277edc443b5be1e3dcc1bfedc2d2bdf28bc3e319e404c5b1bb25829aaff9c959ce6c73a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152684, "uuid": "6d9816c9-9a5f-4fbc-a4db-d50ce22c7250", "value": "3B418589334618366C955A7276BCCC086894E9B174C86FBC97DDBCE8DC5CD017BC4A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152684, "uuid": "497f94bd-8948-41f2-8119-e16cc3490ba1", "value": "48:v4y+ya4yVyxo4y+hyK4yWyLGh4ybyW4yYyi4ytye4yPyg4yKyS4yDyEu:vHVaHoGHNKHtChHmWHniHAeHagHhSHOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152684, "uuid": "22dfff55-9f01-4f2c-abcd-2cefff16ab30", "value": 1993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152684, "uuid": "eec69f0c-5c11-4592-86cb-ce88ec00726f", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152684, "uuid": "6d4dc53a-3e8f-49e0-9793-0a5a5ed1915f", "value": "1f64f6c23146ff798787428a2bf4be6b9579c0f44eedc2866b581564908a4c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef479b3-acda-11eb-abe1-42010a9c0039", "comment": "Malware payload (Ransomare.Sodinokibi)", "timestamp": 1620133919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133919, "uuid": "66dcf915-6821-42fb-874f-6ddca9369398", "comment": "Malware payload (Ransomare.Sodinokibi)", "value": "18786bfac1be0ddf23ff94c029ca4d63", "object_relation": "md5", "Tag": [ { "name": "Ransomare.Sodinokibi", "colour": "#FF5D8F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133919, "uuid": "ef714c9a-d20d-4fab-ba76-65be8ce6b705", "comment": "Malware payload (Ransomare.Sodinokibi)", "value": "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e", "object_relation": "sha256", "Tag": [ { "name": "Ransomare.Sodinokibi", "colour": "#FF5D8F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133919, "uuid": "170e929f-b437-4f00-a2fb-b6d6f62b6084", "comment": "Malware payload (Ransomare.Sodinokibi)", "value": "3c2b0dcdb2a46fc1ec0a12a54309e35621caa925", "object_relation": "sha1", "Tag": [ { "name": "Ransomare.Sodinokibi", "colour": "#FF5D8F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133919, "uuid": "4e9c17c2-24e1-484b-868f-6cb9caead040", "comment": "Malware payload (Ransomare.Sodinokibi)", "value": "9c6ae1131fb069b8f9110171a4b66e798d0e17021e9574b034bb3f7d3a0d4cd2711d4a0ad243796968b92ba07f5c2278", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomare.Sodinokibi", "colour": "#FF5D8F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133919, "uuid": "32a2a404-a09e-456f-9255-bad3aa3e1841", "value": "7F15BF03FAC184B2F5DF053921B3977A8D3AAE109728DAD39B9078658D312D06B3F795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133919, "uuid": "ae2da189-40a5-4930-8e6a-746126f27126", "value": "1179c043cd6766729406d435a48c9499", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133919, "uuid": "f563fc0f-8520-4ab0-b61d-c8039dc22099", "value": "24576:VRjxskD1HtqZ+p53DVJ3Bpv256HDtMTeWDqQE:Jd2+Pf28SR3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133919, "uuid": "a7139e8e-0375-41ac-8990-266dbf3cd47f", "value": 932704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133919, "uuid": "7e57f224-4218-4a55-bbc5-e83348b4a8c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133919, "uuid": "3c6f134a-cd3c-41c3-b779-6630620376ba", "value": "srnmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4168c2-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111740, "uuid": "fa77049c-a967-49f5-a2ea-732b075f965a", "comment": "Malware payload (Dridex)", "value": "2d34e1362ca9df5880aff843711458a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111740, "uuid": "7b78b81e-0e8a-4554-86b6-24c1733f44e0", "comment": "Malware payload (Dridex)", "value": "2050059c1e27d3e9af798abdea0e37744035d8ad499a20112d013983ce710001", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111740, "uuid": "d9fcde52-d8af-4222-95c4-5d56eabcc754", "comment": "Malware payload (Dridex)", "value": "9e3cb396decb860ec3a723a26d2a268a964dbabc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111740, "uuid": "5e7763c3-4076-4718-8a96-1e376059b693", "comment": "Malware payload (Dridex)", "value": "e6c2aafb01bcbab8f381ff051b760ec3f02c59ca35c8320b851887951ac1cf5c31ab9e51ffcfce328c78b0f955735d26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111740, "uuid": "34e55314-9c65-4098-8516-615d2ef7c8ec", "value": "BBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111740, "uuid": "b5d60dbc-b3f7-4bc3-b182-8235d114fd8c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111740, "uuid": "e2b98b02-2fa0-43fb-bde1-c2690c695156", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111740, "uuid": "c5fb318b-d2be-48e1-8ade-395ad2ece20a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111740, "uuid": "8c9f43aa-0062-4878-b0c4-16cf67f20161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111740, "uuid": "2d9c247b-4ac0-4c31-94cd-08587d54f015", "value": "2d34e136_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4cfe715-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153444, "uuid": "254ce3d7-4144-43ee-9e0f-f52729b35f9d", "comment": "Malware payload", "value": "c9a2000fc29366f93c517abfe1de1309", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153444, "uuid": "af97e8e7-fbcb-4023-b9fc-ce6824543830", "comment": "Malware payload", "value": "20e6a70860874ff9c042e1f4fee3e6fe85ecb6deecdcc4379aceb9579710cda8", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153444, "uuid": "177a348d-ea23-4b32-8c29-3705871fc89b", "comment": "Malware payload", "value": "c30fcfe8c8bbec22fa573929d65a373ec8f7e4da", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153444, "uuid": "943b4591-dff5-4fdc-a323-d1fc492c2b28", "comment": "Malware payload", "value": "f10aab91ee68fffa381d98de4484d9eda15eb938b90c435ec19843fad95d382223d8fcac8e1c162a76f9c670cfe48376", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153444, "uuid": "0517842a-2e83-4440-b413-9591452c813a", "value": "9E5229BFB660E4F34593CEA4B57FBB0C3470508AF51C69C4B1B858B6AC59E863034B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153444, "uuid": "537d943e-a62e-4828-88b8-6b5ca4a5ac69", "value": "192:a+Z5NcdLgTLmsKRoHGIyr+hhbPu3TF2e3d6Kyj0jp2Ik0+I:vmhgTLmsKNI8+hhbG3TQe3dVnjp2cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153444, "uuid": "7187bdac-ae1c-4c83-82f2-4209991e0f58", "value": 13994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153444, "uuid": "6462d9ff-d51e-4910-8a41-52bdcfee514a", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153444, "uuid": "8952e20e-36fd-4651-a377-478cc34dff21", "value": "20e6a70860874ff9c042e1f4fee3e6fe85ecb6deecdcc4379aceb9579710cda8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934e285-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142580, "uuid": "6014c945-f482-4478-80d5-39c76923574a", "comment": "Malware payload (Quakbot)", "value": "a209e8ecdcbcc038383b8cdd2bffe997", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142580, "uuid": "2156f13b-d0af-4246-b023-7417f9d9ff84", "comment": "Malware payload (Quakbot)", "value": "21a292df6f84eee00f59bba007144be1ebf516e84ead9ca4b2097084710cdf7a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142580, "uuid": "4da67dba-66eb-4142-94fa-156745d071a1", "comment": "Malware payload (Quakbot)", "value": "75d4e6b70b524c8fcb7963344a132e510241174b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142580, "uuid": "0192e0e7-3874-4b41-99ba-a1c44709a025", "comment": "Malware payload (Quakbot)", "value": "025aeb2fe8a5775c5a37bf7714ed1a02894c70dd4e10368819ab27189d18d902630d3e8dc715765f750244a90dd459f5", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142580, "uuid": "d7736442-32c6-4f0f-9419-77dd09aa4c81", "value": "42B3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142580, "uuid": "a2086cbd-7883-4696-80a9-f748428843f0", "value": "3072:9kYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:eAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142580, "uuid": "e65d04fb-d00e-4ff7-a194-ad0bddac938c", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142580, "uuid": "c076c91c-6b42-4a74-8abf-3989aff68327", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142580, "uuid": "b3a56c16-d8c6-46d8-aee1-da05b5c7ed85", "value": "Outstanding-Debt-1604904172-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bc622e-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620108405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108405, "uuid": "7598a974-dac0-44cf-b48f-d7008b3471f8", "comment": "Malware payload (AgentTesla)", "value": "3631035e25d48ebe58b38db68da5f1c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108405, "uuid": "dfe33343-dceb-4108-8f25-af13f0a57e7a", "comment": "Malware payload (AgentTesla)", "value": "22287d086c5e236bcb7011ae84f711330223cd5b90a82d7cf7a8025bf03d3379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108405, "uuid": "cbbc8b2a-cf03-48f5-9d3b-ea09983634f7", "comment": "Malware payload (AgentTesla)", "value": "d0217428bbdfaca4326856ed41df032b9affca53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108405, "uuid": "e0479f70-df05-4a7c-be2d-043ac38af9b2", "comment": "Malware payload (AgentTesla)", "value": "d5cbc4175203318dfb1dec1b790be73e189c085b3caac239bbf3f58d64b5db0dbf177fa74b57e0199b6b440707e8c0e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108405, "uuid": "a466f0cd-ab6d-45fc-92ee-807548ad33a0", "value": "DB3529FE311430EDD2579A31A7DA1C16832030BD66EB850A43EF13BDC91EE53AEB4596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108405, "uuid": "52773586-91ad-42db-a53d-ddf4e922c526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108405, "uuid": "e441bcd1-99e5-485c-94e6-b447cdd14aa0", "value": "12288:ELoLLoS60/K7yh0XDzeovHlp0Ospl3BD3b+hZvpC+eKt3DuQK503BiF/zsjtWEe2:AoLAHeovT01H3eZvsKpDubq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108405, "uuid": "a162808c-5905-48f2-ae38-2a1e58cfe4b2", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108405, "uuid": "201e1f43-9f67-4486-8061-73a5ba661c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108405, "uuid": "b64bf4fa-be44-4f82-843d-3538851c71b0", "value": "b6fde31a112cb7f9503c140cf980c829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3203936e-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133441, "uuid": "d257e506-310a-4154-ba23-bce89a4739ed", "comment": "Malware payload (AgentTesla)", "value": "b6e6ec67a638e2ee7344d847a749ded0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133441, "uuid": "1adaa6b8-afa0-46af-ab82-edead12345cf", "comment": "Malware payload (AgentTesla)", "value": "226055fd9a87d3bb38acb21c4d3dd7222d600003c72fab036286b9b15b233518", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133441, "uuid": "473c209e-8b6b-4911-af08-62e467a5268d", "comment": "Malware payload (AgentTesla)", "value": "9da346f12d9bd00d454a219f73fe628dbf408817", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133441, "uuid": "a2da379c-1d08-46a5-b61f-ad61fa2aca8b", "comment": "Malware payload (AgentTesla)", "value": "6b5ba8f8e94a67ee9d7b91c55e386b4efdaf388eceafc9ab9f1b6b84cb1c0aa578ea973ebb0831ef955b244ee9c326e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133441, "uuid": "b0b2fd6a-8301-48c2-859b-bc1668de34af", "value": "CEE4CF6633D4AFACF17E9B7590245600A3F0B907E322DA9DBDA510CD88E1FC5C3527A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133441, "uuid": "e05eacab-8003-487d-b87a-334f591eaf33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133441, "uuid": "1072e894-a380-49eb-a6f0-ed1c5678c798", "value": "12288:ktgS6bd4IDOKMYS4O2v5jnwpxdohbmtg6bWlsqBYmHbG+98hj+vPhhG:ugS6a4OKX5jnUshbMgrOV3hjgJhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133441, "uuid": "597be9db-8e02-44ba-ae92-50bcbbf812df", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133441, "uuid": "d6508fe6-70aa-43b7-98b8-7317ad1d7e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133441, "uuid": "aa2eb4de-7b5d-4766-b805-753a066eed0a", "value": "EXW QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfb0a03-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093650, "uuid": "291a12b7-7150-4b78-8b18-bf6c84b54aa7", "comment": "Malware payload (Dridex)", "value": "0a2b8c2873b70a81693f9c7b1e9bdd5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093650, "uuid": "77dc0f87-59c6-47a6-a1c7-73714e3b6d3a", "comment": "Malware payload (Dridex)", "value": "2281ebd26d65284e17208716e39218cf527b858922bcea258f80e1b1c9b8b95e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093650, "uuid": "2759a3c9-a133-48d5-b7df-cc6814650c48", "comment": "Malware payload (Dridex)", "value": "be5bb0f55171a4c56c00db063c56d154fb19075e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093650, "uuid": "c97b0348-4190-4262-83ff-59606e9c187e", "comment": "Malware payload (Dridex)", "value": "79db8efc4027b99c1b8492c2ef03883e45aad5fddb869ee55ee17e958eb20506d661aac59360b765e9e4c6912578803d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093650, "uuid": "f3c6cb82-edd0-452b-bce9-db64ccddafa1", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093650, "uuid": "51c24fbf-e530-46c0-9dff-9d6c3048a3e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093650, "uuid": "b3bbfbf0-d364-4729-b2bc-243c58b1d461", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093650, "uuid": "55b96f30-277b-42ef-a9f3-a0518542274e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093650, "uuid": "f4de9988-2701-449e-a435-a60ee7a27cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093650, "uuid": "6db00c34-1dfc-44bf-975a-35fcf6e57de0", "value": "0a2b8c28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040ee484-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152691, "uuid": "1ecf712f-812d-4f34-b696-7215895028f5", "comment": "Malware payload", "value": "ad51ce49c7d5c6322c016dde8830b5d6", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152691, "uuid": "94f50f29-7b53-4fec-a90b-ca8dcfd7ef53", "comment": "Malware payload", "value": "22dba1da6bbdc09c49f79f875f24a6fd72c4e18738ac4efc8f6e36ef262ce2e6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152691, "uuid": "9de0ce2d-e43b-460e-a0c7-20445de03af4", "comment": "Malware payload", "value": "18c8d709b943e3a1bb22a2524f84be03d436935d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152691, "uuid": "149d53c4-04a5-4c3e-b13b-fe70ad016969", "comment": "Malware payload", "value": "cfd584690e0b558edd6442f7c171b23aa8902a6ef662fd06386f31aca94c3a1f4399b63f2be856bcaa515bb28010ef3e", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152691, "uuid": "f7b39bd3-092c-4012-825a-dedec1327f82", "value": "94053339E7EE7A1824097ED9C541C5B96BD3C10A69DF7F223FECAC4B512983535B8048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152691, "uuid": "56275d54-71a2-4ca7-98d5-f1de8e18d3f1", "value": "24576:ijoGN535ifFGsAs+anNUXend6q3RKNySYS:ijoGN5J3sAs+aa8d6q3RKNhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152691, "uuid": "f79805d4-9086-4227-b1b7-0037848e3402", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152691, "uuid": "e66f77b5-6574-4785-8f68-99526b602cf9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152691, "uuid": "3c13f4ce-aacd-4eb9-a3b6-dfdd401eb0f7", "value": "22dba1da6bbdc09c49f79f875f24a6fd72c4e18738ac4efc8f6e36ef262ce2e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89864efc-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095362, "uuid": "886cdc07-eeb3-457f-b442-fcf72b19fba9", "comment": "Malware payload", "value": "a68cc2ff66e58ccf022c5e156a957e26", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095362, "uuid": "79e38f71-57de-45aa-91bc-a8d5a93eba84", "comment": "Malware payload", "value": "22f278f39a67f78120722936c81bb9618597eb1fb77c332821913028d6192dee", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095362, "uuid": "ceca4b88-78d2-4dc1-936a-9f4ea422d102", "comment": "Malware payload", "value": "84621fe134efda2250916a25778bfaac4766c5b8", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095362, "uuid": "2a04efee-d04c-4050-a941-54306f757b19", "comment": "Malware payload", "value": "7dd5fc2b26de3419c28d68bff64c87ec5be8df0bb4400d0b98200db1ab10361ee60604e549cecbf03e0bf438146575d3", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095362, "uuid": "f9557b1d-7857-4916-bc56-7ca7cc3867fd", "value": "DBE4A39D721075DFC89BD4768EA85D68EB6074BA431B4203A0271DAFFA4D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095362, "uuid": "072f69e6-801c-4f8d-b578-9597633aa5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095362, "uuid": "a63bb1ae-b4d3-4218-8c88-7c3b08193ea3", "value": "12288:QHjYAnHlm1eB1WH0yXIDoNGRX6sSIR0mD79NuTweQNzh2U+9qyzW1RulwlutiezT:IjYAnMwB1q0uSpqsSIHfi0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095362, "uuid": "87d19d18-dad9-422a-bbed-2ad9dd45f337", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095362, "uuid": "491063ce-4620-4ebb-95ed-176630a15805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095362, "uuid": "c6427f8b-e1c3-483c-b69b-e7106d73ec17", "value": "22f278f39a67f78120722936c81bb9618597eb1fb77c332821913028d6192dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b913f7-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126409, "uuid": "919cd498-663f-4c00-899a-79a4b2dd7835", "comment": "Malware payload (AgentTesla)", "value": "1d7f6b978bf1c38292caf121d3110580", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126409, "uuid": "0138a94b-d930-4151-a004-3ec1532735fc", "comment": "Malware payload (AgentTesla)", "value": "2309436e3c0287cebd9e7cb8859fdbe81fb92f39b1e01927e163e36199841643", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126409, "uuid": "62b0b6d6-b07e-45f3-a834-37575bd7e04b", "comment": "Malware payload (AgentTesla)", "value": "3d41870c6c20553ceeee293164966916a3187f34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126409, "uuid": "61e4f347-06bc-412b-8b2b-55706a7942e5", "comment": "Malware payload (AgentTesla)", "value": "ee964e99b6da7df3b0e146b7f4a45ca7733a7b12d5c95357d5c89c200d99d5334b616ca61a5974c54a2e8c93bedee2f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126409, "uuid": "a4b13aed-5470-40fe-9408-3865603a84a0", "value": "EB453BA8B55470EDD22F8A7597E93D9586103E315627C64E432333FCC97EE13AE38582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126409, "uuid": "faf4a103-106a-416a-be22-09a8b384f809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126409, "uuid": "a47cd761-2faa-47d3-b182-f7864496d09f", "value": "12288:1loLLoS60/K7yh07JnqyAqm+SUJBiXfVvJE2AGayAdm/GZAYoPd+374n5M095HOE:boLA7JnqimvUcJJbWyAdImYq7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126409, "uuid": "f3274536-6032-4994-881e-a72379a4bfbd", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126409, "uuid": "b08d620e-92d3-4873-a082-fc2720d06677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126409, "uuid": "3bdc716f-4270-417b-9f33-cb7df62849f4", "value": "2HFcnbfxTINZ7vJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6deb1f1-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122497, "uuid": "701fc3c3-eacb-45c7-8324-0224e171fe52", "comment": "Malware payload (Dridex)", "value": "814e667f81aec0776b025363e4e11d6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122497, "uuid": "595f20fd-67a3-4e9a-93fc-8fc759263c5d", "comment": "Malware payload (Dridex)", "value": "2343a09f8545943414ab1b7c8c32512b62c182b515c63b9ac7c7209eae9e36c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122497, "uuid": "8f8d4b53-f86c-49a6-b0bf-9c10a63eb516", "comment": "Malware payload (Dridex)", "value": "2a8c81c1165d33686630bc1351d9b415e4ae9df4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122497, "uuid": "210d2854-df71-44a2-ad29-0d8cb3404202", "comment": "Malware payload (Dridex)", "value": "02d33c46146e78dfd261c386e8da05732d300e51cd12c0034ba5022fa166299f0664a32491d5fc58fb17f8c1e4ed8023", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122497, "uuid": "bb0fe382-2871-40e8-a9e2-c982d2a9dbc7", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122497, "uuid": "9168504a-ccd2-4d4c-a125-677f038bb205", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122497, "uuid": "ebba5ca7-729e-492c-bc05-dbdd20f7ca37", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122497, "uuid": "688951e2-818f-4bba-96b9-1461bb1e052b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122497, "uuid": "b270590e-3b07-4b93-81fe-008b53e8f41e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122497, "uuid": "7ba87ee8-0a6f-4931-8c7e-b1f1cfc9306a", "value": "814e667f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d680c3c-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093678, "uuid": "2443efae-1b79-4c35-9d2d-4149cdf0e004", "comment": "Malware payload (Dridex)", "value": "dd7eaa4403eb2f216d178334c88b5424", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093678, "uuid": "f48f867c-027e-4804-9168-2bbe68331f8d", "comment": "Malware payload (Dridex)", "value": "2494441b0969aeb115963299ab28131badf921e600425063a369cd60a6b2e132", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093678, "uuid": "d5e22bef-c145-4c5a-8105-a2b8e4d05561", "comment": "Malware payload (Dridex)", "value": "92e5426c5f8a7a255f9c17d0dfebbe49d7303a35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093678, "uuid": "a2f7300d-4b54-4de3-9fe5-8a04474692d7", "comment": "Malware payload (Dridex)", "value": "dec5707d6d57e10449f0e5954bf9c8ef882021c2b239dee2674872a7e3b071465611b50484df3e55e587ca0eade2da40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093678, "uuid": "967c950e-e667-4469-bfe9-cec28bd15fce", "value": "D0F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093678, "uuid": "cc75ce6b-1c20-486c-9324-1616fbb79d03", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093678, "uuid": "3d958ba5-ae4c-4a8f-ac9f-9b22640975c6", "value": "3072:3WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:342IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093678, "uuid": "24f6b3d0-ad57-4ff5-8780-2ecdf5635335", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093678, "uuid": "e34994c8-9cc9-4a02-864b-9bc29e530574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093678, "uuid": "736275b3-b9ab-43b8-8ab3-7bb02279ed44", "value": "dd7eaa44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bc227e-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111684, "uuid": "ac275d60-2390-4206-9aaa-dc15441fc6a9", "comment": "Malware payload (Dridex)", "value": "8989976027bd08c62dbe68a585be9995", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111684, "uuid": "a1ebcb29-0bcf-491a-9fef-95f3efd36d3e", "comment": "Malware payload (Dridex)", "value": "24bb88c5b2a49e71a19fa6887503026ba193e9ef980dade3f5afecf57d4740c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111684, "uuid": "dd97da67-4824-42c0-ac36-99aa543eac68", "comment": "Malware payload (Dridex)", "value": "243b92b285c501b8389082a5399b3d1aeff18246", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111684, "uuid": "d4098ff1-9bcb-4542-b538-01dbfdf43d4a", "comment": "Malware payload (Dridex)", "value": "33dc4f2b3955449f50d1b58b05a6482cd0fd0b21437015af53a208742fa8f66f1a21beb1db54397e24ac34d4a37b5c82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111684, "uuid": "a65d5671-b7f1-4c03-8525-32860dc2466e", "value": "D7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111684, "uuid": "9704724c-f1b3-469d-aecd-ac0270551737", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111684, "uuid": "3e11c6d5-035e-4249-a439-e81236cfe4d3", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111684, "uuid": "4ca2a922-4003-430d-ade6-c4190bb45dc3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111684, "uuid": "9f542a19-a303-40ba-9247-370b7f156c46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111684, "uuid": "ac179986-13ad-472b-b06a-93249c5b5884", "value": "89899760_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984e318b-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095817, "uuid": "0af94d00-2100-49bd-b5ae-73bc0ff767fb", "comment": "Malware payload", "value": "d7aff07cf69039b1b40c31ae7aefb610", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095817, "uuid": "21028264-67d7-4d39-966f-90e49cff49b1", "comment": "Malware payload", "value": "259e1dbf2f18ea2108f431356607e858ef676d25180c7d4ba2172705e6daeca7", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095817, "uuid": "566c897d-32e0-4b53-b379-904e1caf3078", "comment": "Malware payload", "value": "7fbbda0389b041ee47461e110daa1541aed2f7ef", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095817, "uuid": "fbe8cb7f-3e2c-4a2a-9614-cd413c5b1ed3", "comment": "Malware payload", "value": "8ced6c4d87bf1ddd8e658f2597b3ddbaa6ff19076448d22fa930cc6a2a96051be2f2d856deb065c6d214907416065daf", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095817, "uuid": "79540ef0-fc91-4617-b3d9-1068eeb22bc1", "value": "A6E533D5D0658567D31826E85D72BBE8FDA6A0CB1B38309FC5B3A1D329105C9BC26F2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095817, "uuid": "fac9c368-19b8-4e48-bec7-85267d4e6ff9", "value": "49152:98C8tCnoQpuSu5nC/knveoOKM2uXU3mz7sTtt0jurNTQPSEEes88elfWG/X9KD6:9wtxwh/cveJT2uX4TH0aNT6llOGv8D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095817, "uuid": "cdc13cf9-041b-4463-a00e-27167061df67", "value": 3122021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095817, "uuid": "6313bde3-15ea-4d3f-8434-f6c2a7edbc6f", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095817, "uuid": "9004ce8b-899c-40ff-b132-8b8ccbb98501", "value": "AstarothSpammer (4).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4389e2-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160679, "uuid": "b4be9f61-5c6e-4d5a-8315-ea58f5f1252d", "comment": "Malware payload", "value": "465a1f3a08cfc343c56610fc1da9aee7", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160679, "uuid": "136679ae-1748-4fc2-afc8-0520fbec557d", "comment": "Malware payload", "value": "25b16c99005c90f130863499476f182154d2ac71b65eb9d581042722aa5b188d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160679, "uuid": "e8170262-5f2f-4a4e-bd16-3e9e00b95aa7", "comment": "Malware payload", "value": "e139200a8b24d401ec68478e8d909eedc07b89f3", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160679, "uuid": "27ab4084-af46-4c13-a9b7-b7a03f5bc627", "comment": "Malware payload", "value": "23f9a63a1a3601153fe95732ed874651f44494e89658fcd15a73cd7a51ba12bcba9edee76894ccf4d796ccfd6e941848", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160679, "uuid": "c7fc3ff4-bd80-45d9-8df6-d4a766121269", "value": "6C3154B72DC291260312E6A2B745882DE729940E9953280CA6DED54DB194F932FEC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160679, "uuid": "4357516d-bfbc-4d99-879f-c3f888c1b0bb", "value": "48:GEXfhexTvrtWQZUSePSiJVAyrLMH3qJqj:RhuTHZUSe7K2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160679, "uuid": "cb7a0188-4a8d-4c3a-bd5f-acdbf173ac3d", "value": 1748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160679, "uuid": "cedfa971-91d1-457b-b037-13075bd24567", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160679, "uuid": "b40fb8dd-c608-4ff2-9f40-e2754493b783", "value": "a30gHRgJ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c699803f-acde-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620135837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135837, "uuid": "1649e904-5d2a-413d-b370-c9477fc7d9bd", "comment": "Malware payload (AgentTesla)", "value": "9fa266b58f74f23630d145f07cc09a91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135837, "uuid": "d9150bec-2f78-4c7e-8933-14bcd94d9391", "comment": "Malware payload (AgentTesla)", "value": "261876ed0f8d2d0038ce84d15817b66fe0b90417a2c3ebbd40efcb9a069ef7a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135837, "uuid": "860ec357-b947-450b-97df-9ca2beb0b959", "comment": "Malware payload (AgentTesla)", "value": "bdca2aaf830e8a8abdfff816a3434a84acbb69c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135837, "uuid": "af5beb05-d68c-4448-8208-bea01055f5e0", "comment": "Malware payload (AgentTesla)", "value": "40acd7d2290e6cc9c2081603706c468b21b1fbf90504d06d879827adb0a677802edcc9c781680f3cccc48463ee1dd757", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135837, "uuid": "2220af2a-78ee-4d6d-a217-35de20d50024", "value": "71C4234150FEACCDF305769AD79A4DE3A7C7BF310812FC899872AD41C1AA524E185CEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135837, "uuid": "cd7594d6-0949-4654-9b78-d3bb40eaa6bd", "value": "12288:2Rux3SxZJZd0kXv7lh1QTtQ+izDBhr9hxXXlpuiv:B3i7ZScvZhiTtQ+iP3LxXX1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620135837, "uuid": "825a66cb-c9d2-4111-b0a8-ec106260d24f", "value": 563565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620135837, "uuid": "9ef97f78-a285-4e84-bd96-ac0a6f99931e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135837, "uuid": "811d9bcc-9bad-40c8-8db4-11f6fd5c3699", "value": "E-Remittance Copy.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e52c46a-acca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620127099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127099, "uuid": "95fba81e-5a22-4093-9d2d-fbd03bbeeef8", "comment": "Malware payload", "value": "c969c7c6dedfa443114599c9a5f89c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127099, "uuid": "00806871-bdec-426b-960d-bf5f09de8749", "comment": "Malware payload", "value": "26e590315030ce530641ac9ea5ecbdd0b22b4f50e5b41e6c3e2d97f7e14e9e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127099, "uuid": "2d3156ca-9f2d-460e-815b-80781cbbad38", "comment": "Malware payload", "value": "42a099651b8aef7bbb17ed388e512e70106f6cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127099, "uuid": "b5aefbeb-fd18-480a-ba9c-fb6b48f6aa8d", "comment": "Malware payload", "value": "2be4f6f02eded41909cd8273aa03406f8e54bd07bd8fd72c39d7887340da2dd883c4e8086be7ac9150094057436006bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127099, "uuid": "6b2ace5f-3c66-493b-b24b-e6fac0fb48f7", "value": "89B36F79AE455CA1F0404AF587C336FA01EBCD1266F6DED6ECDC7931A539AE830CA061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127099, "uuid": "a5723127-3481-41aa-8cc4-936e75d5acb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127099, "uuid": "8625d9e0-3858-4a16-b0e2-e8e21dfd93a3", "value": "1536:vdypNpJyCNalo0AiWxVj9qYlE6Ym1Ovy6aeYyacbmF:vgpNpcyZNj9HO6AK6apTcbmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620127099, "uuid": "5d45cd36-7ea0-4454-8999-64f3ea7c9513", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620127099, "uuid": "c0e3b61f-6dfd-45ac-a52f-ac61051a2ba1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127099, "uuid": "3ae73c4d-733c-4b8d-828e-5e5cea9857eb", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2e3128-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620090053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090053, "uuid": "6899dc39-aec9-44e6-8cc7-051c26c55847", "comment": "Malware payload (Quakbot)", "value": "e61bbe30cbeac71125d99267ecfe56f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090053, "uuid": "e928e08e-ca8d-4dc9-beaa-3a8adf5fa43b", "comment": "Malware payload (Quakbot)", "value": "26eaa36a97f759ccd4189b7639610fc4821a694e97579bf82cc24dcdacbf573a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090053, "uuid": "8575caac-52b0-49a6-a512-9dc574b8afbb", "comment": "Malware payload (Quakbot)", "value": "de0002fc0b17ce82002f4e7374c101931afd6db4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090053, "uuid": "6d652a3a-a2bf-4730-9a6d-2f75c6c7967f", "comment": "Malware payload (Quakbot)", "value": "7125101ea6eabf026cc4a4c6c25710c9c3ef212131dd9b0fa871057ea6276e661dfc17b436ea2282474645eee511b7c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090053, "uuid": "13d5746d-fb8f-490f-b207-262426fbe94b", "value": "B47423CA9AEEE7697EB4BFA97C6CCDA83E55DE57105C461BD893CD18D04788F00BA004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090053, "uuid": "3a445e7c-342a-4b02-ad2e-32055c729d14", "value": "6144:+2qx1E2A7tV7BBCUq8MjVj2HQWDBWTgw6rTbWDn/87/unKLAoN2cWqaJGHZB76Zt:S19AHT2EQWDIEw6vbt6oRNSjUj76Kc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090053, "uuid": "755bb853-a98e-4da0-9a63-71384b03d357", "value": 357732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090053, "uuid": "29938568-b38f-418c-8e15-eab6ee441f65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090053, "uuid": "98771964-4682-4db4-a3cb-e8f3cd207cc8", "value": "e61bbe30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fcac36-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152473, "uuid": "969c765c-f0a8-4f89-9fd6-f247dae98812", "comment": "Malware payload (AgentTesla)", "value": "ca335d0db05f4d6fb2063fafe1a72959", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152473, "uuid": "2fb33fd5-a7ca-49c0-9313-1f7e1c884568", "comment": "Malware payload (AgentTesla)", "value": "27bb1e8bbd36d0bdb7e746bcc349ed5e440f1fd471503b6ae6754c9d95b069d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152473, "uuid": "d091a359-9aef-44ef-b452-d37f1152ed7e", "comment": "Malware payload (AgentTesla)", "value": "25fe5dee878bd82f02992e82f1af815dc5c64aef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152473, "uuid": "7e64d7e5-96c2-490e-8f4a-a2e511b16ce8", "comment": "Malware payload (AgentTesla)", "value": "7196abd34e6014af97a909e2cc6e7d90348f067b3865748ffb1084dbf80a2e357abc9f1c05f920b3e4febfa0b54c0dbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152473, "uuid": "c7a7faac-b744-4083-b6d3-42d13170c7b9", "value": "99254A6872A81BD1F27B5FB663DA1C0183B92574653EE50D8F9113FE0963F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152473, "uuid": "f545fe84-3b64-4a22-aefc-a2a1061b4ff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152473, "uuid": "f11355aa-5bb2-4c63-812c-ccd8960934f7", "value": "24576:pD9wLdzoLA+YorlMJLp73Swf3zd+64J7/xV:pD9wLdOYMlq3Swfh+7ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152473, "uuid": "ec42ed6c-2b2f-42e4-b1cb-21b99d6a0699", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152473, "uuid": "1d975151-e995-4cf0-a124-d3862948755d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152473, "uuid": "4395a61a-0b6c-436f-9654-115ea0ad301e", "value": "Drawing & Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3579dc68-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118844, "uuid": "279b7ae4-d8ef-4fae-b74f-57d2730969b9", "comment": "Malware payload (Dridex)", "value": "9c7e491b4346743909ac24215184034e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118844, "uuid": "a6794a6c-be5a-4354-9032-ede414945ade", "comment": "Malware payload (Dridex)", "value": "27d557365361eab72282fe95cab13c8cb082fc87be950ff081da3c8427df608d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118844, "uuid": "2727c87e-5feb-41c6-9cf3-559cd8ef74ed", "comment": "Malware payload (Dridex)", "value": "21f37940ac6cf5763225473fd2814ec0d2d723e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118844, "uuid": "970ca171-dda8-462e-ac43-eb74a2ad5be6", "comment": "Malware payload (Dridex)", "value": "0b2bcb084cf60891770ab0adc7e78c755fb558ac62cb1c524ccb58df3e753b19c114ed33a4037ae76119af48f89b5c7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118844, "uuid": "04c1b5b8-78eb-4129-a781-0f5289fc4d38", "value": "88F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118844, "uuid": "255070b0-1e1a-4102-8751-408e05966f4c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118844, "uuid": "4e7aaf21-8a81-4f00-a949-724986b2ea52", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118844, "uuid": "dda40a19-2d75-4a58-8530-a63e35548097", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118844, "uuid": "f0ac44b9-a9ea-411a-8c69-f33fc5b98c9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118844, "uuid": "98b54d2e-a1cf-499b-92e2-e9bf26408f07", "value": "9c7e491b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406a74ca-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108125, "uuid": "9a77e982-07ef-414f-9bfb-e5d45fdebd86", "comment": "Malware payload (Dridex)", "value": "ec568134404194fcc55d83e66692d20a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108125, "uuid": "af9c662d-ce01-48ad-82f9-0bc702a491f7", "comment": "Malware payload (Dridex)", "value": "285dba47a47f7575e482765beb38660b4dd5f7783334175ac095d95b2af536a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108125, "uuid": "d1061dbe-7ece-4d80-8a35-812e868a2ee1", "comment": "Malware payload (Dridex)", "value": "8999dd251b92ffdc201f3dde2f1910e6fc822e05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108125, "uuid": "fa018b6a-50fb-47a2-b803-fa93c8461e19", "comment": "Malware payload (Dridex)", "value": "ae5231b7ec7d4658560abcec3987592a682a47d4b9a95e3de9fc59e52314a5f81cbf6022359a0aa7d38e9fb2bcfd1d92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108125, "uuid": "50403160-9b6e-439a-b003-0a585aac7493", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108125, "uuid": "56331a5e-d072-4ca9-b630-8535a74a0e64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108125, "uuid": "c7fa9cf3-fcd2-4b5d-86d4-67cdc6fc73de", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108125, "uuid": "d8381e39-afb4-4e35-85af-c604168455ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108125, "uuid": "70535f8d-33da-4236-a6aa-1871e35d6812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108125, "uuid": "858c4bd0-7c34-418b-b78c-8ae76e7e6ef3", "value": "ec568134_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a432fc-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "b4436908-e810-497b-bc5a-484b1f5b0d9c", "comment": "Malware payload (Dridex)", "value": "99140c912342724ed938d1c7d714681f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "abd55986-1323-477f-8860-e5f67adfded7", "comment": "Malware payload (Dridex)", "value": "288409aad5b86948fb2ff7b1ae5e3fc10f29d23d6be51528af506ab358819497", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "153b585a-59e8-42c5-b696-f4192105e576", "comment": "Malware payload (Dridex)", "value": "36053cdc03a7eb75627fd720b68545933c4039a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "32fb3de5-b734-4ef1-a87a-f0f0ac3c0baf", "comment": "Malware payload (Dridex)", "value": "5fd1073af6f37a45fff2e99a934b41c3e24187a303ba5faeddad3d4bd3e83df5b299e99919449a6d8ab25d321a9385e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "10c0f17a-7ae4-4b46-9ef9-7aebfd0ceabe", "value": "38F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "135bd59f-1dbe-4337-ae0b-28e86e0aafe1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "8db15d0e-9fa5-490a-90f7-fd42ade0c68b", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126110, "uuid": "389d612f-f31e-4606-8d6c-97ea513b6389", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126110, "uuid": "d29749aa-800a-45ce-93a4-514384d24195", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "c5f680b2-5cb8-4743-b1ad-7c2ac0d44e52", "value": "99140c91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcc34a1-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108093, "uuid": "b2cfdbe5-a64d-4eb0-bff0-2f700abd862f", "comment": "Malware payload (Dridex)", "value": "ce319c48b1539ebc1539aefcc11350ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108093, "uuid": "87cf973c-9b30-40c1-b89f-700db3dfde33", "comment": "Malware payload (Dridex)", "value": "28aaafc567af7a4ee916dd004ff8decd6c86dd7e0e3f6003cda1f5425dfe13cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108093, "uuid": "8b8d0cde-ca68-4e03-8c84-c2a99cefad27", "comment": "Malware payload (Dridex)", "value": "f93a049ebbf7df1d0cdbac4da0a1848aeb54e14a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108093, "uuid": "143b752a-7d35-4d9d-b9d4-46546a25b2a2", "comment": "Malware payload (Dridex)", "value": "3b052f129fda65384f08800865ae2073b0f2c083d8f6936b302babb533417aad39f0c431b498dda7cf268a4a519ad890", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108093, "uuid": "6ae86590-9872-4828-85f9-2a54c7b0cde4", "value": "D9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108093, "uuid": "d45bdce5-8fa6-4683-938a-da02bb306de9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108093, "uuid": "7194f090-05e9-4b70-8083-3a7ae66cfbd2", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108093, "uuid": "b12e2f14-d049-40e2-88c3-51044a00e4a3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108093, "uuid": "eed8257e-4812-4d89-9450-6d310bf57a36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108093, "uuid": "b277262c-2247-4912-81f2-6ef5f734d333", "value": "ce319c48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b17e41-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115294, "uuid": "8587fd50-9e46-4edc-8d9f-cfc954c685cf", "comment": "Malware payload (Dridex)", "value": "fa8b6fe06d505e7c2bdf80738c8a1d90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115294, "uuid": "b01697f6-52dc-4bb6-8231-ad0363affa97", "comment": "Malware payload (Dridex)", "value": "28e8b279fd927defdc87520bb311a4588cc30cea3c391e83735afb7dbe7c64a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115294, "uuid": "5111132c-5d47-4117-8c77-3e9118f13014", "comment": "Malware payload (Dridex)", "value": "4142ebc173552be2036868ad638d047fbe83dd15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115294, "uuid": "5943db42-d201-437f-9bcc-317938b7165c", "comment": "Malware payload (Dridex)", "value": "1612b6d3c9da80d04a8fa83f9da77b1d70057db0cc0c1123f271825a63c1abad31573874d2cf04e7081bc3c47601bacb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115294, "uuid": "972bb708-da25-4a3f-9457-a6728c767f13", "value": "18F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115294, "uuid": "f01068c2-86d8-4292-aa70-9c8a0738a3ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115294, "uuid": "c701df35-8e8d-42ad-b774-499e81aaa251", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115294, "uuid": "31469bc8-b880-47db-baf8-a72f1952b638", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115294, "uuid": "e1ac424c-3842-498c-a1cf-228d76df614d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115294, "uuid": "8060b9b1-9482-46c0-af1a-01c71332802b", "value": "fa8b6fe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e3455c-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111682, "uuid": "468b9fc5-fb49-4b8f-9364-d49e1ac3074d", "comment": "Malware payload (Dridex)", "value": "17e31a736f4ecde6ab0e8b83d838ddd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111682, "uuid": "42b2f0e2-04f0-4536-b8ef-ae6fe63cc749", "comment": "Malware payload (Dridex)", "value": "2939ab2a2a50dbfd5eecc97593386d502f5b6caf9ab8f3bc63b5bdcd1e7c98e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111682, "uuid": "484296db-deb3-4244-a1f2-739ce44ebc75", "comment": "Malware payload (Dridex)", "value": "d52ce8fd765c6e4996fda5d672829aaca33321fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111682, "uuid": "9e28c49a-9b11-4f1b-9faa-fea73786a360", "comment": "Malware payload (Dridex)", "value": "843ba5b5a42f398cadaeffd1c5a85ac5744910cad925dfe9608df3ff10fff36d6317a3cf5c525ec113043ce5757578f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111682, "uuid": "f45cb8e2-bda0-4d65-bec1-219cd2314976", "value": "2CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111682, "uuid": "e6f8cc45-4fe0-4247-b8b6-2c1df8e22270", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111682, "uuid": "9df35f82-5f58-472f-b630-f7f158182075", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111682, "uuid": "702f7729-696d-4dea-b802-7a9c09ea2ac8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111682, "uuid": "a770cf1a-7228-4720-8a87-574e4c3aa241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111682, "uuid": "b2001f19-39aa-42b4-8c8d-df49c268657f", "value": "17e31a73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb61cb1-acbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120492, "uuid": "4fbbb502-a642-4416-8648-4cdc6a1f1321", "comment": "Malware payload (Gozi)", "value": "801f793a5ce077d8535dbf9b0144ae3e", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120492, "uuid": "b42a01ec-dbd6-49c7-a4d8-e4c9c79cc7c9", "comment": "Malware payload (Gozi)", "value": "29886509fe1c9628fa5227a052e98e5b7cd7bc04cab15f498eb884d588654b1f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120492, "uuid": "d488afcb-0bc6-4337-a898-a8a176cc99e3", "comment": "Malware payload (Gozi)", "value": "958bc208d7459ddc369c6ee3bdc78c390043192a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120492, "uuid": "5807f2b6-4ec1-4ad9-ba7d-a3bef2411b97", "comment": "Malware payload (Gozi)", "value": "e8ac55f41b1db6084a928ff121aa1f766d53f6a2fa03504eedb0cdfb3d97eb3a7bbf8f9f27dcf7b6ddd02841f99035d1", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120492, "uuid": "2a013e89-a7cd-43c2-b6f4-d6c80c4410c9", "value": "F813F1E3315C4807C9DFAE3503A85C7A641A13F44B6A804DD62DADD15FEB88A883C367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120492, "uuid": "ff6f9f5d-494f-4c26-a0d5-859231886560", "value": "9b4bd5e9c744a772e2cae4b95c84d26f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120492, "uuid": "c3305bb1-4e50-40db-bacc-8d5c4e907524", "value": "768:ugrMCtGv7GDHAfoD+b0yDUAL0igHe1lo145sLPftQWVI4oUVAJZSGmnsfpt:uCtBDQoD+b2C0ig+41wwP1Q/4Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120492, "uuid": "e916f24a-d2e9-42a4-8021-f4fb637071aa", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120492, "uuid": "7da96156-6aaa-4ef6-9624-27f51a5a5b89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120492, "uuid": "15def379-9220-4fdd-bc58-46c388f21595", "value": "6c130000.da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7869d39-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115250, "uuid": "250eef4d-c261-48f8-8d49-b694ac9b640e", "comment": "Malware payload (Dridex)", "value": "59b2899b2223adb604958d84cd9cfe8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115250, "uuid": "8196cdcf-0725-41b7-bf87-3d4ffd7debbf", "comment": "Malware payload (Dridex)", "value": "298fff9bf34d7044c66b666b93b48d8a30a5c8003c4168db5075763c111bde6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115250, "uuid": "f7a8a966-32bf-4453-917f-33571ffd5dd1", "comment": "Malware payload (Dridex)", "value": "f839fa41c4f3c71ec5b1c773f825ecb5fc67e15f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115250, "uuid": "c8a994d3-8573-4fc5-8031-e2bc83d4cb73", "comment": "Malware payload (Dridex)", "value": "ebde646bb73db018c58d98d9862fbfb09efe661e00d81db7b6f95f020aee519513893d94da673296278ee6b346bae6ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115250, "uuid": "d0fbff38-8908-437b-aae7-d55dedc25c5d", "value": "80F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115250, "uuid": "6304271c-8670-4137-bf14-2f6fb1371b3a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115250, "uuid": "8fd9d29a-6385-4500-b93f-c80cddd5f6b1", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115250, "uuid": "044547ab-8ef2-43c3-a0d4-df27e7cf6fca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115250, "uuid": "eabf2a78-872e-4d19-86ee-a19b29717271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115250, "uuid": "5997d490-5d80-4aea-a30d-041361625bcd", "value": "59b2899b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0ecc26-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108062, "uuid": "33390273-4888-442a-b39e-2842673cb87a", "comment": "Malware payload (Dridex)", "value": "e5a385922c9118a69d4706e21bd4a1b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108062, "uuid": "53bf6b48-bf50-4366-aa79-abc741d11d6b", "comment": "Malware payload (Dridex)", "value": "29a2b3180835857b00f6a75f406fa25029fdb256d0f4141d273ba3fa16ae13ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108062, "uuid": "0dac0b1b-2534-44dc-927f-47d269af8228", "comment": "Malware payload (Dridex)", "value": "13c77fa773910c3b3a2ec76464cc692416075f4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108062, "uuid": "2851d46a-d2cd-4e2f-8734-02c802c6a4aa", "comment": "Malware payload (Dridex)", "value": "19c5890da251f8429e68ef3c712c95a2a1a44c044e2a186e1bdc86b9e71679a80786c10c3ff4ce6d591e4c7511b2ac5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108062, "uuid": "b06d51f9-a204-4465-94f1-4946b1bc7bad", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108062, "uuid": "c9a44efa-190a-48ef-812a-f857f6502a05", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108062, "uuid": "dc36d780-6fb6-499c-8e44-fe9ab38717e2", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108062, "uuid": "8f1974a6-52de-4b4c-b016-24e2d713203f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108062, "uuid": "b0393726-c9f9-43ae-980f-17ff7103bacf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108062, "uuid": "cf81ffac-37f7-42d1-9a74-1970c6513bab", "value": "e5a38592_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149a3d2a-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108051, "uuid": "4cfa8dfe-db7b-41c8-a483-827b6244627c", "comment": "Malware payload (Dridex)", "value": "6f8acd0f2d6e0d1d8b8ccdddcba7ff9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108051, "uuid": "86bc9b9f-6643-418e-83d1-8b7485d8edab", "comment": "Malware payload (Dridex)", "value": "29b4f2677819ef5e043897bbb637fe41de74309cf8982187b9c4ab42150e9dca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108051, "uuid": "c9be194f-3493-4ea0-a903-fb6679502aae", "comment": "Malware payload (Dridex)", "value": "097574a42596a10f85978ce90c1a4a00597b4fa2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108051, "uuid": "5fa02495-87c1-404e-9e24-03c41e929910", "comment": "Malware payload (Dridex)", "value": "105cbdfd65bf30ec1f9561345e37962db119433368e9c14ed688137f78ccf23c5ee7b6fcdea4810f11f26a54514e0c72", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108051, "uuid": "62394a45-5fb0-4657-9e1c-0ca1db2c561a", "value": "88F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108051, "uuid": "b482fbfe-e1c5-47dd-952c-c8478dc8d302", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108051, "uuid": "45fdc6e7-4d2a-47d3-a4ad-e80f1a7c1390", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108051, "uuid": "c59428e1-061d-499f-99fd-fcf5d858f4ad", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108051, "uuid": "a63358fc-a64e-41a2-abfe-03fdb4cebe61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108051, "uuid": "2885e336-4aeb-498a-93c3-a29461b3b884", "value": "6f8acd0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8d9eaf-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620100869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100869, "uuid": "3507bcdd-eb9b-40d3-acb7-55dc88bc487d", "comment": "Malware payload (RemcosRAT)", "value": "0df6289bbf5c4d17a784ad31cdf4c8f5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100869, "uuid": "a6a52456-b218-4301-9396-2c2bcbec7d89", "comment": "Malware payload (RemcosRAT)", "value": "29eacda0c6ea2660180e38df7d5f6594af73cbcf4d421d4bdd9cde1ab9275091", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100869, "uuid": "6dad0b39-e894-4bc1-8d55-935e25b77698", "comment": "Malware payload (RemcosRAT)", "value": "90d210c5fc445eeff1256df98f24e583944b2644", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100869, "uuid": "91d16575-96f7-47d4-af9c-43d4fb2c25f6", "comment": "Malware payload (RemcosRAT)", "value": "500c4721d2e96359fa2a4847e45d90d76ddf21ab04e98db24bb98b1cd0e51d2a34f4ee8ca582a04d725bf1c7a743c01b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100869, "uuid": "ffcd7a57-cc87-4108-9c4a-e9984f76e0e6", "value": "1593120F807633728DA24C26ADDE014F5D63F317F4FE3E75A1D5C0D91958AA4DAAE888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100869, "uuid": "117e320f-38ed-45ab-84ef-3190db986ef3", "value": "1536:xs4Vt5QYXfwb6N+utw17q6h/R1lFALY2E7xts3Cu0HvF8fFN+AHQajss9YHvWsu6:m6tb06N+utS7q21lFIOtkaHvF8fSAHQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100869, "uuid": "7d7330b3-d6df-4f84-8c47-f00c94ad327b", "value": 95504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100869, "uuid": "19ee668f-d7df-400d-8b06-4e3d363a2664", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100869, "uuid": "b6757c1d-1ee9-4661-ab54-13b339c22404", "value": "0df6289b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79229211-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620103925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103925, "uuid": "2ab4ba10-5dbb-420e-80da-7732058135bd", "comment": "Malware payload", "value": "40326a9a889325478edbea8831ea9a86", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103925, "uuid": "e6239a2a-e935-441e-b0a8-1150f223ee5e", "comment": "Malware payload", "value": "2a42b819030dcc6d389168b5b8eb05e537d2bd38cef9a49c99a33c13d41f71ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103925, "uuid": "b9b3710e-ebea-459c-be01-504cf33f0a5c", "comment": "Malware payload", "value": "7bc0c94b6baea8adee5340f620f3017049da0cba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103925, "uuid": "59a8e38f-0547-4a68-a3f6-78ce4f5a8653", "comment": "Malware payload", "value": "42b90b86f672a6730f5c88ca574765a78b409d40eae699d12ab50a6061daf9d07ac948fb41b8f679116d128370a6af37", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103925, "uuid": "3ca5257d-2413-4008-90e8-23693a21d25f", "value": "ABF433595F76C7EB894F8836079378F920246C50076189757AA3DF7E0272F8F699702C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103925, "uuid": "ab53a257-e79d-47bb-b358-0aab0f85c81e", "value": "12288:TvKtbWAqZToNkcww8cgdxTQQRy1oIhPvvhNArhQ8zibLKg1zJVC0QEN:TvKZRqZTNlFdfgoIVvMti6MJVCl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620103925, "uuid": "4953dd78-30f6-42d7-908d-67c044859d42", "value": 744115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620103925, "uuid": "0252b2e3-dc17-489b-a86b-00564774d80c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103925, "uuid": "cb121c03-8706-4ee8-a895-3235cfdc9187", "value": "NGCP Pipeline PROJECT TA 725638 DK RH HRDH HEADER PLATFORM TYPE 1 16 47M MARKING & FABRICATION DRAWINGS WITH FULL PACKAGE FOR CONSTRUCTION (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612fcfc6-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620133520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133520, "uuid": "c9ea6e9b-70d1-436d-94f2-28aa9b6bfb36", "comment": "Malware payload (Formbook)", "value": "27c863c479b0542b3bad21a67ad1406d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133520, "uuid": "098bbeeb-f589-4c52-96e3-815d6bac01ec", "comment": "Malware payload (Formbook)", "value": "2a7a9c6d4505766ddf0a6c7dde9c2ae52369408fbe5ce93d0d3d76bf992b28dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133520, "uuid": "ddb5101a-3a41-4ee4-8985-b644cc99917a", "comment": "Malware payload (Formbook)", "value": "791e1d123c275ac4451c5550635c0a67eb4398a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133520, "uuid": "4dc29875-d944-4363-9525-92f62c0e76e7", "comment": "Malware payload (Formbook)", "value": "7665e69b816dd4d10f06fba6beee391b1239b188433452656d24356d7ae53fc37b74deef6018c50944d3a479f71679db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133520, "uuid": "6332e62f-9200-4295-af30-576eba4a03b6", "value": "2A34123530C0D4A3DA534271BDB82EFBDBF9872A2291A39F6760569775330C95A1F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133520, "uuid": "b75a437f-f4f4-4ed7-a8dd-49efc8292fa8", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133520, "uuid": "976463b9-e91f-4035-875b-69cfff15abeb", "value": "6144:lPXZu0jlSr+Op4w+ZTXu4kVZxnnghYuLj+GblVMD/TLrZp:TDjIp49ZTqhsYuLqCSL/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133520, "uuid": "0c7c4fa9-1a6b-4b52-9e40-680e876eaa01", "value": 233940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133520, "uuid": "b1ae334d-ed30-41c3-95aa-1181393dc0b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133520, "uuid": "3eda994c-01ea-4a75-940e-000261cedaa9", "value": "TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582d7eba-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100863, "uuid": "1d27d4cb-1a3e-4074-9f1b-e146f6d2e2c8", "comment": "Malware payload (Dridex)", "value": "b55d5d62bfefddcc085eb08825f7e84d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100863, "uuid": "972a7263-faf1-4601-83e5-888972ae48a1", "comment": "Malware payload (Dridex)", "value": "2ab96115404e6dd22f78b3142127be1faec03d32665f675667a4ee9456049b01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100863, "uuid": "86f8abaf-128c-4cfe-a117-f9e611f99947", "comment": "Malware payload (Dridex)", "value": "f81ab75cb15a2d3fd1b1eaafb92ad405198f583d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100863, "uuid": "e867268c-7891-4089-b8af-9a811629c5e9", "comment": "Malware payload (Dridex)", "value": "192634c21de42641cdc19037ed621750893d728e613dcccdca06871506111a06f46da4614cbe041e3aadf2b6a2851b73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100863, "uuid": "33af8e00-2972-41dc-94fc-3548fd1e4b52", "value": "EFF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100863, "uuid": "88c5ef35-2750-4536-b820-e054e5ce8055", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100863, "uuid": "c344de8d-7bc6-4f86-98fd-a6374407a1c4", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100863, "uuid": "bdc36eb2-c0e0-41e6-99e5-9fd5578d9da7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100863, "uuid": "39b676a6-65d9-429a-b55a-f3cd2fe31217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100863, "uuid": "d9c6b0e6-f14e-4904-ae27-f73dba17394f", "value": "b55d5d62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7057eec0-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620142565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "088ec589-7450-4a6f-8309-d44eabe791e2", "comment": "Malware payload (OskiStealer)", "value": "f7565a4825eb92f2859114bb5a08b60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "abeb6eb3-f749-40e2-a759-ea0283a4e24d", "comment": "Malware payload (OskiStealer)", "value": "2b3f661e6165b5a63130acb2509821a895f0eee94e7af31fdd6abd32db3ab687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "b2a778d5-0cd4-418c-8fba-b40ed722a6bc", "comment": "Malware payload (OskiStealer)", "value": "83d47736d04939e1c01b3df7720109c6d5ca9f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "4b09aed1-b8ad-448f-a762-25197a7c08ff", "comment": "Malware payload (OskiStealer)", "value": "22fdd9e98759ce2acc3c1f4a9e3f5efa0a802b6c64cdc44433c8df3b2f6c400b78d37ef90da5148a36383c6ffb59af1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "5b3fbded-0f6b-4133-bf67-a3b9de0828ba", "value": "95F2C828BFC8836ADCAE4F7924F102510B34FAF66837DB4F69A0651EED532476D12760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "0e8cb9b3-0991-48b7-990d-bfe7fb3dd4cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "68b1936e-2f27-4dec-9ac5-510b1bef1b9e", "value": "384:oYgUrWYvQIMAsKTQcS4Q9gW+zwTZOjAnbz:oZUdmAsQI4QWW+zwTZOjAnbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142565, "uuid": "e57303bd-ede0-429b-bed8-ffb07c9bd9f2", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142565, "uuid": "07cab007-26a8-410a-b642-e6ac8513d598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "c15c437b-e558-4757-a188-47adcf35880f", "value": "Proforma adjunta N\u00ba 42037,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8db97d-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152704, "uuid": "33c90767-5fa2-477b-8a76-0f0d91f0015b", "comment": "Malware payload", "value": "b351ae095e579a346a2c24c64f9cd0dd", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152704, "uuid": "b782f9ed-dd42-43f6-8d16-ed9b5a4dd8fb", "comment": "Malware payload", "value": "2b6a39b62964ac0834ae8d81e741617bd7f3c6d3e526ea31bda0054760e97d88", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152704, "uuid": "4cee4204-1f10-4d9f-9ef5-295c4e192abb", "comment": "Malware payload", "value": "4ebc1486de3d81a7ad3019abdf2ce3e2003ba306", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152704, "uuid": "0f40a7d3-dfd6-4004-8175-b1542ad70122", "comment": "Malware payload", "value": "a368caa4f2c711e3f4e5d52edb879ccd2cedc882b0b224b30d8235a039a7e955da25f82b837add6304f1766728272eab", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152704, "uuid": "335e83d6-3172-49d2-ac3a-8d2b18b906e7", "value": "A6A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152704, "uuid": "2b30cf30-a60a-4563-aa12-766e65269e05", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152704, "uuid": "77f3dfd4-a8ea-44c2-80f9-0c4c4049ef2a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152704, "uuid": "747c7aaf-7681-497a-adc6-0828860c26aa", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152704, "uuid": "ee60bd0b-1469-44ad-8404-936f84c3406f", "value": "2b6a39b62964ac0834ae8d81e741617bd7f3c6d3e526ea31bda0054760e97d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deeb7683-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620108390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108390, "uuid": "4ffe1cd0-890e-49a0-be75-c693613124a2", "comment": "Malware payload (TrickBot)", "value": "4ccb2dfe806378cd8be77127156f0758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108390, "uuid": "8e989a3b-1e08-447d-a3d1-34a53f54a24c", "comment": "Malware payload (TrickBot)", "value": "2bc02aabacf3e4ad8d40be9fe0d22deaeee53782f77e2803adcb27b450fa23cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108390, "uuid": "40a4a004-8a38-4d72-a569-e5378a5f948b", "comment": "Malware payload (TrickBot)", "value": "02985fa052f03c2f93fe288cd8f6b740992e23ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108390, "uuid": "990b7fa9-9b06-4654-a865-22435c7867fc", "comment": "Malware payload (TrickBot)", "value": "e770557fdfa77d14821e9668aac0087e7ac516d6bec458450e3b8751778ece2c4cc0c3c1d48487bb6ecbb71bfdc419d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108390, "uuid": "40ea4e80-d672-44f3-b482-4718d7d2d12e", "value": "D405C01636F0C27AC6B391304FB6BB29A2F9E9914F354EC72390464D1D325F15F3A26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108390, "uuid": "1d2f645c-2f02-4115-af3f-0f141b2ff06c", "value": "7ed6c4038f63ccaac5c9ff583b7cffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108390, "uuid": "53ec3e76-8665-48f2-8d43-5355de496fde", "value": "12288:WODzE+jyMiCwdorN0PWpgl0BMlr4CiZlC7xOhAUNQJ:yUiDdy0ZFuAuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108390, "uuid": "6b434638-26e2-44fc-8209-7ec88da7152f", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108390, "uuid": "967ac7fe-490b-452c-a832-3fc6418ccddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108390, "uuid": "0fa6290c-3bdf-4b9f-8b0a-12d10d6ac0f7", "value": "4ccb2dfe806378cd8be77127156f0758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb64643f-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115283, "uuid": "27fcfe0f-a7fd-41d7-9b86-a2fc6d5f6292", "comment": "Malware payload (Dridex)", "value": "356503503ee6fcf1e7e3ead631933352", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115283, "uuid": "8547ea2a-fff6-4f5a-ae27-5c7dec30cc72", "comment": "Malware payload (Dridex)", "value": "2c0e29525f15489f9cdec79f798cd5692aee6159442f0550cf59e112083b9a80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115283, "uuid": "6c8824b8-69f4-4ee8-8525-f4f42df76e42", "comment": "Malware payload (Dridex)", "value": "310f1455474bff180b805727d9cb62db71f6c3e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115283, "uuid": "7ed537ba-07d3-44a2-9f94-65748009eba5", "comment": "Malware payload (Dridex)", "value": "78c540970f2979ccf7bca3b0d0e7cbd9fb6331c366b88fb4a5963e4dc51416fb87824d67eb1ea985e168bb9f2c82e421", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115283, "uuid": "8438a3ef-5cb1-444a-b630-691361ab2e6c", "value": "8CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115283, "uuid": "df36b6f1-1c2a-427b-9355-49e96cad21f9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115283, "uuid": "98e9d3f6-63d6-492c-9431-837457a572fb", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115283, "uuid": "bc4e9dee-1e9b-4795-8d1e-9bea09649b66", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115283, "uuid": "95a5c5f7-7748-423b-96ef-fe4201100e84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115283, "uuid": "d63d857f-7ee9-4b1e-b42e-18b97f717e62", "value": "35650350_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f033725-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152709, "uuid": "eccb5548-0fba-40f8-9574-b56431a37f27", "comment": "Malware payload", "value": "283e9459a801918490592bdb2c05b8c1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152709, "uuid": "63564b36-6eea-4b78-9b98-98c6b3c15fe2", "comment": "Malware payload", "value": "2d2a9d594d636b083bcbf65a9c6817065075f32dc709a8ed948f219855dfdfd5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152709, "uuid": "9ac85c13-bd69-4b56-9e28-741f849262ab", "comment": "Malware payload", "value": "444a0a140a0c82757db6c488ef8218bb83459338", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152709, "uuid": "65fc1a00-26ef-4689-a1ad-b8c83bd2f265", "comment": "Malware payload", "value": "d45f6a20ced2b3f03d53e40a9a89fb0a6d36d1dde9d3924a1b9fcbc1425ff9282e43db873e935c302f0e9a6a7c7f82dc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152709, "uuid": "2e907ba7-282b-43a6-a062-90e60a335310", "value": "70C53336F4BB79783641E7E24604C93A7BBAC35A3ABA37160FF49CCD912450B756C098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152709, "uuid": "4a37d5c1-e0d4-453b-bcb0-0ab2b318960e", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1UE6:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152709, "uuid": "34839b45-401d-4237-abdc-9fcadf4fc441", "value": 2658304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152709, "uuid": "0a3cd675-724c-4f2c-8ba0-1f74ae646a0e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152709, "uuid": "57c76f73-f7db-441d-8bfd-c795e52f2a98", "value": "2d2a9d594d636b083bcbf65a9c6817065075f32dc709a8ed948f219855dfdfd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339e36b7-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118840, "uuid": "54ef4167-99d6-44a8-852c-f767e73848a8", "comment": "Malware payload (Dridex)", "value": "45933fd68cd18e1f7ed9b5ea169862c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118840, "uuid": "9af4668e-402d-41e2-9d26-c0addcd9b039", "comment": "Malware payload (Dridex)", "value": "2da16f3d41c47a3277fcef27cdfddeb77d8ba55eafef7a8f6c02ce6dd46d510e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118840, "uuid": "49aedd4b-e5fb-4848-af28-578376e472b2", "comment": "Malware payload (Dridex)", "value": "b1da003f4cf91580d7ee030f88d6be7f9e9d592b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118840, "uuid": "05a60285-2a0a-4fc3-a335-ef312252e9e4", "comment": "Malware payload (Dridex)", "value": "95ba4dddaf23c51c2eb32a6a9e1c6097a25fadbc3d3c64758a232f179505c18489b7a818ea0adb9c30783bc9fd7236d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118840, "uuid": "ebb41d60-395a-497c-80da-95267ad60e02", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118840, "uuid": "eb198623-a12b-4588-bdae-bde965fa8d1a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118840, "uuid": "1c820fb3-45cb-46f7-babf-abddd66c54c2", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118840, "uuid": "17063fbb-4d26-44a4-8d6b-7385066e498c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118840, "uuid": "d34361c2-38fc-4ecf-bc57-7b2599f30a73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118840, "uuid": "9b39cdde-b808-4577-aa1e-9e2d1f985c21", "value": "45933fd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a56344-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111704, "uuid": "7b3b90d6-6f66-4442-ad83-6a7822d9db05", "comment": "Malware payload (Dridex)", "value": "6a495d2a14723bb6c3a7c18dc3aa1643", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111704, "uuid": "d31023d1-d81b-4abc-aa58-d26d0b5a808e", "comment": "Malware payload (Dridex)", "value": "2dce08491a5e69cd0d219b662e84ca6ae4c0216ddaed93c3c6d66a99d217f707", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111704, "uuid": "68432b99-ab83-415d-954e-a8fb7e381409", "comment": "Malware payload (Dridex)", "value": "8c1234ec0edaa0b131281033618418a0570b65d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111704, "uuid": "3047aee6-26ca-42f6-96e6-c7b295a55621", "comment": "Malware payload (Dridex)", "value": "7bf70429b8e8ff5a8cbc484106c83adbe1e1cdebaff21813c8cf5e017bc497ecdb1d0d2b5ed90d8b8e71a7e8c7644115", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111704, "uuid": "5d6cd71e-ec3f-4e9e-afb5-81f59128c73e", "value": "2AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111704, "uuid": "d572c480-c451-4832-92c1-92ef4f9e0d19", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111704, "uuid": "3e00ba04-731d-4915-be92-3b8d51c786bf", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111704, "uuid": "660bc8dd-372a-49db-94f9-3f0a753c7235", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111704, "uuid": "fd842613-5f3f-418a-8bcf-d3a6d44d0fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111704, "uuid": "d2c7838d-3300-4f78-be67-a80895dbd00b", "value": "6a495d2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492ce4ae-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095254, "uuid": "1e66b7ce-77f5-427c-b962-736a10ab027d", "comment": "Malware payload", "value": "d779eb91456273118e27f7d9ef0fb194", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095254, "uuid": "81f1f41a-7c2f-43bb-a2cd-565684644a6f", "comment": "Malware payload", "value": "2e44f233c23bd13489626b6b7a7a929f10ce0bccda0ac3b45a878b5746546b86", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095254, "uuid": "68dd68eb-80c4-4d4b-8952-030edbc2a2c4", "comment": "Malware payload", "value": "5d6e66af2eb13e01468ffec41e899787d7adb90e", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095254, "uuid": "c4f6e72d-99b4-4707-9eb9-3160d4fa4f86", "comment": "Malware payload", "value": "b186e81e1f52615ebb0a94aaf7d1d81aef1b20e39cc04004942f39147c9a914b64366a1ff133884ed257514cb1dddb8b", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095254, "uuid": "3f34e16e-ed47-4766-8af2-5f6f36210312", "value": "8D15949D721072EFC85BD472AEAC1D64FA6078FB831B4203902795ADEA5D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095254, "uuid": "c5628dee-5cb3-4a53-b2df-217b5ee7f1e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095254, "uuid": "60ab33af-36dc-4c69-8615-0cc020952dc6", "value": "12288:b7bLkOUCw+5cbGTV5gX9lmJKmLs+Youlxx8R/3eSwaycmybVlBZJooEk7TzX8BYP:XbLLbTv2mUoUA2F4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095254, "uuid": "1556dd1e-900f-48ea-a41e-a590f6b1edd7", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095254, "uuid": "d56f9478-cb23-4f8e-8070-af72858fa5bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095254, "uuid": "614c2303-0456-4249-aa78-66a3ccb45d9b", "value": "2e44f233c23bd13489626b6b7a7a929f10ce0bccda0ac3b45a878b5746546b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6150a6c-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153446, "uuid": "fe082fa1-67da-46df-a943-31ca628c9911", "comment": "Malware payload", "value": "1cb13b6d9d1da9834dbd2f5eb5ca80c8", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153446, "uuid": "7dea0963-da48-4f75-9ad3-c22141d28afd", "comment": "Malware payload", "value": "2ec44f744ed9b48ea610b859f787fe71e0b7d978c67cb58130e89dddad989b1b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153446, "uuid": "4df9f502-67fb-4c65-9994-11697870c917", "comment": "Malware payload", "value": "8f04e5a29a02d96ea8a63997abbb9d7ae90f73c1", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153446, "uuid": "c1748d92-613a-4897-bae5-0800a75c74b4", "comment": "Malware payload", "value": "d47785f6939a49d967b8764d9d7cec28c063ffa0bde2d9a4bddc33885298644932dcaaab23be744c4c6162a81d4d5cee", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153446, "uuid": "3b54d26d-3855-4dde-a698-e066aa1241db", "value": "ACA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0397C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153446, "uuid": "68930c1e-fa55-4e1a-8040-fc0263a81d3f", "value": "96:WaRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153446, "uuid": "c10c42b8-624f-4b96-9138-2a169756be38", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153446, "uuid": "b000a926-e04f-4fc8-a55c-e3cb14539f7c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153446, "uuid": "19843325-a1b0-4fd0-bd8b-47bc216a6246", "value": "2ec44f744ed9b48ea610b859f787fe71e0b7d978c67cb58130e89dddad989b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8db4ac-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (ModiLoader)", "timestamp": 1620122508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122508, "uuid": "a8cc0f6f-0aa2-4583-976e-5ddb89121b23", "comment": "Malware payload (ModiLoader)", "value": "f97e137e249bb393fd88b7dec1ddf9a2", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122508, "uuid": "aac98bff-527c-4d10-be2e-b397fa118bf1", "comment": "Malware payload (ModiLoader)", "value": "2f2c77d7bcd0fbf80b63b7b2e60b8192130c285bce2f946f021dee83954254e6", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122508, "uuid": "22905cac-7eaa-4d80-b5e8-f748e160a53d", "comment": "Malware payload (ModiLoader)", "value": "09e3865d681b8670aa9a1ef184c06ca40927d94c", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122508, "uuid": "e9702474-0161-4d70-926c-d769f58d6542", "comment": "Malware payload (ModiLoader)", "value": "83dbf59cf2da51aa8a50392baab73be9b69ff2d94c164e8064ffe8e592a336e9bb205ac5c58ed36f0e5d4def4026d003", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122508, "uuid": "53a59aa1-0bd0-4123-9c4c-46156ec2a647", "value": "C4057D61B28140F3C19F1A346C2A7AA559A5BE313DF45C4627F8AE487FBF6903E1CD81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122508, "uuid": "348a87c0-182f-422a-94bf-324dfd67a490", "value": "d2b6753f310b2222d9c1c0b1c05cd168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122508, "uuid": "476083c0-619d-4704-bd10-3851c7682018", "value": "12288:EvDpkleW6jNtAJ1yQU5rl0yQso4e1cR4NvHaGgX6r/o75U/Oy/6:E7O4p/81yQU5rl0yPoKeNvajqeUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122508, "uuid": "cd7f7dad-70a7-4d6f-b25e-0d1f0d063a8b", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122508, "uuid": "2b286ee1-467e-4035-b640-895912243c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122508, "uuid": "b34a3c37-976a-4b8b-823d-7021b30a2092", "value": "f97e137e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376f8c03-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118847, "uuid": "ee0e8d89-57df-4c6c-abd0-6161e1ad4779", "comment": "Malware payload (Dridex)", "value": "eaa9aa8a65e18501806615d9a3ba8c00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118847, "uuid": "9cc8d207-e041-4679-be76-1a915786ee3c", "comment": "Malware payload (Dridex)", "value": "2f79ab1fc6385914ba2a5116fbf1023c21bde075b9b129ee7e4d91de6529b105", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118847, "uuid": "80f35c7d-e06d-494a-a81f-39e9c4c78efc", "comment": "Malware payload (Dridex)", "value": "1d9b53d4c44b35dad229fa996834cf05e15c4c57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118847, "uuid": "d491a54b-a6cb-403c-b488-193ab9ab961a", "comment": "Malware payload (Dridex)", "value": "53bb5ff178215b044df94e1a572a5e3883a9332a5d87be9ed0eff42e01eda0a2c352ce71623944bd7e9a46f695f1453e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118847, "uuid": "de500ed7-3e65-47a2-8207-5a49303cbed4", "value": "77F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118847, "uuid": "0d69435f-2b50-4db7-b3ef-257649d62ee4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118847, "uuid": "ba27e9fe-d313-456e-92c6-c8c15d7fb47f", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118847, "uuid": "914f3abb-b893-4cc2-aa29-8ede7afabc31", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118847, "uuid": "6b7c9cca-0ed9-4055-8966-45c7164df2f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118847, "uuid": "2838a983-ac1d-4433-87b2-6b73f0052fcf", "value": "eaa9aa8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7821063-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620153448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153448, "uuid": "5e9dae0f-0740-4a06-a96a-740f10d87899", "comment": "Malware payload (Mirai)", "value": "d32cfaeed3b16d6d339fb761ab160c5a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153448, "uuid": "0fe85daa-477c-4d24-91f3-5313bf7e65e3", "comment": "Malware payload (Mirai)", "value": "2fff9a1061ce6acd01b213289dc917842f3f2ac0a42812a4f9b091ab0a7cd456", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153448, "uuid": "cc356b0c-cbda-45c3-b063-89ddbb5ea232", "comment": "Malware payload (Mirai)", "value": "bd3096d25d0da6cef0f4ba89051b9907a94a1359", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153448, "uuid": "1ee04ada-51fb-4bc8-b806-646793554236", "comment": "Malware payload (Mirai)", "value": "6dfdfe94d23b28341c539c813b08309670ae593cc36a71681195984cedef7a9fa449883ea1d16a02d6f6cc6448744834", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153448, "uuid": "48885ca7-02cd-4ae9-9086-62d5f8d4b552", "value": "77D2F19D12EED11CCC6E7235CADE46EE34B23265A76EFF162C5DAD1007B825C3B1006A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153448, "uuid": "24139127-e8cf-4a7c-a4ec-ed409c54b45d", "value": "384:MxYJDqKxLl4aEHZ87dleoph9zHp1xJJwCDcIrveIrSgJuMqjPNZBvSpaAuMR7DKN:0YJIB87dgopXzuErvvDtqrjBEHKalE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153448, "uuid": "eb7d16e2-66d7-4102-a4da-3a6a7ec9acd5", "value": 29857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153448, "uuid": "5c0157ed-c87b-4f98-a78e-34800d9f933c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153448, "uuid": "93aefdd0-187c-4c56-82aa-f679bed39a70", "value": "2fff9a1061ce6acd01b213289dc917842f3f2ac0a42812a4f9b091ab0a7cd456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086668de-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097293, "uuid": "bc9e2f04-2553-4b25-baac-c8dfe031ec3d", "comment": "Malware payload (Dridex)", "value": "3e45aee6c8cd7615a4955309d3982929", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097293, "uuid": "9ee8a71a-7d0a-46c3-b489-6de24df0d31f", "comment": "Malware payload (Dridex)", "value": "303e473ee0f29980cd11fe9d190bdc9f449d3d2cb9a751c20607f829debcee0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097293, "uuid": "71a85e3f-fb9c-4ee8-8b61-7f87c4ed0e04", "comment": "Malware payload (Dridex)", "value": "77eec347228efbab2599075a7feb8ef48991bc5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097293, "uuid": "aebf8120-4c82-43be-b3d8-22a07c553466", "comment": "Malware payload (Dridex)", "value": "fb7f5647d376546f5a7cd1888f6e286b2848c4e25c545797a4eb71369050bc0048e430c4b7c033e1e28330689f906585", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097293, "uuid": "d03d40c0-9fac-4111-b188-fe6a9c3f19be", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097293, "uuid": "defc4fd4-017d-4516-847f-993857527c70", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097293, "uuid": "00b9907b-409e-46a4-96a8-a39e9c1fe3c4", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097293, "uuid": "e43f33ab-3420-447b-b2fb-3ba5c61b248f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097293, "uuid": "0710489a-7c02-4a35-ab09-3ae589adff26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097293, "uuid": "d71da11e-5080-4d78-ae6f-ace40b3167eb", "value": "3e45aee6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f461053-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093681, "uuid": "934da02b-8ad8-44c4-88c7-f6d7f005bbb3", "comment": "Malware payload (Dridex)", "value": "e89ee1ff7bb911183ac128abb417c2c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093681, "uuid": "7b455a2d-3b3f-41d8-810c-2529fe995c64", "comment": "Malware payload (Dridex)", "value": "3051b7e45c212a4a0d0bb6ace0e7b357b9b88b6e2308613c840180ce32d3214e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093681, "uuid": "a2813692-ac4f-4352-b05b-1386ef6947ef", "comment": "Malware payload (Dridex)", "value": "47878f7a031115393af54783469628d980fcf537", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093681, "uuid": "b1e44e85-a843-4ada-9875-fd980f909b1c", "comment": "Malware payload (Dridex)", "value": "b704d18a11e8ba1aadb703f1c7e1f8d4b2e905abcf62d6e4ffaa2dc3a990544e02cbefe65284053e2b885253a366958e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093681, "uuid": "e23b04a3-db04-43e5-bd00-cbf1505ac23d", "value": "B0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093681, "uuid": "9cc194a5-32f0-4843-997b-5337fccffac5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093681, "uuid": "e95b459c-9d94-40f5-879b-2c654e562368", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093681, "uuid": "d35c08ba-cb2b-45fb-84b2-47828187d3f6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093681, "uuid": "f9a6403e-ce49-4a5e-ad67-94409ae39f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093681, "uuid": "7bfd3651-4292-4a1c-a196-abd431cc8ce8", "value": "e89ee1ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f33f45-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160824, "uuid": "e2dff7d1-c529-4ddb-b170-85b6c337c42f", "comment": "Malware payload", "value": "0d54af2f6cec93464100da3c806137d3", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160824, "uuid": "efa8dc32-1943-4d1c-a4c8-e03c7ac1a844", "comment": "Malware payload", "value": "3138d909ff5e1fdf6b2ac30b898214ae8e91d1e9edf281f58a183ca7f76d378a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160824, "uuid": "1a9cd6d8-c68b-4b68-a593-aebd63e3b7a1", "comment": "Malware payload", "value": "60c6000c7a99b9c849c967c9aca81c72eeb6cca4", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160824, "uuid": "27c0d248-a77f-4a88-b7b2-eab8d9ef2e28", "comment": "Malware payload", "value": "9e9a78855eab555fd1dc277baefdd91b90de74cd7d68fafbaa6cf4236c8e4b8e874eec68e70a2431022b4de1a8e89ffa", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160824, "uuid": "7a32c9d7-237e-4241-9f37-bf8f23d15a7a", "value": "B931A8B31DC291260312EA92F785542CE725940E9947344CA5EEC94DB1E0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160824, "uuid": "ebfba555-6fae-47f0-b9b5-4e2d8e262a6e", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3sN:GEXfhexTvrtWQZUSePSiJVAyrLMV7qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160824, "uuid": "65022331-ccb5-4d9c-a0de-da202aaab215", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160824, "uuid": "0c09795f-426c-45ed-971e-534089ce49bc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160824, "uuid": "d04b49a0-2939-4e1e-808c-156e3fb48025", "value": "udQSatCZ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee39d6e8-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097249, "uuid": "2e19bb64-6b41-4b0e-a899-44b58d09575f", "comment": "Malware payload (Dridex)", "value": "783eda32196e251789d85c51ec2580f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097249, "uuid": "09271e3b-c02a-4647-b567-a0c4b96f0c83", "comment": "Malware payload (Dridex)", "value": "3190dbc1dba3366505dc5ba9b9fca401a5696793bee67fc205bc7afad3bc3802", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097249, "uuid": "8ac7becc-f906-49b5-b566-01c6f6e4350b", "comment": "Malware payload (Dridex)", "value": "7fb0ec6788c25f270c2bc125ff8620409c748cd2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097249, "uuid": "44da6ca3-8b4a-4e3a-b9e1-d9c0ae36ab7d", "comment": "Malware payload (Dridex)", "value": "ed48871f8694d029d8ae19f4aa22bbc5f288e83a82dd1e0fc1ffd369116120bceee8cda6f1ed4c22d5b6d7a1f7c5a959", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097249, "uuid": "f2bd0077-a893-4206-a775-8e17f0669263", "value": "29F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097249, "uuid": "513e8383-f670-41e2-858e-7d72c83666a5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097249, "uuid": "97a355b7-8a02-45a6-b517-97fb85b7f085", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097249, "uuid": "1ee4c852-72a0-481e-90a9-a7aa55a8c204", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097249, "uuid": "0359b503-4a59-44d1-aa66-cf9ee132a24b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097249, "uuid": "e9f5c9ca-46fc-442b-94c9-473885a76874", "value": "783eda32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c607c2-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153450, "uuid": "ce67ca36-899a-4e4d-bbc4-96bf14bf2818", "comment": "Malware payload", "value": "19aabf4a60d35a474af0e962b6c32eb6", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153450, "uuid": "8716145c-b84e-455e-956a-e3d722488f77", "comment": "Malware payload", "value": "31a4387fda1e0dfdad84675d9c2a7f483d0f2ec92bc47e8d9a07f0d7abdfd8fe", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153450, "uuid": "c2f6e42c-39e3-4f02-9c11-e29cbe31684c", "comment": "Malware payload", "value": "790a25e5cf1bf0ce7308e2a43747dd26866c1073", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153450, "uuid": "405a0955-6b12-469a-b783-79a1f8b70e71", "comment": "Malware payload", "value": "181cf191b0e5bb355287fc93566ed5d0f92e06f5aac53741d27a03250f9bf7ee47ce3c355fed81038f45633c5e7dc5c5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153450, "uuid": "83c7b2af-d4dd-4733-a55c-50688027a319", "value": "11A1E850112C1AB17246697AD26FFA52B50ECC1B0A7B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153450, "uuid": "0eb22abb-19a8-4f42-b47a-a494656f1b9a", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153450, "uuid": "51c9ee05-ef97-4dd0-a36c-bacd7470bce2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153450, "uuid": "d53a297a-ec0f-492a-acec-530b29216036", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153450, "uuid": "acb17d68-6690-4bfe-8eca-9af4061d3112", "value": "31a4387fda1e0dfdad84675d9c2a7f483d0f2ec92bc47e8d9a07f0d7abdfd8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be850c5-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620108224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108224, "uuid": "bab2400a-4bf2-43b8-a428-92c5dbb4d476", "comment": "Malware payload (AsyncRAT)", "value": "a3f4ec37e400752adb85a34e63560be8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108224, "uuid": "c1287088-7244-448f-9e4a-307ed715e448", "comment": "Malware payload (AsyncRAT)", "value": "32696fdc1973162602638cdec277dde152bf855ee4be61a47258fd7b09354b65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108224, "uuid": "adf58e1f-42da-4fdd-bcb2-f71853452d01", "comment": "Malware payload (AsyncRAT)", "value": "b20367d00c0bd8ed3f9df0838c237267b7694a84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108224, "uuid": "36e7ccd0-550e-421f-be28-b26e6631aa3f", "comment": "Malware payload (AsyncRAT)", "value": "d0b7495f21ea09fa761ae514cbaee47e745bfc6b2fbe02ec70c7e2c83d30ce5aa5ded18333c72b895611d04c11b98f21", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108224, "uuid": "a3971ea7-1a50-436b-b0df-b1e91fb7a396", "value": "56E0A355856684F78116FD5241D84175E8B61E4F10D4E734C10888C7F2BA2348F2B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108224, "uuid": "4695e733-4ac4-4fb9-ab30-ad0bc22801a6", "value": "12:D13P5RMGgZVydDmpyK8p8efPSkPaJUmYzerU:BfjMdbemc9pDf1aKmYz+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108224, "uuid": "375f42a1-a0b9-4e09-8d04-db599cd55f65", "value": 436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108224, "uuid": "70d7ac9b-8eed-4b79-a99e-04ac4b8b5189", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108224, "uuid": "a44a91f3-7af3-4cd4-bdd0-57375565b773", "value": "GK58.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0302d6-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153453, "uuid": "374f67d0-d9f6-41ba-a569-18b3933078fd", "comment": "Malware payload", "value": "4f10aeee4a65ec20c23b1580be351ac7", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153453, "uuid": "108b1ba0-d7a3-4d4c-bf2f-981d6e63381e", "comment": "Malware payload", "value": "32701cc00dd1ecfe31a3cdefa2dc99d36d93476df7bbb2c0a48f7ccc18abbb8b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153453, "uuid": "f1757391-8300-4735-9579-1955a368756f", "comment": "Malware payload", "value": "8b1f67ff17851e1385bac78fa6135dca415ef957", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153453, "uuid": "584ab73b-7c44-48ec-a2e0-0b7095da2c4d", "comment": "Malware payload", "value": "653678f269bdf433c28a4e07ee89d190c64697ec1de0970d2ee5f39058515bffebc956001b6f55ec0459a42d95ed4b7c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153453, "uuid": "5ccf56a1-e67a-45a5-bfef-777f53b219a8", "value": "E7A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153453, "uuid": "3ad5a352-3c94-4949-acc2-b949f98ea950", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153453, "uuid": "bc95e84d-c9b5-4324-8809-972b74ffe5ee", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153453, "uuid": "6d3c59eb-43d0-41a9-92f2-980a76da5735", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153453, "uuid": "efc23a65-d223-4f3d-97c4-97e59a26e903", "value": "32701cc00dd1ecfe31a3cdefa2dc99d36d93476df7bbb2c0a48f7ccc18abbb8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604746aa-acd2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620130512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130512, "uuid": "1c26c9df-2080-480a-897b-bbfc9214ea15", "comment": "Malware payload (RedLineStealer)", "value": "fad165b5ba7ddb0389733f6b979eae3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130512, "uuid": "c64c6877-3526-4696-9db3-ff48bd382862", "comment": "Malware payload (RedLineStealer)", "value": "328c5eb8908b83c474ab4ab892ac1c2cae066f1f55dbcd15d850b54cc0f4c3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130512, "uuid": "aa4c1855-848f-4fdb-ac9b-c1e5ef22e7ef", "comment": "Malware payload (RedLineStealer)", "value": "e3641696b0cb2137501ad51501225ee79757ba2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130512, "uuid": "273f7976-f890-4fa8-9cc1-d0ee381fd954", "comment": "Malware payload (RedLineStealer)", "value": "b76c79b904f2e4844aac57395a70ef9d4f6f544f43fda17ed73f350f57208616926a069622a690037154b79f71ffcded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130512, "uuid": "07d56eab-e2da-4966-a21e-539bba27b353", "value": "D2C50A64B7D1C636D5AF0BB588F942894AF2F1112C06DB5F4DC892466A27AC1DF33387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130512, "uuid": "059fba67-ff92-4ed8-9458-f30cc62d9a6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130512, "uuid": "a89667c1-bd95-4bdd-aab8-64f7582bb8e9", "value": "384:u8zpxOaiJ8obrPpcEfJO0kAh/a2kYN59bIHwRISk:bzpERmobrKE4UtDRIyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620130512, "uuid": "eba96fae-0d67-45ed-be36-413e1e5b22a4", "value": 2521504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620130512, "uuid": "ab13907e-03a7-4bee-9eb6-9f82a4c29f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130512, "uuid": "7bdfb1d9-9a5a-43c7-8344-7ebfbc07b98a", "value": "FAD165B5BA7DDB0389733F6B979EAE3E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989726b9-ace8-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620140055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140055, "uuid": "06ce3bab-0e94-4788-83a2-62c3022cdbe4", "comment": "Malware payload (ArkeiStealer)", "value": "67466140accc0e7627a4066413a54ead", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140055, "uuid": "08387f55-6655-4359-a878-364bd9d10481", "comment": "Malware payload (ArkeiStealer)", "value": "34197627fad94070514ffbfbe93c3df4eb9ed6df897095d2bcb1ca6848a8f096", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140055, "uuid": "91a9c370-a990-4439-8725-dbc31d151148", "comment": "Malware payload (ArkeiStealer)", "value": "6840de50da8c11c41ea9ab7503844fe3cbc39417", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140055, "uuid": "16a8acb5-4e55-4021-9add-197731089611", "comment": "Malware payload (ArkeiStealer)", "value": "5706e4135e7bb989f158686862137c2f4cc6076669f3fd14ed83b79339c08443d4cb7456659b50b6803460ee6a5bfea3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140055, "uuid": "2f10b9ca-f1d6-4d91-93ec-36e7aa3bfc5e", "value": "8BD4E130BA90C036E7B601F949B6927C65297D615F2B51CFA2DC6AEE07346F0AC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140055, "uuid": "a25315fa-f797-4b13-acc5-582be5fbf31d", "value": "e282e474b4b570377c09595ac5d79ff9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140055, "uuid": "2a516245-7ec3-4990-888e-6dd4704ae463", "value": "12288:9VVXp4XuMV/dTRRES3kweySX8ont21JgJl5yxs6pqNN:H4+MTUS3kwev2Pclks6Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620140055, "uuid": "71c139c3-293d-4db6-9853-94ce1c8390f0", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620140055, "uuid": "16d79822-feb8-4346-968a-844126552070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140055, "uuid": "8fe8adc2-7e8b-48a2-84b3-25e1b997e105", "value": "5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feda6503-acc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126053, "uuid": "12d37787-cc91-47d2-9bf0-5e511c7d245f", "comment": "Malware payload (Dridex)", "value": "b63797984b03f9b95c503aa7f7b39244", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126053, "uuid": "e080f74e-d045-4a8b-ac13-0e1fd1c96b41", "comment": "Malware payload (Dridex)", "value": "3427f3a2f522fb459ae2995a7fa2bbb2bd68910df2774c108121b16f16f109e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126053, "uuid": "de4f2e1a-9d6f-41e8-b258-659d5296087c", "comment": "Malware payload (Dridex)", "value": "1ef258e0f04464b274a7f5fa0c7fdac04a98a6af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126053, "uuid": "946cf71e-1c65-4f73-8e3b-00ab2209c177", "comment": "Malware payload (Dridex)", "value": "c50641300d4fab438d72955c6227d9c59afa5711d674339a5a2ac603c4696b098f78a2f607659588d5bba834cebcd3ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126053, "uuid": "d6635c88-274e-4a2a-9593-9511cc14ca8c", "value": "E7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126053, "uuid": "e62773c1-445d-43a5-856f-7ffd02732a3f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126053, "uuid": "5079e712-4695-4a7b-a644-7524811cab06", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126053, "uuid": "1b66d6cf-b756-4b43-80f2-307d81d1e662", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126053, "uuid": "03c7e8b9-409a-47b4-a102-304e09ff5aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126053, "uuid": "4bbe421d-3a14-41ba-af92-e3d4e38d0b7e", "value": "b6379798_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b23a25-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095562, "uuid": "4a78f12f-1deb-45ab-9131-3f590f1fa991", "comment": "Malware payload", "value": "05532c9214a84499b285e77de1b3100d", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095562, "uuid": "e1a3211f-4af4-446c-9a6a-2a74d5bbaed2", "comment": "Malware payload", "value": "344dc63a152e797133bf646ecccca5416a3e7f7c6f536ab6ebca60b60a5f60aa", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095562, "uuid": "d7ad9762-183f-4415-948b-0bab33639d83", "comment": "Malware payload", "value": "bc2685899254b82ab40930e50cbf0bbdbf00d5d8", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095562, "uuid": "54408376-6520-4586-964a-fe3727a542ea", "comment": "Malware payload", "value": "0bd6fe60a480701cbbedaf90c1d58f3fde2f37bc5170bd94993a40d1ddabcc30792680ac5fbfad454e194260877e45a6", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095562, "uuid": "755edc5d-310b-481f-b4f5-25fe495382ce", "value": "0B1733A44C8D9F94A5B3F40E4A13CC0E686213142496DE8A395D6B32E05E1FD87F7DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095562, "uuid": "ef03d988-fdc7-4ceb-9990-5a0ecd639aa4", "value": "393216:WPOHaAcxx9ODeZP3WeI/cqJFufWZ1oayWQGaG7EB4BgM9nRjn:WPOHG9OSoeI/HJV1BjiGscnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095562, "uuid": "05a90545-a162-4db9-bb88-26d7c2eb9e3b", "value": 18786661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095562, "uuid": "8d07b1f4-a0f0-41b4-9e4a-a73e767044ab", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095562, "uuid": "7358ff93-528b-43d6-b9e7-c8b7e1805298", "value": "0e953fe28821a2909593ceb575e996f69f11a3d7ead2eab61bff6df8dd321f3f~.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d212c1f-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152733, "uuid": "f1c99f79-acb5-4c75-b75d-51d0ac321d9b", "comment": "Malware payload", "value": "079be3c8a93fc2ecf1f3feb6cbff1c80", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152733, "uuid": "62932d83-996e-4496-8ef4-a6f94d763bed", "comment": "Malware payload", "value": "34d34edaa0e0ba08d4df9ac618f341245f26580382dc266a4ba1bd55d7ec6e6e", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152733, "uuid": "d0fb6ef3-adea-4f69-a514-695718ae49fa", "comment": "Malware payload", "value": "0295fe9e570c2a9e50470f7b8be206caa3aca1b3", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152733, "uuid": "7c880ee9-b200-4e51-99f7-86fde5a5f303", "comment": "Malware payload", "value": "6c53a04393294eea325d0aa6cb9a93c8ed8ff4bfbea9a8a0ee96cb89e65a6e47edd3003f58c987203182eb3a95e4265a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152733, "uuid": "55f7763d-9244-424e-819e-e1362369507c", "value": "C695335135C017CC95D4C91B1F8C9937547BEF863824AAE362E2DEE2210EFC4EAD69B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152733, "uuid": "da6c3b41-eaa5-476a-ad40-f5eddef9420b", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6Z:G1wwAjzIQOMK2GNKsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152733, "uuid": "694782f4-0eff-440b-9e35-97d1a4d13195", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152733, "uuid": "1ceff424-d282-4949-912a-4caedaebadfe", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152733, "uuid": "c16ef2af-2fde-4503-aef0-dcb73e8bb768", "value": "34d34edaa0e0ba08d4df9ac618f341245f26580382dc266a4ba1bd55d7ec6e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169333c5-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126093, "uuid": "9ce4e6a8-530d-4d9d-902b-4f5a9a8f40f1", "comment": "Malware payload (Dridex)", "value": "523eab29a81c65cf6895169340e7299b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126093, "uuid": "1d464a6e-6ce4-435e-96c1-2e8842e01002", "comment": "Malware payload (Dridex)", "value": "3504360dfd25df588755631c4ce9df5512f21e6d809c325308a01b2f3059e637", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126093, "uuid": "61deb662-e08c-44a1-afe4-135e2ea4864d", "comment": "Malware payload (Dridex)", "value": "f61b42564780ed3e0f09b6d3e334b34d2fad5be1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126093, "uuid": "025a158d-e203-46fa-a0b5-a1527b4b2e45", "comment": "Malware payload (Dridex)", "value": "ffbb00496007d641e03e9c27dc39d57022d59c634c2a6a664db5b248797f53abba739de9a299a604a2a2bb5c2435f0e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126093, "uuid": "d8247b89-7b03-4b9e-9918-8e2056d23fd9", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126093, "uuid": "fb9f5409-a2b6-458f-ba6a-62b293243e12", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126093, "uuid": "210514f6-ba44-41f5-80b0-26d29a9b1061", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126093, "uuid": "0f1d40e6-84be-4051-95af-6eeb09993c51", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126093, "uuid": "ff7954cb-3225-4557-b7ca-05a8dfbc8d4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126093, "uuid": "4fe9541c-3c21-487c-a44f-dd0a139b3480", "value": "523eab29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0ad5cb-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152439, "uuid": "f2f66253-63a1-43b2-a027-f17feb784d9f", "comment": "Malware payload (AgentTesla)", "value": "1a59efb27c11d1ae0959bf6661e23538", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152439, "uuid": "acefe170-5301-49c1-ae61-02a359d0164e", "comment": "Malware payload (AgentTesla)", "value": "35a971b8e884d2d443a0d998e1f5c86cac85fe32af0eac3ba3bd518580f26678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152439, "uuid": "ef4eadb5-ceab-461d-a91c-767fdda267c8", "comment": "Malware payload (AgentTesla)", "value": "6c5513edcdbbec2e332601bc136c3bf293b257fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152439, "uuid": "6a74c629-9dee-4ba1-8deb-ee7b6a6cfba2", "comment": "Malware payload (AgentTesla)", "value": "562548a77a7b255e6202b4abb5855d028c52dc2808d93880024f2005fe7b7895d2fd0ce4650979c51483eb51e6ca99e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152439, "uuid": "3fbc3629-b43e-48f8-9bbd-758bdeb3bcbb", "value": "E7E4BF2633D4AFACF17E9BB580255200A3F1B90BE721DA5DBEA550CD48E1FC4C3617A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152439, "uuid": "9ea53e60-912c-47d5-bc56-39ae23b495b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152439, "uuid": "02f0fe43-ed64-4a58-82f6-ef9edca06d36", "value": "12288:NGgJvG5+IQEOKMrkXAEcapHnZWa7lDrGeZ7J3UvnjK:MgJvDTEOKNXFpEA7Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152439, "uuid": "070f5f3a-15d0-484c-908f-63af0a93ed75", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152439, "uuid": "035362c6-390f-465f-a44f-698fb1f5706b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152439, "uuid": "3a051a14-96aa-4b57-b0af-24b2a6e5c385", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3501c4-acbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120496, "uuid": "359c6747-3a37-4663-8ec5-33459ff33c31", "comment": "Malware payload (Gozi)", "value": "434b3d419af30403f6679f0578e9ed44", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120496, "uuid": "2e561a53-1839-4d60-a01b-97869ac36de0", "comment": "Malware payload (Gozi)", "value": "35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120496, "uuid": "fbf45c23-d2ea-4803-a721-be109d662cf7", "comment": "Malware payload (Gozi)", "value": "089b875bca3e06156cdf0166896b2f1a9f64de58", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120496, "uuid": "80a687a1-6044-4d83-898f-ef80fe2da9c6", "comment": "Malware payload (Gozi)", "value": "e1c325ef0cd638b9198e65d3015f862b35d60d459923b7351962bf0810b834a5b26a47e545a9c43c92a0b538bd20e698", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120496, "uuid": "3078b59f-aab3-4675-b2a5-fb8c2b1eb861", "value": "DB13F142D93840B7C2A354F90FBD6E2BB5EB97D40B079066A3401CEF4DE2D94907A6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120496, "uuid": "7e30cf46-c723-4e6b-91d2-c293e2c5fb66", "value": "9b4bd5e9c744a772e2cae4b95c84d26f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120496, "uuid": "5d52a928-f334-4ee5-b6a7-ade2e76bae92", "value": "768:LB8/jsvvTTnDDHB6N1XRMPWDY1cszRpC1EYQP8zMxNX1qy/MI4kJP2E4Ws4xKOpC:L6/jCDh6N1XYWDwzWxQkzMz1qUM3inaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120496, "uuid": "5fbfe516-cd2d-48dd-9850-71e38f30be14", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120496, "uuid": "ae5f8f65-4d3f-42bc-929a-aab30074068b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120496, "uuid": "b1828102-1e3f-4ddc-b250-6a2ddabff896", "value": "6ccd0000.bilper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d3e1b9-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126089, "uuid": "f183a682-e374-4418-8bbb-d256a2897b84", "comment": "Malware payload (Dridex)", "value": "87be565b2deddcdd341c85901e6f1c16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126089, "uuid": "65dfbac8-cfc0-44a4-be5a-7d71a9b75b38", "comment": "Malware payload (Dridex)", "value": "35c9a4d474d094ed5a5a35391d2e4866c0e8d449cac64c073837b51b6f8a6054", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126089, "uuid": "c374590b-7e89-4a89-bab3-55c9fab12cf9", "comment": "Malware payload (Dridex)", "value": "8e6a404f68d4e839d70e32262746cae664b01b9f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126089, "uuid": "e469b3e7-7686-4ffa-a55a-055c673c78b7", "comment": "Malware payload (Dridex)", "value": "0c83c95755b5ed52dfb3f2bc92ecab83b9798b0b8826062c365a95228e9fbbeaa515ef9a9ba4070332b093ba0f0d9a13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126089, "uuid": "cb99a91e-5b1c-42be-89a2-c747863f846e", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126089, "uuid": "f5bbda1f-2b12-44af-aa20-0f5ad7722851", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126089, "uuid": "d6e768b0-b5c1-42ea-b40d-632ba88a2a5c", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126089, "uuid": "cd143aca-8bd3-41ab-8346-b71e12aecc25", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126089, "uuid": "edfaf715-af59-47a5-a677-0681149330ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126089, "uuid": "c354c5ec-b31d-407e-a4a5-a14ce1fb1776", "value": "87be565b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c9c2a-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "f95d718b-d0a7-4ab5-b20a-edcf7e1d9b6e", "comment": "Malware payload (IcedID)", "value": "7688772fa7c18c6d8c085d7d2c87127b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "e871d014-6120-4ef4-a5c0-b32b4390e5df", "comment": "Malware payload (IcedID)", "value": "35ec16b0a3814efe45e64fecad80d8d7fe254803a57bb02ed5fb1fd9185c252c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "17ea9ea0-b53b-4cfe-9680-79f5cd1f0ee5", "comment": "Malware payload (IcedID)", "value": "9b9179d06eb751fcab6046dfb1f9371a43e12cde", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126110, "uuid": "1e8fdd23-27cb-45df-a639-8c6528ab6321", "comment": "Malware payload (IcedID)", "value": "111667307e3100778cb9cde03ba780f222b96dc85823b25d19191a960407711ba4a778d4acf1339412308a35c7523f19", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "4f0248bb-c37f-4af2-ba2a-84779a5c2335", "value": "AE8312F056037E27C7430A2894B57079EF14A2B321A5C07916433FEBA8BF8569F251AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "cb45d141-4cbf-423a-aaca-385ab8c44b30", "value": "1536:qDkABEP0nsUrhdSmMtbABcV7JcV3t9N5qTGT2h566gsrs1mZtbvAGJOp:dABbRnY86VNcV3t9fqqT2h7Q1mDVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126110, "uuid": "e4730fc3-e3c3-4164-aa8b-01d54713f0ce", "value": 83766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126110, "uuid": "bc7c2fbc-14d2-45ac-bcad-74b503b65aab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126110, "uuid": "6db181cb-89f3-4195-b4b8-e5c85bc773e2", "value": "xx_xx-59.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20a5fcc-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095833, "uuid": "61c34707-abf4-491c-8389-a5940e27e2f2", "comment": "Malware payload", "value": "7deaf69bed3f94591973b189cb4effeb", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095833, "uuid": "24f4377c-314b-4a04-aa6e-d8275a86fc0a", "comment": "Malware payload", "value": "35fd4704f516d722edcf9ddde0160cedb94aef689e347b68169e879950dca0eb", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095833, "uuid": "509836ef-91fb-4f70-b12d-de88fa1dd467", "comment": "Malware payload", "value": "18d5e37fc895c64d7eb1d8c6c1f93e65c04d0a16", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095833, "uuid": "9c822e06-133c-4843-bb5f-d47a2799fee3", "comment": "Malware payload", "value": "72e236f1d560ac3a52fffb1567b8d80cea536632b772f3d6d7119bd516e3d9385a6966d2baef8f9a313f8ea707c88ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095833, "uuid": "abedcd9a-b2a5-4df8-8d91-f6d4576173b6", "value": "536533B04F52C98982781B6F8E221BB17F9CB7176415C4F0E09E4E4CE76FD41A3AE51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095833, "uuid": "5a9bf08e-8d17-4e83-b22d-1ddc081722db", "value": "24576:a7RueHka+uU3p2dLxdcr44/ZQacPJhoq87mQLDYgD9ShB:asw+6dV46jPQq87pLccShB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095833, "uuid": "096f1f12-1c14-4e96-bb6c-7891e0b03763", "value": 1470736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095833, "uuid": "a53f2774-d961-446b-bef5-4d67d8f9aff5", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095833, "uuid": "51685f13-b068-40ec-8a4f-a48eebb32cac", "value": "AstarothSpammer cracked.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a6d756-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115247, "uuid": "927ec90d-ed1d-4fa5-9b11-a4e744871672", "comment": "Malware payload (Dridex)", "value": "ac20a7e1fe83d34b9789b4311acff289", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115247, "uuid": "48c280ab-9266-4b15-a6cc-cd7b54326406", "comment": "Malware payload (Dridex)", "value": "36558e69d3f269c26b4bf40d5a546777af1c0728f58d5e5c354f1bca2b0e848e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115247, "uuid": "7dbf212d-20fc-4e11-9569-58f5ea03cc8f", "comment": "Malware payload (Dridex)", "value": "594690aa0bf8978f9d0f72ab056eff4bfc30da49", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115247, "uuid": "0e80431b-956a-493c-8faa-85e69ae40e60", "comment": "Malware payload (Dridex)", "value": "37882471b9e3b665de5cf254e224ad6316ea9313f641722362110cc2748f5ba7866160c0ef5460d2f6a02f2368bb15d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115247, "uuid": "f91efff7-9f2d-46eb-a20f-dee638cefde6", "value": "CBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115247, "uuid": "72db7dad-0d90-4311-a8ff-62d9367d5257", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115247, "uuid": "6974c6e1-3b03-4753-a6fc-44ca4686f519", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115247, "uuid": "6b989bf0-2bc4-4040-b968-c37e2a5a601d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115247, "uuid": "58489444-7c6a-4b7b-8cde-e5b049297b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115247, "uuid": "b905d9f9-be4c-44ae-8b89-24ab96908a3f", "value": "ac20a7e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4bd1a3-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086512, "uuid": "7ba5a162-4558-4446-80a1-0028b6a0ab98", "comment": "Malware payload (Dridex)", "value": "a7871055b77451aa90dfa13ecfbfeb7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086512, "uuid": "3ed5f7ec-b66f-4162-b94e-dc454bc248d0", "comment": "Malware payload (Dridex)", "value": "368f4c23dacfbb27c8796d9ce663df7eba7bc3599deb433d61f72cb8fda22a7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086512, "uuid": "5462ffbe-8d05-4c53-b937-3682a1fbff11", "comment": "Malware payload (Dridex)", "value": "c1ee41d5fbd7878191a153ad6588d2f805bce7bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086512, "uuid": "ee8db230-d264-4fb9-aa8e-8f7c6b5c22e6", "comment": "Malware payload (Dridex)", "value": "550630729bd8032b5a6d8685addc9fe890d8e61d52d30dfe74c472a8d5780adf12c0324f2cac29357a084ca2ae9efded", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086512, "uuid": "d05f58bf-c865-4c18-926e-c69fc118d394", "value": "23F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086512, "uuid": "b412ea07-b197-43bc-a45a-affbac934936", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086512, "uuid": "e75a69aa-4072-445f-b4b3-1a21a7c8c3bc", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086512, "uuid": "66aa0456-ebd2-4c09-a56a-2bf72272d14c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086512, "uuid": "3c6c632d-aca4-46b5-8a88-72397c7fee26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086512, "uuid": "24a257e9-3b38-420a-a405-bc48ee6a0cfc", "value": "a7871055_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9307b0-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093676, "uuid": "54f9f0cf-4530-419d-b1e9-0add50db7197", "comment": "Malware payload (Dridex)", "value": "7384b9aea7e2cf7e364de31ac0bd942d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093676, "uuid": "ca32d560-4a1e-496c-8ee2-c6c8f435c25c", "comment": "Malware payload (Dridex)", "value": "36a393fac8df7a6fd8d80a5ce8218a50a56891b23ae3bf6d8fcb1440fd6e3e54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093676, "uuid": "77acba2f-0980-4e5f-93a8-798e2f108f97", "comment": "Malware payload (Dridex)", "value": "80d6efd2be99984be10b5a0179920b38a589836f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093676, "uuid": "ca3aac98-ed62-4483-8ca4-4fdba35e10d1", "comment": "Malware payload (Dridex)", "value": "5f77b64791e71402c9214fee2af6d4565425cb9c7bdec74e956c18fe20f31b9e9f39715a48fa6a8c8bb0101ffce95e29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093676, "uuid": "5e6f991b-7a40-43c7-83ba-f4615137bf78", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093676, "uuid": "7995e894-8d8a-4e47-ac42-2b0df184db09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093676, "uuid": "c773f326-cc7a-4c1e-9f23-cc093bc3e7e3", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093676, "uuid": "46782f09-2836-4854-bb11-f7622d0a6d80", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093676, "uuid": "823b187f-3767-4f3b-864c-98055f362d39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093676, "uuid": "9421693a-5344-4a25-8fb1-6f2ac64fc153", "value": "7384b9ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b498e7-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108085, "uuid": "21eae2c1-2e14-473c-93f7-86dcab20f169", "comment": "Malware payload (Dridex)", "value": "70e645c6c58b5001ca9db0a2b7bb0751", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108085, "uuid": "739fe038-36e2-4e83-a29d-bdf46800d21e", "comment": "Malware payload (Dridex)", "value": "370a92192cbabf33790c0a22864dd10cd6a14c398278ac073b458c3a4de3f2b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108085, "uuid": "43f7e138-ec42-473c-8356-de024f18503e", "comment": "Malware payload (Dridex)", "value": "58f7270b0855c83bfe1ad47a909fd073771123de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108085, "uuid": "4da34b7d-abf2-4861-a163-9757cf4cc0a5", "comment": "Malware payload (Dridex)", "value": "a1d96518f356259daeb34b30b1d02da998ad07cb23252f58c6fce0148c1bdaedaa990258ef4bbaf68514a5f51c9b66d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108085, "uuid": "4df543bc-9f81-4b3f-a28b-a8e8d1e7d348", "value": "D2F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108085, "uuid": "da224fe7-a938-497e-97dc-23d39fba7852", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108085, "uuid": "2ec39875-415c-4eb9-9969-72fadea12c1e", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108085, "uuid": "9c25cbcf-bbce-488a-a633-32d6ee4835ed", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108085, "uuid": "42006a85-3173-4d8b-a2ae-2753cf838add", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108085, "uuid": "14b24dd8-510c-4c29-b50d-b169a201d5cd", "value": "70e645c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1dac8d-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097296, "uuid": "9326fcc3-ceb2-4738-a049-51da969d852e", "comment": "Malware payload (Dridex)", "value": "c4c43ddc8707b4cd1e16621cf74f33c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097296, "uuid": "953aa91e-0086-40f8-8cae-0797584bfbb3", "comment": "Malware payload (Dridex)", "value": "37179eb048c249d4e8837cc1ddaf3d3e673aa9b3a46caf62e88c711c79076759", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097296, "uuid": "236386b1-acee-440e-a604-ce103348b493", "comment": "Malware payload (Dridex)", "value": "c30203124afd0d70d37d94f69e3718006262508e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097296, "uuid": "2e0b2aef-ca9a-4278-8336-7c8f4f7ec1c6", "comment": "Malware payload (Dridex)", "value": "103922a701ea0049a0862dc071292a7cf2f8416f0bee8b8c34d95892331b054bb088df680555185a92514d3e5edff7ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097296, "uuid": "00324d2f-1623-4466-a861-29825b277829", "value": "8CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097296, "uuid": "0f291684-0786-45f1-b448-64bf385996b0", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097296, "uuid": "96e4f2e7-3ee7-4d53-bdd8-23fb07853433", "value": "3072:aA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:a3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097296, "uuid": "b44edf81-74a1-4ee6-9d87-33503d84c5a3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097296, "uuid": "9bad7acc-8356-4866-bc0a-b2e39822ae79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097296, "uuid": "18ec34a7-8c64-493d-8101-4eb4bbc36c2c", "value": "c4c43ddc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2584c809-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152747, "uuid": "7cc81eb3-f766-439e-a54f-e116fa7c0050", "comment": "Malware payload", "value": "bbd0470d0085dadd8f706a6dbb692592", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152747, "uuid": "561c2bc3-7063-4383-bd1b-8b6290e16847", "comment": "Malware payload", "value": "38517d9bb1c2846652f44ae63fd05b64c263760cd4683ab53573e208555d3b03", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152747, "uuid": "3bc6fbe1-74f7-4b3d-851b-9d6d7aad892e", "comment": "Malware payload", "value": "a2ee30a3bd199cb86ad92b9e39c8dcd9c90db4e7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152747, "uuid": "a6341569-c225-4290-802b-8d495d2f22da", "comment": "Malware payload", "value": "f58a9b0bb4b25866b7791c1340be55603b5158a81f5a17cc9ec18d557eae0fdf2b00b8f6d4da88ec5602b43de22a1d1d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152747, "uuid": "a5748a86-7f2f-49b1-8ec4-775d1b3683ad", "value": "E8163310E8883D3E730F78313805E5A1B9C5E66842DDEF33B7DBB79AA459BD88909351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152747, "uuid": "8665202c-2b3e-48d5-9139-ecb8b4905f87", "value": "98304:Kh6nrVBEsJiIqk0pulNMGUEyRzgbqAmLe0KZT5Qb/fiIo1QLbpkn6qC4bEP:Br/3/qHu3MR9RzgbqA2eRTajfiX1Q/pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152747, "uuid": "46b1c14d-15a4-4d3e-a8bf-9f5d7028d68b", "value": 4398574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152747, "uuid": "53c49bca-d352-41c2-a1e4-3e827ab61eed", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152747, "uuid": "df23e0ae-6f78-4aaf-ba04-22b3bc1457ad", "value": "38517d9bb1c2846652f44ae63fd05b64c263760cd4683ab53573e208555d3b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a12f46e-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152755, "uuid": "b3d8fff0-1970-47e8-92d7-c54402858b90", "comment": "Malware payload", "value": "2ced6d739e3b4088ba1c497b745015d7", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152755, "uuid": "5de0522c-a5f1-4920-a5f0-96a325e5f0d0", "comment": "Malware payload", "value": "3863bdd3670a369fead6b3b5a4f28704f0a90636fa9916f89b9e06291c660a41", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152755, "uuid": "0d2b0854-87cf-4815-ac67-548e529834cf", "comment": "Malware payload", "value": "26fa7cb3a7fdd15c7f1141ac3b969ee78ff78f58", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152755, "uuid": "a08400fc-2f91-4194-9a1e-f0e92d624bd9", "comment": "Malware payload", "value": "2002b1f9ec47b8b50c50917cea300ee0df7ac3714f4015fab559d57dd3679f99f57690f56808756df2f3ee2aff0501cc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152755, "uuid": "2be66ad0-5e03-421b-88d7-282cfbf44b8a", "value": "5116330C1256F8FDAC851A5C3B224EF0C1E45AF5AA8115E2CABD5188493F5FF07DE9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152755, "uuid": "097d74b0-675a-461d-ab28-7a88a42f90a4", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7c:0XSxVJG2fLAqFOfT9sMYNM29SAFN25KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152755, "uuid": "067868e8-5f98-4134-a752-1fbb4f7c45bf", "value": 4362240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152755, "uuid": "094fcff3-ddc2-4840-bd56-679f4341e00d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152755, "uuid": "a6b9e35b-ab71-4b00-8715-82ec36550fc6", "value": "3863bdd3670a369fead6b3b5a4f28704f0a90636fa9916f89b9e06291c660a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e219e8-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160422, "uuid": "6d71c36a-02b3-4480-ab8d-8f0ffca8f117", "comment": "Malware payload", "value": "3e2caaa30b8c8ad0692a249f4806e487", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160422, "uuid": "276b9994-0cba-42aa-8612-f66bcda07fdc", "comment": "Malware payload", "value": "386a86fc22927189e9ed55c9b34470fbf2794a624d88f4004c94378fcacc0130", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160422, "uuid": "03071aad-7093-46b7-8630-d0cc47c132cc", "comment": "Malware payload", "value": "ba9db07b580828265adc2fdd4838824148bf4e3f", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160422, "uuid": "e505d23e-d35b-474f-a301-92d85be36b2f", "comment": "Malware payload", "value": "7d27b064b68ba2cc881fb7d255058c73a363de606ab9888f093838b0ee1a86d528b13ba2fecb9b07794195406e563aaa", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160422, "uuid": "f480cb77-1809-4858-9ea2-d173d893a4b1", "value": "723186B31DC1D1220712E692F694542CE739A40A9997344C96DEC54DB1E0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160422, "uuid": "78656b0b-c383-4505-a454-cb0ae6b869bc", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3AX:GEXfhexTvrtWQZUSePSiJVAyrLME5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160422, "uuid": "472b7c12-cca6-4101-93fd-87bd5e37a4ca", "value": 1716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160422, "uuid": "b07a13dd-048d-448f-bd51-62dafc0964b1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160422, "uuid": "0db85c7e-0019-4e54-9843-aa00f718aa2d", "value": "3X1cEEVs.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325b74f7-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152769, "uuid": "ba6eabf4-bfbd-4bfb-8202-165452950809", "comment": "Malware payload", "value": "07ebffb414e4b4e4d5d642bf5bbc2762", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152769, "uuid": "56a02b66-2bb0-44d9-93b5-c5a1b0454067", "comment": "Malware payload", "value": "38a598f06897124fa4b7cb0dd670c199552f3a7738a734c5c7d50f957705f5f9", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152769, "uuid": "7a5f2ee3-3acc-48b1-9da5-b5aa9ff34c69", "comment": "Malware payload", "value": "0fbf7187de5bef6ec5541669eff0b05d997f80f0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152769, "uuid": "58b346f1-9473-4ad0-9a47-af746071ff35", "comment": "Malware payload", "value": "aea9ddd5887a6545b54bf317fd3f3ea1e63aaf08c8df54d4af0b8863ec2d28113397e260dd902832239087506fde7391", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152769, "uuid": "50269231-57a4-4aa8-a041-3cbd6fdf1721", "value": "1FC533105AD017C9E594CE2F2F9C9936047FEFCA7864EDD392E38BE1110FE96A662470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152769, "uuid": "996c80bf-05b8-4369-bec8-13ccd07f2b01", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfY1:G1wwAjzIQOMK2GNKslgus10S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152769, "uuid": "72bded71-1c8c-4537-abd5-175a25614bf4", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152769, "uuid": "5184a299-691b-46a8-b7a2-c2726803cd87", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152769, "uuid": "3859b09a-05c8-4ac2-ada4-aad33acb90ba", "value": "38a598f06897124fa4b7cb0dd670c199552f3a7738a734c5c7d50f957705f5f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36df42a5-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108109, "uuid": "9405df99-5f25-4f80-a896-bd5b93e2cb06", "comment": "Malware payload (Dridex)", "value": "8730b8fe34c23209a51707dd58c90cef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108109, "uuid": "98ca7323-4912-4ba7-8d3d-bd19df3a9df1", "comment": "Malware payload (Dridex)", "value": "38b162c83680492197d86c2d3e61fd6bdb8a5beabbf8d45727dbc3f65f86ac77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108109, "uuid": "5459a744-0911-4691-a100-a0d6e9f68c68", "comment": "Malware payload (Dridex)", "value": "083d98f05c52b13f4d67bb8eb35e5a9f8ba238f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108109, "uuid": "367600dc-c61c-445b-995a-19f898d876e1", "comment": "Malware payload (Dridex)", "value": "9f764c776ddf533498933147b049adc7c33540f39cb2d9bba8fe9e309053e9014ded83c7a050729daba6f77b1318b621", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108109, "uuid": "734334a0-a95f-4e69-8653-f27ec9af6150", "value": "A9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108109, "uuid": "bf7dc4bc-15f4-4f73-977c-b099cfafe956", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108109, "uuid": "7ba62080-dd98-4078-a5e1-208b17389dd1", "value": "3072:Ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108109, "uuid": "9db123b2-e315-4ad0-a2cd-0ed568a686aa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108109, "uuid": "ce540ea6-f688-45b9-9b31-b0227e836e42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108109, "uuid": "1cdca951-c75f-4725-82c3-9cbed0cd88fb", "value": "8730b8fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8e0a9b-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111688, "uuid": "3d0bfa2d-f238-45e6-b310-aabada811722", "comment": "Malware payload (Dridex)", "value": "fc2e12dcf262a3b5728790abeca8511c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111688, "uuid": "86a19fbb-f2b0-4397-93f6-aa2a5589df32", "comment": "Malware payload (Dridex)", "value": "38f130d048925aa6b188ac5e59231ca854e43ed04aa112484a16fa316f3a88d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111688, "uuid": "43b340b0-cd9a-407a-91ab-80d2e6734fba", "comment": "Malware payload (Dridex)", "value": "9e1bbc4a4c587eb4b19b22796005151c9ebb30f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111688, "uuid": "f339e4d0-fdf1-4891-be0d-4357a1392eb9", "comment": "Malware payload (Dridex)", "value": "86f1170b3a1e7f060a29533cf4946f8d1a69906b634d715af26b386000b8394ecd8cd44c820870f15d15059c6995c2e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111688, "uuid": "201228d5-5772-4b75-96e1-e8fc7cef3c7d", "value": "C7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111688, "uuid": "40ad4e11-1854-4e8b-a015-eedd18a00a8a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111688, "uuid": "e21acc7c-afa2-4e0c-ace5-dc198d1eb435", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111688, "uuid": "b09b40e8-a3c1-4f9f-ba6f-ae814a7b4539", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111688, "uuid": "d33f1ba0-1e3a-4cbb-9c4a-380414462d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111688, "uuid": "d8484307-3274-449b-a097-6bc348f74b60", "value": "fc2e12dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeb45b4-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152783, "uuid": "92ded686-86c1-4b04-abf0-1ca628f96151", "comment": "Malware payload", "value": "65e510c94748fa90c7746faf5f80c09e", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152783, "uuid": "cfba58b8-9fb8-4f85-85fa-f7600dd95e68", "comment": "Malware payload", "value": "397f13f843622e1ac216971bcbd5dc259d4b118d896d200c0e0130125921a0b5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152783, "uuid": "711bdb15-f89d-46f8-b6d6-66337926344a", "comment": "Malware payload", "value": "b1f21f31f7f2b39911d61a3312ae1fb7d907d95d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152783, "uuid": "065ab7ee-7ef2-47ca-a8b0-55e4f7c90361", "comment": "Malware payload", "value": "8d70b4e9d863208446c5a4091cd65b83d94eb015ab2e7996b88c186a9e3b8d7a4760df13e8d363ca585493da4ba187ef", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152783, "uuid": "134cc9ac-2743-475c-a8a4-897f38f50624", "value": "5516337CB0E979FF83946A72A2EBEF30201A1DCDB06253515CB7E58A0819271D4F7A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152783, "uuid": "a489cd67-6618-4f42-b14c-3c0991cafce2", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3J:td69Qg/JFeQ5x7bhE8SSdPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152783, "uuid": "760a1e7c-1802-4587-9483-223bcc0b323c", "value": 4272128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152783, "uuid": "586c1b66-d278-4af7-b9a4-d98e247c8efd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152783, "uuid": "0573b78b-b92a-43b6-b978-c8e36dd4590d", "value": "397f13f843622e1ac216971bcbd5dc259d4b118d896d200c0e0130125921a0b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e3be9d-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121589, "uuid": "6b5322f2-f2ed-479d-a508-ee2c466e8ff5", "comment": "Malware payload (AgentTesla)", "value": "7f19638fd2b3d80450fcccabca119e7c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121589, "uuid": "598c4e08-cd69-434d-8205-9fe55aca937f", "comment": "Malware payload (AgentTesla)", "value": "399196756f1f232eb2d5940da75d168f3f64cb1404d8bb308ed37dc9f49d9789", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121589, "uuid": "121a85cb-8c07-4db8-80a6-d9791807bfae", "comment": "Malware payload (AgentTesla)", "value": "6701f3e79960435194afb868a9a7129069b36daf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121589, "uuid": "529f3180-d473-485f-a0a9-5979ac6ffe2c", "comment": "Malware payload (AgentTesla)", "value": "530f2734d4b23edfa12d4b9894bc70ed92594cc6515fa7fa12fdb51598e65e35cffa33da793f38862ceb1c0000eb9ddc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121589, "uuid": "efa458d9-aa0d-4d1f-93bb-bf00b91ebe07", "value": "2F45338EB6452B631F6796989CBD00BF50D908C7ED710ADBB1219732029E76C1CFC96E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121589, "uuid": "168a234c-b15c-437d-b73d-ccc02278767e", "value": "24576:8JSYBVQk9HR3Ir58LO5B2Nr1Ojxmtw3smIrYw0dHxECFPwMgEZpN9ZOYNy2:jkFR3i5j2Nwj0tw3R5dDYM1ZX9Fy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121589, "uuid": "45034b30-3108-4491-910a-2d3f418b3c04", "value": 1263145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121589, "uuid": "e01a174c-dfbe-445f-a947-13fa592afff1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121589, "uuid": "f3ad97fb-2786-4d6d-88e2-cbcc02432e03", "value": "Payment Copy.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2312ea-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152785, "uuid": "6fdf8c3a-d2b7-4b4f-9f87-cd992d58b75f", "comment": "Malware payload", "value": "b103638cf9c58c44279fc3af05d7796b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152785, "uuid": "245008c8-98b3-4bde-a15b-6ae88233bd44", "comment": "Malware payload", "value": "3a04bf4a5b6aa13200aab81e27c3393cee55f2ec3cdcdb4f2ff4daa296572ae2", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152785, "uuid": "a4938921-d38d-45f6-aa0a-b5fc22655bd8", "comment": "Malware payload", "value": "58d82238850818bf429943caac7945c190387d79", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152785, "uuid": "a4515863-80a5-4ce2-a351-2d8dee27606d", "comment": "Malware payload", "value": "9edece3574ca024c945b84e84a5751b698fe578d171ef9b79046f3a94fc7dbff83d93841755abd621d5ccac4ebd10016", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152785, "uuid": "8da7e088-53b5-4f84-82d7-fbc4f84d5456", "value": "B6A1F850112C1AB07246597AD26FFA52B80EC81B0A7B7B358433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152785, "uuid": "e9279bec-8b72-4d33-b719-2e9672356c09", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152785, "uuid": "2b35db64-69fd-4e00-89fe-533b13af0795", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152785, "uuid": "b79a297c-2b6f-4a97-b076-f6c14391d148", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152785, "uuid": "d7e42fee-cb1a-401f-9dbe-ed55be223658", "value": "3a04bf4a5b6aa13200aab81e27c3393cee55f2ec3cdcdb4f2ff4daa296572ae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2874b301-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090045, "uuid": "c68dac4a-1b71-464e-ac4f-41a0eccf2b04", "comment": "Malware payload (Dridex)", "value": "ef784536505b78dedd97cd76542deb00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090045, "uuid": "e36d8752-87a9-42f9-b53e-19292fa31782", "comment": "Malware payload (Dridex)", "value": "3a695d2f7c31f9118a575f2fa6edc4dab8a125ef5dad82be131a5b4fc18376ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090045, "uuid": "0c7e8451-d96b-4823-956a-ae5cc331fa9e", "comment": "Malware payload (Dridex)", "value": "f36646d7f8b982ea0b8a85bbdfd4bb5ac1582480", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090045, "uuid": "af971423-efb7-4e3b-85d2-9cc44b26029c", "comment": "Malware payload (Dridex)", "value": "1b1557c57ca4c9f56bfa1009521d92ab1e01f8f6a2444618701837e95989a3baa23260cfa3fe639156f96fdb67bd1541", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090045, "uuid": "7459b04a-3ad3-472d-8e2f-55a0dc7b165d", "value": "FCF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090045, "uuid": "c93ebe1c-bbc4-4870-acc2-9e371fc79ff3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090045, "uuid": "c8f67bf2-d944-4ee8-89b2-2136419c9020", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090045, "uuid": "13a5322b-e00b-4dad-b0e0-45ec55ccab86", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090045, "uuid": "77fa0f39-3309-4a3b-b4a3-886c6ffe7d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090045, "uuid": "b48a8058-7f84-45f3-9931-8550d260d4b1", "value": "ef784536_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f575a58a-acd8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620133339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133339, "uuid": "25a77152-417d-4a19-a02d-970cc6c55592", "comment": "Malware payload (Formbook)", "value": "05f49aa5b342dedd1d7b6673f3d8bc41", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133339, "uuid": "0a971117-60b6-44be-9bab-63c418e5e04a", "comment": "Malware payload (Formbook)", "value": "3a6cc669542f5e3f9a801e9344b182c71e72396e27afbeac14eeb3d3be0b9498", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133339, "uuid": "6ecae7c2-266c-45bc-bb43-a8c593e101e0", "comment": "Malware payload (Formbook)", "value": "9ca061b9851269f8b1d2fd990ebe119903a5f0fb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133339, "uuid": "1ac2916e-956b-47b0-aa93-add4ae6e981c", "comment": "Malware payload (Formbook)", "value": "3b35d4b9b72d9839414479d8fc7cb6848daaf4c495974a7b3d66f516611e0fbc70d69b84c49083552067327e72f2d025", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133339, "uuid": "6f96694f-7a05-4610-863c-c24f278f0b4c", "value": "A5552371696B37CEC07B687722ABA8258AE89C457706C109350D3B043CB56F2A7D77DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133339, "uuid": "f03179ac-97dd-4b48-ae96-f01e3cb4ba3f", "value": "24576:iiOiNObhnSFbuLWFBMNbjlq2W6g4t0RH/UXOal6UKcv1eytV:LOi4hobc1P7/CC6LiUqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133339, "uuid": "26896514-5f2c-4006-9ed1-8b3044359167", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133339, "uuid": "6e8c6812-0070-42bf-b69b-28b9a3cc39aa", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133339, "uuid": "018361de-2642-47f5-a55a-e3e1d9b2a631", "value": "Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07f5127-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (OrcusRAT)", "timestamp": 1620093683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093683, "uuid": "5dfde967-fe0b-489e-b8cf-7d0fae1199d9", "comment": "Malware payload (OrcusRAT)", "value": "f3c901a028f999c9d7d09e585c0a1f91", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093683, "uuid": "1973f05c-6bda-47ba-a04a-af2aac9759c2", "comment": "Malware payload (OrcusRAT)", "value": "3a83243f35fa61fb6586f5bf2032597fa8bd6fa32c067f011e7b170c5f7ab529", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093683, "uuid": "0172e448-a39c-47d9-8cef-5952adcf10c9", "comment": "Malware payload (OrcusRAT)", "value": "d07976b18d63711f6185817ec9dfb1978a00189e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093683, "uuid": "2e1a98a2-52ee-458c-a8fd-cb76e0805508", "comment": "Malware payload (OrcusRAT)", "value": "2b8f0724445f7f58072238188c61eda90ebd3b2d22c4e4c5339ed2e187bceb7bda4ba3dc6208cf017a933bea9281717a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093683, "uuid": "57275876-d18f-46c6-a25d-6bce9a91a4bf", "value": "8A15BF113BACBD07C1BE36B9B3732AC917B8E90A5042FB4E185851AD1D9B701FE16367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093683, "uuid": "2cdf0e4f-a738-40ab-8e9a-1c3308aac79d", "value": "24576:6NL34MROxnFf3uzsrrcI0AilFEvxHPgoodE:6WMidnrrcI0AilFEvxHPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093683, "uuid": "4e961d99-0735-4382-a373-27d1e8f3d29a", "value": 932066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093683, "uuid": "0c5874b8-ba04-47cf-b032-6c44a890e119", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093683, "uuid": "4cbc6490-7db4-4217-a6c2-207b72a1c37c", "value": "f3c901a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9f4bc3-ac71-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620088841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088841, "uuid": "8368809d-bf0e-45fc-9c70-4a39c59ad1cc", "comment": "Malware payload (RedLineStealer)", "value": "674e32f55ee780fa54fc9658c33834da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088841, "uuid": "78bdb7c2-bd44-4e03-9e4e-733874d62967", "comment": "Malware payload (RedLineStealer)", "value": "3aca76d7bdd23aa701fffa2994e4b9438439056ad0317b78f6c7251b3fb9f2c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088841, "uuid": "1bd603c8-7793-46b2-940a-0cfb8484113e", "comment": "Malware payload (RedLineStealer)", "value": "275ec6d2f24e7c2eefdb046481d9db07f3d9397e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088841, "uuid": "3c055d9a-c893-4797-859c-e2c9905518c9", "comment": "Malware payload (RedLineStealer)", "value": "667b7b6a7f1d1fe759d51054221cd71bc0775faa30d01b7a42a781638d264c8bc85210b531348f9b7b619e7d3a7fe855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088841, "uuid": "886ad827-613e-429e-9b25-772b363356e2", "value": "F8055B209E84EF79C1AD7B77922F451603F1A0E24331D70D7E9FE6F52C5292B2A4A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088841, "uuid": "885c1f72-0dca-4b0c-be96-e949d5ee2d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088841, "uuid": "da9046c8-70c7-4bca-96d2-22ff3ca56ae8", "value": "12288:GSC6RieX93OcR4qz8DyMyoMlflQrhbEYwPJWI57YBb7ZBzzDPfytpMXY4bgvFYRI:vr5Wz3dXYfmPdFrTBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620088841, "uuid": "7a3bada8-4fd1-471f-875d-494d87afb227", "value": 805336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620088841, "uuid": "45a8ecb5-1f52-433f-9af1-d6da78114e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088841, "uuid": "314c29d4-74ac-4363-ab95-8e34bbefd53c", "value": "674e32f55ee780fa54fc9658c33834da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271ae1f4-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133422, "uuid": "9c5419aa-44f8-4139-9313-aa07e7b46c55", "comment": "Malware payload (AgentTesla)", "value": "9761ac3d2ce33b764ed037486bb84998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133422, "uuid": "41f032bf-a4e5-482f-99e7-e6fdfa6c2dc9", "comment": "Malware payload (AgentTesla)", "value": "3b09b12a8088522bd05d01721976858896151a31638f1b70d3bd6159e6fb6cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133422, "uuid": "1e01a09a-a1ce-407d-a0dc-2ffff25d18b0", "comment": "Malware payload (AgentTesla)", "value": "b0daa6953e3c6c88f1fd436b90675bc0b69259ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133422, "uuid": "c46db220-2be9-4faa-b9b5-6247bac44e7f", "comment": "Malware payload (AgentTesla)", "value": "35b7c1837739d5045db58a7b7c57fe05bbe00b1482d2831820ee79fbc0f76a37c09eee623538ee19c33418059769e389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133422, "uuid": "e0f135b8-f25f-4372-a886-96719d0fb802", "value": "1184BAACC49742988F86ABB86B1F2F85014C7A6EF784A5337274A77527D2C7B501783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133422, "uuid": "3a9a471b-a474-45fc-be7c-e6b73688d35f", "value": "6144:Z2XLhlFY6papCECCrb31zde5kG1Z3bdDj14QV/4kkekTxLmA3JludhQMl9A9ZDFX:66BCxDDOWyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133422, "uuid": "121d03e0-3dd0-4bd5-92e4-f852d12ea194", "value": 392420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133422, "uuid": "b35dd4f8-d493-468e-8344-2811016617cc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133422, "uuid": "a56f2ed8-a61c-4c43-826e-5c68bf90f6f2", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd7cc8f-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152791, "uuid": "1026d7b1-ade2-400b-81ab-d1fa2e0e6087", "comment": "Malware payload", "value": "d5a50380425e69999e6243504aac9f8a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152791, "uuid": "0703abc2-4ac7-4ff6-9448-575d87fa9b9a", "comment": "Malware payload", "value": "3b5565c730df2cac435a3d3b0857f699799b41915ade88fa00097fbb55ef87fa", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152791, "uuid": "bc38c6cf-0617-4877-a455-09adcc77b00d", "comment": "Malware payload", "value": "54693f649cfdfd548cc9ed0e91853dded9d2ed04", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152791, "uuid": "009ca416-b7ac-46a9-8e28-825d793ddb42", "comment": "Malware payload", "value": "8d3ff5485006ec0746ecb018bb9479924acc2be85fee69ac02d05f2f26e37860af47a3ccffa883acc172dc2669f47907", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152791, "uuid": "bd10f746-edbf-435f-a816-018d31ad25f0", "value": "EF45330921FBBCC8F9EF053926531C48C3BE62F2D429609A61884CA146776FD63DD7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152791, "uuid": "56fe84a6-6c15-4f22-aaf3-a54a0bd99996", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDkW:IDSOgOhntWID2I0WkAfMtjNAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152791, "uuid": "4d6a09c6-624c-49b3-a378-2708d6167de2", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152791, "uuid": "58f74a12-7bda-4e9b-aa72-e8f72f134395", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152791, "uuid": "b5bd6c79-f6a8-4d49-8299-41b2fcbaab07", "value": "3b5565c730df2cac435a3d3b0857f699799b41915ade88fa00097fbb55ef87fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c7843-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093740, "uuid": "d9f78c2c-c957-498d-8f71-07294af9b69d", "comment": "Malware payload", "value": "c925822c6d5175c30ba96388b07e9e16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093740, "uuid": "3b4a15a5-c906-40dd-9dc1-6da1167c58ea", "comment": "Malware payload", "value": "3b90d9fad35a45a738c6b2830896168c99014474de17984411be61b25acf6db5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093740, "uuid": "7f113045-4356-4cf4-92f6-b34f7b02f125", "comment": "Malware payload", "value": "dd10c4c9a71b5850c23fde513525cac86943523e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093740, "uuid": "de740dad-e6fd-42a0-9f07-e9a6fe0a95c1", "comment": "Malware payload", "value": "2ba05fd144a03c71f78cb82f3917665f40277409dd0e84c96ed1dd11d99145d6131569cb5612fbe0167efd5aa85c51f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093740, "uuid": "45d7e56b-d524-410c-91d6-d95a70d227d7", "value": "6E05D7590A8F613B93A53B04C66E4C0DEE9C85BEDB185407B1E573DCB6096E2913F2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093740, "uuid": "09be93e6-d1b3-44f2-8ebb-9a52590ec187", "value": "6144:ZqPp4jeUGa4iJfCnoNyCP96Qb3stN4fk60zXLDa7iQ9iBp:op4jliiJKnbCVYj4fknz70idBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093740, "uuid": "359c1ec5-fd7f-4449-8880-9b91dcef0bcf", "value": 834489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093740, "uuid": "0d8d94e8-4957-4d55-8f8c-c7562c20d739", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093740, "uuid": "1ecd78fd-c440-467e-8cfa-8b4e1a5398b1", "value": "c925822c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b457b3-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090090, "uuid": "6e264ff8-1f96-4a3e-b184-da249f7f6be5", "comment": "Malware payload (Dridex)", "value": "0dd729b82c7fd859ba904633e6bd6eb9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090090, "uuid": "1292bb53-0ada-46e2-9ea7-8a86d88bf2c2", "comment": "Malware payload (Dridex)", "value": "3b9ebea7d3e803b90f09344fa0931e503648d6fa392ba22db5bc6a5baa72e1dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090090, "uuid": "33711eba-e4f3-4705-9b42-d7360d00dedc", "comment": "Malware payload (Dridex)", "value": "2ab4ee806abefe31b57a89d115714b50608781e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090090, "uuid": "80957924-0ac8-4b7e-a2ea-7ca2fddaf389", "comment": "Malware payload (Dridex)", "value": "31d01863638a95d89e44b18f3535f94830fe2dac8f55b82f122b9ba400b101d7bfb077a1c97943f737946c932eb6d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090090, "uuid": "1099083e-020d-4cac-8254-6630e1ebdf7e", "value": "2DF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090090, "uuid": "28a6c43b-5d58-470c-954a-6bae8aadee9e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090090, "uuid": "dbe62faf-eefd-4e05-8aca-ced47b791f26", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090090, "uuid": "3cd61f13-5653-4a67-9f2e-2e17012645be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090090, "uuid": "2c792ffc-0742-4934-a027-7ce48d67ff31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090090, "uuid": "fd20ec0a-d9b0-4a52-8f76-d7332e8a4e2d", "value": "0dd729b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f28fde-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152798, "uuid": "89cca5b2-eef7-496d-a23a-aaddca226573", "comment": "Malware payload", "value": "9da91f91367895740b67877968276832", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152798, "uuid": "e0523a36-4857-466d-8227-0f4eb12bf286", "comment": "Malware payload", "value": "3c28023b7e976329d77e53bb1de36477c5009c3a3e046783a104be83f98154b3", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152798, "uuid": "bd5641d5-f01a-4a43-b96c-30d4d1c4c063", "comment": "Malware payload", "value": "9c01d71a38e8d21896a743284809cec5e573e0e8", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152798, "uuid": "085be2c6-c6e2-4019-9d3d-4f4ea7671e1d", "comment": "Malware payload", "value": "24ff29a131478b25bfea60ba392e4584474f8abd3613af18bfec4109293b3b22744e39fb2d814d6506c0d6100779d00f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152798, "uuid": "c55845cd-e6ae-44e0-9823-fc6d5f501886", "value": "927533A1B60770E6FDA81890AF08E2796D408EF574C68F74FAB08F5617B9D891F9D810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152798, "uuid": "2c3b91d3-94d5-48e4-a214-6e0d6d9c483a", "value": "49152:l1UdkOgGKlJkHZrZ39xWgpsc9Ersdu9LxP:l1akFnQrZ33WKCguf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152798, "uuid": "d798d63e-bcb9-471e-ab40-8db6e985fa7e", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152798, "uuid": "99827d01-5ad7-4e1d-9978-5949d2c5f65f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152798, "uuid": "1af45261-6d35-4ad3-858b-f5977142f229", "value": "3c28023b7e976329d77e53bb1de36477c5009c3a3e046783a104be83f98154b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac65aef-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152810, "uuid": "99125fdc-e5d9-43a2-9f10-e5784e672027", "comment": "Malware payload", "value": "585fbca3ba65dbbc5f3a3fb29a543604", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152810, "uuid": "d9f60652-878c-43f5-a922-57510f81e396", "comment": "Malware payload", "value": "3c3ebb30177db821f5fdc5dfe174b7c972dd8446ab7642166f6780b4037266bf", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152810, "uuid": "1c3f6cf6-9d39-4741-9674-d68d525a7e1f", "comment": "Malware payload", "value": "5a309160a17e902be4c187a747f55bc8cd4f07ae", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152810, "uuid": "95e67d32-4a7e-4d5f-9aab-3cb9f8dc814d", "comment": "Malware payload", "value": "d26d53eb435331b8fa81988f5d1ac557da0f336ba096bd66f5cefa82651099344f9314a62bf735f65e2227baea1f188c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152810, "uuid": "9e9ab69e-fa87-4f34-8e5c-ed7d06e4f468", "value": "0936330505D021C6F684ED1E87D837B45136EECE64E8E9D2D6D3C3B2050FEDAA631B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152810, "uuid": "d524190d-e732-4a86-896a-0fd65ad6a609", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVdoTGcB1:G1wwAYBr21uQsJ7vTBAlYV+TGcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152810, "uuid": "2f76b486-8bd9-4684-8029-e66ed63ae81d", "value": 5021696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152810, "uuid": "f868a565-9add-4181-b3b2-8586749205fd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152810, "uuid": "15218020-86a9-4a92-a5d1-3d898a9c5fb3", "value": "3c3ebb30177db821f5fdc5dfe174b7c972dd8446ab7642166f6780b4037266bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cb3779-acd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620131373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131373, "uuid": "7e9be0ea-139c-481e-bfe9-3614dedbdcfb", "comment": "Malware payload (AgentTesla)", "value": "9c719936aa560ca627cf8e13c0e572eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131373, "uuid": "c4bb9ad5-c5d5-45dc-8db5-6ce5d898819e", "comment": "Malware payload (AgentTesla)", "value": "3cb19f648096769ee0a5c8e75baba67896e6c59145e3bb18ce059f34c31e73bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131373, "uuid": "3452270d-1c8b-4687-a192-2a92f6675fe0", "comment": "Malware payload (AgentTesla)", "value": "43645af5095ae90c81797e0287ea011760b6259f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131373, "uuid": "b62c2baf-8cc5-4d43-8598-51b496175f4d", "comment": "Malware payload (AgentTesla)", "value": "f4c32d9d749ec0101ceaea30f70c763f9f93339baf109dbe098aef51c888aa2abe7d0dbe442428edeb7222aeafad5cd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131373, "uuid": "f73237df-e832-4287-9fdb-90e045d8fd4b", "value": "DDD4BF2633E4AF5CF17E8BB95125520093F1B94BE721DB4DBDA510DE88E1FC183627A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131373, "uuid": "b73cc6cf-2481-4f59-9a09-dcedeca6b8a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131373, "uuid": "d6b2b761-c3bf-44da-8d63-7dc0be957630", "value": "12288:7lgzz3IovI/OKMrg1PZ65uQ6jN4RyZ5gADPWe+5432f66+g/VQEa:Rgz8gMOK3RZc6jNFZ5TPW5RF/VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620131373, "uuid": "6c1f93e5-44f5-4c7e-8536-959ca554db44", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620131373, "uuid": "a7177ec1-f4e5-439b-b989-1193739e8c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131373, "uuid": "8fdf5719-8921-49ab-8603-d693b5d8c6fb", "value": "FFrIJMwrI9cxeIZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c68b387-ad33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620172140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172140, "uuid": "9e407e52-1838-44f3-bc36-444e0802d55c", "comment": "Malware payload", "value": "219a612b8cf85f5fecbb7e6e27ae0e47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172140, "uuid": "3989ab60-3555-4ce3-afc4-f74343980652", "comment": "Malware payload", "value": "3cd2b72f85d145e8bfc5fadc184e97d6d102e3b22a45815358c43538c9c1dc18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172140, "uuid": "5ed57d09-1176-4749-af9a-c636c8bae66d", "comment": "Malware payload", "value": "a846e68a6d927ec6ea41b0958c20f02fed066842", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172140, "uuid": "1ed654be-575a-48f3-8700-a7dfe55079c1", "comment": "Malware payload", "value": "18a2ad012ed871951917b59d64a318176604926715e99c469d1217decd1af13584cae4f13dab7ca71d3ef75caef91f6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172140, "uuid": "333554e2-9dae-4dce-95df-bbb58f8d905d", "value": "B354E482B1129564E1585F36E836457C42EBEEAA7B38F18B2C04F3B73B771D23E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172140, "uuid": "7c8e4eb5-a597-4258-abc2-2258a7d99fe5", "value": "6144:acPiTQAVW/89BQnmlcGvgZ7r3J8b5IYJK+nBoOhF:RnOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620172140, "uuid": "80561031-f91d-49ca-bda3-9554c56e8b47", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620172140, "uuid": "2dc42bed-576a-4129-910f-85058f93a88b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172140, "uuid": "596fbe0b-63b9-45dc-938e-749ef109e6bb", "value": "SecuriteInfo.com.Heur.10838.2618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf9499a-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152812, "uuid": "ac08298f-4404-46ee-813f-2782a0651787", "comment": "Malware payload", "value": "0ad3ab1e641f2ba21979d37be25c0fc2", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152812, "uuid": "5fc8fe26-bbd1-4754-9ce6-bfd6fab7912e", "comment": "Malware payload", "value": "3cfa43a6e4471dffc2f83acd4c61f2ad8a16e8976311b414854012df11609d1b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152812, "uuid": "8218d393-9f97-466e-ad61-8a95a3a1dbbd", "comment": "Malware payload", "value": "91fcc3a355f3d78fcbd4f289ffd68b2ac33ec6a1", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152812, "uuid": "f48bb673-e080-4238-a255-db256e28f801", "comment": "Malware payload", "value": "347d04eaabf8b8566600e2d3767d761f0dc4a39787d242dea60926df49fee825b5041738d8a9790a33f4f6e679c834e0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152812, "uuid": "398aa31f-e146-4546-b331-860c42d13357", "value": "2EA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152812, "uuid": "2e525459-cd41-443c-acc8-13fdfca9ea79", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152812, "uuid": "845e313e-9bbf-4bfb-b37b-9f15c20f9b2e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152812, "uuid": "eb1984bb-254d-4f4e-adde-a7102ada4c73", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152812, "uuid": "6389d2c4-7133-42bf-8bb4-42adda03ddb9", "value": "3cfa43a6e4471dffc2f83acd4c61f2ad8a16e8976311b414854012df11609d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89a0ed9-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122526, "uuid": "71ed8880-d7d6-4554-aaf8-0498d5d8d173", "comment": "Malware payload (Dridex)", "value": "330442effb6b4ff24b054962a43992cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122526, "uuid": "18cc1afa-b976-4885-838c-217400f5ccc4", "comment": "Malware payload (Dridex)", "value": "3d46b19ac9e83c452be6156f00f6de8816ff6ef2695605ccbd25291b30ff3f71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122526, "uuid": "c6e23c5a-1f7c-4c91-bf7b-61201d473efd", "comment": "Malware payload (Dridex)", "value": "9b38db7b63162469ac0284373e44810c8b3889c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122526, "uuid": "42b7d1fa-7a4d-44b0-88bc-68d95ff43f37", "comment": "Malware payload (Dridex)", "value": "d82eb191f36637b14fc1b11379985918c1a6e753c385754d6a33ea03f178df7281c203eb21547e0869dd5f0c08dcd556", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122526, "uuid": "ca4d7a2d-e8e6-4206-b74c-e4531328e794", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122526, "uuid": "7a22103a-c8cf-4ed3-8719-359d742da27d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122526, "uuid": "21ef61bf-3eea-4f62-a49a-39fda7db0aaf", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122526, "uuid": "86ca7f02-4f0f-486f-9a39-e7fe578b7a24", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122526, "uuid": "a135f3c5-005a-4f97-8494-d8c2a250f639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122526, "uuid": "44260b49-7cb1-4112-90c1-a471e74fc1a6", "value": "330442ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7b9744-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152814, "uuid": "ae6d3d66-dbd2-43c4-b601-4c42e47beb23", "comment": "Malware payload", "value": "bb2739979f75d5009dc0f915a2c1524d", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152814, "uuid": "5df7b4d7-2d23-4d9e-b928-d888a5087117", "comment": "Malware payload", "value": "3d6f998de3fee65157e1aeceb5f1ca39f5827191eb844ac3333610205960077e", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152814, "uuid": "8d56acd2-0508-4170-9d98-ec13dd3da216", "comment": "Malware payload", "value": "6a1e922ed62926dcd1c1f6b8b229fd074d01948e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152814, "uuid": "95d35943-7879-4318-8d1e-07de0f53e5dd", "comment": "Malware payload", "value": "4496dfe22ad87a516f8dd13700c79424ea842d8cb9c1d374af8d483b05d5cc61264f0b79a3664fb08a6761e7d84ca7c2", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152814, "uuid": "842918ab-b264-4eb1-846c-a71f44c869c6", "value": "934302F616FD70D7D99AA04EB244C7C696CBC0A65D57BD8B262C30A8D047CD83CF6924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152814, "uuid": "cdd534b2-8049-4c8b-ba19-cf07fe4b7d7f", "value": "1536:GP+v5E/FKwEh3/8zJQTM00UsT+TBwMxbb4vU+I:bxGK8lQY1TsBxxbb4sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152814, "uuid": "9669deb6-7e76-4fe2-ac9c-a0e929be741a", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152814, "uuid": "b96e0f29-c667-4c37-aeea-209b27c011f9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152814, "uuid": "8941669c-b452-4d4e-bb8f-9ad100c4306a", "value": "3d6f998de3fee65157e1aeceb5f1ca39f5827191eb844ac3333610205960077e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f45b344-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152817, "uuid": "f7afff79-9e41-4d9a-bc5e-f35ff3ef4f8f", "comment": "Malware payload", "value": "305b61103de02c9db6cd2f9497b86028", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152817, "uuid": "3901388e-9e45-4166-82e6-d5aeba2e2ece", "comment": "Malware payload", "value": "3dce68946f449138b7434039f9f0c9f77e6ddff605f4889e08a7f8025094afce", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152817, "uuid": "9b835a8e-124d-4433-851c-a1576763e528", "comment": "Malware payload", "value": "8c866f180599f0346d0e99a08921d1af3ed27245", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152817, "uuid": "a563cb29-c9df-4145-ae4a-74a1333fd03c", "comment": "Malware payload", "value": "0700b4c4d9535b5affe1939492a8c5c2c1b3654d1ea50146e7da39aeed0ada83814df7a207341ac25c57207e46315bfc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152817, "uuid": "4553e2cf-b8a4-4473-bcc3-487a02e534a9", "value": "3D6423B691C8B1812005B7D98A5686D099ADC02936EF3E6377C8BCDF94ADC7C3DF4624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152817, "uuid": "a26ed8f6-1f65-476c-b8d7-7409a2f195e0", "value": "6144:WJl+blcj/mDNgl/I0AcDm2zvVtQae8tmxnwN53qoliq7HFIOcpC:WNj2Nglg5R88wN53q0iacC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152817, "uuid": "56dc2a84-3137-4b2c-93be-a441eb8de998", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152817, "uuid": "71f4b7bb-fc0f-41f5-bbee-bd730dee3a49", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152817, "uuid": "7c62866b-5698-486e-ac7f-763f7b07e6c0", "value": "3dce68946f449138b7434039f9f0c9f77e6ddff605f4889e08a7f8025094afce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50795ab3-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152819, "uuid": "b976874c-1973-4ac6-8414-d14116a40d39", "comment": "Malware payload", "value": "62c618df4731275e5b906fe2326d342a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152819, "uuid": "6dcbec9d-466e-4b76-8640-0dddf1ea629d", "comment": "Malware payload", "value": "3ea90304b414816231520623aea45f5477d92734e529cc055ad9c33d10e33e16", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152819, "uuid": "ac610df7-2e74-4c4a-bb53-38a5c33327c3", "comment": "Malware payload", "value": "406ffc4806606a80a719568d044fdfa97e473058", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152819, "uuid": "6b0ff7f6-f692-4ba5-aed5-84fbbe8f842e", "comment": "Malware payload", "value": "54ad2836956379335aaa7cd9e16b32674208638ee1f60bbdde08deb244fd6322a8e1847264bc5ae60707db0d77bb2588", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152819, "uuid": "0927441a-318a-49d4-b47a-63e8784548b0", "value": "AAA1F850112C1AB07346597AD26FFA52B50EC81B097B7B398433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152819, "uuid": "d7e716ea-ac40-48c9-9ca2-7a4dee5ea20e", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152819, "uuid": "b621b3e5-9d33-458c-b183-54629466141c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152819, "uuid": "3827272e-934b-4f67-94ce-11c280269819", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152819, "uuid": "03493bd0-4d24-406d-a267-4f41ddaea4be", "value": "3ea90304b414816231520623aea45f5477d92734e529cc055ad9c33d10e33e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3b8ae3-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153455, "uuid": "b71fc9b8-d845-4639-81fa-92f1273049d2", "comment": "Malware payload", "value": "cde48c7fa909b6c6c7ab7ca1d3a58a32", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153455, "uuid": "efa2be24-68dc-414b-9256-e36e23a4d7a3", "comment": "Malware payload", "value": "3eec7d0376c7493bd42e80efc6fe5441eb3416bdce983754c9b7fd738cfd8376", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153455, "uuid": "0c3bf97c-a2b7-48b9-af83-f8244f4616a6", "comment": "Malware payload", "value": "a47a8d9c4d9c81f1388cf6f25f550e30241fcfdd", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153455, "uuid": "611bc643-f332-4412-939d-bbf389eedc69", "comment": "Malware payload", "value": "7abd3d46d91fc1566fbcc3fb1f60042a68434d0b5b5f3cceb2fff6ccb601a98290aaa8cbc95151656a4b5cff51122c23", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153455, "uuid": "636e4eaa-0816-4209-8381-fa0b9b77d49b", "value": "B5A1F750112C1AB07246697AD26FFA52B90ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153455, "uuid": "1eb34634-7c62-4c63-908e-cb00d8ef76a2", "value": "96:9URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153455, "uuid": "7b82adc9-8aa1-4f95-94e9-f347852d3be9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153455, "uuid": "8229346b-9084-49e6-9afa-adcd693b4d3a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153455, "uuid": "d20a603d-af8b-458e-b4d5-fb90c70704f0", "value": "3eec7d0376c7493bd42e80efc6fe5441eb3416bdce983754c9b7fd738cfd8376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ddc801-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152830, "uuid": "724bd3e8-ed80-4102-a82b-9e07651cde0c", "comment": "Malware payload", "value": "e020f515ad2249bcdb0ea821b0b29565", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152830, "uuid": "9f7aeb9e-7e9f-49f6-98f5-1199aa249fdb", "comment": "Malware payload", "value": "3ef90c86d4e7e4ecfe5210e995bc7d24c56bc0cac191b6ca295ce974bec14e48", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152830, "uuid": "64df6b3e-74f0-4aca-83f6-32e87315a33b", "comment": "Malware payload", "value": "7d9a0786bfee38a144f699d673a5472cf6270933", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152830, "uuid": "032517b5-1778-4252-8d4f-84021ef95bcb", "comment": "Malware payload", "value": "6d043b8b33c0502ef5c3c43dcf32d221412ac5b91639fe50c2af5dc28e0810345a90824b8796335ac95f982c28e8a3f5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152830, "uuid": "b22e84df-7908-4327-937b-70bae688cbd9", "value": "E616333AE07774746903DEE2462C9D7227F9DB0B3E4A37190EB4A89FA12850B77B8544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152830, "uuid": "f1878c2c-7a01-416d-9c72-2cf02bbb5172", "value": "98304:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HVCjzrbXbe8gGjAuv2p5qR:KnD4Yqqvc7hvLFOMojzrbLVf2p5qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152830, "uuid": "9bdb29bc-20c9-4da2-b479-8f9c8936dea1", "value": 4313088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152830, "uuid": "d13ac07d-4cbf-4d51-8c7f-9b0d733829ca", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152830, "uuid": "4dfb4cd8-7d30-4383-a027-7173051007ec", "value": "3ef90c86d4e7e4ecfe5210e995bc7d24c56bc0cac191b6ca295ce974bec14e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abb391d-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133428, "uuid": "77bfc7e0-cf7f-4193-b429-ef00835876fa", "comment": "Malware payload (AgentTesla)", "value": "05c282367425cd1e07674f9f92a76c7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133428, "uuid": "263f5b2e-0164-4bc9-85c6-dbb1598105a4", "comment": "Malware payload (AgentTesla)", "value": "3f324b36806b1580450a1957e73f4a9c74567d3281db2db9a924dcb4c226202a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133428, "uuid": "7bc5deb2-4231-4932-b454-f259791f4ab5", "comment": "Malware payload (AgentTesla)", "value": "2c2ea2e9ef29dc7dc2018200918d8e5e7d282b6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133428, "uuid": "85dc2035-d49d-408b-a115-d6284d639a86", "comment": "Malware payload (AgentTesla)", "value": "25a62e732f9198f96f39c49008d96c34ad6b4536a0469d82e53b28361f84651e6b70fb427647f8e015937ed062b082f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133428, "uuid": "c29af483-f783-4891-8f60-605103e7a808", "value": "72910ABD567C11D6CE68D962D279FE0241E7F20A89CF0851356EFD640BB23645332746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133428, "uuid": "93f9ff4f-ed70-49e8-85b1-80ba8022ede8", "value": "96:ZXtAyP9txLbBC9DSDwYAB0eIouMv9Wmpmq98XO:ZXG2txbARpY0rdmXq9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133428, "uuid": "9ff0c97d-1e80-4369-8941-e9407683d71d", "value": 4224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133428, "uuid": "e50f11d2-c9a4-45a6-b26a-6c70079d4f1f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133428, "uuid": "d6a7c431-995d-4a92-a8db-912701523e38", "value": "04052021paymentscancopy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5957adc5-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152834, "uuid": "4a9592a6-e78d-4bde-b13f-a8d0bad809ea", "comment": "Malware payload", "value": "767a2412d33638948eea099c501775a5", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152834, "uuid": "a2263221-8e43-455a-8266-9cb1dc80c772", "comment": "Malware payload", "value": "3f3631fadc1b045afe023619ab9bb250683a8e2ff9d45694ea46a89c26a203cd", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152834, "uuid": "09467a14-c306-4215-a3e7-2d4d009a10b0", "comment": "Malware payload", "value": "0269853e870958fce1c58106bdcd1b4387823a53", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152834, "uuid": "87c1263f-0c9d-4397-a400-83eebf8bae11", "comment": "Malware payload", "value": "9cbc01c00ff78ad55ce2442560e39fd902a2cae9df2cf5c84e27e6045573ca7eee0aa8c74013dfc842e0bb09c0a2d471", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152834, "uuid": "6c694302-77ec-464a-9e59-dbb293323055", "value": "21353378B3E332FD652C6571AEFFCA1E602FF9CC806ACBE059975184500553A9BE1A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152834, "uuid": "3123e11d-2fa9-4bca-8eae-208b460bfd08", "value": "24576:tNF0+xOOasdIE4Uf8FUeT0mUPVanRHwPdmjs4tiS21yY820pI1Vec0x+0d5X:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152834, "uuid": "f63efe66-b8ec-4244-acaa-d32b53ffcdde", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152834, "uuid": "46e882c6-b3c7-4d32-85a0-2d0e155f8a6f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152834, "uuid": "0646c85f-d0de-403b-b4d0-8f7948c21eef", "value": "3f3631fadc1b045afe023619ab9bb250683a8e2ff9d45694ea46a89c26a203cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0945b6c9-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097295, "uuid": "aff64feb-0557-4f31-ace7-588f056a2a0f", "comment": "Malware payload (Dridex)", "value": "e88737ee8bf7c79571a99104f96492ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097295, "uuid": "26e537d0-d1b4-431d-8065-3a7824254897", "comment": "Malware payload (Dridex)", "value": "3f71ec52634b485d4b623e70b44db8f18ed431137f8aa2abc3db53887630579e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097295, "uuid": "2943c97f-a9dd-45e2-b76c-dbe2750e3f87", "comment": "Malware payload (Dridex)", "value": "8760de10e88a31dee23060dcf2bdf947942432c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097295, "uuid": "d59c4259-524f-4d62-b42f-b6535754b764", "comment": "Malware payload (Dridex)", "value": "2dfc4f1c519abc4f61e565cea8542d5ae12322544dace9f5e8201fcbb74011e9fd7cff983b2deb5c978202b5c1c052ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097295, "uuid": "372b3f10-d088-4c5a-a833-6222b722bbce", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097295, "uuid": "7c66f59f-f505-4c02-acce-bbd278220c20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097295, "uuid": "b92cc17d-fa67-420d-908a-4fbe898e5f20", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097295, "uuid": "c5016e2c-e8e1-4dfa-ab39-bc694d7cdebf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097295, "uuid": "a3bed50b-3821-4b38-b499-0c00caf71847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097295, "uuid": "f9f4f046-7396-46e7-bea4-d8d9512451a4", "value": "e88737ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc777c0-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620141752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141752, "uuid": "d89e82ff-1521-40e2-be02-0ce9e5c4c9ac", "comment": "Malware payload (HANTA)", "value": "45abf1c6243ca041b3cf9d17ada882fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141752, "uuid": "56d6ac82-fb26-4fe7-8784-c627108071cd", "comment": "Malware payload (HANTA)", "value": "3fe7335d5876e6f54eca61bb2140274f1d2f87d42f1a6168c3a1d87e17f2bd16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141752, "uuid": "5445005a-b5ec-4713-b4ff-9b32e4fabb37", "comment": "Malware payload (HANTA)", "value": "4e77e9ecdb68577692abd25178e84cc890b6a324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141752, "uuid": "41540d98-bdc4-4552-aa88-0e4d1937f906", "comment": "Malware payload (HANTA)", "value": "5abaeb2080037a616e05dac24fcc56bcba239592a29b7ea4ca70ebd8214539ae1d97b905574cfec20407680447a78ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141752, "uuid": "18eddf99-4e02-473a-94d6-3da25a0881b4", "value": "F1051277406A55A5C5992331F0A01F0F366CD6242680B598F08FF2BADD1D28EDEF83B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141752, "uuid": "9c41374d-b14a-4daa-905d-1b33613345d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141752, "uuid": "a29f6e9a-6804-4d89-ba50-cc6e370655d8", "value": "12288:bg5bo8esQSDwRjikKpUFAWsSTNR6PAB9flT91pf8KPR+YcsevL28nZ9aX946x1Tb:0h1enqwgkKGTsAQAB/h1p4GL8n+N4Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141752, "uuid": "d6476a3c-15fa-44ab-9431-18d03e6bd3fa", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141752, "uuid": "5141a075-1e02-4bd4-bd01-2337fa1e9d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141752, "uuid": "0ebb6ecf-c425-4ead-b9df-081c71bf2f5d", "value": "h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a20b5c-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142485, "uuid": "e50be247-180c-4292-bff0-ce1adb8c3e81", "comment": "Malware payload (AgentTesla)", "value": "edbe3755858ada0c83d0ac2d87e5cbf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142485, "uuid": "41c3c880-1332-42f7-a0b9-d801788001ad", "comment": "Malware payload (AgentTesla)", "value": "403d472e21ec125246769b1b97ea6c61920e6fc1a146b5465654bc70ea806553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142485, "uuid": "e0d18b49-3568-4d17-977b-70c3f816ab94", "comment": "Malware payload (AgentTesla)", "value": "5e92dec2ae2bf9d0e1a9965da828e96fd00f162c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142485, "uuid": "d408c584-4d25-4810-9af0-4d1441a1f033", "comment": "Malware payload (AgentTesla)", "value": "a88bec383c3e9d3c73e0aa3385a135925a46dffa195886f5dbf95f6666880c581f094712d5f583bf31c952073186e14f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142485, "uuid": "acc0e42b-9a5b-4c9c-a5dc-ca214f344004", "value": "DD549E7768849D2EDEB5C6358CF206F3E92961CF3E43881E919D13054613BA77F8A22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142485, "uuid": "1e48361b-2b2a-4dde-bda1-6ffd9762d6e2", "value": "6144:ZSi5Za+LXdkcmt21Ru6dT5WRYFCmoIa50:ZSivlLmcmILdT5WCfoIa50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142485, "uuid": "0063d9fe-23aa-4955-a056-22a9827ef0d3", "value": 290717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142485, "uuid": "794781fb-d769-4b6f-b45a-31d4a3eabc1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142485, "uuid": "e9b50f45-1fe8-496e-aa96-6da54560ba2e", "value": "edbe3755858ada0c83d0ac2d87e5cbf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bb2145-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620108048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108048, "uuid": "9c90dcd7-e924-403f-8738-fd6f2e4e4666", "comment": "Malware payload", "value": "22ce1890dbf1981731be698c37e491f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108048, "uuid": "e56678fb-614f-4f8e-844c-b055dc8406fd", "comment": "Malware payload", "value": "4081406d27f30f1dd68fca09d23aa9db54af4ea4fccfa3c486c5aa31ff772054", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108048, "uuid": "caa12379-ee0c-4639-9989-519d29d61076", "comment": "Malware payload", "value": "ddad79b38918ea685b84f4db1b32d688e6132557", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108048, "uuid": "ffc9c62f-ac02-4d73-8d93-7c1c04f670d9", "comment": "Malware payload", "value": "75e31244005fb0f3f50a60e3385953b0ba0c7998a375c1c28ecb4f03f57a807c526893f461863736068ccb544cb31fdd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108048, "uuid": "4caed3dc-3d24-494d-b694-0e611a36aec6", "value": "1D552302B7D289B2E1721E3219399B21757D7E302F24CA6F73E45E0ECA35481A615FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108048, "uuid": "e197b8a4-faa2-4651-8881-d864db21eb81", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108048, "uuid": "c4354d82-6cc2-4545-b83f-64720c0531da", "value": "24576:RXhZgPlsrriZgqF1rHWApWTt6iJHa+RQcZx5DJkZpxB/QCdTbOCasHq3XmQ1LHLu:pICejWAUTAiJHaybx/kZCbCas3Q1rL4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108048, "uuid": "005be47c-a641-4e66-a4f8-71eb5bbe33cb", "value": 1390060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108048, "uuid": "6b6887ed-351e-483d-ba75-136b31b4c20b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108048, "uuid": "754eded9-1e54-4f7a-9cbe-a32229eef8d7", "value": "22ce1890_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c0f47-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133384, "uuid": "66fe8fec-912c-4482-872d-6b0a63ce6058", "comment": "Malware payload (AgentTesla)", "value": "e5f61bba2d308a5b4108c0650ebc44de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133384, "uuid": "404b1530-b9b7-47c2-94de-2f2309ce2ae4", "comment": "Malware payload (AgentTesla)", "value": "40896d35b172e5bbd2f26ee6d610a7b2f87769cdde3a3d793f9923009cc9b328", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133384, "uuid": "1c79f288-50e1-484d-bd00-ba549c72b12a", "comment": "Malware payload (AgentTesla)", "value": "aada1b08a5a49e70f0c685527ac86f72f27a6310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133384, "uuid": "0ee2b251-1e3f-45a7-80ad-244c3ab47843", "comment": "Malware payload (AgentTesla)", "value": "bb3820e410060cb26c21c6a4f8f2024a9c193be59a506bb8ea949b3cd56f2184e7338b0717a4728f7d3f7374891ff659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133384, "uuid": "eeb83853-183d-4eb0-9d9a-41a861d5ce6e", "value": "FA8422867C3C4B0FC8F780795195F68C18F3CC066A4B593ABAE6348858F739992C7B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133384, "uuid": "1e47b1d9-d3c2-42a8-816a-7618e710bea0", "value": "6144:saXKF3tklKC6mNLIFf1QLBFX69lZhJbgushwE8aRzQyqHzGhyCZIZ3NUC:Pae6oYf16FX69lZfcushF8aRSHYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133384, "uuid": "fda6bf30-ba66-4764-8d18-a27b4bad01b7", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133384, "uuid": "7e326ddf-b1b8-4e7d-b86a-eeae8f24836f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133384, "uuid": "60617b45-c6d3-4e97-b1d3-02b422c589e1", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c6f300-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100881, "uuid": "a5194903-1553-4fd1-becb-25b048c17e15", "comment": "Malware payload (Dridex)", "value": "45906908aa47b1a6c2111637d4cd41b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100881, "uuid": "bc681634-467a-45eb-ac03-44cad60cc3ac", "comment": "Malware payload (Dridex)", "value": "408be534f658dc70269e65324367c6ba06d840b79a197ecfa78d1d6ad65fb01c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100881, "uuid": "152db553-15cc-4c89-91da-7d9824f19788", "comment": "Malware payload (Dridex)", "value": "bbd4ea2ebbb873d6b2f833a5c2c539ccdd4f9bb8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100881, "uuid": "0b0dfaed-ab09-4fc2-bcfe-8cac20b4eb24", "comment": "Malware payload (Dridex)", "value": "05a407de9ee77b5c6dd52cc043aa0a18ea61284242232e25db6862b70dbb9ac5e1c5fbefa0f63c82f33a75a3ab8d4f97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100881, "uuid": "927d6cfc-4882-46db-afe3-81dc7fae55e4", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100881, "uuid": "61130538-8348-4c72-be85-5737923c4830", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100881, "uuid": "2e1d2941-de4c-423f-af87-cc2af18fb0b0", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100881, "uuid": "4d0b63b8-4ada-482d-8026-3008fffea5e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100881, "uuid": "5a893fc1-3a68-4d42-8368-0327a038ba87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100881, "uuid": "d548aea4-f735-4ceb-895c-68b62c02a6f8", "value": "45906908_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f78a4cd-ac9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620107747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107747, "uuid": "cfd656a6-6595-4c47-93fa-6725e0b4a348", "comment": "Malware payload (Loki)", "value": "7a876151ca1230e8f58becae9d8cb903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107747, "uuid": "14b1c473-c51a-475c-a742-542ecda4253d", "comment": "Malware payload (Loki)", "value": "40e8910e48e5bfde7fd30bbc51a1d371a378dc4a306ed2145990219554f80a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107747, "uuid": "8f47a5cc-357a-4673-84f9-8a08b6f000bd", "comment": "Malware payload (Loki)", "value": "0731ace285886c5c322741a97d5ed626dbd83b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107747, "uuid": "a30415a5-c10c-4790-9abe-a45b49785514", "comment": "Malware payload (Loki)", "value": "784b2784138d701e01d1a256b12aa2cdf4c919bca0ee294ca0ba2067cd8f62ffe3d0bb7aa8b46ee12a57f94afae8c684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107747, "uuid": "f662d8d8-7ba8-4187-aba5-3042253696b3", "value": "8E440112EE18F21AC8A5487E5EA5C6FC0731AE14AC12C7476CEC7FCF797A3697805192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107747, "uuid": "c122138c-c5c6-4b8b-a6cf-c5c8d7481645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107747, "uuid": "63b7360f-9e08-467d-8af6-3f825da8d743", "value": "3072:5tIsFibE+vZJKZ0Hz+eXyLp/ChdWKEsth6xElNCi/T0A2nWgEVseKpZKiGZcap7:5tmbD4QSeQ2NEi6xE3CiL0AcWgE72Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620107747, "uuid": "afbb652a-3d1c-44c3-aa6b-b51c44c206c1", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620107747, "uuid": "64a2a45a-ed8e-4427-8170-c40503feb437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107747, "uuid": "cc3b1809-5fae-4d34-a94f-3ac8a91b4af5", "value": "RFQ for Valves - TAG-A2R for SD job, PR 21-10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba9cdfc-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620115257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115257, "uuid": "bfc5f8c7-49fd-4c8f-9b0e-07f0c7c53dab", "comment": "Malware payload (Loki)", "value": "07b7c2aca6fea2f22f08fe8b5fcfa31f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115257, "uuid": "e807fd6d-ed89-4b0c-b0c0-81ba36e25071", "comment": "Malware payload (Loki)", "value": "414491bef4ddd8112a6a5df1d1b8d4af5afb0525fe6e056526c907625522cbcc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115257, "uuid": "4e7e2ee8-e51c-4ebb-8809-9e6d663a99a1", "comment": "Malware payload (Loki)", "value": "701c266a64ada4d2ed1e174bf49044672913b4a5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115257, "uuid": "2e52108f-88e4-4355-a79a-33bd6d7386f4", "comment": "Malware payload (Loki)", "value": "74f7079d5fc906d8e846558738297a32084a8df14d1eabd659c8e15df2a33204c8a0bce8d857aaec469ecc0cf6b2519b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115257, "uuid": "241ea454-ccbc-407f-a4cf-4354c524d5ea", "value": "77455BAC715470EEC2178E3297DA0C0182213575AB2BC60B936317BD991FE57AF34AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115257, "uuid": "08ec31f5-f279-4d92-aeee-b32f15f61a52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115257, "uuid": "9d1707ec-6965-4043-940c-3677e879385a", "value": "12288:rCfpq0IsoLLoS60/K7yh0Sb42Bmjh0d5ftToliyAjYkhcAivFjUCHldk7M5TsT+e:uxNpoLAIb8yd5tNpl27v3Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115257, "uuid": "349ed5bc-0da4-4968-9eb1-b61f290ecb89", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115257, "uuid": "e41ea7da-bd13-42a1-b289-3c6f35f7034c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115257, "uuid": "cf9999dc-2b13-4f85-a222-4990cb846924", "value": "07b7c2ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca1e40f-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142371, "uuid": "5cd3b4b3-a7d4-4fcf-bc4d-d4a852298485", "comment": "Malware payload (AgentTesla)", "value": "2a2a8564ad128b54843a01cd01f71ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142371, "uuid": "ede0c319-3a4d-40ce-97de-4fdaf4cf305a", "comment": "Malware payload (AgentTesla)", "value": "41a7a4e95d4881c79a80b17cce3cc854db63e60ad334cd7d454d2aa489ffa95e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142371, "uuid": "7501f2f7-a623-4eee-b326-ac5e67f646dc", "comment": "Malware payload (AgentTesla)", "value": "e644c59e0dedfd7943c950d8f33938776be91cdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142371, "uuid": "51192383-8e9a-485f-a46a-a9124b959a4e", "comment": "Malware payload (AgentTesla)", "value": "9b8f0ec2a53c11bfcaf8e8c6d162443129fadcb3d5b8f35b9212544b12d757e38a15479e1c42d120fd331cfbbf6fd85f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142371, "uuid": "5353a25e-2e94-4657-861d-475c7731996b", "value": "77B54A5522A86E05F93E57B48730442C47F6BD17DB72DB9EAC84B0891FB37C18B1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142371, "uuid": "7bcfbc53-0c70-4a59-90ce-fc7fe5e3f64d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142371, "uuid": "c9ba69a9-b26b-4539-b920-b72ca0461ddc", "value": "24576:52XQU2ypN5ZE1XcgK4vBLsK4YxNnehPBDmIV:52XQU2yTau7qe3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142371, "uuid": "40a5f0c2-a176-4b3b-87ef-de00be589609", "value": 2318848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142371, "uuid": "42e793bc-ec0f-4f2e-a94e-7ff102f1a3ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142371, "uuid": "ba37a153-38e3-410d-93a2-7171721aa6f0", "value": "2a2a8564ad128b54843a01cd01f71ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbe4749-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152840, "uuid": "27c3811a-5a75-4e6e-8192-688d0870a4b4", "comment": "Malware payload", "value": "d75b22e6aba69659060d7a4a9e434857", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152840, "uuid": "d4a527b9-3955-4997-bbf3-5ebcc0cd3cc0", "comment": "Malware payload", "value": "41dee2a36783bde36b3205c2210fd203f5c129cf5f7e398b7daa017a3510e04e", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152840, "uuid": "8c7372c0-d730-4161-85b9-14503a4d7504", "comment": "Malware payload", "value": "afea6936b884c30cd8241770b6ad6bcaf3d50081", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152840, "uuid": "a553ac3a-69c4-4620-84c1-60cfff12bfc1", "comment": "Malware payload", "value": "550460ced1c898a9a6097e52c3ebbddb69dfce0520fa4c4828ad34be503399d075f8ce4655a45fbd9704dfb33ad82f37", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152840, "uuid": "af7e50cf-ff5d-49b1-8bc7-b88bc837beb6", "value": "D2C533119AD017C8E594CF2F2F9C993A047FDFCA78A4EDD391E28BF1110FE96A562460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152840, "uuid": "ead55805-dc62-47e2-9da3-be44b037c076", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQA:G1wwAjzIQOMK2GNKslgus10S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152840, "uuid": "efe91983-981d-4798-a859-98d9ef6870af", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152840, "uuid": "7b82f06a-c070-4b3c-8506-2289c278016c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152840, "uuid": "49820004-2930-47dd-abbf-977f8de14334", "value": "41dee2a36783bde36b3205c2210fd203f5c129cf5f7e398b7daa017a3510e04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242db741-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620090038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090038, "uuid": "073a1321-4b38-4558-a2dd-fd2adbd43c63", "comment": "Malware payload (AgentTesla)", "value": "b0db352ad95248e96a5baa14b26e8551", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090038, "uuid": "ea2d0aa2-54c4-4454-bf11-c11092783e8b", "comment": "Malware payload (AgentTesla)", "value": "41f1444194bf166f00c0b7d1736a2f3a4726b8ec9e1d7ce846d78e17594a5b59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090038, "uuid": "07564ed8-b7b9-41d2-986e-f89957b6422c", "comment": "Malware payload (AgentTesla)", "value": "9b88f427571341d403583bc0985085506ead33b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090038, "uuid": "10f1f652-133d-4096-893c-a4c33cffcc9d", "comment": "Malware payload (AgentTesla)", "value": "e8b95d5654918f740da2a0fe4d1211823b1e2dc97dcaebc129097ec75fca4fa2ad6d69bab2f8cb54b7481bbc0aea140c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090038, "uuid": "01158f51-53ad-458d-963f-f6ffbd227265", "value": "CA84BAACC49742D88F86ABB86B1F2F85014C7A6EF784A5337234A77527D2C7B501687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090038, "uuid": "12820db4-fc09-4f7f-b7aa-01a382ef57d7", "value": "6144:DvAhhlFY1o+pCECCrb31zde5kG1Z3bdDj14QV/4kkekTxLmA3JludhQMl9A9ZDFu:cATCxDDOWyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090038, "uuid": "2ce7e04e-05f1-46f9-bcea-3f5d785e3343", "value": 388975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090038, "uuid": "1a8ada6c-9246-41a5-a044-6fa8ba31291e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090038, "uuid": "002952a0-9cc5-4171-a17d-c8de0953f7ae", "value": "b0db352a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294d2192-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090047, "uuid": "01a5434b-3133-495f-94b1-4bb13fb762bf", "comment": "Malware payload (Dridex)", "value": "b2ca5fa2411275809f97aa91c34a9c20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090047, "uuid": "b21c3b36-1a69-471c-acb1-d83dd53dc313", "comment": "Malware payload (Dridex)", "value": "4205b3d95b967cd1c360b96175485d4315cd5eb7c44213950900d88a4061d46b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090047, "uuid": "ab3d10aa-ab66-4586-bd8b-6b3eb4fbb11d", "comment": "Malware payload (Dridex)", "value": "97a303f20afaee9a36c11cd84e471541e84415b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090047, "uuid": "98186286-0273-4ac1-9790-3559af20a1ec", "comment": "Malware payload (Dridex)", "value": "5352f08e0ebf8ee6861c461c1bc9bf4b336bd640d4146e90fbbedd96bcecb5950805b27009d418dff629211c66983901", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090047, "uuid": "ae189123-c88c-44a0-a83c-f80b4f24f6e3", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090047, "uuid": "f87ca8a2-9a1b-41ea-879c-2a74498716cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090047, "uuid": "49734e49-7761-422d-95ee-d6319a8b3a07", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090047, "uuid": "f504d269-dcc1-4c53-a840-e04b731a3f5e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090047, "uuid": "5dbf488a-31da-4e69-95a4-926b5b2d98f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090047, "uuid": "60feae34-11e5-489d-8a12-70191c982bdb", "value": "b2ca5fa2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df64607-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1620152842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152842, "uuid": "5e321afb-862f-41e0-b624-5b8d23971e8a", "comment": "Malware payload (CobaltStrike)", "value": "b026324c6904b2a9cb4b88d6d61c81d1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152842, "uuid": "c1560439-f1bb-4e0b-a48c-f66ad1011167", "comment": "Malware payload (CobaltStrike)", "value": "4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152842, "uuid": "0825764d-3b2a-432c-99d8-c0e2805180ed", "comment": "Malware payload (CobaltStrike)", "value": "e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152842, "uuid": "b6ee4f61-fe8e-43a4-8457-6b00fba850dd", "comment": "Malware payload (CobaltStrike)", "value": "f07020242c5eb616c1702c60774735c868bd2b9eb071660166121723126e21589e1f7f21d871003b939247682166d0ea", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152842, "uuid": "bb77316b-3433-404f-b0a8-4e5b58a0699a", "value": "3:2:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152842, "uuid": "edd398d3-422e-45c6-9911-0c2b15f6ecdb", "value": 2, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152842, "uuid": "94be571d-fa0c-4f54-ba13-75b612b5153f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152842, "uuid": "7499cd41-ba37-4cad-8828-1282a580d1c8", "value": "4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913523a1-aceb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620141331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141331, "uuid": "0071ad49-463b-42f8-88e3-57ce147737cf", "comment": "Malware payload (Quakbot)", "value": "770ec8230138bb271c449bdaf5da519b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141331, "uuid": "2ef33218-3c6a-404e-bb6f-6f2efe5fc0a1", "comment": "Malware payload (Quakbot)", "value": "43c9954c68907acc1f1a6e7d5cc90a3043f9da1c8416b079d182865abea734c7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141331, "uuid": "81edc869-4474-499c-adcf-612cae0443b4", "comment": "Malware payload (Quakbot)", "value": "21a0bde033c46eab8d42e5b6d9431f52f5c6ce48", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141331, "uuid": "61a3caf2-46e0-41c8-805b-2dc726def083", "comment": "Malware payload (Quakbot)", "value": "083c7dc0d6c58b6b1cba81a3992b171d895b88543331949a9ea890891102e3d4711dc884b57006654647c5950db53239", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141331, "uuid": "9ad7c4ed-0fe9-458b-8c2b-44c7a27c64e7", "value": "22B3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141331, "uuid": "05084c3c-6497-41be-afc3-1bd7cbae89d0", "value": "3072:1kYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:WAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141331, "uuid": "92e36eca-0a0f-4852-85e8-3352dbea31de", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141331, "uuid": "f10ccd52-873a-4971-9114-1a82179d19ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141331, "uuid": "cab2308d-ae5a-4400-8de6-65edc109e084", "value": "Outstanding-Debt-1636503299-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc57b3b-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126078, "uuid": "be922a42-15c8-4265-a683-cc672b45c073", "comment": "Malware payload (Dridex)", "value": "90acdc3fdfe77e2a000a992c5b785bb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126078, "uuid": "8df40ed3-6d2f-4e12-9746-cf07037b1d9a", "comment": "Malware payload (Dridex)", "value": "467733c1234a7fb68b52725dfedd0febaca011fc242029e89e4f2cbd07d4dd71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126078, "uuid": "2ab5ef35-ec96-4107-ae81-6f9fbea77c6a", "comment": "Malware payload (Dridex)", "value": "b23a5dbf18c3eb239eddf29a813c78fd67c47914", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126078, "uuid": "68160c4b-a96e-4819-a6e1-0c3f400635d9", "comment": "Malware payload (Dridex)", "value": "151725f1b714b8c5ef23c458949df4aa16de4ae3efeea8d146bdd648c2082223f5cacc9f50b9cd1e62e70639d6119e06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126078, "uuid": "c8222cc2-cbbb-428e-8528-b7527d97ecef", "value": "97F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126078, "uuid": "e091e96b-df6e-450d-8f4d-bb72a022f539", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126078, "uuid": "ba54f898-ded3-42bb-af56-7e0bccc47473", "value": "3072:3IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126078, "uuid": "ac8016d3-d2bf-40b3-85f0-de59a3dc2a02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126078, "uuid": "ad10b64b-e404-4b22-99a2-cc7584430c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126078, "uuid": "802ffcc2-6e1d-4dd8-b111-dafec2f998ad", "value": "90acdc3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd1ba9e-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100842, "uuid": "13f6bd41-42ad-40d5-b058-5982e24b5837", "comment": "Malware payload (Dridex)", "value": "a9c1c1eb78a6f51eb3a952b099c143b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100842, "uuid": "892b90c8-fa56-4bf1-bce7-5bc10e9a5301", "comment": "Malware payload (Dridex)", "value": "4706171a6c09fe90e22a3683d68d87fb71e64c0fbc3104088d3e2a95da059c48", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100842, "uuid": "5773c99d-cc6d-49ab-85cb-96a94a9e738f", "comment": "Malware payload (Dridex)", "value": "9838cdc7732b31e1f7165f38df522a7ca4d5b594", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100842, "uuid": "e5446808-d6ca-467d-8423-0865c39e2795", "comment": "Malware payload (Dridex)", "value": "24de1b677525817eee94a1eb5295356b36dcb8a6daadd7632cc0fa9286a6bf460e633169004df2aca760d0b5de28d4e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100842, "uuid": "3bb75225-65a7-47c2-9bfb-a0f9881b1ba9", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100842, "uuid": "460768c9-f5e3-4d18-883a-920dfffaf501", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100842, "uuid": "960e4a85-6f72-425f-8e9d-1ecb82aac1f8", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100842, "uuid": "fe15fd2d-dfda-4b6b-a41f-80a4be5b66f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100842, "uuid": "982b48aa-d13e-4edd-8c17-9c80254870b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100842, "uuid": "ea942f31-3c36-4a2c-9af5-bdd40b55654f", "value": "a9c1c1eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fea5d2a-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122458, "uuid": "8fc9c99e-edb1-461d-98c4-6d1e279abcdf", "comment": "Malware payload (Dridex)", "value": "609368a7083016dc885aa3a6aaf06459", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122458, "uuid": "abdfa170-e1ce-45b5-aa75-bc945f90d3ea", "comment": "Malware payload (Dridex)", "value": "4720fe8c55f38d29d5492f1a4e21f2dd0e179b2964a7b93e8e42b64accb29d06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122458, "uuid": "33d4cbe0-217b-428e-be08-5dbdc5f7a614", "comment": "Malware payload (Dridex)", "value": "053641d32419685ed5c9280221020ae045c21440", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122458, "uuid": "6bf783e0-020f-44a1-baf7-03769f795148", "comment": "Malware payload (Dridex)", "value": "e7e557da06d364c8a34d784a3ce2062da6248143033d84fafbe7bdc270860defbe982123ff1654a2b06a8cc80968c5f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122458, "uuid": "79d6f85e-df47-4164-bc02-d4d451560803", "value": "0FF3D088CBB3E4E6EFB3937966F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122458, "uuid": "a2bcafbf-7850-4898-84d0-fcf74dd7f7e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122458, "uuid": "8c5fa4b4-5ecf-4b1a-a1f8-c9e3628fb74a", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122458, "uuid": "dc4e8222-3726-495b-9944-99b0fbd01d83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122458, "uuid": "2256f884-22ed-41a7-8686-4c8f6a0c6a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122458, "uuid": "8b75e629-9d54-482d-a7e6-353f932f81fd", "value": "609368a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cd5951-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118898, "uuid": "7a621c7f-e98a-4a9d-9305-8772328b7f78", "comment": "Malware payload (Dridex)", "value": "4d8c102bc7e33a37c0735162f9b9da3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118898, "uuid": "010c1adc-c8fa-475c-9b0e-0d650779b98f", "comment": "Malware payload (Dridex)", "value": "47443d014301a515db4966a8469552ad3d64cb33b1a297129f2652980bc9ebdb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118898, "uuid": "d6d85d44-9f04-41a0-8d6b-43fce6369be4", "comment": "Malware payload (Dridex)", "value": "9c66a33c39b2d7897cb84272ecf74611392ca4b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118898, "uuid": "8e7548d0-07ad-43c5-9334-379c19abffab", "comment": "Malware payload (Dridex)", "value": "a8a93f67fa77c52ae5100178566a0c11fdec777d8c36b39db58ca894f2aefd96059243be139b53085436cbc5eaec15d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118898, "uuid": "2e27cf42-ba2a-49d2-bebc-a17d3233209c", "value": "ADF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118898, "uuid": "48c46364-ac03-4c15-9f2b-3a732156e52a", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118898, "uuid": "9f85baa5-a381-4dd0-8581-985ade54c444", "value": "3072:1WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:142IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118898, "uuid": "0bd9f7bf-df61-4ab2-95c4-e199058c9368", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118898, "uuid": "b6acd1d9-11fd-4691-b93f-916fadd3865d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118898, "uuid": "f5990008-a855-4a34-81de-de9966fbf9dc", "value": "4d8c102b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74848ba9-acb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620117661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117661, "uuid": "d2225ad0-5da4-4449-9e47-a42bca6c6f7f", "comment": "Malware payload (Loki)", "value": "e59b651fb8b412862448ce705e4e0f3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117661, "uuid": "52be7468-820a-4adf-85ee-4a28fc04db09", "comment": "Malware payload (Loki)", "value": "476d5d7615d297e6946a9c4926e0490e13db0cbce9fad9a97d3d4175fabff511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117661, "uuid": "96bbda3c-5702-4bfd-bcb8-657daa4119ad", "comment": "Malware payload (Loki)", "value": "1eafa01d913d77014f368a45e083239f0b8b0c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117661, "uuid": "95718892-ffa6-4f83-9c56-b9e8d443df0a", "comment": "Malware payload (Loki)", "value": "799f5c5a02ac22c5a7b829ed9aaa4ade64b22bf01b8e04c5a7fa6d27e23138b026a649ce13c525a7f191973125cce2d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117661, "uuid": "5e9bf0b9-0d91-456d-b48d-77e23d2bfdda", "value": "4554CF6D3250D096C4F13E74C857E107EB9DAE252DD5025F3B827BAE263109EBD2722B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117661, "uuid": "41b3e036-085e-448f-abb5-439d2fdd52e3", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117661, "uuid": "7507e514-89d6-4748-9e62-fab7d5156bc6", "value": "6144:iPXJMnVVKqmeCGWzICZdTzMMfZ2OtWAgq:UMnVV+e9Wz5Z+eW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620117661, "uuid": "ac1544b8-5d2b-42d0-bdea-55fafebbd7bd", "value": 291029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620117661, "uuid": "3aad421f-2572-4a66-a949-086d6f608f8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117661, "uuid": "3ca8101a-dcf0-4d95-bf73-e2e334a1c5a6", "value": "E59B651FB8B412862448CE705E4E0F3D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b24e195-acfa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620147790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620147790, "uuid": "e35e4f2d-6675-4448-be5e-c4c0e7922c77", "comment": "Malware payload", "value": "93e3e9ffc2305676017bcc6101572494", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620147790, "uuid": "68b100b0-a0ed-43b7-94e6-7669ff9b49ef", "comment": "Malware payload", "value": "483a3f7f5ae2834deffedd9b055a9aa76db99b6395bf6126536e12811bbb9675", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620147790, "uuid": "83b5c9b3-f6cc-4103-823c-023e026681f0", "comment": "Malware payload", "value": "63093d477b993aa925554b2104ef433958336829", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620147790, "uuid": "0a5b5dd3-37fe-45f4-9bbc-1c75ec5b4a36", "comment": "Malware payload", "value": "9c71f24793fdd25cf7f06fda52f84a8fdc8f2d31a452f217aa6114c42cb885c22346fcfdb3d126235e1fb505f2fc7fe9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620147790, "uuid": "39c2d63a-8500-4c60-a09e-cd7654eaf38b", "value": "C1253B6832A81BD1F27B5FB663DA1C0183B92534693EE51D4FA113FE4963F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620147790, "uuid": "e89f735b-2697-4a47-a712-dcaabef3d623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620147790, "uuid": "ed3f45c5-bd01-4c1c-9fef-802d5b844fb9", "value": "12288:Cj+bB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMaQ9wLcmFH:6D9wLzsoLAazjT7lT6KmSzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620147790, "uuid": "ac596490-74eb-4518-b96e-ff2a9b7857fe", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620147790, "uuid": "776d4b6d-3565-4260-b32f-535f045c0664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620147790, "uuid": "5e54f3d2-78cb-4e88-ab66-7b6609f3a056", "value": "SecuriteInfo.com.W32.MSIL_Troj.ASI.genEldorado.27642.8757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6929100-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126442, "uuid": "d21e6768-f232-47f0-b452-990f9b5e5c25", "comment": "Malware payload (AgentTesla)", "value": "bb09fb1dc62b892bee5ace4654b16797", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126442, "uuid": "81c8b2f3-9a08-4b54-a282-49354082d832", "comment": "Malware payload (AgentTesla)", "value": "48acb7012c82d4e0c078c2a886443160afd62ab36611901e2655e22d403ed0e1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126442, "uuid": "b643697a-33c4-4792-a8de-b66fb417b530", "comment": "Malware payload (AgentTesla)", "value": "1f4687b6b52affaaf4d1003c3293c97a5862586e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126442, "uuid": "7d8bc0f6-47c0-462e-b626-e9930c1fc50d", "comment": "Malware payload (AgentTesla)", "value": "740561ef1cee2a446719dad8ae3766df938eee82223867110c48b0b3c268895ca88fb07d13fd4ac5a933ed79ac284d12", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126442, "uuid": "82011739-a3cb-4cf1-b8aa-3b9117fdc419", "value": "77C4239398A78152C03CF84158B69B9BF91FC77EA94DE00A13B6BEE7B5744818C12E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126442, "uuid": "7e6ba8d7-03ad-4afb-b00d-f6e6edf16089", "value": "12288:P8L1aMy5ZnUVmAdPz8EYivOOF6HTz8f4WJwbVu8NJM7oc:2aFU8Ad78zivOOeTwgWwV5NJM7oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126442, "uuid": "f2dc4291-41b8-458d-9598-98a0eb713f76", "value": 559534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126442, "uuid": "89ec6984-dea6-4cd4-9b5d-ff88e5d2209e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126442, "uuid": "e4f73ea4-de54-4ef8-ae58-c507c251bc1b", "value": "ARIX SRLVl (MN) - Italy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9176c74d-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095805, "uuid": "77a39be8-d3e2-49e4-ad18-931410042685", "comment": "Malware payload", "value": "879052fe68f7a5e84ebb27302fe4c868", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095805, "uuid": "9ef67059-c7fc-45db-8d50-253261744376", "comment": "Malware payload", "value": "48b54a4880ba7787a70e9a2c1e45d7eb9446e2d007bcd224e17efd16531bd827", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095805, "uuid": "bd2f50e6-9577-4fb8-a9b0-5ce49f895d1a", "comment": "Malware payload", "value": "2f3995863dcdbadb52f16856cacc15715a97e6c7", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095805, "uuid": "351e3694-142e-4aab-b891-52edccfc0855", "comment": "Malware payload", "value": "1c65fd1a80b04fb9246b2263aa1be6691784e1fa2777c035d99c0d5ee36d00c9fc75401f94692c7f29e355db66fc806c", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095805, "uuid": "10750271-dbd2-43f8-9d14-be829b13c52c", "value": "99E533E4C5C23640A6AB2D1DC792C86D0C13EB1FEEA68ED634CD4155E41E8B367E9CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095805, "uuid": "1e2b6fb5-1da7-408d-aea3-fcdc27d348ec", "value": "98304:vDp4Rll4NLkfpcqUEarJAcAqJAd/D4FaQaM3Q+m/PV:balwOHUVAcxqm3Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095805, "uuid": "68641a7e-305c-4bb5-9352-0da35c7b6f1c", "value": 3204449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095805, "uuid": "72d78f4b-7d98-4f50-bf3d-faac962d9998", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095805, "uuid": "345442c6-9736-4f1d-aaf4-29550e09605c", "value": "AstarothSpammer cracked (2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc76f0d5-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153457, "uuid": "eac8ce8e-147a-4a2f-a522-283dd3fd3e5e", "comment": "Malware payload", "value": "3981d9edd959eda3ca576631a313a695", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153457, "uuid": "5e0ba353-b6e4-4f2e-b40a-a19b82a46823", "comment": "Malware payload", "value": "48ff5a739a6704083b5523314e1d3e8c1afefadbf423b19a3aa7e90476359d8d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153457, "uuid": "a46523c8-b046-4f35-a775-4b0fe4b14d08", "comment": "Malware payload", "value": "55c4dc417effaa610fe48b47a41af4eb91cbf8cf", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153457, "uuid": "5ea56269-af98-4d6e-aa52-e0e5534b9c62", "comment": "Malware payload", "value": "35a78af17095cd7a2471ccf83cda1d6b7249f6dbb767c5f651bb62fddd53bb0b431e1eb8d4da0fda5b53e3d0e60a4fd1", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153457, "uuid": "7c0b7727-e039-4408-8b89-697222145b3d", "value": "01A1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153457, "uuid": "399bdfdd-bf88-4c56-acfb-e9cf74768337", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153457, "uuid": "e73fc0b2-9261-453a-b738-c70687b295be", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153457, "uuid": "ac6c9452-c2e6-4662-843d-11e73d3a30a7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153457, "uuid": "34475fe5-7a1f-49aa-b590-d4e0e78bcd46", "value": "48ff5a739a6704083b5523314e1d3e8c1afefadbf423b19a3aa7e90476359d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960e6d36-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142198, "uuid": "f7799ef9-e477-4a68-8dd6-2656888f4c6d", "comment": "Malware payload (Quakbot)", "value": "87b3f4a29899b54763d5a73a7e0483ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142198, "uuid": "9d95399d-82e1-4d4a-8eb8-12f95fecf99b", "comment": "Malware payload (Quakbot)", "value": "4920b2f647aa16bd4e806c88a1af679fbfec0c6790372ceb878efa787a5e55bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142198, "uuid": "a83a8545-0da1-4e66-956a-2d6993801284", "comment": "Malware payload (Quakbot)", "value": "75dfb32188c588f1e24abfc8af53f138740aa7b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142198, "uuid": "1620ead3-a20b-4a3b-8e17-fde54b1ca9c2", "comment": "Malware payload (Quakbot)", "value": "ff3cf6fd508f08a2838ac8a2f2d18f6cef9938bd6accf08d35d3a16bfff1f93473f61f3533b88b138a1a8030c702a5a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142198, "uuid": "b4bfb872-69f7-4e39-b6ea-a049794f27f0", "value": "0FB4BF7CFF668973E1142FF1A3C35F940A53A9D175A0610E42B11F6E3DA93D5383AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142198, "uuid": "03168894-c2b6-47e0-80e8-bfcfd4adc6f2", "value": "d4b10803acf444b49f2549bbf867a9f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142198, "uuid": "1a748fc8-e83d-48ae-9f6a-7f59e54a39fa", "value": "6144:U0LcdcjuQ/9zoaV3EeVHq/Ca6VbrdRNXh:njuS9zoadEYHq/CjtNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142198, "uuid": "4cfe9c08-c18a-46b1-98ef-7c5fb25f07f0", "value": 497473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142198, "uuid": "0189ba99-c93c-40de-8fd2-4ae6655bb92d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142198, "uuid": "7350eec9-0e85-46c7-8d1e-d22628d53bd2", "value": "87b3f4a29899b54763d5a73a7e0483ea.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90400a93-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620111694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111694, "uuid": "137ad222-b5e0-4d91-a640-fd61fd621fe0", "comment": "Malware payload", "value": "67cc6861079537f96af11757751af777", "object_relation": "md5", "Tag": [ { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111694, "uuid": "381bf469-74ca-448d-8476-ef5ff234cd70", "comment": "Malware payload", "value": "49afcf72a04f34e09de9cd9402fea5886d957e2654f668566fd876355b6bc896", "object_relation": "sha256", "Tag": [ { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111694, "uuid": "aa89a0a7-b609-490d-9710-aeea9207b4b2", "comment": "Malware payload", "value": "b4a05c381df4f962b18ee02a99657c5e5f4df1e0", "object_relation": "sha1", "Tag": [ { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111694, "uuid": "0fd5b2db-6971-4eb1-bcb9-53e9ed1b2e62", "comment": "Malware payload", "value": "9ee4625ca86a39b2a95c6ea3d65c47208ac9a80e6107f23ab892de5af9ab0a9c8e0c23919747aabfead4fb91aa0f7368", "object_relation": "sha3-384", "Tag": [ { "name": "KillWin", "colour": "#756287", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111694, "uuid": "ece3c33e-728a-44a9-9116-3100c85e8614", "value": "FF225C0B7F510833C7940B7821379992CE76BE311B5127D767B70B5ACE640D6D83459E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111694, "uuid": "86828e98-e9f0-4191-8275-fff5913cdcfb", "value": "de32e901e38015c95212b1f2d1397a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111694, "uuid": "9a537097-22de-4416-99b1-32d80e0f1136", "value": "192:GziMcUygl5BEsFEuXHkxFFgBCIkoaEYbwRGNb3oN7E5pz6h3W4O:GJcnI5BEsjXHkxXgIIk/BwMYN7E4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111694, "uuid": "0fc872e1-709c-496e-a320-51d5db9e2cec", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111694, "uuid": "9b9f672b-9b63-42bc-bb5e-d38d0ca894fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111694, "uuid": "d4371b15-1553-4890-b432-ef204ad26f34", "value": "KillWin\u75c5\u6bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fb9f13-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093697, "uuid": "3fa017f6-2f7b-4062-92d7-8c13b9123872", "comment": "Malware payload (Dridex)", "value": "a3d2b5964911dcd9c927d19793e3fb9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093697, "uuid": "bd098ed9-5d69-46bf-ab63-3ced65d03301", "comment": "Malware payload (Dridex)", "value": "4a7abfbe7b3933dd3490627a7cff06bdb5e0f8f888189125db52ac395ea77846", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093697, "uuid": "f02a38e1-b745-46f3-b038-0f6dcc3dcd63", "comment": "Malware payload (Dridex)", "value": "4ad6e5f43c1a500d479da05b35bc5a61f432643b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093697, "uuid": "3199e334-c158-46f1-88b1-d85a861f10d9", "comment": "Malware payload (Dridex)", "value": "f07765b642e05da4e79d8dfe7459cf99e6712ef7443474b00a6ab777b2202486cc99b39c6a98081f3fa5203b0e1208e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093697, "uuid": "8f27316c-26f4-4fb9-a91b-6e95eba02b49", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093697, "uuid": "f7e56c4f-9d5c-46ca-8c29-c2ac78859dd3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093697, "uuid": "034c3460-3975-4d78-9014-13b5f842719d", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093697, "uuid": "f71980e6-1ea5-4e21-bf2d-f607f12da63a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093697, "uuid": "50084226-4c52-44e8-8b33-ed69adc153b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093697, "uuid": "3ed471bd-5d2f-4278-8c36-da36cb82e687", "value": "a3d2b596_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88db2f6-acea-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620140941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140941, "uuid": "8d242ac4-8488-4cf8-bcf4-b1632a0b3dc3", "comment": "Malware payload (AgentTesla)", "value": "7eb650183d4d3a9c79d897d11d54547d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140941, "uuid": "e0632430-945c-4364-88be-743606c6fe9b", "comment": "Malware payload (AgentTesla)", "value": "4a97062cd26aaa6430826f03ab22cd25668218b53b34c374e885e5820ee264f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140941, "uuid": "ee637343-7cf0-44af-9963-e122914f0f6f", "comment": "Malware payload (AgentTesla)", "value": "7a4f83f1fcacc6402032bdc309dd91d3e36c2549", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140941, "uuid": "e982e091-630e-4cc7-b6e3-bb7fc27102e7", "comment": "Malware payload (AgentTesla)", "value": "afa3cd71f7a63aaa3e9544b8a4a0afbe7e650efc1dffcce82388615e7d2744f9673e757d57e1a34a8e39711af42992d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140941, "uuid": "7caec064-aec5-438a-9b49-aeda9868c422", "value": "92A4AAACC49742D88F86ABB82B0F2F85114C7A6EF784A533723497752BD2C7B501697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140941, "uuid": "3922a902-3d82-4153-b8cd-2258afe69701", "value": "6144:cmirYbhPKcwAgsgx+r+VcdQ+Eg2AqZhp40fbLV7kMZltgsmyoYPdi4VP8lQ7m6tv:cOHkYyLbwhZOgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620140941, "uuid": "51b3a968-6094-459c-9302-1cf26c644e5a", "value": 456572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620140941, "uuid": "2aca54ca-3d58-42e1-b134-a110050eb325", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140941, "uuid": "e6d31878-0465-45d2-9f98-c56692d9633e", "value": "PO_001412.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94356c70-ac8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620100534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100534, "uuid": "4c278f3e-168b-45ed-b661-80d6a179dc26", "comment": "Malware payload (Loki)", "value": "c59ebb166d97d070ab571149524a1a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100534, "uuid": "d7d34f37-f2fc-41d8-b5dc-341b0e10fbf9", "comment": "Malware payload (Loki)", "value": "4b6ee615bf81f53ae678c3430249da8578e2fd2d2026a36ec3993cf8fbf8f70d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100534, "uuid": "824c3733-6d4a-4468-957b-17ca50aa0d56", "comment": "Malware payload (Loki)", "value": "2b1dc28dc388dce8b0692a66b8a2c60e720c3235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100534, "uuid": "4c73262c-9e60-4525-a359-2917b3538768", "comment": "Malware payload (Loki)", "value": "9b072bc6553acb55895f8562a9f737062903d61f526344d0b44af8a371dd42a8c49e2ecbb66ece80cd801340fbf74c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100534, "uuid": "5754589e-ca1b-488d-af0c-140698edafbc", "value": "5AA53B5122986E45E93E57B48730441C47F6BC17DBB2EF9EAD8470891FB7BC08B1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100534, "uuid": "af1d6046-b969-496f-af90-fd0629d36317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100534, "uuid": "43fd97f9-f98b-4350-b11e-ab1a50ea6295", "value": "24576:EI9zE6KzhI38iZ3GILfZE1XcYA05opWME40kLpChk6lPBDmIE:EI9TKNIMiZWQfauY2J06pChfzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100534, "uuid": "690a982f-8cb3-420c-812e-aa9928a189a4", "value": 2231808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100534, "uuid": "fefff1a1-063b-49bc-baf2-e508324803a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100534, "uuid": "4020d2e9-ea98-4468-b5cc-3ed6510ad82f", "value": "c59ebb166d97d070ab571149524a1a84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd2fc79-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095178, "uuid": "46f6fc07-93b9-4882-9222-473f906a214f", "comment": "Malware payload", "value": "b87beb7264632330cdf644b604f240ac", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095178, "uuid": "c1b387e1-01de-45e7-b8f8-db4ff67861c7", "comment": "Malware payload", "value": "4bbc62296e87ffdc3b237de135f2f2d659c93e70d053e2da1dfdeec3c130d4dc", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095178, "uuid": "8c43faf6-4a31-4dcf-9aa7-d891de47882f", "comment": "Malware payload", "value": "f11743d18ef90a3f70792cb1ba26097ef9779c60", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095178, "uuid": "8080da3d-9578-4002-9b83-675201ec8d43", "comment": "Malware payload", "value": "7ff67925587bdb39d96225d52be4633f7e4aa01677e965dfa3e6b96c394be1072772a44d3000b553441aa2176d06b84c", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095178, "uuid": "69d3496e-da9f-40b8-926c-e83093ec15b8", "value": "FA552203B90CCCEEC7CA967D1C94EF684718E66C5811819236753DB7FAAEF831C1A199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095178, "uuid": "1560b1c0-12eb-4b86-86c0-417be2a5e3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095178, "uuid": "efa1ebde-e47b-46a3-a1e4-b0bb3d5b3e55", "value": "24576:bgvg7Lt5NZf9B2qJPxXQFAAkrzutkGz3k6yCIM0En/:bgvcLtzZFXJJXQFAAyzutkSCB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095178, "uuid": "399a3132-c899-4ae5-bb7d-9d82e862316e", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095178, "uuid": "595182de-bb42-4348-8aa6-ce6f81164317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095178, "uuid": "88cb6726-c360-47bc-af09-b9431d459f05", "value": "AstarothSpammer (4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0e4db2-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Osiris)", "timestamp": 1620120412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120412, "uuid": "981fa730-961b-408b-b622-e87f751855a0", "comment": "Malware payload (Osiris)", "value": "1cdb3fb1f8aceed1ebe8dbf591f3d8db", "object_relation": "md5", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120412, "uuid": "e64ccce2-ac8f-42c8-a378-f535c6cb19f1", "comment": "Malware payload (Osiris)", "value": "4bd4ccdaefa72f9326ba93542ddc447f6df1452a6f626a54d43c3a4c37e23968", "object_relation": "sha256", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120412, "uuid": "57b7df8e-9927-4e36-884a-daa20e6e42e2", "comment": "Malware payload (Osiris)", "value": "21bd149cf8eec05f453665b888aae9b2b8e62320", "object_relation": "sha1", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120412, "uuid": "54a62f67-1d9a-4c65-8a0a-687d93d58461", "comment": "Malware payload (Osiris)", "value": "ec9404cf5611e571b690b899ba1b9c9501d70080d196fa39ca678ab82ee369c51c55d8dbc7ab818e46ca46e07a8a16c8", "object_relation": "sha3-384", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120412, "uuid": "29fc0a9c-a97d-4dd0-91ed-324d03d1dc16", "value": "F094BF22F581C036D2B102B0CAAD7F3B97FDE525033599D7B78809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120412, "uuid": "1de6c6e3-fc74-44ee-a9a4-cddbfc3c36cd", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120412, "uuid": "30de6942-36e3-44bb-af59-446b9a63b13e", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK98YdTTsx/SA/WegYfdNbrqns:rXh6XcBXo8TsL8Y8mWdTTySA/DrfdNbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120412, "uuid": "de10344a-9744-4a85-b8e0-d3d2aa7bade3", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120412, "uuid": "9a9f0ed6-9f4e-4811-9449-bb403fd823a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120412, "uuid": "15db92d6-03ef-469e-9b2e-9249f6b8279e", "value": "2bb0000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cc869e-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133425, "uuid": "91616373-ea2a-41e3-a689-eaab1971c830", "comment": "Malware payload (AgentTesla)", "value": "95f8e935279c289154b784d37bfdbae7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133425, "uuid": "d114d38c-ee74-4b54-be32-e22c1b7f928b", "comment": "Malware payload (AgentTesla)", "value": "4caa64908b36893b18dca45402ee03d15381c605b6c0f07497f209f73a1c038d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133425, "uuid": "0507baba-b595-4256-a8a2-01dd0f488763", "comment": "Malware payload (AgentTesla)", "value": "3e711dc23a09ef291f95b7e06c9ba708e35dbe95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133425, "uuid": "58c35cf4-1554-45bc-be7a-12b3c89e011f", "comment": "Malware payload (AgentTesla)", "value": "aae93df51ff5732ee6bd9a7edd3045809f7c1a5d528f6bc40c9d0e05a5c83a4c68ca0e1ba9ea24ca9496691a2c75769f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133425, "uuid": "268a744a-4c19-4ea1-81a9-6b3a362e632a", "value": "1206AEF876047DE62A6F536BCA96ACDD13B617239ACBA4CD806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133425, "uuid": "55d945c4-ebb3-4e53-b07a-9a3fc7bf7b75", "value": "24576:8JqJ2bmbpoTgKzUVwa9JxQBLEg7YXxDYScj4alMWU6ovT+pG/UJBnaweDg70HIVL:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133425, "uuid": "4c71713e-9dbd-4864-9350-aaaf0aec3f1c", "value": 3965686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133425, "uuid": "9cb0b17b-072e-4b6a-b9f1-384776377a8b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133425, "uuid": "750716e1-5d4e-4e9b-ab8d-9ec865de3ac1", "value": "LM Approved Invoice-04-05-2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b1283b-ad17-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160314, "uuid": "06fd642c-ebf4-4625-8fb5-946993625830", "comment": "Malware payload", "value": "8fe7ace06aa60365ec0bda67df21fb2a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160314, "uuid": "7e2c9b95-33e8-4a26-9992-90539e549389", "comment": "Malware payload", "value": "4d1c21b55441b7c1ebf70bfa9907267caad81cb0f7768de319125d5de8376322", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160314, "uuid": "5da097cd-5d0f-433f-8101-57e842be7668", "comment": "Malware payload", "value": "69bd76b2fbb11cd7c1a3da53fad3cdfa97bc2236", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160314, "uuid": "84c14a02-aaa3-45f6-8737-1592c56f2f9c", "comment": "Malware payload", "value": "28d7cbaa45a1293c1211cf0c4e6e0bc42cb7d8c229f1d34897b1a567aaf55c6e5ddecb567bf2deeb73a51eb9e5aba300", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160314, "uuid": "76f01641-70cb-4e82-9d30-2ad9f54e303d", "value": "3361A31AFD47D15CABB5236BEDD78A22FF1B401B5DA3100876ECC2451F20809A7ACF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160314, "uuid": "b79a3f77-a8a5-4fb0-8cb7-e32aad014cd7", "value": "48:AxYwJckjOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQdy:NQHWChrffoypvK0elkEYZaM8zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160314, "uuid": "e973f460-3045-4f60-a065-c0cec1233883", "value": 3210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160314, "uuid": "d4e243c3-bcf7-411b-8d0c-b603a72e4971", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160314, "uuid": "31137c34-cd65-4a98-b642-a736b7278484", "value": "wCNaSHTi.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca777d89-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122530, "uuid": "49bc41a1-dab2-4ec9-b39e-d1bba86366d8", "comment": "Malware payload (Dridex)", "value": "ff00ef0f2a4a31e29f4c59fafe71f9ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122530, "uuid": "fbc37308-7752-4c9a-8768-f08f84ee264c", "comment": "Malware payload (Dridex)", "value": "4d286c997361e3e2e94831c322a7e5fbd73e9a3905561e2466301e8a41173e24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122530, "uuid": "d307bb36-a96c-4a49-bd5c-c35f93e2cab6", "comment": "Malware payload (Dridex)", "value": "4a99d59c47904aab85f3d54a52421dfb166ef838", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122530, "uuid": "7e8b4cfa-49f7-47a9-9a11-54f04221cf4e", "comment": "Malware payload (Dridex)", "value": "d889c9df6b8c9da520cac58f4133a16746bc399d423f9ec64d223f546c126283c5d1986a2420721f978db4f8f7e0cb5b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122530, "uuid": "739bc203-dd28-418a-97fd-bf4cb4260a50", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122530, "uuid": "d2993a07-cbda-4a02-afd2-76f541ff5347", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122530, "uuid": "7041fcf0-aeb6-4b24-9698-e580bba81497", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122530, "uuid": "f17ce581-e953-407f-906c-0691f1d84e4e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122530, "uuid": "4d079a15-fe17-459d-9049-c9c372deaf78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122530, "uuid": "93780fcf-3f06-4151-b2bb-4ba6782c11a2", "value": "ff00ef0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32610c49-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090062, "uuid": "735a2222-36bd-40dd-872a-5431207aee23", "comment": "Malware payload (Dridex)", "value": "17cbbef93cba0b9b6a20fcd9df2ae6f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090062, "uuid": "6eec2305-84b3-42d5-9c4d-b57ff7dd928d", "comment": "Malware payload (Dridex)", "value": "4d48fe02ed313bb8097efc85818db4b3c776604d581cf60968ef0d48fef19210", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090062, "uuid": "2099100a-9420-4e87-890e-4db0a2e1b948", "comment": "Malware payload (Dridex)", "value": "d962dad4b121b709c9f0e14bfbd0cae0ed458848", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090062, "uuid": "a2207365-7436-440b-8c64-3a025821add3", "comment": "Malware payload (Dridex)", "value": "f8c3b79913e6c211261a9b8c2d460a89ef594aee7c4b774ba6ed06687edf0407b581efc7b58adbfb2dd11c3cb923bc59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090062, "uuid": "8dbd9c61-dffc-4e5c-8c5c-7ed56e08e750", "value": "75F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090062, "uuid": "22980870-7b2e-4d6b-aff5-0197ad63633d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090062, "uuid": "f7e6cefe-1de9-4cde-85f5-7919fe987edb", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090062, "uuid": "17dced3b-cb5d-45e9-a5ac-de06ff188351", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090062, "uuid": "e83d7696-77cf-4683-9267-d78632a6312a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090062, "uuid": "199931aa-e0d4-498d-84af-db8d131930bb", "value": "17cbbef9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eea065-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119061, "uuid": "d9ccba11-f3cc-47f0-a3ab-9bc8a44c93e1", "comment": "Malware payload (HANTA)", "value": "188a6172bcc72b12a6b2aace45f2812e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119061, "uuid": "28f458cc-694b-4d7c-a77c-0036533482fb", "comment": "Malware payload (HANTA)", "value": "4d86207c8b1552b199903ffa2db244417369b657130db6be924b2ea2a42b28fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119061, "uuid": "87a77866-4565-4558-bfac-4f68868491ef", "comment": "Malware payload (HANTA)", "value": "37e802e625ff9c76f176f1ca1646c7f7eb1b24f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119061, "uuid": "d1534051-b5da-4b2b-9462-507a056e5138", "comment": "Malware payload (HANTA)", "value": "1e3ec94327579857b678e248b1b1c68d2d445b6c9fba0e73828936e228e9d5d03f9059ae9b9e2f641566ea63246cd77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119061, "uuid": "0b2658b6-7c0c-4b6e-9aae-7000fcedaadf", "value": "58050277006191B9C5592330F07A0F4776ACC6391581F598F04FA2EADC0EBAE4EF97A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119061, "uuid": "849b2cbf-8463-47d2-97a8-340dd02681fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119061, "uuid": "c6f3c524-2ec4-4a9c-a993-23a73fd08905", "value": "12288:Q3KOHdRQZmlKTb6XoAV9DcDgFijHGmJr/8XsLIFLsMIVoLX6Ws4mJimS:AKkdy6yKYHGmJrVuYMNdm9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119061, "uuid": "fef4bc45-2b81-4ff7-b7e8-f20793ca31f7", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119061, "uuid": "e367db85-fe64-4aec-a106-9cfa0e01f1f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119061, "uuid": "02ad3252-989a-4790-a9df-d7c4f8adb1aa", "value": "188A6172BCC72B12A6B2AACE45F2812E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f29c119-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152844, "uuid": "5026ec86-0f90-4054-9527-045a55db948c", "comment": "Malware payload", "value": "774245660da2a993f9ab6b0b866c3c46", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152844, "uuid": "06467c7a-f86a-4a0b-85d7-4b2bf3eb7056", "comment": "Malware payload", "value": "4d863a615050d71f6ce00f9f49b747327c057f166fb4ca43cb27d6ebd2ee6204", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152844, "uuid": "5efde152-08e0-4d83-8c87-1f5d8f6a78d0", "comment": "Malware payload", "value": "47ade10315f3dd47364a6fcc8f14b5cffe46a236", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152844, "uuid": "249b3fdb-834d-4235-8e12-3469e1df9e27", "comment": "Malware payload", "value": "38a10fc545f5a0b68aa615c6bc4eab0d955b636345f5abfba73c2e16047e7249e08bbf94706c097145fe43ab27a7a964", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152844, "uuid": "d4141c8d-251b-433b-8331-7d95c224068d", "value": "02A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152844, "uuid": "268f5b6c-2912-4f93-a3cd-b1b82808ce75", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152844, "uuid": "601a62b5-2ba0-4188-abf4-7051e6d32f08", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152844, "uuid": "8da4f0c2-83d6-4f3d-bfe4-5a43e4a5086e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152844, "uuid": "32309a4c-ae84-414e-8b7e-b9edc2fc7bf3", "value": "4d863a615050d71f6ce00f9f49b747327c057f166fb4ca43cb27d6ebd2ee6204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6155c89e-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152847, "uuid": "d18bbb72-89a8-48e8-90a9-9cbbe676f8fa", "comment": "Malware payload", "value": "63d6cd74a7cd01bf3a3921c36e90237f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152847, "uuid": "83c71bd0-59a7-4819-85db-6a8e16121d73", "comment": "Malware payload", "value": "4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152847, "uuid": "b79701d3-356d-4950-94c7-73efb6a9ec75", "comment": "Malware payload", "value": "f697783da228c7787cf1c6a67a10a8c065d6aaa7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152847, "uuid": "25e66f1b-f38a-49d7-ac1b-214dbaef6ed5", "comment": "Malware payload", "value": "f4d240ecf72a2e143792416a9453957bf07adfdf52e1582c8aa2744a25d21909ea339af453212787492e9a95841868da", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152847, "uuid": "371496cc-8bce-4bfa-9772-d7cf1ef381a3", "value": "FAC45C06E243A2F7D82705B0128BF7BF4630F63584129DC6B7949E5AB9339F26A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152847, "uuid": "b42d446a-6b52-46af-9327-3eddc494202c", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152847, "uuid": "1d3b334f-7f0c-4306-af97-734baf4e1053", "value": 562240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152847, "uuid": "f19b7cbe-513c-436c-b8f6-8d4464c5d970", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152847, "uuid": "84574860-58d3-4ad8-9576-a98a63acef67", "value": "4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ae0299-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097290, "uuid": "91b15fae-be62-455e-a504-2f792cb28abd", "comment": "Malware payload (Dridex)", "value": "110a0d7a460022b51b25385c121acf96", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097290, "uuid": "53f0e115-fcc7-49d2-b4cf-1a302e4ff5dc", "comment": "Malware payload (Dridex)", "value": "4f100233073a31c53d76eeb304f873cc4d08ee648d39c5c300e53ab2bf5b4111", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097290, "uuid": "cf0f2e70-8f61-4285-ae77-60420361acfa", "comment": "Malware payload (Dridex)", "value": "94b01a8e70266548840d96aa45d53ec700bad57e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097290, "uuid": "450acf46-4acf-4d30-8ebd-ca87342c27a2", "comment": "Malware payload (Dridex)", "value": "59873eb5d5a753fe217f87c66fdd637a1f74887ed048dc1e444f6403ec7c43e00cc4be5462f5235a403128a2615ec436", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097290, "uuid": "11509bcd-b152-470f-868e-1ec56d38d93a", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097290, "uuid": "11c69870-65ae-4f92-a076-b0e0c235d0e3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097290, "uuid": "28504841-7252-416d-955b-68e31040dd57", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097290, "uuid": "33299d42-1fb2-4337-850e-19137d49ff94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097290, "uuid": "c96ccd61-89f5-435a-b1b3-c43ff17b56cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097290, "uuid": "8194b416-766f-4694-ae35-5a30319fd986", "value": "110a0d7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628667dc-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152849, "uuid": "0f90173a-c059-4a89-adbf-40da4df2380b", "comment": "Malware payload", "value": "a7c0e8c5d58e1e06723c23ca97558b54", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152849, "uuid": "8ead8d61-e5e8-4764-863c-ebdd582de960", "comment": "Malware payload", "value": "4f18e06391a66b185b77eff92cb255b07c604b1c442dc96f1a0a9c7ec9343262", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152849, "uuid": "242f1402-bb16-4685-ac67-33ff3fbac328", "comment": "Malware payload", "value": "7175efd81821ac1ffb8f2ba50268a0e36ca1ae7b", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152849, "uuid": "5d82460b-6473-4f31-a595-f96ba891d052", "comment": "Malware payload", "value": "c166c2bdc654d50cd8ec687b1038990542a5be6fce7ac5d8a6b2ad5c662ec1285dc7f5052be23e5f43a3d6a96afff2b6", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152849, "uuid": "89d4c871-51ed-4a31-93a3-1d864aefc1a7", "value": "A53195CA22A14EB16CA4F92773EE855934D4F9D719CBAF582CED3CFA448DE047010693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152849, "uuid": "0b6543e9-f753-4e2b-9f15-70099368c8a3", "value": "12:q0FOYrV0FOYV0FOYoIc43fX0FOYWeekX0FOYsk0FOYJX0FOYj1FZ0FOYAEX0FOYY:vP+Kpc4kqasC1s3+kEsKEJyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152849, "uuid": "b6beb886-e9f1-4907-aa38-9b8d579ed146", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152849, "uuid": "d8d9ca29-1bfe-412e-bb6a-49734ddd6736", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152849, "uuid": "9283e74f-4490-45ef-ae60-6d3bc9df5b7b", "value": "4f18e06391a66b185b77eff92cb255b07c604b1c442dc96f1a0a9c7ec9343262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b91f97-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152855, "uuid": "84110688-9a6b-4f59-bef7-50632bab0cfa", "comment": "Malware payload", "value": "305ad7baf03bd498146de2273a67fbdd", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152855, "uuid": "47977ce0-e895-4b2e-90f0-a785fe618e0f", "comment": "Malware payload", "value": "4f47d3734e3373f06ed7bd1a16f2cf6eaee5c3bef13460ed70f536911bad87fc", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152855, "uuid": "edbbe4df-99db-409f-acf1-aacd58dd555c", "comment": "Malware payload", "value": "6ecee7cba500bc82cff94626ad9ff6fe0b021503", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152855, "uuid": "86a4dea3-6241-4672-a1dc-fc621f792cb0", "comment": "Malware payload", "value": "9eadf7175577cc48f591a2d6136ac0a78f95aa9daaa696753e8a2f4f19815e7d666f59f915ca3560e31b42d96b6da88b", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152855, "uuid": "d7b7dc40-2cdb-4461-bbfe-ace8631ba3e9", "value": "D435336AB50B6493F8A42DD0DE05D23A6518CEFAF5C68FB4F5708D0123BDD4A6F9C812", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152855, "uuid": "f4edfcac-1901-4756-aff2-442dd08f5a37", "value": "24576:l1+oecc8g4Wk6bJot8tKQIDT6ym9EkHZYxIFvGi1wlU9x3:l1UdkOgGKlJkHZrZ39x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152855, "uuid": "b33bd28d-eca0-4a3f-a77b-f5ffd7079e0c", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152855, "uuid": "abe7e7f8-72a6-4973-968d-31f871b937bb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152855, "uuid": "f8b706fc-7777-4a1c-8c7a-18c621746f2b", "value": "4f47d3734e3373f06ed7bd1a16f2cf6eaee5c3bef13460ed70f536911bad87fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ea06e9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152857, "uuid": "cf1638fb-d0f3-4c89-a204-f67374759b28", "comment": "Malware payload", "value": "5bfb6f97f9baa3a5026622fddf919674", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152857, "uuid": "95d34b85-6b65-4499-9299-9cf4419b56f0", "comment": "Malware payload", "value": "4f51b2dcf469b4b62981ba9d3c8f20e5543dd36ffe67e5d3ad4db4592bbdfdfe", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152857, "uuid": "c4cf5add-b8b6-4b0b-866e-53568c67f67d", "comment": "Malware payload", "value": "4290ed8e2175443c8dd9f05f2cd6414e0f5476b2", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152857, "uuid": "45241d7c-428a-401f-b8dd-eccbffe11779", "comment": "Malware payload", "value": "caded14d34b9db51cfa171e21bbf4f38a92b20b6bb2bf2f47970fa84d24b3cd584cf1934dbd04e1852bff9fbb060d6a5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152857, "uuid": "7460cb0f-0873-4ebc-a37d-cd730755b5cd", "value": "4241444B73DBF631AFD3D872749520202282D598D0FD5A4CF6D839DDD06DCA4726A5C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152857, "uuid": "03004252-5f7e-453c-927d-d3bb0510a89e", "value": "48:KUfgNejbKzAHNv4tCZQLc5qITERBY1Z1A1V1a1hSBaX1mpwFqOYg1fvYNI:KUfgNejuzAHNv4tCZQLc5qITERS1Z1AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152857, "uuid": "ce97c491-6a54-4bf6-9ab3-9aa789d5d0ac", "value": 1987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152857, "uuid": "11609e1f-4ed4-4e58-965c-da4c12c967e8", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152857, "uuid": "c9cd3654-ea7a-4999-a411-5d2a4188ecd6", "value": "4f51b2dcf469b4b62981ba9d3c8f20e5543dd36ffe67e5d3ad4db4592bbdfdfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c515b76-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152866, "uuid": "98180838-0648-4a07-bf9c-b74a8f482100", "comment": "Malware payload", "value": "ed622ada0ebc5717fd9b781798ecc06a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152866, "uuid": "8e78cb98-20f9-48e1-bf3d-7bd527b76536", "comment": "Malware payload", "value": "4fb44157fa768d9ad47fd550af47fe2031a2ceeba0eb73f68d95a25a80d655f6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152866, "uuid": "7f469cce-4692-4f53-b297-07443e3431e8", "comment": "Malware payload", "value": "c1ecca59365866ef633bd4d09d0b73381ae6694b", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152866, "uuid": "aee11671-cb6f-4486-b588-1ee513caa728", "comment": "Malware payload", "value": "5f10c436b4bc3ca52090ed1701843e70687b0faf05bb49ec5c28c9186e004ad65e6e7c2140061323127b86e2b268e3c0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152866, "uuid": "2bd4cb3d-a075-41fa-9ea4-d459219f9b74", "value": "BDE5335099D106C8F598CE2F1BDC6536143FEFDA78A8AEE391D287F1000FB869A73564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152866, "uuid": "441babf4-9540-4bd4-9870-d6d8a81b6e00", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9D:G1wwAjzIQOMK2GNKslgus10Y14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152866, "uuid": "cb581155-a6f9-4829-aa97-32f83f17966b", "value": 3055616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152866, "uuid": "3bc28eec-5826-4847-886c-b8b9ae06593a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152866, "uuid": "53465dee-912d-4e00-8500-c115c44efd6e", "value": "4fb44157fa768d9ad47fd550af47fe2031a2ceeba0eb73f68d95a25a80d655f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c53077-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122523, "uuid": "2aec2a26-d47a-447e-b881-dc56730a0278", "comment": "Malware payload (Dridex)", "value": "1a92153cfc3bdf2253069b61d740975f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122523, "uuid": "8e1cb31c-aade-483a-a35d-14a19dbdb6ee", "comment": "Malware payload (Dridex)", "value": "4fca9fd9ecb1e494558317abf14c5230307412b6c6bef8f893d16522d86c9cfa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122523, "uuid": "d8ec6ef3-6e44-4fcf-ae1d-42c9fe03393a", "comment": "Malware payload (Dridex)", "value": "b6abcd65da51cfd3a076e7f986e284ba3766f012", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122523, "uuid": "986c9db4-f75b-4274-9e18-cd74a24f6cea", "comment": "Malware payload (Dridex)", "value": "f405205e32152468ad9cb407cad622b96a235355e952ac3b29527470f4e98e42e05bc04cc4fc4c0c3f1589e2645c37bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122523, "uuid": "3ef433cd-7e55-4e43-9408-cce442f6d619", "value": "47F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122523, "uuid": "d9c93c24-0810-4065-97bd-31202dfb3c95", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122523, "uuid": "56c068c9-ced3-41bd-9e98-01be9671aeeb", "value": "3072:RWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:R42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122523, "uuid": "16ed7084-77f9-4015-947a-3fa0a5d89017", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122523, "uuid": "6ef247bf-9045-4799-af98-ac4eb33aeaee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122523, "uuid": "f26fe5d1-b993-4cec-b30e-4f01bd153c31", "value": "1a92153c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea18ed5-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152870, "uuid": "510a5bb2-d0ba-4c25-bc94-db925c19ecd7", "comment": "Malware payload", "value": "05a1ad0e206e01e6695256ae2e549b03", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152870, "uuid": "a761a208-80cf-4686-b55d-2208dba57cf6", "comment": "Malware payload", "value": "4fccbfbe1c3faa7ee7958b7451e0c521f855d582b292dac19f4748bea440c178", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152870, "uuid": "cb2cb35f-8707-417c-894e-011e79998d71", "comment": "Malware payload", "value": "9c6c93ea72a557dcb5181765546a10085f55a1d3", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152870, "uuid": "f4c693a7-2a4a-4dcb-87f1-33d23fc7c433", "comment": "Malware payload", "value": "5e550b43c0d0843f8bab9af16f352089f2b77654b8bea7d71978b0a413a3f1c8e4e62a34e28cb4f2526c1c1e7d93309a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152870, "uuid": "d684279b-7fbc-4d96-a38b-b33f4dc8111a", "value": "B0E42346A9C13DC8B0ACAD072E8E450D9099FFCAA068F68711D497A6205E75C6FF733D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152870, "uuid": "b958b624-9f94-4217-a234-a311bdf4e1d0", "value": "12288:G1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+GDlZN6O1qyQj7d8g+SnR:G1HxKBpxMjuBd5QUP+GDxDQjKSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152870, "uuid": "011c3f56-d374-40dd-a404-29e7144e6377", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152870, "uuid": "043eb068-f247-472a-9332-54f950fcf49b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152870, "uuid": "f8d4e031-6d93-4b1c-976c-0659058f0b34", "value": "4fccbfbe1c3faa7ee7958b7451e0c521f855d582b292dac19f4748bea440c178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fc06fa-acbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620121252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121252, "uuid": "58f361c6-a111-4672-bacb-c80c27eefc71", "comment": "Malware payload (NanoCore)", "value": "af64699ae611bd9008f11e0a087c4947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121252, "uuid": "132b1b10-1f10-4b7c-91b4-f844ae458c9f", "comment": "Malware payload (NanoCore)", "value": "501a63b52b27b41d2f100a37d38b3b5961b8e18298ed32104c7fc2323150eb5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121252, "uuid": "7e885a39-5750-4e74-9167-aa5759020e43", "comment": "Malware payload (NanoCore)", "value": "42ffd0c3e267a347ec09a176fd81556bd5cd39b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121252, "uuid": "0de2e8ff-3556-411b-b0e6-8eeeb6cb4322", "comment": "Malware payload (NanoCore)", "value": "2cab89a790eac7153bd436ea8cd273289a3709b929962603cba18ab9c9352ac4ffa6886a22c2807bfd36d5171eadd138", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121252, "uuid": "0521955d-d4ee-4a97-af33-59a5e337a781", "value": "08852CA4EB31019EA854F0F0B6C9876CEF9FC9F19037A8C746296017B61151E3F993B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121252, "uuid": "ccfc951a-05a6-4456-bbbe-0232c7ba82d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121252, "uuid": "8a33b54a-6ba9-4463-8c2a-55b51d790e78", "value": "1536:aNEeB7PsACQwI9VaCVH/9/bT+xCsYnuW/mnPFJFWMszcazNLHLUOLlSKoaczzQ3O:a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121252, "uuid": "51a7ef2a-be31-4fa6-a18e-83877c64e572", "value": 1822208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121252, "uuid": "07e10af4-4f4f-4d54-a1d8-3a2098a846eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121252, "uuid": "9aa5888f-28f4-4778-95a5-dfedee0eacf2", "value": "Copy#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcf1c13-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097302, "uuid": "a18d2ab4-a769-487f-987b-819aab9732e3", "comment": "Malware payload (Dridex)", "value": "e2388dd5011cce0340ffc434b9b18f50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097302, "uuid": "0c8699b2-d6af-430f-9279-056f90f63338", "comment": "Malware payload (Dridex)", "value": "5079d77afe8fad0556fd0a926a02889420536ed743c724c2a04fea59da519f8d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097302, "uuid": "95b9b672-13cd-43e5-b1f0-2d1d678b33ee", "comment": "Malware payload (Dridex)", "value": "82c282fdc5886e1ba8413244e53287fe28332f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097302, "uuid": "8aee55fd-b8fa-4b7d-bf2e-5bc4abb4593c", "comment": "Malware payload (Dridex)", "value": "517f3c7517bbedd9c26f2d356e07ec637d0c81ebccd2bdd87a7d84b5e8838de88c1ac95279c5b057da6cd1e07d28bac6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097302, "uuid": "30d4b835-36ac-4cdd-9d24-5f8e383508bb", "value": "BFF3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097302, "uuid": "909ed861-3589-4c87-9628-c98c4e788eda", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097302, "uuid": "3ecd2074-58ea-469f-8585-25e670e39e09", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097302, "uuid": "76f0cad8-9173-47e1-943c-4f64830e0a13", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097302, "uuid": "8f971a21-ddab-4da2-8b6c-71591f26661d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097302, "uuid": "3ff5fa41-2c67-48d2-96fb-d812edeae1d0", "value": "e2388dd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f91ca7e-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097305, "uuid": "8a2b4de4-0ea8-4428-8696-8f44e7169129", "comment": "Malware payload (Dridex)", "value": "6daf6006d3796a865cf3dfcd22c408c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097305, "uuid": "f6dd219c-1a2b-4abe-8904-2213066a2091", "comment": "Malware payload (Dridex)", "value": "5086c39c006d9f0b30a7c7656d0c0849133fe46fbe465c177e9af65f83f1fe21", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097305, "uuid": "4ffed7d1-f5f8-47c2-be5d-27877e1897aa", "comment": "Malware payload (Dridex)", "value": "58209523840ad767eee96d312f96cc741bfc1f00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097305, "uuid": "a2ad7910-be6e-4a1e-8221-43212a5108a3", "comment": "Malware payload (Dridex)", "value": "c8e86986ca83af11c2d1ac09a24b3b7e53abd07ec3ebfc63c2f8535e508f81e7d75b61e2b1b670da40b42d935fd4297a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097305, "uuid": "ddb040f6-ee10-42df-85eb-e65b70cea776", "value": "28F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097305, "uuid": "a0286a46-9b6c-4f19-9511-1eb36ca043a6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097305, "uuid": "b36fa994-3b7e-46f4-a06a-9f05c468bb82", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097305, "uuid": "fbc620f5-bf72-4eb9-a740-37021698fe1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097305, "uuid": "1d91aaef-fd71-434e-a825-74e6d797de43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097305, "uuid": "bb912ba8-df86-410c-b0b3-4a5806c10126", "value": "6daf6006_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3bc728-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100875, "uuid": "9709ba8f-db0e-4b2b-beee-8363ea430739", "comment": "Malware payload (Dridex)", "value": "93155467fc29a397ea8d8634000124ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100875, "uuid": "63e90db2-7e53-482d-b46e-867b8bffc1b3", "comment": "Malware payload (Dridex)", "value": "50943e2f944cef7f77eac1c4848b49cf3af5ece780cbd078880d0df7ef2cc9a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100875, "uuid": "a2e4f282-db2f-4add-aa00-9c5f495a4237", "comment": "Malware payload (Dridex)", "value": "d39c4e9d08d9daf089143fb405c5ea5ad90a7615", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100875, "uuid": "c4ec4e34-e04c-4069-9a23-d869fed9c0bf", "comment": "Malware payload (Dridex)", "value": "62e0c1e681adbadd42d14e26f8e58b2b989a929dc36816875b9aeec707aad1f981024f13c5683a8c2d086a53f8964873", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100875, "uuid": "535d14dd-6eec-4961-87ab-7e278c275014", "value": "C8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100875, "uuid": "dd3c6c3d-f609-4d0a-87ba-49c76513a872", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100875, "uuid": "4577ce2b-e284-4c62-916e-49dd5d484801", "value": "3072:CA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:C3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100875, "uuid": "64884f5b-0cc8-414b-aa2d-b18ad6e5c255", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100875, "uuid": "cf5d1ca2-edd5-48b6-b12b-f8a750ded242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100875, "uuid": "c78bb134-3707-46e1-a012-92497995cd96", "value": "93155467_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bbb696-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152873, "uuid": "5be1184e-9e95-4d96-8c98-efef5a44590b", "comment": "Malware payload", "value": "6b8199811d7db99fd31ec9bc4fd09065", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152873, "uuid": "d745fa16-277d-486b-9a20-3226c45d9be3", "comment": "Malware payload", "value": "5114e290cb984a6d01d6aea8a97bde328f334d22cad07aac86c6ca15281dd3d1", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152873, "uuid": "6d912b9d-103c-4c0c-8d0b-2c3bf538a1f9", "comment": "Malware payload", "value": "cf2e6be7d8f464a8ae44062407f228a298f60e51", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152873, "uuid": "a3af7da8-1355-4a09-b417-eda935702e24", "comment": "Malware payload", "value": "9080a19f5becea8e3bd87d075a547cc306a33a8a3797c7feb8a1baeb8096ce41b16d3bea72b56500ad7c7a66f9b54720", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152873, "uuid": "0affb28b-2cf4-4dda-a548-6d3544acf0ab", "value": "90A1E850112C1AB17346697AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152873, "uuid": "df11b749-fd34-4f76-90ed-19c8f5f1a0f7", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152873, "uuid": "43102ffc-ed32-4bf7-b55d-37e4fcfe831f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152873, "uuid": "6f071c59-0e82-4334-b9a2-14058a41649a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152873, "uuid": "643d4488-8639-4f72-bca9-1a4ced8ea5d7", "value": "5114e290cb984a6d01d6aea8a97bde328f334d22cad07aac86c6ca15281dd3d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d0a9ad-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152880, "uuid": "43b5974f-949a-44c1-a249-3957f45708e2", "comment": "Malware payload", "value": "4953b3dbbef8d75ecdd75ef651ad0c26", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152880, "uuid": "2490cc6c-c90b-4a20-b35a-215846257b3d", "comment": "Malware payload", "value": "51da35b6ccc255006ea141f25560f00ce4eb44641d6c5bf250a6853668ea4c1b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152880, "uuid": "06f4daad-b0e9-4818-8205-2157bca5a871", "comment": "Malware payload", "value": "e2945741ad8654cf2f2626a77f22fffb1458e7b5", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152880, "uuid": "a9ff79d8-a01a-492e-88e5-f3a3810ef5fd", "comment": "Malware payload", "value": "a97568cc8c3f1d5d7c57e3c1c56cb0343c3bc386b8e9f13b6108ea60da7320667df0cd0963864208d30bdbf3a0a4254a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152880, "uuid": "cff04ce0-02ef-4101-a880-161dd3892257", "value": "ADE5330C13FAB8FCF89D4529376389D1C2E861F0A58265F2D6781998083F5BD1B9FA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152880, "uuid": "2fdb8bfe-019c-4048-a543-f74210788aa1", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4l:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152880, "uuid": "0d531bd2-f8b7-4d2c-8bf4-e0c5910e1089", "value": 3112960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152880, "uuid": "e0174eb5-e932-4d1f-b4f8-f31304aaf172", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152880, "uuid": "ed697195-0ec0-41b2-abdc-d0256aff8532", "value": "51da35b6ccc255006ea141f25560f00ce4eb44641d6c5bf250a6853668ea4c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a27676-ad0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620154492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620154492, "uuid": "68071646-ebdd-42d9-8875-9679665cb162", "comment": "Malware payload (Dridex)", "value": "24875ad63104608b4b396051b2b69660", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620154492, "uuid": "f6932917-d7fe-410d-90b9-93dc65db6c1c", "comment": "Malware payload (Dridex)", "value": "52003481c7245905ceaa859b54ffb76ecfeae91491f9741b5ea3c16a1db80989", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620154492, "uuid": "f19a87b7-662d-48e5-828c-d582c0bbffda", "comment": "Malware payload (Dridex)", "value": "407a60266d08747def593476907f45d97c4889a9", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620154492, "uuid": "41adda2a-bf67-4ec0-88cc-0ad7de48f56b", "comment": "Malware payload (Dridex)", "value": "907fa36cf0d439156d3fe11818f5935775587f23abaced1214243372f46ec8f8cd35642266741237b7473a5e840c7f57", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620154492, "uuid": "30e4c2f7-55d0-4bca-99c6-da41198b2df6", "value": "0333F0AEBA3DD809C6B3083CD01BC0B4404D8E438997F99E5D58E24D95D69B7072F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620154492, "uuid": "23396a3c-4147-49da-9520-82ecd291854b", "value": "768:bTHkUoWMviVh76QgpHZ+quwO+r8T8iHiURzXO+iTCstxp0zQmk8W1VRgE+b:kvLv3HZbDO0S8iHiUt++gCGxDWE+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620154492, "uuid": "79db6241-43c7-4ce8-81c0-ca4c107212d8", "value": 54549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620154492, "uuid": "db2224b9-4ba6-442d-815a-1d535fb4c662", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620154492, "uuid": "90fa38c3-9203-4fad-94ff-b26209b8a6ea", "value": "Sollecito_pagamento_fatture_29087.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a947dd-acbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120485, "uuid": "3864930f-90d9-4973-86b4-58b97f5cb484", "comment": "Malware payload (Gozi)", "value": "33e3bab7bddaae6c39a9133e002a1b29", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120485, "uuid": "f5c10814-0156-49b6-814e-c21a6c033519", "comment": "Malware payload (Gozi)", "value": "523fdce885c5d2fa0dc8aed7812cc13c99aba7d1441ac70ddb6b928585cb3dd5", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120485, "uuid": "68770725-fde7-4639-8d07-9bbf91f2a789", "comment": "Malware payload (Gozi)", "value": "cd1e41e49a7d1611a04cfa8d9444b3b7e3287515", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120485, "uuid": "54598655-be41-468c-9b27-4a7a498830b8", "comment": "Malware payload (Gozi)", "value": "3d469a7bfa931033ed71c8e300ae1b14aa69f25f3a2f25cfa615534d7d3de553cfe3a57c247a992f118f520736473982", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120485, "uuid": "50b353f3-c0ad-44a2-a741-475c82029767", "value": "DD13E143FA3851B7C36319F80EBD6AEBB5DA53D8061754B193001CFB5DF2954A03A2A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120485, "uuid": "99dca9b4-ecef-41ab-9d78-3c4951db8438", "value": "9b4bd5e9c744a772e2cae4b95c84d26f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120485, "uuid": "670414ba-94c4-49cc-9746-1fcbf53d2a1f", "value": "768:XLSB0Zv7TTnDDHB6N1XRMPWDY1cszRpC1EYQP8zMxNX1qy/MI4kJP2E4Ws4xKOpC:X2B0RDh6N1XYWDwzWxQkzMz1qUM3inaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120485, "uuid": "8a41769f-8f66-46f2-ae4b-935fbedc4e23", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120485, "uuid": "b4ae5907-f715-48e7-b63b-666b0401e4be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120485, "uuid": "0fe9df85-186e-4a90-8dbf-bbe27de444c4", "value": "6bae0000.bilper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24e6541-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620122543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122543, "uuid": "fd0e920c-3470-4f73-b66a-67f120373d1b", "comment": "Malware payload (TrickBot)", "value": "ba820cf3ca3957bd6401fc39b8d692b9", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122543, "uuid": "80007882-0fba-4a86-a25c-cf61ad623c5c", "comment": "Malware payload (TrickBot)", "value": "5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122543, "uuid": "ec7c57c0-4a96-4585-acd6-4e81bb6cf6e8", "comment": "Malware payload (TrickBot)", "value": "1a66dc68510e10ce83ce0c938c185bf67cf0eb44", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122543, "uuid": "5a860628-0fe3-4644-8cf8-eb754f746c04", "comment": "Malware payload (TrickBot)", "value": "32fff006998840e3e3829ddb8eb01489fe2c55482be185188691084b22536e467f25ae21d310e532aed3b41abf48c716", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122543, "uuid": "e8855b4b-f976-4d42-af78-121537c3025a", "value": "D7C4E02A37E1CCB7C5A755790EE2DBAA62FAFD204F718A8323543B0D4E31AD15931316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122543, "uuid": "dd3541b3-93cd-4861-86b1-5c25c5f7aafe", "value": "ea97e91275f65096e0769ec8f21f572b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122543, "uuid": "4eed897c-c321-4253-bfab-82a70881ba75", "value": "12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttYW60EQSO1A:ZXQUIsQpMsequrmGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122543, "uuid": "48baa51b-f027-40ed-803f-cca741c1d705", "value": 547608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122543, "uuid": "83ba1ebd-e8ff-4135-8894-cd29962df837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122543, "uuid": "dcaa2a5b-b9e3-45fd-a414-3551ef7cb006", "value": "ba820cf3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601501f2-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100876, "uuid": "a1c1ef8b-e1a4-4f12-86f8-7b901965d6d8", "comment": "Malware payload (Dridex)", "value": "fc2202661af2b5ed4c8eea8e46df87b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100876, "uuid": "51c7962e-4f8d-41b3-9a69-c32bc8df3100", "comment": "Malware payload (Dridex)", "value": "530ddbd4fbae18f65d7c8a42c72ec210ddfd88dc7652d94029b1a82f23ce79db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100876, "uuid": "82bbdc84-7f34-4400-8004-ac40d3873c02", "comment": "Malware payload (Dridex)", "value": "a9ddc0596962a2abf586de88bc02fdd834a216e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100876, "uuid": "56bf8f88-b1f9-4c3c-be5a-35896fe7d273", "comment": "Malware payload (Dridex)", "value": "c156855867a8e774b59728deeb17030668072ddbe1191e91328802f22c80c9d5c06511a62d8f8485f23b42c3e2844bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100876, "uuid": "ffe0454d-31f0-46e0-8395-40eaeb3a2e3d", "value": "93F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100876, "uuid": "975433e9-c785-48bc-8726-f9a460530697", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100876, "uuid": "68b8f578-123a-4caa-9b25-93a2c7846824", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100876, "uuid": "78c53e2b-f1ba-465c-b14a-81eb5f4218b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100876, "uuid": "e6f4f581-a262-4d57-be0c-809534e91a3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100876, "uuid": "72a4091c-eddf-491e-a819-2321b25456e0", "value": "fc220266_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e05fc1-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620090039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090039, "uuid": "8dca44ef-23cd-41fb-81c7-587c4064ee37", "comment": "Malware payload (Quakbot)", "value": "a8b4e37766d35b543884d8882147eaa2", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090039, "uuid": "d9d9e7bc-fca3-4f79-8b2e-d105428d4ff9", "comment": "Malware payload (Quakbot)", "value": "533c8713c4e10c223a9f8139f9d408ca326aee14a1d88382c91f2ff18cf0f93c", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090039, "uuid": "a8239b86-1c5a-4eb7-9e90-24c60080d62b", "comment": "Malware payload (Quakbot)", "value": "4356c14118ea9098dabb6d9af620003b7929058a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090039, "uuid": "a716b63e-5546-4639-a45a-f1004e067917", "comment": "Malware payload (Quakbot)", "value": "8c61857502b6225c2e1367e145520d8dfb2e5288934bbf7bceecde1af3716aa0970ba18641e34addff0b4a0fe806f0fa", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090039, "uuid": "9e3dad52-6bb9-4685-bff4-c0e2dd01b7a2", "value": "3CB39D0BCC189AC7C12E92FD7D074DF96E1E5718D8966FEF04221F8A3A161631E4F46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090039, "uuid": "31dd9d85-921d-436b-838c-6a7cc4eb0c94", "value": "3072:K6vKINbjvw548LMb/oqKO8NnS8+60Kcxtc:6AbT648LM7D98Np+Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090039, "uuid": "dce2db34-fa96-4c03-a7fc-b3f9a16ce57a", "value": 114788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090039, "uuid": "856851df-7b87-48b7-b1b7-c7e1071aef99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090039, "uuid": "b9a364ce-5b29-4cd6-8a2a-43875190973b", "value": "9177284661-04302021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbfc8d6-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153459, "uuid": "2ac62ad2-be9f-4f52-b813-7f8e58cc95ed", "comment": "Malware payload", "value": "105877da42be7f7bb4eb46bb5e1f9c93", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153459, "uuid": "38f61a0b-f0d2-4248-a2a3-36cdd05e928f", "comment": "Malware payload", "value": "5347458dfb4e3976503aac855d0cea578c9bac2ed21c6777b7dbc989c36e1be9", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153459, "uuid": "dee3f380-8e69-4b34-963c-e189ea5d7e05", "comment": "Malware payload", "value": "a971f045a487775a585a5d8e300b9f4245045793", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153459, "uuid": "413a8dec-9aa5-4f3e-8e53-eb81fe8c008c", "comment": "Malware payload", "value": "d1917f91f352e1bffa222ce2b503f4ecc5504ba204360a4e03ce0d5fefe2f8c31b2a3a379211e3a69eb8a7a054221396", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153459, "uuid": "48c3a1c5-be1a-4df8-ac29-297f41d04131", "value": "1CA1F750112C1AB17646697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153459, "uuid": "31066ac5-78df-464e-be62-5ce3b0b82f88", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153459, "uuid": "e9650e32-82d1-4c6b-99a4-8c2a33450163", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153459, "uuid": "94c30dc3-f373-4ae9-aa6a-5c1e3ad051a4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153459, "uuid": "7a7d8e09-f5f3-46f7-be82-5beedcda48c8", "value": "5347458dfb4e3976503aac855d0cea578c9bac2ed21c6777b7dbc989c36e1be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c18a6-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090055, "uuid": "5ff96ae7-bbc9-4517-b836-b91fa1e51296", "comment": "Malware payload (Dridex)", "value": "ded461cfe83bcb78a26249e6684ef720", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090055, "uuid": "d1d903e9-c79b-4bbe-88ea-45d37610b4cc", "comment": "Malware payload (Dridex)", "value": "535d2c8e620a898024f6e4287686cdb18cba6fe62ae1d181252bbf1a0f158285", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090055, "uuid": "e255c909-52ec-4884-95a4-0c27ea707dbe", "comment": "Malware payload (Dridex)", "value": "0c2ef08e6bd0be6e24661072161db28cb4434a10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090055, "uuid": "38fa7cac-40d7-4429-a680-911527fba427", "comment": "Malware payload (Dridex)", "value": "9916949840a7b265f9944aa704fd8f64be5bd8fc64e33ec836e54c2f1632f719a7aedfd495f782de11f764b17d620c16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090055, "uuid": "1a89ff0a-bdce-45f1-bd44-c839e9eb3078", "value": "5EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090055, "uuid": "659c4333-f880-4046-bf92-9d3e12b5c3c4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090055, "uuid": "c11245a1-e3d7-4001-afc4-b011dcd9e512", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090055, "uuid": "eba09977-1108-49f1-b90f-de49c89c2e4a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090055, "uuid": "9f56cdd4-0989-463c-a17e-cba2ee7fbbfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090055, "uuid": "5f97f7a3-0481-4c23-bb63-596ea9a5aa8c", "value": "ded461cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08470c2e-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126069, "uuid": "35cdd919-6608-4dfd-8921-a4371dff10d9", "comment": "Malware payload (Dridex)", "value": "4f5191dd2e969d5d0d827a1e69ac63d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126069, "uuid": "2ba0d34f-8cbe-4ccf-b605-b134e98dc085", "comment": "Malware payload (Dridex)", "value": "53665838b7ceb1570bf36398b3ba98a099c863141a4b8b89a3606c4ee937fdbc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126069, "uuid": "8024ea64-4f0d-468f-b6dc-a63dfd1d101d", "comment": "Malware payload (Dridex)", "value": "de87c4000dc8949f4da0c45863c94f86cece6982", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126069, "uuid": "4fabaa0d-1504-4ff9-a9f7-4436043ee3dc", "comment": "Malware payload (Dridex)", "value": "d730b5c666d6601338607ed9961ab101a569c8236fbb6a3fc7315e9195e74e9763f2c00c515463de1834950c9e258ef7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126069, "uuid": "b9e35d94-728b-46d5-84b4-6cec8930e76b", "value": "71F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126069, "uuid": "13b141f2-0274-448b-af8b-1036a7d04cbd", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126069, "uuid": "664a16c7-a238-406c-bc8f-256f0883a235", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126069, "uuid": "5f15a524-e027-438c-bf20-3cee54722571", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126069, "uuid": "8b2c514e-c6c9-4bc6-b0cb-2332c9ee0f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126069, "uuid": "65912eac-b776-4dc0-8899-5e44b1036b60", "value": "4f5191dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17611db4-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095171, "uuid": "38f61e25-8e3c-48c9-9bd0-0caf47abb881", "comment": "Malware payload", "value": "8c01ef7cfa9e635f5ba0d12f2dcf6367", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095171, "uuid": "0a32c966-5042-4dab-af76-79076adfede1", "comment": "Malware payload", "value": "539e545b723edd593abfca4515069608dad9b3d18e4eb1842bc85c64cd9c6313", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095171, "uuid": "49423a73-946c-40d1-871b-e79492f285b8", "comment": "Malware payload", "value": "2006bc57945a5f2d0d67f7ce0d9c0f1dd0ab2b8c", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095171, "uuid": "28d1fdc7-81fd-4a67-800e-d3f0bb1559e7", "comment": "Malware payload", "value": "4e1ff649a873838c2ca28487e750b0c64e848761ef5840fd6f21a32d5a6f1e03f6b3d0370657cbdaf9731df6b80865b7", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095171, "uuid": "715fa6a6-9c41-4c94-bed4-c4467a4588bf", "value": "1726C50946FBB2E8EB9D62FC4B6805DD8F814F321453FA7942BD7E97171321E0046A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095171, "uuid": "6cd567d2-0a34-4c4b-8a7d-b58503b7228c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095171, "uuid": "3bc52bd9-e1e7-4263-806f-b1bec3050a81", "value": "24576:RvExMW2ZlQxWxpr79L1NjSu2ngxN+q5xtpeDlkgdvUUNqaHdHONZ3hDzkSnVOMoV:RcxMJnZnSu2neN+YPeVUoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095171, "uuid": "8218dc1f-c251-449f-bf7d-2578864cdf10", "value": 4655616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095171, "uuid": "63b23932-c932-4b6d-b887-f2cc99bd8b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095171, "uuid": "1483eefb-2e39-4a12-b3d9-35491da9d1b3", "value": "AstarothSpammer (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b458676a-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122492, "uuid": "f821d676-8c86-40c8-bd0e-a7c78b03d417", "comment": "Malware payload (Dridex)", "value": "0bfe358cd69730636af4228731638174", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122492, "uuid": "30ac1bf6-5f5f-4eac-a907-c37565bbdc73", "comment": "Malware payload (Dridex)", "value": "53de3735a54a4c058698002f83ad551714e932e4c2901209006a355e718d1d87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122492, "uuid": "24ec4cae-fca9-4baf-a4eb-fc770616e7a3", "comment": "Malware payload (Dridex)", "value": "5508b564bea02ce8d01d17bd0d6ec5a691b22543", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122492, "uuid": "40da9109-9dd6-472f-b105-92b16d1f8822", "comment": "Malware payload (Dridex)", "value": "c7f16d1071a3ba1433293eb2c4a0295144a9b4f78b48c3e30b23f1ed8ad7d3d2476eee61a6a761a48eff248378eef4ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122492, "uuid": "99ad2528-84d1-4174-bbf3-bbf3b6270c3c", "value": "80F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122492, "uuid": "347f38fd-3799-4608-95f0-44b0d3c24b97", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122492, "uuid": "3c77bc07-e927-4428-a6ba-35b166e1169f", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122492, "uuid": "9706aa7f-4c11-480c-a40c-1f5f2055c9ef", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122492, "uuid": "475c2268-1eb7-42e3-a885-ee6edfaed461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122492, "uuid": "306c47ef-0daa-4878-b38f-e4e59003b7d6", "value": "0bfe358c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1152484-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093738, "uuid": "701526d0-7582-441d-b6b6-aea6fb9037e9", "comment": "Malware payload (Dridex)", "value": "6e4b81a75a3c90d4d11b704ca616085f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093738, "uuid": "b2cee033-f8c8-4c26-b459-8022ac6342ea", "comment": "Malware payload (Dridex)", "value": "5400186d38c3962d84a81e23915b5d9d8035a85e03c8b10484dff5a98cec098d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093738, "uuid": "e119849d-9662-492b-acd9-65de7d17f8c1", "comment": "Malware payload (Dridex)", "value": "3ae04c39e7bb82f6d3c8edc74102da8cc9b56f7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093738, "uuid": "68953283-f8e0-42ca-a6ba-f7aeae5c344f", "comment": "Malware payload (Dridex)", "value": "64d32520b9c3536f64083fd8f822225d31f4dd32599095c676f28e9ad48a261149fcc7b2f8a061d26c503c5a7cf8312b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093738, "uuid": "22ddcece-4b1d-4799-9d39-8dc5771a3b90", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093738, "uuid": "865b5b33-a360-4f2e-a1f3-070076b65722", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093738, "uuid": "2b1776f8-a193-4d27-9548-b08320d92683", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093738, "uuid": "f802a759-2dc7-432b-b631-310a5cedcb92", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093738, "uuid": "073998d5-528b-4c01-9806-61777b2b1867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093738, "uuid": "320b363c-7f7c-405a-a275-1128a2e9dd46", "value": "6e4b81a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13268de-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122514, "uuid": "9533d954-564e-4c12-a015-97bcffe76cf0", "comment": "Malware payload (Dridex)", "value": "a63ec0f895140643f864a8c24935f480", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122514, "uuid": "0fefa0a6-c1fa-4d86-94dd-3f0a04971ebd", "comment": "Malware payload (Dridex)", "value": "544ffa5df1dd39d09c0dca1d51ab260f4160729f5320c7d8b515497055dcf470", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122514, "uuid": "08a4e998-4038-4df5-911c-4e8dc6f813de", "comment": "Malware payload (Dridex)", "value": "cbd1b9cedc3367575afc4ef6a406dc75a6af7695", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122514, "uuid": "d91291dd-a31b-4f0f-8852-3566a888c557", "comment": "Malware payload (Dridex)", "value": "5705e30533c0bf86d295844ae731cfe84c9d4f179c0319bd8a41f222b47c3c5b8bd5ba8369488375f9e45cf6310fcf1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122514, "uuid": "5359eeee-6c5f-4c1c-a106-5e60e23b6540", "value": "B8F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122514, "uuid": "f1e94dd2-eeef-48e7-bd27-2e53b4e39452", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122514, "uuid": "7fb99531-da01-4804-9572-1d7bcd683ab7", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122514, "uuid": "0b84a038-42a9-4434-ba28-d545f13f90c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122514, "uuid": "fe36b038-86e2-4777-bee3-45f82cba4e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122514, "uuid": "351a9bf6-da11-438b-aa3b-d93c967debe8", "value": "a63ec0f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7d49c0-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093705, "uuid": "0a9198e5-4a25-4517-9a78-58202bd00f44", "comment": "Malware payload", "value": "618634b681695d4baf019ed169676a08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093705, "uuid": "ff5828f9-85e1-4d65-a744-a0227854d35b", "comment": "Malware payload", "value": "554d82d6f76466103dacb9ba1e4c709b5424a56bd57cc988fccb086c71ae4280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093705, "uuid": "02f36e9c-6654-4394-a952-991edf01916a", "comment": "Malware payload", "value": "aa6801daf0ad37070d851523e7b71cd349f5a99d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093705, "uuid": "27a18c13-3aac-472c-90eb-193361988a11", "comment": "Malware payload", "value": "e1aa5cfda5903e119f307e6d971c7842ab7d72e524670592b21bbdabf56a706718d95bb997082661030cf5d8f387db68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093705, "uuid": "6e0aba8f-00a8-48e6-9cf0-74a16b245c68", "value": "22063356D63CF5C0E4494838805B977C9E026F81DA8BAAAFAFC4385DEFF21F52814587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093705, "uuid": "61bf4b62-764f-42a6-a6e9-bf280294c44d", "value": "22f1422fd1b2bcd3c0cc48d8e2023070", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093705, "uuid": "21f9230a-2f1a-43ba-986e-5cf02ff1a07f", "value": "98304:c2vAKNcozgHOxX3k1jYQtnSKEBdFYNDhUGFXbxcmBd:c2vAMxX+jYQthC+GmbumH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093705, "uuid": "c0a19729-f34a-4661-8b2b-a59751527fc8", "value": 3738232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093705, "uuid": "1b5631f8-c7e5-41a8-916a-155476408e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093705, "uuid": "03cbc9e8-566f-469c-89c8-99a2309957f9", "value": "618634b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aba780a-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620152890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152890, "uuid": "d0b56665-0f05-49e0-8c38-75d9f81a3bb0", "comment": "Malware payload (Mirai)", "value": "399367b3308eea3f906d3bdddc9a8c6e", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152890, "uuid": "31b514b1-7d93-4196-b76e-2f1753c283dd", "comment": "Malware payload (Mirai)", "value": "55fb9e1f3485fafa17c33f909ebaacde39695bd4c92a4fb8a27a2a7fd0604a4d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152890, "uuid": "3cb680d7-f9bb-49dd-a5e9-458f6e9a0148", "comment": "Malware payload (Mirai)", "value": "d6831e06f671339e14b5f3349f2d9dc72efda026", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152890, "uuid": "02a41fd3-2d35-4e67-ae7d-aa832213a651", "comment": "Malware payload (Mirai)", "value": "fd96a71f8b770a2912c23d1922998cafefcb46a14f16f22a60cc470fcbbfaed939904822b073c8e012c5461f8aabbfbf", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152890, "uuid": "7f014e32-ee75-4ba8-b65d-6e36a2b9b935", "value": "17B308C4B143E9F4DC4505743026FB375E36B1BA222FED97D3F89A636D92A42C805A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152890, "uuid": "45236a34-16d5-4ee9-aea9-29f1d4590b3e", "value": "3072:kswROj6+18a7qJ/lAO1/i5FKCQLG1xOFR9BXlMclq513xDFCH2svXG0DP:ruOjN+cq9Aq/i/KCQL2xOFR9BXIX3xp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152890, "uuid": "df24d5ee-17f2-4f3b-b1cb-50fb9e6c01c6", "value": 115600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152890, "uuid": "610c1185-d1dc-442c-b68a-3f4e8b16a073", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152890, "uuid": "86128f18-36b5-4d5a-a9ff-90a74ef4c7af", "value": "55fb9e1f3485fafa17c33f909ebaacde39695bd4c92a4fb8a27a2a7fd0604a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521a4f35-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118892, "uuid": "23cac4fe-ff9a-4578-891a-5801091db8b2", "comment": "Malware payload (Dridex)", "value": "7ce0eb022f2d61c3e4e56b611d547468", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118892, "uuid": "2ad8da34-69bc-4ae9-bd64-a5f8c62ea53f", "comment": "Malware payload (Dridex)", "value": "561fb07eafa15d1b2464c9ce6574b82473e8e136c7f59b6911c05565932d8cd6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118892, "uuid": "949fea60-18ac-4490-8647-9ce1f29ee403", "comment": "Malware payload (Dridex)", "value": "68e6c04ac5072c17e1f1c209c81783af635dcd66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118892, "uuid": "51098adb-0514-444a-8080-820196983758", "comment": "Malware payload (Dridex)", "value": "e2c7482b0e5c73e3b24eb0b4029470d04024e07be8f60eb11bc86e4fdfe15812b590d17c015cf457fe6ed34ba7ce4587", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118892, "uuid": "6d92ae3c-5ae9-41ab-ab7d-e4d9a3401fc2", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118892, "uuid": "efc66b4b-1609-4a2b-a9fb-34a9116359b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118892, "uuid": "ef5a862e-8cc2-4f52-b5c4-afbde7bcbe18", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118892, "uuid": "54b8e0dc-5aed-434b-aa32-1c8d42c5c152", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118892, "uuid": "bb1c8721-b49b-4fc9-936e-3e84e4e8ce9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118892, "uuid": "5350c4d0-975e-402a-8218-4238bcfbfa4b", "value": "7ce0eb02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f83646-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152902, "uuid": "a4a225c4-13fc-445d-943c-10ae6a5277d8", "comment": "Malware payload", "value": "8989cbe4d2d77bc8bb532e6ba0e2a108", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152902, "uuid": "21da3336-df9f-4aba-acfa-4c642b9d6bd4", "comment": "Malware payload", "value": "5686dca7b4baf289a943c1ec9ee8def9750659146c273a762b5c15c9805b9dc0", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152902, "uuid": "f2c0a24d-a632-417d-896b-7932d28d030f", "comment": "Malware payload", "value": "571e015eed7e6d11c79d0efeca666d58e7bf07de", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152902, "uuid": "9816917d-b0b6-458f-a29f-a2f3b7099b05", "comment": "Malware payload", "value": "873ffa801a784e4de255e4d1d3c7039e5a5b36f49478eb61a8f2f848e68d7ae61ff764130d509474ffdb9d0843b00f63", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152902, "uuid": "ebae84a6-26eb-4e7a-ac6d-9a59e5d30a10", "value": "61A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152902, "uuid": "f586442d-69ea-4a2e-9236-1cb1f819b053", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152902, "uuid": "02afbc6e-681d-419b-a8e4-843bd279bd35", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152902, "uuid": "3ccfc9a6-73d8-4ef9-a6fd-f0626af25f37", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152902, "uuid": "5126d250-5e76-4dd2-b7b3-77bbc5df5a46", "value": "5686dca7b4baf289a943c1ec9ee8def9750659146c273a762b5c15c9805b9dc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8097a8a-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093696, "uuid": "6f2d9fd1-088a-4080-800a-973df5b8acc1", "comment": "Malware payload", "value": "097b6d4c1363f03cb4f3f21504edac7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093696, "uuid": "1aca14cc-742f-4598-8a74-1c41446b47ad", "comment": "Malware payload", "value": "56b26111e1f62398df8cacbd9636491414f9a281298ea6d8433d125d63d4d7ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093696, "uuid": "0222e2a0-cded-466a-b5e0-a7f3b92c034e", "comment": "Malware payload", "value": "22a6d08a65794f018c430a87de2d5e6b0b8ca5c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093696, "uuid": "06431220-6605-4df1-a529-1ac516cd6dfd", "comment": "Malware payload", "value": "32dab60ade8dbd2abd9cd8dded670acb1349b1c7ac5d6a7a4dc4e474c6198fcad47838c3503c94cb9daf291f10549deb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093696, "uuid": "a6553f41-1d96-4b71-913c-c425fb48a30b", "value": "8DA52362B9911844C1C672325FB7D236E726ADACDE40B54617F05FB73FFEA831A112A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093696, "uuid": "1f28aebd-e6f5-4510-bf11-81004933f1bc", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093696, "uuid": "24d7bfa1-2bf7-496a-a1d7-15758d727d80", "value": "49152:evaGMCy+/PU9m0sGh8cuEwBkVUpWt72q6Y5KdQE:evr/MM0F29BkVr0Y5Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093696, "uuid": "448ab2fe-177d-4d41-add4-4f77a5209c67", "value": 2217936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093696, "uuid": "73c5b60f-7b00-4607-887c-6e0f61e46098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093696, "uuid": "8b6c15fb-b77f-492d-90cd-2c62d7517f79", "value": "097b6d4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833a7e15-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152904, "uuid": "2c882ba8-aacc-485f-87c3-dbd250223796", "comment": "Malware payload", "value": "4867b7cc887f033f23241281a1f3d54f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152904, "uuid": "a9961e6b-981d-4cca-80c9-8f85776a04f8", "comment": "Malware payload", "value": "56dd9f1a4bf9969d9f19e00d8f24465df9a5d7967bc36c201e0bf29d4a81aabc", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152904, "uuid": "fb0c5d8d-1125-4bdd-8e96-a33b2bb088f9", "comment": "Malware payload", "value": "255b03403a63cad5f27b630a59b4dc89747ca8ae", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152904, "uuid": "7b6dd313-7f2a-4da4-a9ec-4371e9fe12d8", "comment": "Malware payload", "value": "c275e29940d561329dd27e41db18bc1380c1c418ffa5607e6eb8cba7064292f5a86a0bca67c63a5390947a90802e1280", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152904, "uuid": "3d997cc0-68cb-4441-83a9-140afa3bc19d", "value": "90A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152904, "uuid": "2374e623-38e4-4f0b-95bd-07b3cf7f4bf4", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152904, "uuid": "118cff2b-bbbb-4c7d-84aa-077102e402ce", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152904, "uuid": "98e85a8d-86a3-429f-8a51-4a74116ef5fb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152904, "uuid": "734b9559-60c8-4d95-97cb-9d8cf6f7f5bf", "value": "56dd9f1a4bf9969d9f19e00d8f24465df9a5d7967bc36c201e0bf29d4a81aabc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299311bb-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108086, "uuid": "973a0bce-9f1f-4194-9f22-cfe8cf6ed0fb", "comment": "Malware payload (Dridex)", "value": "c54839b35b065c127f7ea9602a6022e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108086, "uuid": "781cc9ca-c66f-4df0-860b-f5004ea3c3eb", "comment": "Malware payload (Dridex)", "value": "57065abb4c82954a2e384128358a82260d13a51d5e13e77d80372f8875dfb38e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108086, "uuid": "f31d49ae-6348-472c-a468-bc503f3c1840", "comment": "Malware payload (Dridex)", "value": "555cfde8507b85fcf3efddc7c3a217b13c8cb948", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108086, "uuid": "b1987922-807e-4ee1-acbe-78667a9f7ce1", "comment": "Malware payload (Dridex)", "value": "861a09562d90cb62cd67113328f7d814c1e541ced2232fc8784cb8c3ce027f6565541eddd2ea4852b023cb4400bef85e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108086, "uuid": "98587d14-5c2b-44fa-b5ae-3d24838cf5ba", "value": "B6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108086, "uuid": "2c659a0b-623c-4e1a-9f08-1cd6827c050a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108086, "uuid": "44951ecf-b243-4b5f-be78-b56a8ee9c8cc", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108086, "uuid": "b8b2e8b0-34a8-4ee9-9bca-eee60353b17e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108086, "uuid": "79e24818-0f1f-4459-9e96-86a1dc94b94e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108086, "uuid": "894cd6cd-a7ad-4db7-82a3-c4e6f2570f35", "value": "c54839b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea57ade-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090083, "uuid": "d519da18-1ac8-4799-91af-ca0ed04137b3", "comment": "Malware payload (Dridex)", "value": "4952debac6220062d82a9a32041adc01", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090083, "uuid": "7743dd25-db67-4c4d-a023-dea529247b6e", "comment": "Malware payload (Dridex)", "value": "5722c4313f04b27d17d2904dc5266ed121a9f076218b4ae21ca9423844606d7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090083, "uuid": "efe5c9c4-1779-4531-87d4-280bcb0ec2fd", "comment": "Malware payload (Dridex)", "value": "56ed41a54f4a41c6e1792ddf8e547a75e49abc18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090083, "uuid": "76601c89-fa12-4001-a139-42b667e59d61", "comment": "Malware payload (Dridex)", "value": "804c7d6a4f028c870c18462ccaf4d51996902d0bcf7802f7329d6e1aa0281c132078cf682c3995670db95d0da1c2b6b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090083, "uuid": "aab1d2b3-ef3f-48c7-834f-3e57e508c9d9", "value": "3FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090083, "uuid": "8351869e-76c2-4391-b225-e347c091e87c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090083, "uuid": "7e33be54-9550-49f8-9228-5b8d7d727a98", "value": "3072:9A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:93J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090083, "uuid": "973599f3-2286-4212-b19d-99a60d2fd3a5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090083, "uuid": "8c77cce1-3540-43e8-94ec-fbaef8e7d39d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090083, "uuid": "bd03b555-a60c-4169-b36d-40f8d7651a06", "value": "4952deba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d897492-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095369, "uuid": "9de805b8-60ec-4c5e-ba4a-b58a08ce5640", "comment": "Malware payload", "value": "5adb2f8f49aad7b28ecc1521658c9b4e", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095369, "uuid": "d2cbe91c-b5b9-4622-a610-ae5a842f7871", "comment": "Malware payload", "value": "57f179936f5770d73331a786e0262a82df38437fd90919f60a7a6f4b2661eacb", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095369, "uuid": "19a0fd4f-05ea-4f5e-9f29-df589eaf8fbb", "comment": "Malware payload", "value": "8fea6348298209d5acbb62d202ee332455d00d78", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095369, "uuid": "8ea58194-ab58-42a0-ad45-4eff2e655d1e", "comment": "Malware payload", "value": "6b131a55ecb8af3b699be6f9819aa2f411c7339b18abe1643ff60c4f5f64c9f368013f70a90d68950f31fc733526e79f", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095369, "uuid": "d27c1164-c06a-4b37-b982-6c2e41a20a21", "value": "0DD4949D722075EFC89BC4769EA85D68AB60747B531B4203A0271DAFF94D987CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095369, "uuid": "e8de1fcb-52b6-4792-886f-a1626fab817c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095369, "uuid": "561ff7f1-c51e-4032-bae0-fad3154b5769", "value": "12288:vQUEef8PNDZ9PBhcaELFqhcecphffmGqNgluJmkxpo9nAy18frk1UQjAK8IUMfDq:vFf8dnPBhxt0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095369, "uuid": "39550151-12c4-41f4-8843-3bb71a453435", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095369, "uuid": "46e06d8c-8491-40bd-add3-b067dfa9a5ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095369, "uuid": "85eb7fbb-3272-489d-aee3-9cb84233bcf0", "value": "57f179936f5770d73331a786e0262a82df38437fd90919f60a7a6f4b2661eacb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846ff43c-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152906, "uuid": "7abd77d7-2426-4703-a2f3-432bfc3b491b", "comment": "Malware payload", "value": "67beec92c1ef696aa913d8f43f4f447f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152906, "uuid": "3204ce47-5089-4291-a210-60b7d1afb68b", "comment": "Malware payload", "value": "57f8c73409c97d51369aa4d10ceb98469c86f998181c727ba38f3b26fbe57bac", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152906, "uuid": "ad12241f-8d57-4cb6-88ca-4a8e69e525c2", "comment": "Malware payload", "value": "e7a562e57e19452cf6a3e861db647cc5135d0f97", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152906, "uuid": "13c7e5c1-fa42-489d-9375-968f56178509", "comment": "Malware payload", "value": "af559b5da8b43f80e00573db2c190a4fb20ebf0c8bf960c4a1c7a59ba1ae5c7d6611d8fc1e913a2d138b5454e67ed4d9", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152906, "uuid": "c14fc2c1-b26c-445a-b230-401a7b5a695e", "value": "BBA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152906, "uuid": "6e9c8c2d-daaa-4266-9764-ae689ff12458", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152906, "uuid": "a886a67c-e68e-4ea2-8e15-a9907c8a8e39", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152906, "uuid": "5cfdfaeb-0f9a-4e4d-8282-b68f384c4d0d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152906, "uuid": "3799e5b5-2d73-4d18-9e76-bc019215a059", "value": "57f8c73409c97d51369aa4d10ceb98469c86f998181c727ba38f3b26fbe57bac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12278a07-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126086, "uuid": "d7038785-a11d-411a-824d-6025f2c8a9c2", "comment": "Malware payload (Dridex)", "value": "2044d4ec556fe1f9e06ba63d8d6aaf3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126086, "uuid": "41d26acc-4120-4c4a-8e5b-26f8c982440a", "comment": "Malware payload (Dridex)", "value": "5840d7a5d452e9d5e180b82b25acae55d7547887f2bac377339b8b3f309507ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126086, "uuid": "aadb1461-609c-4a7b-a88a-64294fcafa24", "comment": "Malware payload (Dridex)", "value": "6e9686c11e52b24c5d300af1a65831ccc64bdc9c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126086, "uuid": "97301ed9-1c16-4f27-b949-2a7fef4da748", "comment": "Malware payload (Dridex)", "value": "bfb77d38e4dfb57a51eb9fb4677c7cae64fbcb730a1d22fc21781016063999f46ed6911cf4177c44d5eca0e9a2d7a3d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126086, "uuid": "2b8f6e10-4854-46a5-ad59-eae695a4dd12", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126086, "uuid": "09d1272a-d727-45a3-a39c-772aefe498af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126086, "uuid": "6e0140e1-3e0b-4584-a90b-3ee5c07a1aa3", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126086, "uuid": "38a397db-5867-4c88-a2c2-77a5523e1f75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126086, "uuid": "28ce57e0-20bf-4289-9ded-cd4b9d26ba68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126086, "uuid": "eaa5a0db-4e1d-40c4-8fb6-c2e609c1ce36", "value": "2044d4ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878f9a92-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152912, "uuid": "0cef4e91-c62d-45f3-8dea-aa6358dd1d0e", "comment": "Malware payload", "value": "03ced29ecea48dee66be63677e1341ab", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152912, "uuid": "e268a038-7dfc-483a-b462-356a75fe3532", "comment": "Malware payload", "value": "58c53260807f9d76ca29bf61e79a0aeca915d03866b0edba42023aac21507280", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152912, "uuid": "42a2a90d-2cd8-4e6f-9287-a08d7a9252e2", "comment": "Malware payload", "value": "27f1b51b0bb19f82cee735ea6d02433418a87b1c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152912, "uuid": "6fb99e49-7741-47e2-9a27-4c11a1d615bf", "comment": "Malware payload", "value": "5bd2d6241c39e4cb49098c7255c2b1cc1fefd5e533490bc3fe865cbde29877e7f8a936e86986b43c977b9e34986e7e3a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152912, "uuid": "2f649ed7-1818-4bec-8b88-10b0b7ec3d83", "value": "48A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152912, "uuid": "6f276c3a-16fc-480e-ae5a-54b85d0b89bd", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152912, "uuid": "af8d26b6-139c-4dae-88c2-3c14e31cc84a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152912, "uuid": "ce83efe7-e472-4739-aa00-ac212656c639", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152912, "uuid": "d7aa066e-d785-44e2-910c-a19482e2ec2e", "value": "58c53260807f9d76ca29bf61e79a0aeca915d03866b0edba42023aac21507280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c75b5d4-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152920, "uuid": "0300f5f0-19f4-40e0-aa0b-42e7adf9c81e", "comment": "Malware payload", "value": "2102d2fcf5a81e00bd0ed86faca388b3", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152920, "uuid": "1e827953-65c2-4a14-b11a-e5f22cde70b2", "comment": "Malware payload", "value": "5924a709ec5246f8ca3b2f0bdabc10dc31614d675f65b0d9a52de1a1a4ef0693", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152920, "uuid": "bc687b90-6093-4972-8e0b-67b3c851e947", "comment": "Malware payload", "value": "1e7faa1fba11f166285bbaec8459d007c8315840", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152920, "uuid": "dcafe03b-95ec-4e31-a5d4-a30ce7fad714", "comment": "Malware payload", "value": "58e5bf1a89e438c51630b90fd560c46a34525c3b262c1dde4267a1645ea59bb76a0b167cfdf63897136b96fc7ab71929", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152920, "uuid": "93c4d8d2-6330-4666-acf1-804512dcca65", "value": "1AC533BD71DE28BE82D4E772B7EFED287016A18D602187906DA381CD1C16131D9E9E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152920, "uuid": "9a3d9aa8-c83b-4e8f-977a-4e87d7c0cab4", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hf:tos909Qg6ecEZHyEexmLaI9MYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152920, "uuid": "d3152c51-2671-4cfd-bdb4-53e0982d1df5", "value": 2715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152920, "uuid": "01e09c8a-1c71-4f0a-958a-37ff7693318e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152920, "uuid": "ebb3b417-a555-4d11-ac43-f5fa9fad5ecd", "value": "5924a709ec5246f8ca3b2f0bdabc10dc31614d675f65b0d9a52de1a1a4ef0693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d87ece5-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620152465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152465, "uuid": "ff57712b-02a0-4813-9982-8204eec3e439", "comment": "Malware payload (Formbook)", "value": "02a32cc05efbf5236a8c0928d3c9170e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152465, "uuid": "1e44befe-2ae7-4fa0-a094-1ae6573b7608", "comment": "Malware payload (Formbook)", "value": "5930cfa7dd5664e104c299fce83451021349922b6b02774235eae6bd14fad464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152465, "uuid": "4a52a8b2-f36a-40a7-95df-5ecfa87f15bd", "comment": "Malware payload (Formbook)", "value": "fa3a639f15116da149b14d832b9255528f0bfe65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152465, "uuid": "698727dd-a0de-439f-b550-dd7e54108191", "comment": "Malware payload (Formbook)", "value": "49abaec0419b435dce7ae0e55d34ac381758333be7ee16a0735054e020b28af6ae0c65ef8a801c0f2ba11256cfce4205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152465, "uuid": "dccf9ae4-925a-47af-ae96-27e05351a5d1", "value": "D415DF2B7FA85615E5BA5F381835030067F4F01AE725C31F6E6860ADDDD2AC18E277E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152465, "uuid": "63aca0ae-c103-4f00-a077-0360b0994fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152465, "uuid": "ac676be8-14e2-4423-b52f-32aa51245a95", "value": "12288:hjGTBHP8LKMTnc2NOAbLWVUuxM5XQTOUZ9V6EnReYLuIsguNA4D6VvxErz2cqPSs:hjy9xkXB09V6EnRhxODMvmXsDds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152465, "uuid": "30b5d38d-967d-463e-b70e-0b185464de7d", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152465, "uuid": "fcb5c81b-44c3-49ab-bf8f-e1a5684dddb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152465, "uuid": "1fea1956-6f88-41d6-b5ef-b2122d97a4c8", "value": "Nuevo orden pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36858c04-acc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620123999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123999, "uuid": "d4e96bdf-cab8-4a47-905b-c542867652b0", "comment": "Malware payload (Gozi)", "value": "aaba239e1c2208a6f00bb10034cba621", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123999, "uuid": "9721a315-84cf-4df6-b665-3031f2ce745b", "comment": "Malware payload (Gozi)", "value": "59767b2ac03eb8320a661f410d53a025c8975b12de796e80b1c84306200f6a75", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123999, "uuid": "9f627768-1be8-45db-8a95-d1f6cb319bb2", "comment": "Malware payload (Gozi)", "value": "2520815cda4b4cdf652de337d4c9285e74d2a585", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123999, "uuid": "b89a94ae-51aa-4130-92f2-76bb55e8aadc", "comment": "Malware payload (Gozi)", "value": "25cdb8aa070ade8ff4f01565f308e1668468ab274399b952802b421745edb0a0f6f0fb509e4c47c022ff8fd48ddb49b7", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123999, "uuid": "9a451386-b880-4649-a636-e68a5e6d0c3b", "value": "86B4AD313192C136D1B15835CD0BE6FD26A1BC05EF2A194B36E23F9FBE356A19A32315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123999, "uuid": "c2da1a84-779d-4bc0-8cc0-2bb086399988", "value": "2b785b2204f63f9f118d4b3c0cc01ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123999, "uuid": "9b6f9986-ea46-4447-bed5-29d940f16bcd", "value": "6144:ZtuOlnq3kHzR1XyrOA5/NeQCJkGg5Q8eb2n1J3M5ScnH7dzVxWmuk:3ln/yrPXeXJk55mSn1FM5Syqmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620123999, "uuid": "ba701473-1f7b-4141-b2b9-422114e8849f", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620123999, "uuid": "c8555d55-e063-4ae6-9073-25f9985bdb10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123999, "uuid": "f44727f2-daf0-4d02-93f8-5bff93ff8b9a", "value": "presentation.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dab6a44-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152922, "uuid": "a293a1aa-a842-46ab-8acc-a602e916c307", "comment": "Malware payload", "value": "c7b6d03dbbec0b69c8327c3efdbe76dd", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152922, "uuid": "60b49688-1ec1-4cdd-9f5b-245475d480e3", "comment": "Malware payload", "value": "59d99de0628fc70138a6be0cd632290956cd1809a966a2e43181b5e896f5cca6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152922, "uuid": "867c12e4-c51f-404e-b123-a6a2f26897da", "comment": "Malware payload", "value": "fc271b8d8a8d41c38fe938499f5480c04169dba8", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152922, "uuid": "e45d01e4-5b53-44bb-ba74-4fcbb2b7d376", "comment": "Malware payload", "value": "166fb295f3f3b61c040b41aec82b9bc870af230edd39ebd4f12800372b00228fde331a4be7ce7b491a9c4738d1cd809c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152922, "uuid": "188c86b0-0b25-4b37-82d1-e4f34ea2d7e0", "value": "3:BjmEI4n:FRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152922, "uuid": "53b5af5d-65fe-4ebd-9c09-abe0e0f8b773", "value": 14, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152922, "uuid": "033724b7-503b-4491-90e7-df8771ec6db8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152922, "uuid": "ae2e52b1-f2b4-48b5-a6ee-696fa766d25b", "value": "59d99de0628fc70138a6be0cd632290956cd1809a966a2e43181b5e896f5cca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceb5903-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126077, "uuid": "438781c7-12e6-4aeb-8368-b7d7b2e5f0cd", "comment": "Malware payload (Dridex)", "value": "b3976dff4be6cdb50b469286f1b8671c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126077, "uuid": "61fcf950-5c29-4395-890d-9662fede9f68", "comment": "Malware payload (Dridex)", "value": "5a2fb32e9a062483ce5230076e6572b780b2d0c0090c147517085d799c3f8ff9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126077, "uuid": "8a8ca2d6-97a3-46fd-8e78-7a8ab5f999cc", "comment": "Malware payload (Dridex)", "value": "deee21e2f6e50acc6963243c7838d0a47034f947", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126077, "uuid": "eaf20fb8-9031-4957-a2f2-7758fe048571", "comment": "Malware payload (Dridex)", "value": "0505d14cfb2f6301f591363439cab3005f45f227f4bd7727ae89b2fd3670c37129fe9cd578f8af8a1cc40c64c45480fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126077, "uuid": "fd6b3b91-4ace-4bb0-8a30-3f7203abdc69", "value": "AAF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126077, "uuid": "3dd30992-3bae-4f1b-a44f-9924d8761cf4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126077, "uuid": "7a30ee23-5e19-42e4-9cfc-ac81a77cfce9", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126077, "uuid": "33c5dbbd-fd51-4a1c-ab35-11303fc6a2c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126077, "uuid": "effef667-d5c6-4e16-b912-c3231873a310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126077, "uuid": "f7f25a82-23f9-4250-8484-cffa77945b89", "value": "b3976dff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edcff6f-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152924, "uuid": "74ec4308-4763-461d-8f59-2e75d679164e", "comment": "Malware payload", "value": "543439d907e21d3a4d5b927cb7a74946", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152924, "uuid": "7fc5e221-f712-422b-adf5-caeac8f796e5", "comment": "Malware payload", "value": "5ad1ace53112cfeb6380b759a4d567a68c0a1991868e7ae2ae047b32ceef3a52", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152924, "uuid": "ed703efa-47e0-4e4e-b3a3-20be3a43b646", "comment": "Malware payload", "value": "6c63acb4df2bfa10051b8101adc26574eee0e104", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152924, "uuid": "6c24accf-59b4-4a64-9437-a9cae7f9632f", "comment": "Malware payload", "value": "15c94c2fd4bee4ea7848c4ebcf7bd7bcfce3d30f0bf243ae15c91afde7451f970c4e6c0538d0344c748df56327a348e1", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152924, "uuid": "4d421637-3ac7-4a95-9c0b-40061bc204b2", "value": "A4A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152924, "uuid": "687c0a10-8f41-4806-b29f-bedba32d72b7", "value": "96:3gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152924, "uuid": "1ebc9400-ac9e-4aa5-a145-8b603e47f4cb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152924, "uuid": "8db82d5c-1d43-4be9-a740-c56d8946c344", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152924, "uuid": "8a71440e-6318-48d0-985a-aba814f4410b", "value": "5ad1ace53112cfeb6380b759a4d567a68c0a1991868e7ae2ae047b32ceef3a52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710c54d3-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620104341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104341, "uuid": "26a33426-fcab-4dc5-a983-07d870a112ad", "comment": "Malware payload (Formbook)", "value": "c509b6a808c193e10da64c8835361080", "object_relation": "md5", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104341, "uuid": "742048da-e243-4285-9bf8-43157f9bca3d", "comment": "Malware payload (Formbook)", "value": "5b37a66d9c4dce04b671f22c0746f1472e9dc089972e4b0c949d3884bfcb2b66", "object_relation": "sha256", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104341, "uuid": "00afd51b-9520-48e9-8684-cc349fd9eaa2", "comment": "Malware payload (Formbook)", "value": "bc20b979b8d1e77d39389b5b9786a97bc76d1ac7", "object_relation": "sha1", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104341, "uuid": "0d72928d-2a9d-4ba4-b203-b4e1b635d1c1", "comment": "Malware payload (Formbook)", "value": "89bdd3ea3c38c8479906075d57af2d54ff24c7a54451c317edc0a66dc4f486f2f4ef993d51d89ffe573f99afeed9e4f7", "object_relation": "sha3-384", "Tag": [ { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104341, "uuid": "0c4cb58f-5951-483e-9bd0-d8ac0e9b5fe1", "value": "E82423D817D68102E10413E204F74BD70FCDDEBF768969190A9898BBC5BBB9C41E2D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104341, "uuid": "b652eb76-914e-4fa3-99b3-d65cdbdce9b7", "value": "3072:vARyFNeIswDS7ubqTPDhFsu3CX6d4oqoM9WwJdGBmX4lwlx1Ky8sI6SRh3sxL0m+:PFIwOS6PDhf26d/qrUKQC0w4y12sx4As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104341, "uuid": "6dcd0d04-810f-4a29-86a4-0e7064a1562a", "value": 219890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104341, "uuid": "29ae5d19-4c19-4d51-a3dd-2511c2c90300", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104341, "uuid": "89ce1ff5-c259-4c00-bfac-2eb3fc6dcda8", "value": "202139769574 Shipping Documents.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac9ab7b-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115309, "uuid": "ce928b47-8243-45f1-9369-df27ca846645", "comment": "Malware payload (Dridex)", "value": "90f5818a06479a23446f76cbc9b2e2f1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115309, "uuid": "8ad59259-7cc4-4c85-984d-8bcb969aa16c", "comment": "Malware payload (Dridex)", "value": "5b39fb108e1efd77f8d3fe4566dc58ca4701f904f8e9fe81be28ce9dea281137", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115309, "uuid": "71364c32-f3b6-45e0-8084-ab2ac0f961f4", "comment": "Malware payload (Dridex)", "value": "0774373ad29c9723c159cea0b2f33e4b6c633511", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115309, "uuid": "815a7ca7-e44b-4775-bbe0-d0880748f80a", "comment": "Malware payload (Dridex)", "value": "69c16c303a0e29095b26fbdc075504469a9dfbe9a6737c6b382623491a06a09e9afac4b2becee4fc4c86eed651f8d491", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115309, "uuid": "6d32c52f-83ea-4cd0-9bc3-77825b33c014", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115309, "uuid": "e67daddf-5d1d-4223-b179-ebcaada8a0f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115309, "uuid": "e06b41ba-fb36-4e47-8d8f-94ebb16a6e2c", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115309, "uuid": "d4406ddc-9bb6-4673-b9b5-237459c01e41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115309, "uuid": "5ab881ce-1d23-4069-bf0d-2af9f1b2a76d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115309, "uuid": "950c8cac-ca61-4c3f-801d-d0496bcd5b26", "value": "90f5818a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d441ca-acd8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133123, "uuid": "3331fdc1-2530-4bd8-974b-032179d8e5a1", "comment": "Malware payload (AgentTesla)", "value": "ad599fa4527aaeae68b57e6671686218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133123, "uuid": "223d9363-7a77-4b2a-98a2-814351f83cdd", "comment": "Malware payload (AgentTesla)", "value": "5b47e23b2eedf1f1c3fb2f38b573e783920befab88279c2eebd229f5507f6934", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133123, "uuid": "95548d09-be5c-4433-8107-48d04223f7b3", "comment": "Malware payload (AgentTesla)", "value": "e042e1003f3b67b786d1f0e890923c7340bc3cfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133123, "uuid": "59daac8c-3c71-49d1-8f88-20b77ff3bf95", "comment": "Malware payload (AgentTesla)", "value": "1e6c26a4f4bb48e2fd7a3ee2a5f0b0bbea4e54d325164adeb3147ac4f29bce71605c6cecef3e2a7a1b30d881be36edc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133123, "uuid": "5ca01a58-2730-4a23-a2ec-2a014afbed63", "value": "51D53A02AA947E10F67D173785B48820DBFBFC01EB73C51E69C8B89D5AB3BD48A15712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133123, "uuid": "fa86967a-0cd4-481f-92ee-9c0541bad108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133123, "uuid": "f02600bb-ea69-4416-966a-d04540915b48", "value": "49152:mpZQUk8B25bKOdHQXGY+8ciVwx/rd7Yj7wyqlA:mDQUkR5bKOdY+8ciyJp7YjXqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133123, "uuid": "bcfc13b1-e29e-407b-8fa4-cfc9832ba51b", "value": 2897408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133123, "uuid": "2014b9d4-20d2-4adf-9050-1ec6af34e002", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133123, "uuid": "01f98c42-9459-4f90-bdcb-1832e387f615", "value": "Payment Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2046ed-ac9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620107983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107983, "uuid": "fdfee4ce-9383-45a7-8942-37f73a472c54", "comment": "Malware payload (AgentTesla)", "value": "24189b85b98aa717fc69697e03b96b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107983, "uuid": "213892d6-e9c8-4692-bea2-8433422f2e44", "comment": "Malware payload (AgentTesla)", "value": "5b535c36958568c9226db768eca93aafb3b0b80e41018cc10ad5d42dd188c4ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107983, "uuid": "bd10d80e-6c87-416c-bd37-1dcc80b21a0a", "comment": "Malware payload (AgentTesla)", "value": "f980749755a1f09ae5782b698da097871b37ffa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107983, "uuid": "cb55bdaf-6349-42d9-b48e-a8bdf48045c8", "comment": "Malware payload (AgentTesla)", "value": "caa8d55c5597af7b50ecbc5f65af96e4d239407449d063782403319a32f2dfeabcca559c0b78242631501e9a696b0bf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107983, "uuid": "6c053581-e420-4223-914d-a38049d70621", "value": "5A65AEF876047DD6266F576BDA96ACDC13B627239A8BA4CC8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107983, "uuid": "80bde7f2-8491-4ba1-908a-aaca4f5baae6", "value": "24576:LxLQ67Lwtu2XbX6knBHXQ/WFU+mrOJHgNUJNwUF7BMvQ3fqCCTzRwo/flII5ZgmE:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620107983, "uuid": "7bac416f-cbe7-4cbd-b2cf-d458780bc851", "value": 1435363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620107983, "uuid": "f9b407bd-9c8a-46c5-a00c-f1757662c332", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107983, "uuid": "a981a72f-dc6f-47e5-81b6-27d3c5b0163c", "value": "LM Approved Invoice-03-05-2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900facb9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152926, "uuid": "4481b518-e5ea-4a64-a32b-a6e6d5f2e701", "comment": "Malware payload", "value": "6543b91c70104e3b8add9da404d25c28", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152926, "uuid": "33fb3877-02fe-4e6e-89dc-ca7876f579a1", "comment": "Malware payload", "value": "5c6a8b6560c45e467989306a9d3c8e694bbd13eacfdfeb5ff777e3875c3b9988", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152926, "uuid": "dc73058f-478d-45f7-9adf-0df4a5a07791", "comment": "Malware payload", "value": "af05360c44d4e11d3d6277947ba13f92eeecd8ec", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152926, "uuid": "d8173a5e-2ba3-4f28-94c8-f110914616f2", "comment": "Malware payload", "value": "1b22a108e63d66afb523c078600d577a1383a39ff541ac0583c10da9fb60dcbd7216b6215f809995058dbd63b1f0f34a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152926, "uuid": "a322bf7e-801f-4167-9f85-a133a4e976a9", "value": "A1A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152926, "uuid": "a0004874-af96-4db0-83b0-9cefc8509b02", "value": "96:n7RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:7RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152926, "uuid": "183e3c8a-f797-430d-8eb5-9dd1ee4d39a4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152926, "uuid": "0301edc3-02c5-4f9a-991a-b04833606477", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152926, "uuid": "9aa86280-e5af-4e2a-b40d-37488369838e", "value": "5c6a8b6560c45e467989306a9d3c8e694bbd13eacfdfeb5ff777e3875c3b9988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0abd6e-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093731, "uuid": "83ec47b8-c16f-4cd6-bec2-b7731bf508d9", "comment": "Malware payload (Dridex)", "value": "f7fbcce51649a78f3d987dc5aed53572", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093731, "uuid": "be21fd50-5b72-45d8-9a01-68fe19bfaa65", "comment": "Malware payload (Dridex)", "value": "5c9f25e53b50134aff8f1e315eacf9c19cb25198dedc838e2e789ead45993af2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093731, "uuid": "cd0e1c91-c6af-4d7e-8ad6-cd1f9d787268", "comment": "Malware payload (Dridex)", "value": "9812da70098e93ba84453f4f1ab60b79301a6adc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093731, "uuid": "46301ffe-2c12-4fea-a396-4b46481e645b", "comment": "Malware payload (Dridex)", "value": "838d498e88644856e681861fe861da4ea69f0f4eb5142985cc0bab8066a8098d2f6e4c7c4e8289225d4228e4a8813346", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093731, "uuid": "9605e4b2-248e-4d64-9542-dc2675785026", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093731, "uuid": "3c0e25cf-d7cb-4bf8-b061-148f8a1e459d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093731, "uuid": "83a360ca-ef24-48d9-bad4-f3253f0fbe7b", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093731, "uuid": "fc96f8ab-a55b-4e8b-b23a-6c0feaa9e08d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093731, "uuid": "a2510043-5a8c-4a8f-b8d9-54d756719dcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093731, "uuid": "e3e7e254-0068-4e93-bfa1-75fca23b1d4d", "value": "f7fbcce5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0299f4-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620126102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126102, "uuid": "f07d203d-072b-4f68-935a-493f47495f26", "comment": "Malware payload", "value": "7d4d366f9760f43ddf5097fe84c2ba71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126102, "uuid": "70d0fafc-f9f1-41e6-ab86-6c1a383f471e", "comment": "Malware payload", "value": "5cb02c8020d84adb3e8436a32d3b98732282878f58bfc03da6b95aa2f22193e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126102, "uuid": "c2d70a9d-37a2-4566-af31-d6ee0b624672", "comment": "Malware payload", "value": "309610408932cc8543526b4df9c4962013eb4e88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126102, "uuid": "5014be60-1a89-4b41-8a2a-a20e54d1660d", "comment": "Malware payload", "value": "d1ba67ef521242e91dda4170c89cc044f2012b1e0084cf437cd0070df42e6ba8057ec52972933e643809affbb16076d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126102, "uuid": "6466e084-bc7f-416c-961c-384872f47294", "value": "0C96331B3D84648F7D6C1B0C8BF253899B24DDB532CB4BD1EE13A062B42A3F25B15366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126102, "uuid": "174af4f5-cb91-4df7-8c2b-bab0ed3764e1", "value": "196608:uTZeQAQfSY8eSWXv8H0zAL/rxlI4EPjkSbFrRUZXhmpdukAlZ:uTZ8QqY8eF0H08L/rxl3EPXbFrRuRmub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126102, "uuid": "57b7fdd9-29dd-4466-86f4-88a742d29d69", "value": 9104290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126102, "uuid": "9ee515d9-ba1f-4992-958f-1d54a15edab2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126102, "uuid": "4cac3b4a-5594-4a91-8641-7a9ef4a66172", "value": "7d4d366f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de79c464-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122563, "uuid": "5c06b6b4-d352-41ea-aac1-badd31e54403", "comment": "Malware payload (Dridex)", "value": "24dd695e7f1968209747c7efc029121c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122563, "uuid": "e4ac9d36-50de-4a5d-a91c-a29a64f21cb7", "comment": "Malware payload (Dridex)", "value": "5cc69f628e69bc022d2746c817c632ed07658ba07a2311df7674236d44657d73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122563, "uuid": "53ed8fdf-5cd6-4236-aeba-8b91af6fd65a", "comment": "Malware payload (Dridex)", "value": "1c38ccafb152dcb9eec86ce1e2283e0ce3532700", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122563, "uuid": "382ea3d9-6ac4-4bc7-8536-c661587b4a3e", "comment": "Malware payload (Dridex)", "value": "ea047a243d46a9d29a110ea469911b4818eece9059ba4d5b2960b957bba6bdd5c90376f4d7fdd6281cc657feebc9d033", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122563, "uuid": "5f985f05-512b-43dd-b708-fd9e40e4be5c", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122563, "uuid": "89fa112e-fbe4-4417-9418-aaa9c62fa1b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122563, "uuid": "3475d8f3-cad8-496b-84e7-0b0417d74b74", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122563, "uuid": "62b475fb-db7c-4ee1-8317-e11397c4fb05", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122563, "uuid": "708c3c8f-eb67-423c-bd68-dce43798a683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122563, "uuid": "c9f3143a-d663-4504-b0a0-9d4d81ba1200", "value": "24dd695e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998aadbb-acb9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620119870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119870, "uuid": "fe429252-29b5-4fc1-be4e-f0b9abd502c3", "comment": "Malware payload (Gozi)", "value": "4ea47e933317499aecc740bfd9adcbb8", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119870, "uuid": "56e691c6-8ee1-487d-9f20-170267e62e0d", "comment": "Malware payload (Gozi)", "value": "5d002f8a395fcc9a680a9ef4f78a8674cc0757850b02bf12a8ef4df79e2e4bd3", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119870, "uuid": "e5b266ec-121a-4d82-9656-254e04a2d8de", "comment": "Malware payload (Gozi)", "value": "6b26f847dad738687c05c039d738d2f09293b414", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119870, "uuid": "9efc71ae-ed2f-4115-a0fe-91226dc7f713", "comment": "Malware payload (Gozi)", "value": "d4b28293505cc7471e2a21bd008540deddd310194d3f98dcc5494483172af31fd41462dae57f9b72e73b788f8ab34f44", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119870, "uuid": "5af0c4b1-300b-440c-a1e2-51c54ff0cf78", "value": "43A4CF1275D28138D07387B68077F99107EDBD654E325A9F36C82E9FBE324829736722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119870, "uuid": "ac1fbeb1-c4c8-4268-8369-e8b225661c05", "value": "a2e883fad07aadcb044a42ddd8dc88c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119870, "uuid": "1c60a000-8b82-4b2a-9a5e-200df80547b7", "value": "6144:Rt8/Eoy0lv6/dSe0PEZrNw2SXCDHYZZD8ePkF5GQnuID7f1dBJ4/zc1hF:RtiEoyySMM+bXAHSZNPk5bn7NPJ4bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119870, "uuid": "ca42f767-f1dd-4dba-ae11-33cf8f0a422c", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119870, "uuid": "724916d2-0c45-44aa-93e1-e1798e420c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119870, "uuid": "f6e2a9e2-f666-4d32-8331-df35f6baf83d", "value": "609110f2d14a6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e6c305-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090068, "uuid": "30eba689-9a66-4397-abea-407966e5b3e6", "comment": "Malware payload (Dridex)", "value": "9b3999ee3fdf77212c78d3d6894c7691", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090068, "uuid": "f68c4df6-59ce-46db-a154-a80f642b4d02", "comment": "Malware payload (Dridex)", "value": "5d285614b51cac09bfc0bfee05dd6c037119278069151bad4ec71a8d197650f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090068, "uuid": "9f6880c3-f752-4852-8841-4c04ec333eef", "comment": "Malware payload (Dridex)", "value": "707ec0963223c12ff5663bffc08b8980200285e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090068, "uuid": "681e530a-e0aa-4b1f-aafb-457329f86e0f", "comment": "Malware payload (Dridex)", "value": "e407dbfbf7fd8a2c8e12e70ebf0478bdeb95c48c0b45cc5ca18c0853e3bbc37e5b16da252e23bd991c905eb8c0bb57f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090068, "uuid": "eadc3f17-6c8f-4211-a09e-4d39454984df", "value": "05F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090068, "uuid": "d31672b7-f6ef-4669-b0b6-66c147aedb1d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090068, "uuid": "68de56e3-0448-46af-8b50-1103b35956b8", "value": "3072:dIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090068, "uuid": "dc04f4e8-19c5-4608-83ed-0bdde0af3166", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090068, "uuid": "f55559ba-b54c-46eb-baaf-5f4371f1a55c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090068, "uuid": "a3e264ec-04c7-434a-9b6b-c9ffb2684572", "value": "9b3999ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05cc26c-aca3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sazoora)", "timestamp": 1620110433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110433, "uuid": "ee682bb6-0bf6-4a35-bc8b-6e3527c39995", "comment": "Malware payload (Sazoora)", "value": "c382203a6097153580124f8863b09b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110433, "uuid": "09f53a84-d6fc-4f1c-8534-4c25d9611448", "comment": "Malware payload (Sazoora)", "value": "5d932142aa0df04570cea8bba6291c058438d41004554f058ea7d866b306617b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110433, "uuid": "f5d172a3-b6fa-4422-9745-1fc761e03165", "comment": "Malware payload (Sazoora)", "value": "827a812ac1047593ba7f6faebb2596c8f90c3b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620110433, "uuid": "69c7adf2-90dc-45b6-801f-31032002f519", "comment": "Malware payload (Sazoora)", "value": "023ac65b42f639d1bd9421f1c192953bb5dafbaf71defc66d0531bee156ddefad47bcb06c50815b95dd2985cd9275a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110433, "uuid": "c48cb894-c392-49b4-9413-7851e0e4be58", "value": "8D06CF02FA41C562E2670230E9AE77BA053CF5344B2085C3B7946A385AB56D17B3BF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110433, "uuid": "0ac4404d-38de-46e6-8d52-ecb2f557a77c", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110433, "uuid": "b5f88dcc-7412-4087-91fc-63983b58cfe8", "value": "49152:ZXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VI0:ZXrEeZzdhjuV/gd1VzsGUqNKTHvQeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620110433, "uuid": "67245460-1d0f-4d5d-9c93-5aa7f7b2eba6", "value": 3941888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620110433, "uuid": "6f283d8b-abf6-4b26-8df6-8790e73406da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620110433, "uuid": "40e3dd25-b9ed-4f88-a2dc-d235ea167381", "value": "C382203A6097153580124F8863B09B8B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251c836f-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090040, "uuid": "9aeee864-fc46-4547-acae-770bede76f27", "comment": "Malware payload (Dridex)", "value": "184a03b324437ba26c82d752c1ffdfd5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090040, "uuid": "66b8c545-dee2-45ae-a515-f4c9558bf92b", "comment": "Malware payload (Dridex)", "value": "5dbb40658f2c7f9feae2576d57c79f4081b8c53f14704a0518dc02edf0ceec23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090040, "uuid": "db9dd399-d6c3-40cb-b1d0-638f4f23f424", "comment": "Malware payload (Dridex)", "value": "b210c051f6bfd24d7ae36c35775902eec590c61c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090040, "uuid": "f8d9f64a-bc40-4464-b714-6cc46dd4d957", "comment": "Malware payload (Dridex)", "value": "d7ad9eb6e280f936f3aaf16c4f83b0aed032d6beaaef60c268a3f69d30c9af68ad4834a5dfae58d3ff0297a5b7b14efb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090040, "uuid": "a4e527d3-9a44-458e-97c8-75ea439fe2c7", "value": "C2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090040, "uuid": "4cf04daf-962d-4b16-a35a-f80553486e62", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090040, "uuid": "2ff8e834-9701-4957-ac0b-c621ab977a7c", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090040, "uuid": "b739c676-a880-47bb-a5ed-6931c85fc93d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090040, "uuid": "66da05d9-60fa-474f-b079-053b1dd0ebab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090040, "uuid": "226acf2c-35f8-4dd5-910d-130e312d714d", "value": "184a03b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9a22a6-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111685, "uuid": "6665988b-32e2-4377-8a33-98344c8a178a", "comment": "Malware payload (Dridex)", "value": "1837cc1afda6225b20bcbdabdfa34def", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111685, "uuid": "9a4bb82f-e1e3-4c93-b4b4-726fe5f5e818", "comment": "Malware payload (Dridex)", "value": "5df46cd7030551a06cea158aa352d947c285413037b5303ecf903e7d10fa90af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111685, "uuid": "498b5aa9-6eff-4575-96ee-e790323104bd", "comment": "Malware payload (Dridex)", "value": "4d7d4f2938a064bd17b5e82abbd20c57fa0737a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111685, "uuid": "77f721c4-07c9-46ce-96f6-b1a7f86011ec", "comment": "Malware payload (Dridex)", "value": "5cd9c8777fab05644b1a4658f35dd9a1c4166afda082cc9a248b2aba781d89a6be6dcd0171622e25363f155b0f925563", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111685, "uuid": "6cd89473-c7c5-4b30-87b7-86fc66f0fbda", "value": "3FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111685, "uuid": "9b5c977a-03b4-4df8-ac15-22e7dba7e7c2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111685, "uuid": "26e7d429-6ff7-469e-b6c5-94fd6e7af9f5", "value": "3072:0iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:3eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111685, "uuid": "1fa7aee6-c0a8-457c-8984-ae77fd40153a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111685, "uuid": "c43cbd4f-8f67-4fcb-9b6a-56d2e650e640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111685, "uuid": "ead66672-04a9-4eb5-8817-2ff7f12d3d8f", "value": "1837cc1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8a2ce4-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160837, "uuid": "421d1ce0-4db0-48e1-97ea-9c3d251ef8b0", "comment": "Malware payload", "value": "4f57e1b16bb870fb06ba398a280dd535", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160837, "uuid": "a4ae6811-9656-4883-b5de-702fa1b032fc", "comment": "Malware payload", "value": "5dff18b1dd2f535a73303c9cdfe02318484ba7b874d0d01f9be3073d20d89b22", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160837, "uuid": "64db0ec8-1e69-4c7f-8e01-136e0ebd73e2", "comment": "Malware payload", "value": "3ad1691669a47e8e1a5d803cc669f62c1001757a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160837, "uuid": "729b5a2f-5928-4a33-bc2c-766ac58de53c", "comment": "Malware payload", "value": "546ab8a9cec7108fa8b65c81583c53a6a82f10363ad0a725e77be2f2f608adeaad878f0a1494bbee6938702eed8888b8", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160837, "uuid": "b4665d48-053d-401d-a3f5-09db20f2d1ad", "value": "803186B32DC291260316EA93F785542CE728940E9943344CA5EEC94DB1D0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160837, "uuid": "6a583240-f9bb-450f-9b70-ce720d2da446", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3fa:GEXfhexTvrtWQZUSePSiJVAyrLMfSWqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160837, "uuid": "9eda06fc-0c89-4a84-a33e-b23a85544c89", "value": 1719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160837, "uuid": "e4dda969-1041-4afb-a6db-fcc71c5b8236", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160837, "uuid": "8ea1e2dc-ec90-47fe-88b5-684a71aea713", "value": "Vg7m1sEr.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d26e04-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152935, "uuid": "dc2b5116-2ed3-4510-86b1-59947f5876ee", "comment": "Malware payload", "value": "37f5cbd212d7348a3cccb4b753aa66f0", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152935, "uuid": "00e50a63-da65-4bf6-87f9-a97ff6c7ef69", "comment": "Malware payload", "value": "5e2fa7bbbebbcc9221e18d0dbb87300a88fe3f57fa7d10320bf96aeaa29f8fa0", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152935, "uuid": "0ca3cca6-13cb-4135-baa9-28c96c617730", "comment": "Malware payload", "value": "bd63669756a815b8128e44b91162e409118db5e5", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152935, "uuid": "cf0d609a-7830-4562-8c46-1a9632ba289e", "comment": "Malware payload", "value": "d3b1e178dc16c86e878c78a2f6f99b0bde6fc5ccf9a97d53ba381fc7f477f9f4b75d3c20e326a8c05bfb64baf6f717d5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152935, "uuid": "f537b971-b9db-454d-b3a2-4c0c2d261fd5", "value": "3026337CB0E939FF83946972A3DBDF20206A19CDB0A193529DBBE5870416331E4F7919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152935, "uuid": "a1a99782-0dc0-4c2c-ba3c-adf8bb992f76", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+/:td69Qg/JFeQ5x7bhE8SSdP8v+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152935, "uuid": "5599e554-c717-403d-94d9-ddd61de6493d", "value": 4452352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152935, "uuid": "a40ac8b7-d195-48da-a87b-d40ef241fd1c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152935, "uuid": "e32e84e9-80e7-455e-8781-97f6463c39fe", "value": "5e2fa7bbbebbcc9221e18d0dbb87300a88fe3f57fa7d10320bf96aeaa29f8fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd43ec6-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620144094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144094, "uuid": "b2d3f963-3132-4d6d-a80e-be3d4f8a7710", "comment": "Malware payload (Quakbot)", "value": "28b17097b94798543c9ba87e68a4a932", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144094, "uuid": "f4901057-04da-4633-971e-4a633aad5561", "comment": "Malware payload (Quakbot)", "value": "5e317f119a35d4b03733b6bbe4976b0bfaa8d0aa9fd3e8469d18ce1b7c0a45ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144094, "uuid": "e56ebed0-251d-4efb-acbc-0245fa88349f", "comment": "Malware payload (Quakbot)", "value": "a19aae90e40885484cb73adea45d6f870895a6d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144094, "uuid": "57ee0743-5f31-4ca6-af8a-218dce852cb0", "comment": "Malware payload (Quakbot)", "value": "c06e8fa6854a0a6b70c660ad972c8c541b68edc7d92a553298f2da3aadb3b5a2de193c9dbf54e8eec6e9f714589a378a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144094, "uuid": "2a4c017b-3cd4-451d-ac55-992a4db00b45", "value": "75A4AF6CEB62D977E1182FF492C35F940B53E9D17560660E42B01F2E3D993E53C3AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144094, "uuid": "0d783f87-3b65-4fb9-9f6e-9182fa81c7f0", "value": "bb6c5cd9afdd44aa768f3e91032660d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144094, "uuid": "2eb6ff8c-e83b-4da8-9f05-b6a095536b25", "value": "6144:K4kYHG/5aWHq/Ca6VbrdRNNcjuQ/9zoaV3Eegof:KTHq/CjtN6juS9zoadEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620144094, "uuid": "f22eae12-0d71-4f92-8828-5db0a07a04e6", "value": 483373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620144094, "uuid": "4671894d-daa1-446c-bd99-8a1c9dbabfdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144094, "uuid": "ae7fc698-1a1e-4add-85ac-6149ffc200c4", "value": "28b17097b94798543c9ba87e68a4a932.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e87a911-ad0d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620155903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620155903, "uuid": "b91e840e-9552-4fb1-a592-6232999a4e3d", "comment": "Malware payload", "value": "158e499db47d9c6a56449c86f3b1596f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620155903, "uuid": "c6e56d5b-d78c-49ca-a705-94357ba5e295", "comment": "Malware payload", "value": "5e7fe9a4eb6dc098b6ed28b083d277455d66a515e7c78b270ad0515a90279f45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620155903, "uuid": "92fc486a-e739-4a51-81ec-ae5de224c89f", "comment": "Malware payload", "value": "6d0e9274649112ec7e9a757168b7de6eb2c48ff2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620155903, "uuid": "73be137c-c6fd-4252-be0a-b0f924560957", "comment": "Malware payload", "value": "f2cc57c6899bfd181654184259a46a8934b12f4ade53e27f64bc5eeffd4ea072e7b6f340bd41abbcd2a2bca3daebeacd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620155903, "uuid": "e1c27d8b-8823-4822-bc92-b81d46e9e397", "value": "FB9302633C5500E0D3D76AFAE8A0312C9EF52D2F2667512EA321539BAD720D13C9F639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620155903, "uuid": "673fba46-dcb5-431c-981e-574f867a6701", "value": "1536:jQUWNY6UPs/c63J2lk4Gjh3mkGaWIpOJcJ8BsjTxfNbQxds7WQGBJeDS8:jQJG6UPMtIlkdjh2kJWgjpfmb/eDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620155903, "uuid": "c9155f9e-22fd-43cd-ad5e-d182c750cb23", "value": 96745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620155903, "uuid": "c1819df6-723a-4336-991d-aace5a1bb76f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620155903, "uuid": "cd057632-00be-4988-ba14-7e704fefa865", "value": "PL_503_13_570.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67118c7a-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620095304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095304, "uuid": "ca857f79-b4f2-4eb5-81b5-ef62cddabb3f", "comment": "Malware payload (RedLineStealer)", "value": "f345a855216552ed4af432710b86298c", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095304, "uuid": "3cf95fec-95f5-4d40-afa6-22cb6b6d351e", "comment": "Malware payload (RedLineStealer)", "value": "5eb9a632e38d5f74537f5c87e953b772e5eabce3f087ddfc55545611b88f2777", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095304, "uuid": "8f9a1804-6fa8-4126-9a27-bd96e1fbd701", "comment": "Malware payload (RedLineStealer)", "value": "e9a38ea946e27819277744574901945e4758bc66", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095304, "uuid": "267364b7-6dd1-492a-b01b-08bded5850ef", "comment": "Malware payload (RedLineStealer)", "value": "912c5f6b96c288099ac493e01c64cf783857d7190b67628f87169d73c001595aa1fe83a53cb802f1dbc93c3068d8bb1a", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095304, "uuid": "d05b8f88-a210-404d-b426-241610160a27", "value": "353512202190D076C0BB14707DFD8EB85A697EE50BA45987B6C9F7AA2F703E076782C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095304, "uuid": "cc83d7d0-8f2a-4928-9b82-198023aa200b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095304, "uuid": "94f86154-7196-4d16-8738-8633bbd6a2a3", "value": "24576:1k70TrcCA2F4QlQbIngZOVCAz9UrjreHRZot8W3B:1kQTAj4lQFZOtzyTnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095304, "uuid": "58733368-75eb-4152-85a8-d3ed7592190e", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095304, "uuid": "bb6178c5-1790-40c6-8a60-942f56312db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095304, "uuid": "23d26239-15cd-4310-a30f-8c100d9a0df9", "value": "5eb9a632e38d5f74537f5c87e953b772e5eabce3f087ddfc55545611b88f2777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a59d7e7-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152943, "uuid": "c6ddb245-53e1-4a6f-aaf9-abc8dbd29a42", "comment": "Malware payload", "value": "8f2c7ecb85ff8fbb6469806fd85fe9e2", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152943, "uuid": "a1d4cd4e-24f6-464c-811d-cba019eed6fa", "comment": "Malware payload", "value": "5ec40e8c40494ee3321d3931ad2fb1f4128d7fbed9f06aa94960b569cd518a52", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152943, "uuid": "6d41de43-703a-4576-9f66-60d5c44b8ba7", "comment": "Malware payload", "value": "c3f5129f2a7ffb2e7146b02b829f34f7bef39e52", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152943, "uuid": "10475adf-3914-440d-b03b-0cb79fa30f8a", "comment": "Malware payload", "value": "5b8c54bc5feeb66bc8673a7035604c3cbb4f8b09d893c118a90423304e85b3b81e0e0e6436e7d4b4bdeafc8bf342bca2", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152943, "uuid": "822a2145-05eb-4acd-a47a-42352e177d40", "value": "19D533BCB1DD28FE82E4B773A7EFE9243016A58D606143906DB381CE1C16131D9E9E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152943, "uuid": "6cda691b-120d-43bf-b3c3-a8e3d804eb39", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4h8:tos909Qg6ecEZHyEexmLaI9MY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152943, "uuid": "a48c046b-b20d-4139-b3a5-be74d1821c54", "value": 2797568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152943, "uuid": "b87c3c84-6aee-4bb7-94b8-a46d7018a0ae", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152943, "uuid": "0e1b6649-8496-4515-8a1a-4db3d935f6fd", "value": "5ec40e8c40494ee3321d3931ad2fb1f4128d7fbed9f06aa94960b569cd518a52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3efeb2-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120383, "uuid": "8b2d44bc-c87b-481d-ac6e-ed009001589c", "comment": "Malware payload (Gozi)", "value": "f7b799ce96efabe25bf1d0e729e14741", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120383, "uuid": "c5875321-c81c-4ede-ad46-16f39bc06c19", "comment": "Malware payload (Gozi)", "value": "5f7374e56eb5a147fe5cf0fd243186023d1d498063fe38d90a39b7459cb2cf20", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120383, "uuid": "7c617300-07f9-49f5-b5d0-633f30630b82", "comment": "Malware payload (Gozi)", "value": "743601e881d9b0ceb3c090188b6db7e010860f6f", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120383, "uuid": "3f5eb14d-e535-4ec1-a79f-dd37c0f90da4", "comment": "Malware payload (Gozi)", "value": "0a3f277d880151f359b6fcd959bad47edbacd18abdb878b7a4e6ea9f05f8786b7dabb8e80ede742b1837c6ca7a323dee", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120383, "uuid": "121866eb-fb23-4c83-8095-89b8cb1b7346", "value": "C9245B6AA2E40695E9BBDAB5CD53C61BE7F334441B28D70F03B0CA656F57321F228352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120383, "uuid": "59f95e5b-a0ab-4f24-a514-d10c2d1ebeb4", "value": "3072:fWLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYPr9fGWg+Bm5kQpDLm:4qO/rsPHN7Q6l7Bz9zhvNJYPrg15L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120383, "uuid": "fff24161-5ca4-4e23-8b5c-9985148ef8ce", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120383, "uuid": "88be04e3-af0e-4153-b3c3-235a55030b83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120383, "uuid": "195f92a0-f171-4d53-88e3-f5d78e8551f0", "value": "19494460000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b96bc1-accc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620127857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127857, "uuid": "26df8817-c556-46c4-a19d-9fe1c0c19058", "comment": "Malware payload", "value": "a9bca0889a464119b345db7b0ecd79a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "NoonLight", "colour": "#9270BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127857, "uuid": "0a08c1d9-a2b8-48ec-a19f-f7ece769a4d0", "comment": "Malware payload", "value": "60fe4a1f0ed577bfa8d10195a3d1123b0a7ab551d3579686ee6ac6bc18282fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "NoonLight", "colour": "#9270BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127857, "uuid": "bd523046-5efd-4410-8ae8-6caa8841c738", "comment": "Malware payload", "value": "8a49203fa94921fd6eb80710756a1ab6dd917a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "NoonLight", "colour": "#9270BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127857, "uuid": "6832459a-a6ef-4131-ba56-1014dbc19dda", "comment": "Malware payload", "value": "43e81f4a12664763b33c06729ab877c7215356ecb8208d42140ab0aca4c416eaaa94faade41d137d7f3508dda028a7db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fakefolder", "colour": "#E34D49", "exportable": true, "hide_tag": false }, { "name": "NoonLight", "colour": "#9270BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127857, "uuid": "9255e571-c8e1-4788-86c9-224ec657b8e3", "value": "00E27D563B036817D255C83B8C5287DDA332AF255E133F4E6A583A9A3D360A62F32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127857, "uuid": "a3ab0970-135b-4455-9523-8ce89b06100a", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127857, "uuid": "596545f0-c441-4fc8-b47b-d887140c6c54", "value": "384:VmpUto8E6qhIA8ZfiSM+3/marB4djzuf4uFfTlCTZ94GgR01eEe/tfF1XfvgmraJ:wpUt1E/8mS+amkLFRccny45nHguUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620127857, "uuid": "d44f962b-6bdd-483e-b421-0a79721c5b98", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620127857, "uuid": "8e484d9c-fd45-4d79-9d08-95b432231d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127857, "uuid": "a5a5fb36-7d5a-4027-90ee-3591af46f7ee", "value": "NoonLight.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d658c-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620143750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143750, "uuid": "0c286f26-063f-4e00-9a37-ae65448822d3", "comment": "Malware payload (AgentTesla)", "value": "106ada585df884b13cd6a8a71e404c78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143750, "uuid": "d727c9a2-72a1-4283-ae47-d8e58c48d832", "comment": "Malware payload (AgentTesla)", "value": "612d1888d98714893e69c4649a46a990c9c26367834d5be5afc05df15e913572", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143750, "uuid": "abfcb180-e6f8-4a7d-a6cc-c48b8c5993a7", "comment": "Malware payload (AgentTesla)", "value": "470e8dd108972fe65c027b9d4856aa365b69fd9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143750, "uuid": "f8feb2d2-afad-4ea7-b716-9ace13946314", "comment": "Malware payload (AgentTesla)", "value": "ab1e7f9560dac9bb74250526f6980bf9a1df4f4ca02c35ec799c8a818ffec1ca94a5ca0476576547f358eeb3bfc88676", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143750, "uuid": "ddf0642b-6768-42c0-82af-cb9c188f6781", "value": "FFF4CF2233D4AFA8F17E9B7580255200A3F5B907F322DA9DFEA550CD49E0FC583527A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143750, "uuid": "2574b8aa-0a33-4b07-92cc-44c49ba1d0b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143750, "uuid": "b9b05e9e-06f5-46eb-820f-7e76de72af01", "value": "12288:MuggDj8/IDOKMPxsCfhbdAEOoqJjLzdIhuene2sC3kTGCpQT6i9Y:Zgg3CgOKMsOdAE9qdpfppTGCGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143750, "uuid": "4ce36d15-ec5b-49a4-8ef4-9c8c0db7d83a", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143750, "uuid": "84317738-ff7c-4d8f-af19-d6132696c7c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143750, "uuid": "1432377f-8fa7-42b7-812e-8fac8ce00983", "value": "106ada585df884b13cd6a8a71e404c78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6451b3cc-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142545, "uuid": "2ebe24c3-6b56-4953-9229-2556ab68fec8", "comment": "Malware payload (Quakbot)", "value": "9f67edc9319d6d60253c89a9341d4b91", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142545, "uuid": "989110bd-d560-4906-9df3-0f11eb4a505e", "comment": "Malware payload (Quakbot)", "value": "6210e0750a91de0737ad438ee0fd491915e192d141ee95bdd0aaa44fba358cd7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142545, "uuid": "3f4e66b8-24fa-42a4-9202-b6fa63ba8b03", "comment": "Malware payload (Quakbot)", "value": "b7faf5582ce4306bff50fe74305df295f1f11633", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142545, "uuid": "0ff2f6d2-3203-4540-9ce8-9d0cf9dab3e0", "comment": "Malware payload (Quakbot)", "value": "9d468a6a0c538967c42443c31043c0a9dcbc659b5d50848b503c8da3ec3535fd72b997dab58d1760cf26d6ed12df679c", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142545, "uuid": "420d84b4-bfee-4d32-93b9-636e47f9da19", "value": "54B3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142545, "uuid": "c93ebaee-fc84-46dc-8bd6-f9e3b92ae423", "value": "3072:nkYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:EAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142545, "uuid": "ecbac274-ed0c-4756-8332-bf2120dda6d1", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142545, "uuid": "27e9987c-8c40-4301-922f-2c1ff4a61f6c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142545, "uuid": "1797a905-6df8-4d8a-869a-5cf00cd1a320", "value": "Outstanding-Debt-764934899-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf123fef-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153461, "uuid": "9adbb671-5f89-423c-9c50-e2bbfd58cc51", "comment": "Malware payload", "value": "87468b1e7496e3eba363b63b27a8c1fe", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153461, "uuid": "4d84796d-d2e5-4cce-91dd-e59087dde3c7", "comment": "Malware payload", "value": "621c4ac09e693effb55dec1712d2e18bf8bd2e941f464cb0a5bd4a0e4828dd02", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153461, "uuid": "c3ffca29-0162-448c-bdb2-f776950e6459", "comment": "Malware payload", "value": "1d91c0e0a1a51a95e1e12e168d1e4c5eb4b6c974", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153461, "uuid": "6edfd0bb-681b-4929-9f12-67d035abdabe", "comment": "Malware payload", "value": "6fab1e84c97f688c09a2f158636f843a2eed3a1539c2be7581abde53f926494f001ad26a61d3f9de04a985ce1487dada", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153461, "uuid": "62e07556-6ad0-4c92-b196-f1151bc750a4", "value": "D0A1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153461, "uuid": "40e85b8b-1ae4-4d6d-aa43-8c7c61355717", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153461, "uuid": "3d68a3bf-58d8-4de7-add1-a3826a1fc273", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153461, "uuid": "23489625-e9c6-48be-a569-a5dd9e9c5acd", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153461, "uuid": "d700c9f8-45c3-4a8e-8789-1aa705b17980", "value": "621c4ac09e693effb55dec1712d2e18bf8bd2e941f464cb0a5bd4a0e4828dd02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde4d64b-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120388, "uuid": "ef409bc4-f73b-4fe3-a9c7-2d6294eed13d", "comment": "Malware payload (Gozi)", "value": "c4d495c1893db4393bbae247fc5269a7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120388, "uuid": "f3823ad9-7651-4faf-9d37-1d87b06a968c", "comment": "Malware payload (Gozi)", "value": "624086b51e6ae13f1ba34b9f34566f22e0d5c481577916639268cac8929cfe1e", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120388, "uuid": "71e63219-b1d0-46c5-b753-1de0a2211eff", "comment": "Malware payload (Gozi)", "value": "c343b07c1ea5c28f15e7cccf2c3f52b13b00883c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120388, "uuid": "9a7f4708-d164-4c1a-818b-9dc24738aa23", "comment": "Malware payload (Gozi)", "value": "02be5a89299af4c1f14e87d7ba91df89774bb0a133449efb65d8670f7518573c2e501ce69d970959cdbc41aa5bde213e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120388, "uuid": "2b3cd75d-335e-461c-850e-9aba56b5ec4d", "value": "26245B6AA2E40695E9BBDAB5CD53C617E7F334441B28D70F03B0CA656F57321F228352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120388, "uuid": "ffead564-5c39-4647-a83a-565fc4a82ed2", "value": "3072:fWLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYPr9fGWg+Bm5kfxDLm:4qO/rsPHN7Q6l7Bz9zhvNJYPrg1UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120388, "uuid": "19ca090f-1a39-4755-a01d-5cba098d8569", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120388, "uuid": "920a6c08-f3fa-4f1b-97d9-addd38ff9da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120388, "uuid": "feb46527-e020-478f-bb10-9bbe1c707967", "value": "202048f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2f0f90-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108060, "uuid": "4dc9d29b-1235-49c5-9e98-04efbad94fc9", "comment": "Malware payload (Dridex)", "value": "e741fbdf3e16bdbd5f7c55b277eaaa5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108060, "uuid": "879d62ef-09ff-4ff2-a9ba-c278a992c5c7", "comment": "Malware payload (Dridex)", "value": "626e83e0d76ee6d1a509273e82d74ddad864cc826296077a4909b983104d2cb2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108060, "uuid": "70f236fe-765a-4c81-93f5-b2f4d682a03c", "comment": "Malware payload (Dridex)", "value": "8631329d0c087d363ef56335bf09e6b316a5a904", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108060, "uuid": "7a56b5f2-b691-4250-8d50-f78381fd4cd8", "comment": "Malware payload (Dridex)", "value": "2c9ff5cee203a131cdcaf12f67763f2a6ea8b643cb7d269d2a60bb0a8562d41af431978127cd3af0a602fbdd09f648cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108060, "uuid": "606a6a79-fdbf-456d-978b-71ff81aec7e5", "value": "2BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108060, "uuid": "69c06997-7e97-4e6c-b2f3-f1ab5ccf50d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108060, "uuid": "e91ef001-bf42-4b98-a944-15d8109a6dbb", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108060, "uuid": "abd98c73-b40d-4de6-a39f-b18fa47556fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108060, "uuid": "260f3736-b6b0-42cc-ba68-88c2f7005cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108060, "uuid": "60f44241-2e59-43dd-bc27-4f6466050d78", "value": "e741fbdf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8f63ec-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152945, "uuid": "c2d65c03-f083-4285-a8e7-406c38a6d1a9", "comment": "Malware payload", "value": "848b21d09dd8cfe0f993ab1847367a97", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152945, "uuid": "549c359a-0723-4671-91ab-9779db0ac527", "comment": "Malware payload", "value": "62df66bd842be21862b1cde901fa94ee66dd5f1f0b8c26f3c53c29ff6b535138", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152945, "uuid": "f48a0b27-83d5-4c78-a7ed-27c4ce061bc1", "comment": "Malware payload", "value": "ecbc1f2c06d9889131f1a6090e2de0647f6f12c9", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152945, "uuid": "c2275b51-4af0-4347-83d2-6dfa1163f5bb", "comment": "Malware payload", "value": "dbc1764845a29d1485490153eb7957f211725134b6e2ff860ce3d2f27f08ec9fd368cd5824c594ea695ca503c53b4ff3", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152945, "uuid": "02855308-0211-4e9e-9708-7a98dc18aff2", "value": "60A1F750112C1AB17246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152945, "uuid": "1d2df7fb-6ba7-495c-831f-b4c1c256badb", "value": "96:tcRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152945, "uuid": "545e6201-975c-413d-81fe-8c38343174d8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152945, "uuid": "f15fac19-3aeb-4bd6-8b46-cece68d7c07e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152945, "uuid": "586a94a2-a76e-45ac-8712-f12b968b8b4e", "value": "62df66bd842be21862b1cde901fa94ee66dd5f1f0b8c26f3c53c29ff6b535138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf518cfb-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122511, "uuid": "919b798b-e8d3-41c6-9bb4-6a43643dd5f1", "comment": "Malware payload (Dridex)", "value": "edda953396f10ec1fa916cf0850c4376", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122511, "uuid": "8e2e540e-e62d-4e30-8636-3be038bf7213", "comment": "Malware payload (Dridex)", "value": "632d5b9d020b83bb37930ffc211cc320c5dc8220d058bb2b5c4a78e56ebd6fbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122511, "uuid": "77f3ed6e-ea2a-439c-a3ba-007441220716", "comment": "Malware payload (Dridex)", "value": "c641b40196aaeee1cd04f59a52fa0a43096bbe46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122511, "uuid": "a7702013-a526-45c1-9ec4-40d232af011f", "comment": "Malware payload (Dridex)", "value": "29a3d035796d1fdcd967a4eca4693eabd66a7847abe3ba99db69caab2e5923492047eb6f34f4d26d6be84cf933bac9ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122511, "uuid": "d98ed5a0-9ae2-4664-b340-061447be1a6f", "value": "41F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122511, "uuid": "10cd1d5e-0aa0-4c2e-aac8-05dffeb13862", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122511, "uuid": "462f04fd-d33d-42cb-9735-f1486b6bf085", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122511, "uuid": "f58b34bd-84ee-4a98-a6de-023694584f41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122511, "uuid": "d2181b6a-8acd-4f79-9318-3cf52fa46a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122511, "uuid": "b67d3c61-ac48-4514-88ca-79c7ab707c9c", "value": "edda9533_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d81adc8-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152948, "uuid": "1a8c99bf-f6f3-4399-9e56-e84a6a0b23bb", "comment": "Malware payload", "value": "d74ef11fbfe749706ca703da7442c9a1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152948, "uuid": "2c48e88f-cef8-4b80-869b-2415568b8bce", "comment": "Malware payload", "value": "634ec8c60e41a3cad61d3bac38e8afcc2e854e6cb8f6d8e5d6cc9b48b1815ec0", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152948, "uuid": "87a4d6f3-e3dc-495e-9f71-7a90b55ab3a0", "comment": "Malware payload", "value": "c876982e46d2b7507267b4faaad4b00007b47c17", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152948, "uuid": "b12c14f5-a646-4585-8a4f-338623aef948", "comment": "Malware payload", "value": "b2e0f0b485780c948ea51420f78a26dfd12833eeab4c739a990e7cedb02ac36f6f96eb97e1cf7110a5fe21f5c9415a45", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152948, "uuid": "46edcb86-e59c-4f70-90ce-a5f7050ca462", "value": "7E84233950F115BF267E496789FE8A3E415DF9C880BBC3C597BAC009281B86FB76124D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152948, "uuid": "843dcfd5-2e0d-4498-bf2c-4fac5c926dd9", "value": "12288:jJmL3cFcmubZ+xOObus1fv4J/c4km1qfSzFUeDHyeev:tNF0+xOOasdIE4Uf8FUeT0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152948, "uuid": "56ab028a-e8ec-470e-8863-35b91b6c250b", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152948, "uuid": "3414584a-5591-4866-86b9-c6f78e2f26e6", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152948, "uuid": "03240e65-935a-45bf-8da8-a52349076ce1", "value": "634ec8c60e41a3cad61d3bac38e8afcc2e854e6cb8f6d8e5d6cc9b48b1815ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808f5433-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620142592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142592, "uuid": "f52eb837-ba6a-4889-8b0e-8592f32b3a4a", "comment": "Malware payload (STRRAT)", "value": "0917fbd208a8645f6baf6d5aadd62ed0", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142592, "uuid": "0b66e7e9-9145-45a1-b684-63b6df74ed62", "comment": "Malware payload (STRRAT)", "value": "639ee6e0d9338cb339c804d48e759e20be2a9f6fe09a74c8531e1373e239a644", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142592, "uuid": "0afa5754-8c9d-423d-af54-c1459dd27d3d", "comment": "Malware payload (STRRAT)", "value": "00cb52652623edec170cca21a2fac207af1d66a4", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142592, "uuid": "45db931d-ec8a-43b0-bd94-b5a461e5647f", "comment": "Malware payload (STRRAT)", "value": "201d4963b383577bd29ff95f25b8b843da6a45f91e68865d5d509a727979af82e20d9b31a535260e95f8545b2519a635", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142592, "uuid": "e3da1e1b-69e6-4ffa-914b-de6200500074", "value": "D4A3C06BBD9E93E2E02B50365025A232DA1C2298D806903FF1FCA5965C75D394F13ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142592, "uuid": "554707c7-bbdd-42fc-ab88-86e26b0da999", "value": "3072:ZquXjA7DXtNJTNj7pgBl5GklptKM/jbRF:ZqDXtzh7Kc0QMj1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142592, "uuid": "7cbbdb71-38d2-4320-bcb8-c5938635ada2", "value": 103005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142592, "uuid": "2267bf13-d916-49bb-bb24-ffc00b5998f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142592, "uuid": "60e1cb1e-2533-4938-bb93-bedc2707a2d7", "value": "DHL Notification.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b44983-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090059, "uuid": "fdfc8789-9ec5-4888-821e-eab8f8071dc4", "comment": "Malware payload (Dridex)", "value": "c51f0bf63477e9ef418c27e3ad649295", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090059, "uuid": "c344e48c-2c6f-4610-9355-2d2c8da47592", "comment": "Malware payload (Dridex)", "value": "63e4efdad3106418ad916089fbfceccd4b05614e9d7ee10916a944ccf39574a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090059, "uuid": "649557a2-b0c0-4eec-93b6-59e32f24816b", "comment": "Malware payload (Dridex)", "value": "18da93e64fcc8386b704e723be8a14a87f3fb1ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090059, "uuid": "cbf08bd1-da6c-4e9b-bb00-ae996c87b163", "comment": "Malware payload (Dridex)", "value": "d23fa3af60ea0dabb861e52a00a2d27cd8021a1c49bc6e1d9f90953294a457267951158892b117548916b26c605d66a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090059, "uuid": "47e13533-a9b0-4b88-9deb-00359dc9a406", "value": "3CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090059, "uuid": "63796c4d-cb9c-4118-8d30-2468168ade1d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090059, "uuid": "1199ffa1-5ada-48b7-a0e3-a367b4fa1f0a", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090059, "uuid": "0d4df757-6a02-4299-83e2-46f1b33b94f2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090059, "uuid": "b5de969e-b4f5-4163-97ed-0b103d182e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090059, "uuid": "9b86a8a9-9f20-48da-88e6-2130286332ab", "value": "c51f0bf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3322467a-ac92-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620102948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620102948, "uuid": "9f734006-5fef-4ac0-957b-5bb26c6e15ea", "comment": "Malware payload (Loki)", "value": "b9198c6dfd3cc4897b125eb593ff6227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620102948, "uuid": "d252a74f-153f-4df3-8219-e85b4d10516b", "comment": "Malware payload (Loki)", "value": "63f8140e7e37fa045e36df9e5cd9858ad270161732d570735ee82bcef73f17b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620102948, "uuid": "43a75028-17cc-4826-8682-87148301188d", "comment": "Malware payload (Loki)", "value": "ad4cac13d4d422bcf47a69d257e9ed5e9b9dd4e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620102948, "uuid": "3b3584d9-6641-491b-b5d5-ea38daf1bf05", "comment": "Malware payload (Loki)", "value": "0a8581208e8035155c1b861ab41a83c7e08e890b6010428eac1eac79c5ed5ece36569fa9e85d257fe8758986b7937a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620102948, "uuid": "11ab069c-6756-483e-8b93-8bee9a475cfc", "value": "58E4120527ECAF59E93977B9083A1300A3F5F417E722D52DBEDE50C86A26E818713B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620102948, "uuid": "89cae6d9-ecff-447f-92cd-39db0b6c24b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620102948, "uuid": "141254a6-68ce-4e4b-af3b-98afa76924f6", "value": "12288:DqsUz22qt1g5XnpAQpt8zLeFXt0+/fNdY6SM+WU2ZRiUqjzEcP8Q11+:Tyxp3uLeFXpdHSbMZRiUqlNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620102948, "uuid": "df790710-b155-4e29-9b01-848376db5532", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620102948, "uuid": "93e2d1dc-8d31-4f63-a109-093675b0e104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620102948, "uuid": "9e91be9d-6691-4a48-8d0e-68891cd57fbf", "value": "B9198C6DFD3CC4897B125EB593FF6227.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f9d393-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086474, "uuid": "4cb22491-f437-4076-be3d-ee66119fbc8e", "comment": "Malware payload (Dridex)", "value": "9259e9cf552d2d772dca2b1f121de613", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086474, "uuid": "2fecac0c-4aac-43ec-bcb7-eff42a2cb793", "comment": "Malware payload (Dridex)", "value": "64e3bcfc5b4a9c39bea523e9c59cfcd82b7a079db3a3e435f75255679d4b05f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086474, "uuid": "9836400c-b798-4911-97bc-4cf06b52219b", "comment": "Malware payload (Dridex)", "value": "768c98fe240e759a479b591eaddb882af684676b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086474, "uuid": "95beeb14-7eb2-4e06-b03e-8824340a817d", "comment": "Malware payload (Dridex)", "value": "c9d49268d2f195534f58bc674318874b3e546dd4a475769b043798c518b6b0b3263c077a0b0603b1ff89a1eb3ea15602", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086474, "uuid": "eba6fc74-6c97-4183-8796-38e38faa9626", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086474, "uuid": "789db17c-0c3c-4dbc-818a-da81237a8c28", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086474, "uuid": "6c06d67a-d76b-4b51-a418-238b4b44340f", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086474, "uuid": "198e5208-b71e-4832-967f-ba5d8a05e93b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086474, "uuid": "00bb4e98-c73b-4901-9ad0-0f39fed71d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086474, "uuid": "f6c5014f-ba8e-4929-a9f7-8c4b276a6586", "value": "9259e9cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6706c0-ad33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620172138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172138, "uuid": "9f0c34a5-c988-46d0-bf78-79635330995c", "comment": "Malware payload", "value": "9646c9d32cec09ab37b67d393aaa6312", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172138, "uuid": "b504a80c-d888-487d-b745-9b1ea86982a2", "comment": "Malware payload", "value": "6554bb875518a3f98aca2f086217a5fc86778c3e90132f4e1f0fec6000ba3103", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172138, "uuid": "9796b2f7-b9b4-4659-b7b4-681f3b7ae061", "comment": "Malware payload", "value": "c4f45533795bcd7e3a1e7a28f3700b826356c981", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172138, "uuid": "6b4ca90d-38b6-4d76-a47b-ceb8ca10370f", "comment": "Malware payload", "value": "ab55d6f723877ef6fd5b393109d958cc68d11137c3f9e4666b8c4afa30641054ca15171f49f9e4865aa08084aa3ee87e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172138, "uuid": "27f3f2be-7b88-4706-87c9-911493fda010", "value": "A854B292E112B164E1583F36E82E456C43E6EEAA7F68F18F2C0473B73B761D12E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172138, "uuid": "3d96709b-c481-4d96-8155-43bac4568e14", "value": "6144:6cPiTQAVW/89BQnmlcGvgZ7rDjo8UOMzJK+tfq5s:5pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620172138, "uuid": "8dc0bca0-60d8-46f3-85c9-be1749dab40e", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620172138, "uuid": "3e838acd-beda-498d-8a1c-eda5b3d13225", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172138, "uuid": "e5c23877-c592-446b-bb95-d5741b69d348", "value": "SecuriteInfo.com.Heur.32597.10604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96316e40-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095813, "uuid": "d4e16211-c44a-42b8-9a62-f8c0587de48b", "comment": "Malware payload", "value": "8c14597dfd51bcee7b378240a70e932c", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095813, "uuid": "f7e1e6aa-5414-4329-b3fe-cb2da9e3f664", "comment": "Malware payload", "value": "6572ad0348169374245c6ffdc80432da5af53402f99561abd03dbbf65ae84120", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095813, "uuid": "54a5e1de-63d6-4cb9-9015-c1f627f99c21", "comment": "Malware payload", "value": "2263c319e324df5ae7c6a93cecfb6fc875d70e4b", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095813, "uuid": "1dcd75ae-8e1d-4a94-b115-56b6c898d85f", "comment": "Malware payload", "value": "91ede69b929cf8d6d4e47869eac67af01fefd09ef97d4f0efbb84c6bdc905db506fc16b8bd2d53fbdbfac1b435b515a5", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095813, "uuid": "93db322e-348a-4569-8cfe-a51d4e867bbf", "value": "EAD5338F9C87F374AFE32256215ABA44F5E717C3AF126074398D6C620A9B5F074B074A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095813, "uuid": "50465e56-4799-4f53-a547-2d67082c7ed2", "value": "49152:ulUZ/lGIuQP8N3mp0ZGaGuRE+WETnLyJ4w0/620wowJ15nTl75hSY/PZL3Kz+Ws:2O/l31P8N3hGaBWgL04wufzJ1hJSMPZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095813, "uuid": "10454698-8f00-4013-a9c2-0971abc897bc", "value": 2943901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095813, "uuid": "189dd6bd-3871-403f-b624-1880d227b6e2", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095813, "uuid": "82db0a97-00c7-4d44-b733-f953d762a7e1", "value": "AstarothSpammer (5).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0623c0b2-acaf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115328, "uuid": "c8e38b39-b6f1-42e4-abf1-45af4ab5890d", "comment": "Malware payload (Dridex)", "value": "ad2cc5c6b3631dd47e82a12d9c5efdcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115328, "uuid": "bae857f0-c7c9-47db-bc40-8254aa63fa38", "comment": "Malware payload (Dridex)", "value": "65998e1fd9a97ef99ec1c23433c6a05810b567557e524ee1425cf4a0752a06d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115328, "uuid": "30cbd5c8-294b-4bc5-b669-13e1ab30095f", "comment": "Malware payload (Dridex)", "value": "88314a208cc921291cef3c5ad35deb3fd1c6bd2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115328, "uuid": "2d200e62-20a6-4b4c-963a-a12ba3842fd1", "comment": "Malware payload (Dridex)", "value": "84027b19c4701a5fc5c7d7150a480647a0cdca17503b4e34eff1ec2a7272da27c000c3c6e518abaaa08efc8da987c39e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115328, "uuid": "a4ab53b1-48c7-48d1-83ff-527b7527b97a", "value": "C4F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115328, "uuid": "287aa074-5e30-471e-a573-1ce39cdc66fe", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115328, "uuid": "0f905642-dcce-46dc-8f36-bc1335c26eb7", "value": "3072:BWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:B42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115328, "uuid": "8cfc3d3d-3eb0-4e17-ae04-7ded7fcd7bcd", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115328, "uuid": "890bcced-98bb-4871-b473-ab41a9345b8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115328, "uuid": "2d1995e8-bd47-4e2a-a50c-40c25dbf5c15", "value": "ad2cc5c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742e1eee-acfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620149014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149014, "uuid": "bc4d587a-9149-4f87-8298-8aead6b2587e", "comment": "Malware payload (AgentTesla)", "value": "34d4452c1b344685e3f5fd7d0e9640a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149014, "uuid": "f53f841e-de95-4b52-bab5-6c2fb1b4454b", "comment": "Malware payload (AgentTesla)", "value": "65e210b78d73141c61b7087dce60499ca6c225e1b028d3951589c93baa8f0668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149014, "uuid": "16596ee7-7ca3-473d-ad84-bd6aecdf6162", "comment": "Malware payload (AgentTesla)", "value": "bb42e71329d2ad4baff54600020eb7053cc53026", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149014, "uuid": "149fdf4b-fee3-4755-a91e-00f525601f5a", "comment": "Malware payload (AgentTesla)", "value": "8d99c6e5ef4bd04a9a28be2b32e3e63617cc50f4a546e210486e3bdba502e651db053ef8a39ea2070bd29b28abfd6a00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149014, "uuid": "42c905f7-9ff4-4c2e-b657-1112592b025b", "value": "E92539AC315430EDD227CA36ABDE1C0592613175A62B960B872303BD8E1FE57AF349D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149014, "uuid": "dba58f6c-2b1b-4366-a802-0c960fce245f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149014, "uuid": "a2249b61-9245-4bc7-a505-56d960eb1398", "value": "12288:MrloLLoS60/K7yh07qG3wBrCFfzTmjDjZLSMRoRf/mq4C6K+mgEie4Qi/Ibm+OFO:qoLA75wppvZy39uKhgEiQiga+OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149014, "uuid": "1cec9a72-230d-41fd-a7d2-44f0c4ceedf3", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149014, "uuid": "a97a647f-835e-47e0-ae61-80a6f57d7380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149014, "uuid": "6d9aaf49-1c25-42e0-9fd8-b5dd6b4db209", "value": "ashleyx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f42c22-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093742, "uuid": "e22f3ad5-bcea-4c4f-82b7-8b799a06fcdd", "comment": "Malware payload (Dridex)", "value": "b98bf88592aaf0ebb256bc127a04fdeb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093742, "uuid": "e94a6f30-50bb-4ddd-8cd6-70ce15ab0b99", "comment": "Malware payload (Dridex)", "value": "661b17872b24fdd8a016c6fe1ba32781e537cce53237aeba800576a4a67e2e0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093742, "uuid": "148929b5-756b-420f-9125-3835a1d7da2f", "comment": "Malware payload (Dridex)", "value": "67aa38fc48b4237b553c4c52d7d2fc8d9a75c48f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093742, "uuid": "6174cb13-8dbd-4cc5-9136-2cf048fe9ffc", "comment": "Malware payload (Dridex)", "value": "b4a173d2b24eb9b74f1ea35cdba57cd15cfff028414b309b74a832e47f8f3d75d6dcf8e7faac832202fb1db206a36ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093742, "uuid": "07913ad0-dfee-43a4-8703-5fa289a05d3d", "value": "A1F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093742, "uuid": "77664f75-6448-4bbb-b6e1-0cc2ae302b22", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093742, "uuid": "b543c6fd-f1c2-421b-aaad-1cf90cfa14ee", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093742, "uuid": "c682b437-1b7d-4c04-aca4-d28e50532557", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093742, "uuid": "4ba37e78-d0a9-4fd6-8239-77121d1b4fc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093742, "uuid": "701822ea-58cf-4036-a933-bd7c478aadad", "value": "b98bf885_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6b32d9-acfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620149079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149079, "uuid": "c1091759-730a-4ca8-a40f-0995650a36e5", "comment": "Malware payload (AgentTesla)", "value": "23495a6a0fd6123653dea6900654b7f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149079, "uuid": "1ba16348-a600-451f-87a6-b1cc973d160b", "comment": "Malware payload (AgentTesla)", "value": "670722e76eb0821959829571a7e70310d97b254abeba166950e39df1443482f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149079, "uuid": "9e089554-4557-46ca-9e04-3ae237577326", "comment": "Malware payload (AgentTesla)", "value": "ecc59be83b68aeb85b32ba2d317cd08b87054756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149079, "uuid": "227986c9-e421-4712-8c55-84b41edf6b74", "comment": "Malware payload (AgentTesla)", "value": "74938ebaf9bfae8071cf6dc66906179678601f687496d04c8b66d2b741457c9c4b84dde5097bca6500a60c9998b354e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149079, "uuid": "060d79e0-b21b-493c-985f-0eeac99ba9d7", "value": "BD85366063FED450B3E7BF9987B832232D0B7FB78B3A108C629682645E18C5564E7774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149079, "uuid": "2fcaaffa-82be-4dc0-b245-5dd71fc6acae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149079, "uuid": "31d80ddb-3511-4351-9564-33e910d5a1ca", "value": "768:k1cDXumzNLh+UM1Fv6is77PKL7SlVVrMNiabA55QTO79l517YUO7Vb97jre33//9:k1cD+yOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149079, "uuid": "fdbff23c-fd6f-4f22-8fcb-3d7fd7446fc8", "value": 1842016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149079, "uuid": "270de1e1-47b1-41ab-8c58-80d062a6229e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149079, "uuid": "412f4b71-1d1f-456f-bb24-453cfaf669f6", "value": "Purchase Inquiry 040521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114ab1ce-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126084, "uuid": "96a66e32-a462-492f-b5e0-f22ef4220558", "comment": "Malware payload (Dridex)", "value": "fbca5ac9c572375b9bb1788b7896b43e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126084, "uuid": "3e102978-5559-4ad9-9d7f-e553dec86e20", "comment": "Malware payload (Dridex)", "value": "67c96a8c208f133c31a511620d28b6071fda639ba693c9ceb1de0da3252a0719", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126084, "uuid": "039eb862-7966-407d-b346-9754950315c2", "comment": "Malware payload (Dridex)", "value": "cab0b7a4f12b778a831a5880382f14ad5bbd733a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126084, "uuid": "114b9b65-c263-4af3-8ef4-3b246f522514", "comment": "Malware payload (Dridex)", "value": "1e98584a9aee3bfea7c34d5a8e4ba7770a5abd2743b5b4b488c91e066618467ebdeec310946a7e98a972bea27e4ec5b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126084, "uuid": "d6ae9aa0-08ca-437b-8a4e-dcf16d66bb87", "value": "F4F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126084, "uuid": "74cf17c3-619c-4c6f-9d81-137128376b40", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126084, "uuid": "636cf3ef-97ff-4fda-b703-fc2cc54cee84", "value": "3072:EWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:E42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126084, "uuid": "90eb5e90-2465-486c-906d-34230da4c42a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126084, "uuid": "f63a3c46-59fb-433b-b5c3-dc0dc0c9ddae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126084, "uuid": "bda7d0fb-900e-4e89-b0ec-60f0625fad39", "value": "fbca5ac9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072b71c2-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141959, "uuid": "4a1a8fcc-17bb-4b25-94b8-038f45992d8e", "comment": "Malware payload (AgentTesla)", "value": "a1f21deabde4ac7fe57170410912cdd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141959, "uuid": "20152cad-0089-4b0b-99d1-27155c7509a7", "comment": "Malware payload (AgentTesla)", "value": "67e900002f5cff55084abd74646c25e1d22cf652cb0142315ab4bdc2906aad53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141959, "uuid": "1021b267-3ffe-4ec9-b39e-dd770f705246", "comment": "Malware payload (AgentTesla)", "value": "9cd78ad0b7b988373870ddff2048f39bbc2a58df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141959, "uuid": "001e5efc-f2f2-496d-bb4a-5fb1a99afd8c", "comment": "Malware payload (AgentTesla)", "value": "b0ef8f033b74df6c177f0c9253ddc900c9d63a4626a2e713f1cd8b79bc7211e32de9cfe9e86296e389cba6cb53c4c180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141959, "uuid": "bdf11d03-1e09-483f-8dde-46989df4c162", "value": "2CE4BE277FA85262D4BA1F381835031057F4F51AE724C31F6DA860ADDDE2AC18E677E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141959, "uuid": "ce3a6810-c9e1-4300-b78e-90e9d33cd957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141959, "uuid": "cacff725-2128-4743-9d30-f22fec86c287", "value": "12288:c1/TBPnNHKManc2gOAQLJtjM/xMT3D1pOQzawtp0cwRUDwSlb9xFfg+83D:cifI/xc3hp7zHcSDwcz++8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141959, "uuid": "f8b0c31a-5359-42bc-927c-a98af6226bf6", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141959, "uuid": "4e339417-66b6-4771-aca7-c42f03e6a0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141959, "uuid": "42595e7f-802c-4a45-8fbb-fcf181d311ae", "value": "MZyeln5mSFOjxMx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca7803d-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152437, "uuid": "86e7c360-e018-4c96-9e1f-e10471b135c4", "comment": "Malware payload (AgentTesla)", "value": "a14391876bbe1525b9674c37ae9bbc1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152437, "uuid": "e41f38c5-a31c-4dd3-91ac-532885ef2fd2", "comment": "Malware payload (AgentTesla)", "value": "682975915925d77c388cad6bf2868c2eeb94e0b647387f6a9dc2768ff4242920", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152437, "uuid": "9796a6b9-4233-45f4-9a7b-9854ca54d980", "comment": "Malware payload (AgentTesla)", "value": "d10ac418ba57d95314e4f33b26dcede43bc78233", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152437, "uuid": "fc5bdc1e-28a9-4571-8dd8-877fc3725f8a", "comment": "Malware payload (AgentTesla)", "value": "8de0ef57d4b9c7d7069bebf94b887b5fb042c9ed86a12832f70e78bda3346599e03af10e7f4517956f1e2ce2176d2cd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152437, "uuid": "79e28dfb-dd27-4e9b-9069-cb4ac4504065", "value": "08254B6832A81BE1F27B5FB663DA1C0183B92575653EE50D8F9113FE0963F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152437, "uuid": "8eb83219-85cd-4694-9f00-778bf385f8ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152437, "uuid": "6ac049e6-2cb9-4119-be7d-4b88d74f9a1c", "value": "24576:+eJe2eXeMeZYoLAnd6F8NlzO34F6uaRvOUCLW:+Crc/yI6azGmaBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152437, "uuid": "d781b757-19db-4430-8c88-65a6adf52f55", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152437, "uuid": "787c871d-47e0-4d62-b196-c076bdf4c8cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152437, "uuid": "a0f65439-1acc-4e5b-894d-9b8e87c9640c", "value": "PO4802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cf813a-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118869, "uuid": "96006e97-8d87-4799-ae5a-e569c6158cb3", "comment": "Malware payload (Dridex)", "value": "88bae312615c54b4447b0ea2abc93fc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118869, "uuid": "80eb89c2-cea4-40df-a600-a8ad5843c25f", "comment": "Malware payload (Dridex)", "value": "6829c6788bb3b4bdf6f193ebe4ab9af2791e2e5eb17a9b09e132aac2d0037d11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118869, "uuid": "c3d4ff1b-83ff-48ee-9103-8890d48ede2f", "comment": "Malware payload (Dridex)", "value": "cbd559d0cfdf0c71512952530daf272ab39e5a08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118869, "uuid": "08370770-4bd0-4576-916e-c777db731b64", "comment": "Malware payload (Dridex)", "value": "bbd4e25130fe27798d263efc4e399bfefcedcb00c6a7fb649f792bd5bc05ffc2285af5e27a5ca8d7e5bf28e51922cf55", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118869, "uuid": "1c207fe8-1780-4b6c-90d4-d64850a7b604", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118869, "uuid": "783f75ff-a017-4138-b248-e7fee2466629", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118869, "uuid": "91233c7d-7da3-4a56-be36-b95e4b4df475", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118869, "uuid": "6c8a186e-e5b7-478f-b454-c2f6f9e05561", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118869, "uuid": "29d7f399-632f-456d-9c93-e45a4cdce9e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118869, "uuid": "bfc27368-37fb-462c-a2c7-c4ac291c6734", "value": "88bae312_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3951e730-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160511, "uuid": "1baed12f-2d3e-4f7b-a33b-b239db4ee9f7", "comment": "Malware payload", "value": "8b4f3c6346afd801fa3fcb70912790ad", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160511, "uuid": "117cb8ba-06b5-458d-acb5-fbb5990797b3", "comment": "Malware payload", "value": "68425293147930e026da059034e6bd5461c6fb83956ce38ee52ce2c843aedf79", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160511, "uuid": "63d45afb-1ccb-405c-a0bd-a3a0f1bc37ea", "comment": "Malware payload", "value": "afb8924a310c4be8a164496da0ce67b002c82b7e", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160511, "uuid": "cb51ed2b-51de-472a-a32f-68412a26fdcc", "comment": "Malware payload", "value": "71f9b73ae95467cfdf4e96d75b1220a1b9aeca0f7568eb55f852c125daf59fa92d08f4896e0c1373d6189f162e30587d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160511, "uuid": "9ceeab9c-0c3d-4c8a-9407-8b8f6d7e131a", "value": "3C3166B31DC191260312EA92F685542CE739940A9957344CA5EEC94DB1D0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160511, "uuid": "dd441f50-639d-44f4-9e8e-fed30d5a08f8", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3f+:GEXfhexTvrtWQZUSePSiJVAyrLMf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160511, "uuid": "c8054d13-ab93-4dd1-bcb2-97baadd8dedb", "value": 1693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160511, "uuid": "78489918-e248-465a-bd29-7fbc463de4c7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160511, "uuid": "087a6445-12a3-462a-9239-b6225dca458c", "value": "4fwGxKzb.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d0b4d2-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620142201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142201, "uuid": "31c59e65-e674-4745-bad4-bdc51811fd61", "comment": "Malware payload (TrickBot)", "value": "c9964c315a0d85ba4894d541816cf676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142201, "uuid": "e9040705-b4c4-42d9-9650-a325de18b8cc", "comment": "Malware payload (TrickBot)", "value": "69947cfea7518aab0920c81530b9e643d0fd0a14b0686a5d13dc1500366f071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142201, "uuid": "461d1638-905e-436b-89a5-500228e092e0", "comment": "Malware payload (TrickBot)", "value": "6e26e2ce4ae0b98ba615cb894cc9c25767080775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142201, "uuid": "2d143ba7-7ff9-419f-8baa-28bc1b7d457a", "comment": "Malware payload (TrickBot)", "value": "19da335f95bfe7b37804be80ef08bf94fbcc45bc10fbe3846ef6d256dee9ce3a1986e4bf2dead9628cd75bcc2a4a1189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142201, "uuid": "0ecbbf62-b397-4a89-812a-9d784e029de2", "value": "DB74F121B6D0D072C0C91530E46ADBB59E2BAE6666B1C1476BC43FBF7F213814F2A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142201, "uuid": "c875eeca-dbd5-4a4e-af3c-de4c04cb4906", "value": "2c132af889766d2f124bc09146cdd55a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142201, "uuid": "b570a060-2237-4a26-a07a-087535a930a0", "value": "6144:pFF9MSFuZD4p+e+C6lby/Pn2E5wx4JoV6Hj2fX50QGPlNmE3Ip:rF9MSUZ8p+Qoby/Pkx4WAI12lNmEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142201, "uuid": "6569b3b8-ff33-465c-a733-5e67d2639ace", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142201, "uuid": "431041a6-bcc6-4156-95dd-a8ee9f3ad60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142201, "uuid": "eea4b9d3-439d-4050-8188-a4c8b45651a9", "value": "c9964c315a0d85ba4894d541816cf676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e428aaa-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126106, "uuid": "32e85143-5713-4944-9c3e-325380f219a1", "comment": "Malware payload (IcedID)", "value": "894169c41e45975fa36c36c031628f52", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126106, "uuid": "d78be4a1-173e-4030-ab92-1999787f6bc1", "comment": "Malware payload (IcedID)", "value": "69a97d83771cb6cb1583fbf95e5fb9ada26f1ee6257351ecf24b9b4e9e4d80d4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126106, "uuid": "b9ec19dd-98eb-4709-a608-735e355ec6b0", "comment": "Malware payload (IcedID)", "value": "3ad2f1b52fca973252dfba03610bf1def0c37e3c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126106, "uuid": "68d70374-80ba-4552-a85f-8251e39ba59d", "comment": "Malware payload (IcedID)", "value": "d32182381d2f442e0ae31c1bf03f3686e9bd96904847899acb024a8555f3e2f3d950840bdeb7960b905269e8ecbd3135", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126106, "uuid": "aac2322e-fd32-4e66-8303-89b02e359dac", "value": "77B3C0BDD502E4E2CB69DC3DD1167412AD5B91877F0FE61F208621AB0803DA76E352AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126106, "uuid": "dc349e17-87f6-4c62-87fd-60b4f91b4879", "value": "1536:iutuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:ikuocrZDKGopH8x+8HdoLqp6vif+zUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126106, "uuid": "1f53da6d-24d9-40a8-984c-dff44b9e8e37", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126106, "uuid": "dc7e5756-904a-4b25-a951-b1ce62ce18e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126106, "uuid": "f1acbb63-dcde-486f-941b-7f8639003e4c", "value": "statistic-2067311372.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c40331-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133427, "uuid": "8354c771-bf29-4a67-8567-d5eda1b13053", "comment": "Malware payload (AgentTesla)", "value": "f82763e5f524f19d47086b0eb3cb125f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133427, "uuid": "d86d9762-a86c-4675-b830-4e80e3d2890c", "comment": "Malware payload (AgentTesla)", "value": "69f043d892b288557c8053a4a70f517adff05da255843f2b047bc019df6daa99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133427, "uuid": "735100cf-70a4-46ce-9eab-5868606fe52e", "comment": "Malware payload (AgentTesla)", "value": "710d1feeae85571ae3c9aaffdde73718fa13725b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133427, "uuid": "926b056d-c2a0-4cce-99ea-55a4596ecbb2", "comment": "Malware payload (AgentTesla)", "value": "f43cdc12c55febabe04ab3610fccb9a50c2fa56fcadfea09f2b47d288dc356c2291826e1f697974ea8f0d4c2845a4ab8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133427, "uuid": "5b796fc3-1d84-4309-8db4-3517a23f4931", "value": "6AA129765F485C9BD18AC0F3C0847D690443F2A9C8CB6E48739DF9B11B3F245722BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133427, "uuid": "8bf7fd56-67c8-4bd1-b535-5f18f039291a", "value": "96:W/KsrnaC0NtaDTIioIPLEjeSMVGUiKcAb0in/lhZk3bwynMEvvPRJ:W/Ksrn0UTjoIPLE+VJlR7ZkJnJv5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133427, "uuid": "ac662608-c376-4558-b5c7-debeeb0516ca", "value": 4799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133427, "uuid": "d70c2a31-4b34-4040-8a74-bda946fa9c1c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133427, "uuid": "3913c294-96e7-4459-9b10-9d7aaef9935a", "value": "Enquiry OS _227621 - FOOD OIL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24f39e9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152956, "uuid": "af3d75b5-1293-4daa-887d-ac26adf23db7", "comment": "Malware payload", "value": "c194392435a7c611c8fcadd922b524d1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152956, "uuid": "a9d7fdb8-d82e-4b0d-9079-96eadecde6b7", "comment": "Malware payload", "value": "6a25d11cba1fde4e57acf093099a97aa8db163b0402a49672e39febeb4f2ac58", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152956, "uuid": "555ff726-7dcc-458a-bcc7-3a657bc09978", "comment": "Malware payload", "value": "06711bedc2197710a8999c3d4f7c5960116a9ee0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152956, "uuid": "a0ae49bd-11b7-4dfd-a441-87b34444d1ee", "comment": "Malware payload", "value": "b160ba23bf551bec34c6b098abe5931fe35bdf8e5c31c6e92f88dbf006837e382e4fa937aede279c172fb5616ba2bd9f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152956, "uuid": "550da3e9-121f-41fb-9cdf-0ce0beaf3d51", "value": "9F95334852BD7CECFD9B12292B6289C0C2ED76F0E84060A172645DA45D3F1BF039FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152956, "uuid": "c926516f-0941-4c00-ba71-20f24707a82c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25I:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152956, "uuid": "f5d37b78-5aa9-4899-8af3-14b674cd75c0", "value": 2019328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152956, "uuid": "7624c940-9ef3-40c4-84e8-b8538e7ec6ab", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152956, "uuid": "c119873d-1064-49be-8ac4-212f4c472098", "value": "6a25d11cba1fde4e57acf093099a97aa8db163b0402a49672e39febeb4f2ac58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed78cbaa-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086511, "uuid": "ab3d8f1d-40bc-4aab-9d30-f697d6bcad28", "comment": "Malware payload (Dridex)", "value": "0c2aeae67754630a1922cbdb9ddd3bde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086511, "uuid": "97ed53df-3df8-4d3c-9241-a274e786638c", "comment": "Malware payload (Dridex)", "value": "6a7f674c053c8b7a998139e583ea73df6bedec4908834a2d60e4046ab1ac9002", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086511, "uuid": "82616fad-4a4b-4195-97c7-1773596e4f02", "comment": "Malware payload (Dridex)", "value": "ceecce301a0bfd918a4edba7c56c7a39769948a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086511, "uuid": "fa793946-7f0d-47bb-95cb-2bfcf5c787d5", "comment": "Malware payload (Dridex)", "value": "2848922f9ce653a6848705a0784168c03f1e94774b3cfba55f37056a042ef34e3cc875b06d5c60eb24c4026a14ce7ecd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086511, "uuid": "674b0321-467b-4f01-b34c-f2b0d4ac142a", "value": "5FF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086511, "uuid": "a97666ec-63f8-4e15-8c38-25f66087be2a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086511, "uuid": "7b1076b1-f290-4875-9661-5b741c0d8c20", "value": "3072:wIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086511, "uuid": "57f50160-d4e7-404f-b7dd-5e43874f0cc0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086511, "uuid": "5adef101-779a-418f-99e6-ce18c9d48e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086511, "uuid": "9fae9ed8-1802-47f5-92d1-ccbf3aea771e", "value": "0c2aeae6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c84ad-acd2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620130538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130538, "uuid": "c303c25c-62ad-4cb4-b433-7855173220df", "comment": "Malware payload (AsyncRAT)", "value": "fb5f1a2f214dc8774c41d7a67965a733", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130538, "uuid": "7e1b8c43-11e5-461e-8741-20d75c968bf7", "comment": "Malware payload (AsyncRAT)", "value": "6bd0f63d69ebaa8e28b21e9b0f5c02e05c1213535b2881d080db1d09082e9f1d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130538, "uuid": "2c3ce620-cba8-4e7a-ac37-fee50438bf5a", "comment": "Malware payload (AsyncRAT)", "value": "07bb74780172f5dd719e7c392817a0aaad27f173", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130538, "uuid": "46efbaa1-a919-4ea8-aab2-3a162f0b2601", "comment": "Malware payload (AsyncRAT)", "value": "a7918c93f5d005fccab374d4c4cbc2e8439cce6cd8758c3301905e526012950acefb3d7db0f8b0ce6c6dd26d8b226eb1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130538, "uuid": "511f3aa5-a12e-4a42-b0ae-6ee441208bbf", "value": "4D1412A5238E8527F7A6A6B55F36E790835096110603C73FBC8D84443F3FE9E55223EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130538, "uuid": "4aa2fa9b-ab72-4992-8cc0-3ddeb5653b50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130538, "uuid": "48ce7ede-f433-4ed3-859d-d103fec32b82", "value": "6144:xzNVgfanHv+ohSVgtjOM4lljJCu5tRBpLu9DLhlN2:xzzUanPHhSeAM4r9DJBu9LvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620130538, "uuid": "ee71df09-2bc7-4bf6-918b-78d4a9958cb6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620130538, "uuid": "2ff143a4-a84a-48a2-87fa-c7579dd6141b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130538, "uuid": "1232f599-4620-4871-8fed-14f434a7e5de", "value": "6BD0F63D69EBAA8E28B21E9B0F5C02E05C1213535B288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0508b26-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153463, "uuid": "6842c005-a270-4395-80ce-2101bdab350e", "comment": "Malware payload", "value": "06e387ac04892721ac80e61a82d4d0d8", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153463, "uuid": "daae8fd0-0c83-4e98-9b07-cbb9b9936663", "comment": "Malware payload", "value": "6c5e72177d948f4a4e8407281742704991da5b3661ceae91905af3ee0c7712f5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153463, "uuid": "953ddecf-c687-4be0-9a53-7a01cdf237fb", "comment": "Malware payload", "value": "d78108289be68abeb6b658fb6491ca84624479c5", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153463, "uuid": "a1c434ae-5730-475a-bda4-588f4b25badb", "comment": "Malware payload", "value": "92871282c585453761731162bccbf99a899307e7898307898df200ae137e3e6541ab72f12e7f4e8916195cdab21488d4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153463, "uuid": "a1cb7743-4950-4c2a-9883-126dc2b396ae", "value": "1CA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153463, "uuid": "33708d54-59c5-40a5-be4b-262c65939f51", "value": "96:bLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153463, "uuid": "147792fe-347d-4915-b359-60539994f18e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153463, "uuid": "5c8d7b81-a04a-48fd-9189-2b3392489c5b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153463, "uuid": "4c97d888-2fb2-4c05-b407-d32a2dc774cd", "value": "6c5e72177d948f4a4e8407281742704991da5b3661ceae91905af3ee0c7712f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1ce71d-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160759, "uuid": "56086c0b-5102-44ef-932f-b473acb7a270", "comment": "Malware payload", "value": "b84ed6adb927f663cfae7461ba93586d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160759, "uuid": "eb2603c4-1e65-4110-a3a8-417892e8c266", "comment": "Malware payload", "value": "6c9ec82a2770b4409335d842c7234573acfe8e6bc54e8499a752f6c3165c0863", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160759, "uuid": "c536568d-b211-4d8e-855f-0e035da34908", "comment": "Malware payload", "value": "af08f5a1605ce890347f02c69a2f3e11c9d5d1c8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160759, "uuid": "96ddfaf5-779d-4a79-896b-05bc90d4aaef", "comment": "Malware payload", "value": "70211c627c9175751c12d84242e019ac39f5eac5a574c06ebf6aaf5a7b072ef02ea54762c8359429228866aefc7d6e68", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160759, "uuid": "f510cf4c-01d8-4710-b163-811d8d3365ae", "value": "E131A8B31DC291260322EA92F785582CE729940E9943344CA1EEC94DB1E0F933FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160759, "uuid": "9f26c8f7-2e66-4004-8dac-d28521ce73db", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3ka:GEXfhexTvrtWQZUSePSiJVAyrLMVe7qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160759, "uuid": "b98c86cb-2174-47f3-9841-dc710280575c", "value": 1711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160759, "uuid": "05f08e7f-6fd5-43e9-b50a-afab70549a30", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160759, "uuid": "7723efb1-3283-4cd3-a938-9aa2b10f6b17", "value": "JjkDQ2Se.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb5f6ea-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620141805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141805, "uuid": "1c8e3794-1d15-4fe9-bc8f-432aaaa018df", "comment": "Malware payload (SnakeKeylogger)", "value": "4eb10dfd43a4d6415e554316cd1bc288", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141805, "uuid": "ae12a7b9-036e-43d4-bf52-725f42dd7c8a", "comment": "Malware payload (SnakeKeylogger)", "value": "6cf104c9a72fd0d57d3a9e6be82836cb66e74a89cac1890d36a37c8d7452cd8c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141805, "uuid": "23ad18e5-453b-4198-bc34-84656d4fb9cb", "comment": "Malware payload (SnakeKeylogger)", "value": "0a488404456576535cb7acbbaa948fc5053f30f5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141805, "uuid": "234d7f67-5fbb-4143-bb6f-a7db71f7024e", "comment": "Malware payload (SnakeKeylogger)", "value": "5f4ae8ac028eeeac297eaa1bde011f15bed24fa3d0131b3a0599640c02f133dac32376c2c5738c6da977f6e9b4b2084d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141805, "uuid": "0d6df87e-6dcb-4f71-b62f-24dcc30fff23", "value": "A1D49C277FA89652D4BA1F381835070067F1F509E325C71F2DA8609DEDE2AC28E677D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141805, "uuid": "da817db6-84c4-4826-b76e-02811dd4c700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141805, "uuid": "afbe272b-d137-4a38-8ee1-1929ae35f9a5", "value": "12288:yZmxfn/wvKMwnc2IOA+LS906xM1bGiJvdFh8P6cBAnk3eI9/UZ:y0d6xElFu6cBAnkuA/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141805, "uuid": "db0c1cbf-74b6-4032-8a18-7c05dce50ed5", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141805, "uuid": "6adfa7be-197a-4316-936b-96ee422624da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141805, "uuid": "b64ec409-b521-4937-af39-b2519438a70d", "value": "DHL 4677348255142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bdb225-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620142336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142336, "uuid": "a4e8962c-d74c-4817-bf6a-c4052263e47b", "comment": "Malware payload (IcedID)", "value": "0714b4fb25c38db2182d3e4f368df93f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142336, "uuid": "8069e686-06ef-4d77-8753-a84a943b85c5", "comment": "Malware payload (IcedID)", "value": "6def838e1d1f938fa7866ea6b7ca21df8e19ea0cf681058720ca71363dcd88d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142336, "uuid": "dd2e16c1-def9-48a2-b44d-8f28e712c300", "comment": "Malware payload (IcedID)", "value": "8e945751bcc8171b4fbce5465974485529db8884", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142336, "uuid": "affdc9d4-2125-4f1a-a5ad-4169e2880551", "comment": "Malware payload (IcedID)", "value": "0d04975f0b1888e65d3225e3f117ebeb5833f236eb9e2b59323ab6c8f3ed19b05cca7e598223f05e121ebe1f093ea10e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142336, "uuid": "c4bf774e-df12-4194-aa9b-ec5bd91d1b99", "value": "0C44C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142336, "uuid": "db61f97d-f718-4b19-88aa-31e56719925b", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142336, "uuid": "272b6539-a5c3-4e49-9910-cb563447d049", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142336, "uuid": "fea5e1b6-034d-4380-91b8-bd7cfffda3bc", "value": 272849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142336, "uuid": "73965805-4e06-44cb-a267-ae089dcdc99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142336, "uuid": "78992973-ea1a-4bd9-83b0-c939ba64e6d9", "value": "0714b4fb25c38db2182d3e4f368df93f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c1f45c-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093717, "uuid": "abfff0e0-0592-459a-a8d8-c79d9671d6e2", "comment": "Malware payload (Dridex)", "value": "7bd9c691285af695479b562111d52cae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093717, "uuid": "ca6c4852-2191-45b2-a91f-40c77ad336e0", "comment": "Malware payload (Dridex)", "value": "6df51069f6c7a9d7909f43caa6725901c7a430b7e456b5c9030270bdb6f488e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093717, "uuid": "a3a895ce-aa6d-4d9b-bc26-336ac8adb9a3", "comment": "Malware payload (Dridex)", "value": "6bc6b042454521d3c01da926630fa6e15b006c85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093717, "uuid": "41f4e26c-3327-4e83-aec6-140dbd281801", "comment": "Malware payload (Dridex)", "value": "33554104961611fa2787ec9c9493f44facf61a92791c6e9779e02302a1e6dc43e30d162204d16e5c7a930c9c89d06aa0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093717, "uuid": "4f32275c-70df-40a6-a955-57ab4f9533e9", "value": "E8F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093717, "uuid": "8bffe990-7b2b-4325-bb01-cdb3e0f6afeb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093717, "uuid": "210b07cc-64bd-4526-98cf-1e546b4a60f9", "value": "3072:VIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093717, "uuid": "d0b6a1ba-7116-4f26-a050-d8267382e3c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093717, "uuid": "f228b681-bae8-4a60-93f3-8b2ef0da4f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093717, "uuid": "f35e1850-f9d0-4351-b8b9-05588ff396e3", "value": "7bd9c691_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6725e7b7-ad1d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620162736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162736, "uuid": "1f9c6e39-2c99-42c8-b59e-e331a0fc43ba", "comment": "Malware payload (Formbook)", "value": "9fe12cde3aa06a540dd00ef6b182c5d0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162736, "uuid": "43cd5fa8-566e-4257-b42c-cd519d45f478", "comment": "Malware payload (Formbook)", "value": "6f6aa9aea231c8d01eddd78fa14d447202bb71c77512265ce9cc195c62ca1c65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162736, "uuid": "cad54aeb-6ed5-46f2-ba57-49f60522f1e8", "comment": "Malware payload (Formbook)", "value": "5b71e9d19292cbd95d455ce778db5d5c86270ab0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162736, "uuid": "0eae2ec5-597a-45e9-9b0d-241775e83ccd", "comment": "Malware payload (Formbook)", "value": "14fed5efd1f80dbefe18d18f2b2c7b2035810c46d1bcf17f27da8589824a0e5a69ac46a71815785cbead68394ec08b4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162736, "uuid": "6b99cc8a-3822-469c-a4fc-ce7521432dde", "value": "3EE4BE277FA85662D0BA4F381835031067F5F11AE725C35F2D6860ACEDD2AC28E677D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162736, "uuid": "b538abf0-a81e-4f89-a5bf-c0f506df3675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162736, "uuid": "f072bf45-85ae-4dcb-8bc5-74e30887af9b", "value": "12288:Wuj/LRTvw0KMrnc2MOANLLBbVSxMmIV3mLlzjcNaDtZWCUIKjbMvPAMTNjJE5ZM9:WGmVSx1IV3mxjcWtZWCUgvPAgNj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620162736, "uuid": "afb0c110-b377-4d95-8af7-b484bea684ee", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620162736, "uuid": "2e574555-d27e-4ee0-a3a6-3c6778c0a69d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162736, "uuid": "37fd44fd-2102-4be8-86ac-628655c53bc2", "value": "Invoice (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7792fb-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095314, "uuid": "1347fed2-48c7-48e4-99c6-8488fc4fea8f", "comment": "Malware payload", "value": "89dcaf2e618ded4ae6838fdeb6e35a62", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095314, "uuid": "0f38de84-80c4-46ce-89f3-a9f9692440d4", "comment": "Malware payload", "value": "6f745c457d3f4f7a9b9c300549a164682e9cd76dc990ee20c7e6972d4a4d646d", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095314, "uuid": "4365f2c2-da8d-4d7a-afcb-3333da9d9973", "comment": "Malware payload", "value": "afc6eafcd33e69e4bd2d7b64adf735acc9f7b0df", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095314, "uuid": "21217da1-2312-429a-bae3-b53a688bfb47", "comment": "Malware payload", "value": "8433741250d3020b41e2eed8bc6e4ddae0010d1985afadaf252cb9d18129054f6c5db4baf317d2de56e6de9f9cd68cbe", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095314, "uuid": "3c1f86ea-fdbd-44f3-a4ca-4934dee1954f", "value": "1FD4A39D721075EFC89BD0769EA85D68EB60647B831B4203A0271DAFF94D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095314, "uuid": "a202eb1f-7340-464f-b463-74685ea2c1c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095314, "uuid": "1b941c65-e9df-4d7f-89b1-4e30bf6d038b", "value": "12288:JCuizfgkUIJQ8vep1nAw701Cj+j3a5edDZxWB5vZBC241AClLcFTLjsXRd159H2N:Muizf/68vC1KQ0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095314, "uuid": "f8cde5a0-23f1-4266-a48c-a48542e4858f", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095314, "uuid": "42a1524f-ee25-4013-bdec-5de26aea3de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095314, "uuid": "a1e284b0-fe86-4edb-b517-ed632359871f", "value": "6f745c457d3f4f7a9b9c300549a164682e9cd76dc990ee20c7e6972d4a4d646d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4212be6d-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126166, "uuid": "5b98d571-046e-4a8e-a8f6-e64eeb1013b9", "comment": "Malware payload (IcedID)", "value": "9874090b5dddbc7c420de4d32b5fefee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126166, "uuid": "1b2379f5-afb6-456c-b341-d13af0a54ad7", "comment": "Malware payload (IcedID)", "value": "708009af6ee49e8e14ae994c0d4c6f2428d226cfefce9718fbb92983f6b67236", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126166, "uuid": "2f22b3f3-f95e-4a96-a640-04a1b5dc32c8", "comment": "Malware payload (IcedID)", "value": "6a86bab401eac607d7c75d4188a6abde47325e28", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126166, "uuid": "068d4a03-de5d-4281-8dc9-7e9b41b25419", "comment": "Malware payload (IcedID)", "value": "f34b39d310b2cb881f70b202d5be94ca50ac4f346e646e6e547e91bbaca45bf20e2bcddb763b1e8a1287e6f29b1b7c58", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126166, "uuid": "6ca16d89-2118-4d8b-9caa-12cf21c2b1f0", "value": "29830238110A8A12E75500B166FA78D09FE27473B4C5CC7D496734F7A83B9979E2530A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126166, "uuid": "c88e8b5a-8980-44a2-be71-cc71b44bd6d7", "value": "1536:OUrV78gyr4nChiX10V0L9v6GQV7JcV3t9N5qTGT2h566gsrs1mZtbvAGJOU:OUZqsnChM1Oi9PQVNcV3t9fqqT2h7Q1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126166, "uuid": "2d4e6f7a-ab4a-43f4-9980-983e3ed09b9f", "value": 83764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126166, "uuid": "1ac735eb-4456-44ca-a500-71748d9eb067", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126166, "uuid": "0611946e-5799-41cb-aec5-c3a342d7ca2e", "value": "xx_xx-45.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c2ed15-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090086, "uuid": "edd9cd70-3121-4d07-82d9-f80b3402849e", "comment": "Malware payload (Dridex)", "value": "0f3a9d35288fe6c3eca5088f0be9711f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090086, "uuid": "da63c7b3-bc66-4aef-8058-9a69a824c40a", "comment": "Malware payload (Dridex)", "value": "70a56273c308314dd8af5fc64c975954ac14b008c1b50d989d7a4b9678d47a51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090086, "uuid": "af4daf79-831b-457f-bfc4-9319dc4a03cd", "comment": "Malware payload (Dridex)", "value": "ebb2f3726560deaa8d354c47687a47114a19977b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090086, "uuid": "5cba2cc1-3f01-4e37-8ff6-c48d797d4ca4", "comment": "Malware payload (Dridex)", "value": "aab8efc5fc66b103488aa01ed296401dd1ea22c92b080dba3bbffaa720bea644c2eac5c2be617c958942544733c91c76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090086, "uuid": "91490123-7160-4d65-b324-d5d00f618a3a", "value": "93F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090086, "uuid": "cc77d8f4-1e13-4b2a-bacc-91cd5bb9738d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090086, "uuid": "2d425a93-789d-46ed-9c1a-0cc29b6f8f18", "value": "3072:uiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:leAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090086, "uuid": "d8dc48e4-802c-43f9-a946-bcafc661bfc6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090086, "uuid": "edece65c-e81c-4ed6-afb4-009af75aabb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090086, "uuid": "008e0dd8-97db-429b-bcc5-9027dcc09a8f", "value": "0f3a9d35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef067cc-acfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620149246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149246, "uuid": "09d7c815-bebc-457c-916f-bb0f109f8f27", "comment": "Malware payload (Formbook)", "value": "25e847b9631bc2fe8d87fe4278fa142e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149246, "uuid": "2b9c33b0-fb32-4912-9075-5b1f5d390286", "comment": "Malware payload (Formbook)", "value": "70dfd7bc81878d265e39803f73f55af96d7bf2a336408b52cc6005785fbe0415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149246, "uuid": "8d66511c-03bd-432d-8891-3152c89a5ccb", "comment": "Malware payload (Formbook)", "value": "641756a84fdce68e101a53cfa6809b68190b7ad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149246, "uuid": "e2005f94-fc58-4779-a4f5-37d8ae189eae", "comment": "Malware payload (Formbook)", "value": "9d4b2f0974dcdd15897f7b37d340d457422a518087d5fef2c5e890d3a01e3ff2b1eeeab5860da02045663e5f34ced320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149246, "uuid": "be83ac90-b598-4b97-b2d7-7f024eb242d6", "value": "B734126512A0C5FBDDAE03715EF7736D2B87D0260AEA2B075FA0975F79122C1842F262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149246, "uuid": "49d83784-4cbb-4b2d-a757-43bbc88b7b49", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149246, "uuid": "b3e134b7-7db4-4e86-bc69-87dd7188068f", "value": "6144:lPXZ+Qpc3dgPKMqFsSa94wwuYc3ZqiU5OPiNCPEXH:T+Qpc3dg4GS+4w5YcxiXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149246, "uuid": "2cb56153-01e3-4c82-8e2a-0f75746a3d1e", "value": 233957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149246, "uuid": "1c412c7e-4ff4-447d-b1f1-dac30aa00419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149246, "uuid": "4be15cfa-7da1-41ae-86d9-7075bc619c90", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b865df43-ace5-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620138820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138820, "uuid": "8b72c4f4-a8d2-40c7-8945-9f80f9b848de", "comment": "Malware payload (CoinMiner)", "value": "c85e27470e88ad0d0449ab68ef18d0a3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138820, "uuid": "9f96d4bc-5822-47dd-9a0f-7a5649e64412", "comment": "Malware payload (CoinMiner)", "value": "70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138820, "uuid": "5d4f8f95-9b5b-4e01-a454-71e4998a8407", "comment": "Malware payload (CoinMiner)", "value": "4791330c3acf353772c3d073cc52a619eb4cd7cc", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138820, "uuid": "10eb86df-3e91-4501-8241-ef6498d99dcd", "comment": "Malware payload (CoinMiner)", "value": "347b8ee220553f5fa869d192c4700b228afd9fcfe75bcf394bbbe93c2e2ee29b3bf51891f07665e1de95a69d517cff19", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138820, "uuid": "b6f8fd90-fb82-41b1-bce3-6d7215fbe218", "value": "3BC4AE2638C1C033C67335710AA9F6719ABEB4701D3396AF53C8663E5F346A1AE1563B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138820, "uuid": "f3c6910b-86b9-43b4-9bb7-0c6a5c0f7a0e", "value": "c665d9cd2047df148cb63b3c8dd5e0ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138820, "uuid": "8c23db3d-0f6c-4363-9631-8b2757fc2fba", "value": "12288:GfIvFvLLcM3mb4eQEu0vowGBnL0wehr2ceCBb/I1Q2XBmRaJouRDJvwgkdq:2OFvLLcM3mb4zJIXgceCBb/IRBmR4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620138820, "uuid": "c468ef69-262a-4094-be90-77128d4f1d4a", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620138820, "uuid": "14762b4d-f0fc-4863-8250-062d6e9b427f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138820, "uuid": "c6243858-0dfd-4b83-bdbb-166857188720", "value": "70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0979a63e-ace9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620140245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140245, "uuid": "463d126a-6f96-4dab-b19e-a89f0559df15", "comment": "Malware payload (Stop)", "value": "98aeb8fcd1eae79f983087721305aa9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140245, "uuid": "d1b73d28-f2e6-43c5-b542-f17d7734da6e", "comment": "Malware payload (Stop)", "value": "712e9e9e2976782e38288d45a2d177f1dc3757c7610b4b9bae9e35be9f20b913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140245, "uuid": "17b7fa27-e82f-4e1d-8c01-5ebcc7544189", "comment": "Malware payload (Stop)", "value": "87c013f1cd71a20836c5a2ba7f7206ce1fd64a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620140245, "uuid": "6fb7b797-2f53-4032-96d3-e73442b680d6", "comment": "Malware payload (Stop)", "value": "f5348bcc94baf55f366b7945aa842ab6145eb9720b911388e14de18cc7f1f5dda8523eacb0c1a0b4786d39c62900c910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140245, "uuid": "b81df15e-9352-4ee0-9556-a8fea3f5498d", "value": "43051211E184C475EC0755B288A1D6B64E6F7C1362221EBF7EDD3AFAEF24291B62130D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140245, "uuid": "1beb508f-e4b9-4aad-97a6-20b078c1e111", "value": "b0ad6bf31823e1fb2677105ef8ea4f6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140245, "uuid": "e21a037f-8c0b-44e4-96b4-190ed993ddbd", "value": "12288:4xju7x/OaOyAt9QEvdfrMV/ZFRhoV7D2HhlKGoUPkBd7SVt/1zmr:0Wx/OaoaqYfFuqHuGoUPUd7SVt/1zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620140245, "uuid": "65a49ad2-eab6-44c4-81b4-efae26fa2e80", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620140245, "uuid": "bd29d2ee-1edb-4561-adf8-30a882e75a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620140245, "uuid": "80ce5feb-1dbf-4d46-b6ff-22f9980742d8", "value": "7D1E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec000b8-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Osiris)", "timestamp": 1620120416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120416, "uuid": "fe842d75-a915-495f-b267-534b651011bb", "comment": "Malware payload (Osiris)", "value": "e2f99487e970a27006cf282abab1d49a", "object_relation": "md5", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120416, "uuid": "46b75ee7-7245-4e40-8db4-4cc10c90643c", "comment": "Malware payload (Osiris)", "value": "7176b06d8ef959057db3fa2868695ee2d3e810353fb236923840903ddb47019a", "object_relation": "sha256", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120416, "uuid": "a4315304-66e9-47e9-ac07-349654bc0638", "comment": "Malware payload (Osiris)", "value": "b5d6b3b95f265888ce74e1be495858928214eb00", "object_relation": "sha1", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120416, "uuid": "c61b1fde-4cc2-4cb2-8cac-4914463ec6ed", "comment": "Malware payload (Osiris)", "value": "4230e19eef7c3b2fb178ecec389239d98f16d671a60feb7476982d70d99872173afb9fc4a123d0512d8097c6a928066d", "object_relation": "sha3-384", "Tag": [ { "name": "Osiris", "colour": "#50A871", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120416, "uuid": "3b6e4fbe-3410-410e-88a8-ce900f17cf05", "value": "6F94BF22F581C036D2B102B0CAAD7F3B97FDE525033599D7B78809951EA44E67339B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120416, "uuid": "2e0d4688-2e8d-4d4d-b7d2-4eac23c6a69c", "value": "cd3fc0dde37bf2787f0f054ef3b5a350", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120416, "uuid": "ae76e294-7beb-4dbb-be79-4eccf2311c92", "value": "12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK98YjTTsx/SA/WegYfdNbrqnG:rXh6XcBXo8TsL8Y8mWjTTySA/DrfdNb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120416, "uuid": "662c19d3-a9f4-46d4-869b-1fee5d8e73c2", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120416, "uuid": "91a43bfa-92b7-4571-a0ab-5ae92f60755d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120416, "uuid": "e28ed29d-f583-4761-a134-2f6e565930f7", "value": "2f50000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6d35e6-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111686, "uuid": "0cef9f7f-7d9d-47b1-b8ca-084e655ad03c", "comment": "Malware payload (Dridex)", "value": "e3064f9d220db2dd04355f84e2150d59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111686, "uuid": "74480082-e139-40bf-96cc-e2f9e8701c8e", "comment": "Malware payload (Dridex)", "value": "7179d83312ac0030963d93292c79fe7f169ff0afa56676f7da53615ccc89be83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111686, "uuid": "8e07a74c-05a0-4a66-8601-a1b6fcbfd2db", "comment": "Malware payload (Dridex)", "value": "a9f19ecba23cda2d2440944fb7894f9505116e83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111686, "uuid": "6bbd9811-2367-4441-82c2-a604d5cc3b0e", "comment": "Malware payload (Dridex)", "value": "f0a57db23024a8299e7c7a80d2d5bc374c145b1ba5ecd06ea97ba2df2d33572893ebc1e8ea18efec5f3242a1bc6ade4a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111686, "uuid": "b2aad2e4-7fc4-4013-86eb-58560093af37", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111686, "uuid": "7c59a40f-1427-4b0b-a0db-1ac2c48c357c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111686, "uuid": "12a7fd5e-c6ea-4d80-9205-79b02f69c6a9", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111686, "uuid": "d5438ee2-2645-44d0-8acd-099f75725d9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111686, "uuid": "8dbea797-bc12-4e12-99cb-f6e6ab741f77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111686, "uuid": "946d5a37-5a8f-4051-8204-b52b30deb260", "value": "e3064f9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3142592-acdf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620136261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136261, "uuid": "bb482f61-2fb9-480e-bb11-9e30d5a30c55", "comment": "Malware payload (IcedID)", "value": "b946e5876bfe78898077a1af8f623ef7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136261, "uuid": "73306758-26c2-420e-98b4-4a4d3a54841d", "comment": "Malware payload (IcedID)", "value": "718ace8dedfa4d43286f7749d11096f65e18fd48581c7e274d96fd958eb3ffda", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136261, "uuid": "6afb354d-6f96-46e6-85f7-5d4a89a66a0c", "comment": "Malware payload (IcedID)", "value": "8c7e0eed137eaa082dfe0d8b3f7429cc10e35da2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136261, "uuid": "964269bb-db7b-4f01-b1e9-abef4cdfa78e", "comment": "Malware payload (IcedID)", "value": "f3ce72aac136dc5fdae7fc98c847d0e866899b8c28e7d890c4c81ee16831f98daea9b5a8ef660a47d44ece52542d4e65", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136261, "uuid": "5620ef4d-16d9-4e67-bd13-4e30166c25c0", "value": "D07337219B698BD0ECCA79774345CAB1E3324FD0174377E7BEAC7A4D2B68981482512F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136261, "uuid": "5a12a215-2b71-470c-9058-01a14b4bdc56", "value": "768:i3e8Ymkyk751bTD2LdNnh2OiImFqGYjloqiE2DpKrflUPYPbskMH5zmC:5N1bTDkNnhipFnY5IE2vYjsRR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620136261, "uuid": "a5acb8a4-7424-4c26-974c-ed5182c7a337", "value": 77572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620136261, "uuid": "aecfd3ab-a0e8-4246-a27f-d543da2667c9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136261, "uuid": "ace7fc8e-551e-4f39-b59d-f159ed6fcfaa", "value": "rule.05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f5721c-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118893, "uuid": "21272535-f80d-4683-93da-5f2d666c6cd3", "comment": "Malware payload (Dridex)", "value": "66b8652bf759489f829bbf04fe4ee767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118893, "uuid": "a5d049fd-8142-4076-b932-c718418518f6", "comment": "Malware payload (Dridex)", "value": "71a3541fc962b8732810166aaa140dfc7563fca663710da5bbbb2cbb7c7868c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118893, "uuid": "a385c9c5-5fee-450e-8601-72b7c6a47197", "comment": "Malware payload (Dridex)", "value": "ca90e980d9498e2f37e047379e6e914fe8596a74", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118893, "uuid": "b516e132-0d2c-4ce5-9f65-cc75e3ab8a77", "comment": "Malware payload (Dridex)", "value": "61d5f2b17cbcd0825441adbd8d64740c25c8a5e92a58861e86f6b651f0260cca05873232c1a2beb440d34f7d2383e0f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118893, "uuid": "cd2a9daf-f9e8-46f1-a0e3-8e04ac360cc0", "value": "39F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118893, "uuid": "71fa99a2-c510-4c13-84aa-d3b1b58af2e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118893, "uuid": "f420647a-47a1-47af-85ab-a51b34a7f22e", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118893, "uuid": "ae0d1f4b-8fbc-4a5a-b840-8077b30e2f9b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118893, "uuid": "13c347d9-c788-4f04-b15e-cf3c05417c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118893, "uuid": "a3499f8c-f37d-465b-bda2-45381a99ad87", "value": "66b8652b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c01b557-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620143819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143819, "uuid": "c68aeb67-5b93-4be3-864b-c26aed5d3dd5", "comment": "Malware payload (Quakbot)", "value": "92888979e33ce98460220aca2ca69582", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143819, "uuid": "146bbb77-723f-49c0-96a6-0bfa6b2289c7", "comment": "Malware payload (Quakbot)", "value": "71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143819, "uuid": "54a45908-ecf2-47a4-9e54-c7eb208ae319", "comment": "Malware payload (Quakbot)", "value": "7198cb968a60f7e6f80492e43c146865812388a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143819, "uuid": "4a4e0eaa-576d-4ffd-a196-166f272ab793", "comment": "Malware payload (Quakbot)", "value": "94d50941262f000f95ab325ce290efa93bf226e7da3472ecd3bb8827a515af3518fb1294cd97fbb789ccfc0552d6487a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143819, "uuid": "13609b4e-b4ea-4840-afd1-9ea997bcf12b", "value": "CC657C31B1D2C437D473267C9D7AA29D982A7D111E28985B7AE40F4CDF3A6803E2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143819, "uuid": "c0ddd7b9-def0-4399-8cf4-be848b383777", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143819, "uuid": "038fcfce-cab6-49b1-904c-8feb0e7201a9", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGmw5:sbeeGRuPPu7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143819, "uuid": "468e41f5-bfe1-452b-932f-b3f7d0a04819", "value": 1493216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143819, "uuid": "5f9b7fb1-b2b5-4152-be29-39cef2991bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143819, "uuid": "bb3eca8b-297b-4ed0-a740-c5c2e2cc3275", "value": "92888979e33ce98460220aca2ca69582.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36a771d-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620115270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115270, "uuid": "7c94616b-3e49-4ede-b68f-1b31608151bf", "comment": "Malware payload", "value": "2c22e00631f50883be16acd7872cd5fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115270, "uuid": "8a41d9c3-e343-435d-a419-f70d95feab14", "comment": "Malware payload", "value": "72ac21d5e382f4fb2de264e0e490b9c4551cd3010d2467cd1cc03f0fd6e710b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115270, "uuid": "6e54ed66-e873-4c56-a84f-614548b6f7f8", "comment": "Malware payload", "value": "1622093fa22825b0a4ec37aa42055eff04e4239d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115270, "uuid": "b04f8915-1b18-4981-8607-5eddce37f875", "comment": "Malware payload", "value": "c4f7074563361cb0f046f84faed9a7dcddee5afc283963625cb3d067cd4dd36c9d768454a41dac01ef4f3dab98fd181d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115270, "uuid": "d805a49c-2826-45fc-b4a6-4dc403af4ed0", "value": "6722AFE1E923D6DA49003BCBFB0D04585EA9DF4AA139FC8A8F95B5B2A75BC310154770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115270, "uuid": "9f27dd01-5f22-442a-9cd3-5da876f664d1", "value": "192:x2irtnJq/nbzr5xHKlo/XWnM7j3tmz9Ks+pkUMO921gXSviK/iwJG9t:x2KtsDzPk4EQ3tmUkUMh1gm1iw0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115270, "uuid": "7a4d3f86-f5f6-4a2f-ae0a-61f64217f86d", "value": 10680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115270, "uuid": "ab77b82e-1ce9-4bf8-b7af-26a296343567", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115270, "uuid": "d91bddaa-c6c3-4770-a2cc-342a11625538", "value": "2c22e006_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b17c71-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152960, "uuid": "e84eca9e-7e4e-4caf-bf2f-e69723f5a0be", "comment": "Malware payload", "value": "32e1a5328ae2225b4b5298dbdefc620f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152960, "uuid": "8004099f-b6ec-4a35-ac9b-7845b6be1d96", "comment": "Malware payload", "value": "72fea8e675adc41278648651c86733e1dbeea2310741c51ead490774dd91a23c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152960, "uuid": "83371e23-dcb4-4f52-82f5-cbd5b45bd8f4", "comment": "Malware payload", "value": "8d850816bef833f8b41c804a6a10bd8a5ff0d025", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152960, "uuid": "4d6dbacd-7d50-48e4-b27a-bbbb7dade160", "comment": "Malware payload", "value": "85513afbf0658bfcbe170f714653cc269e2d11b9c4dcbb20fcfea6f8460e62b23e1e9e551ac632313be458e4101acae4", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152960, "uuid": "ced952cd-b3ae-4e0c-b75d-560409b37b3e", "value": "9DA1F850112C1AB07246597AD26FFB52B50EC81B0A777B358433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152960, "uuid": "9ace8dab-b2a4-4b95-944a-7311df8ed3ec", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152960, "uuid": "8a8add4f-77f6-4dab-857a-32a9a405cff3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152960, "uuid": "970a8d19-ffa3-4e45-ae74-68f9c2729b53", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152960, "uuid": "a8cd0c7a-7303-4b00-8bf8-1cf6d5190b9d", "value": "72fea8e675adc41278648651c86733e1dbeea2310741c51ead490774dd91a23c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea14b3a1-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119147, "uuid": "8fb63a78-a7dd-4e73-9765-2ab5b50b3dc5", "comment": "Malware payload (HANTA)", "value": "a5605a82a4aa6a8145d9968801cb8477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119147, "uuid": "8f8e2d7e-cc9a-4dd9-9ad0-3464cb034a7e", "comment": "Malware payload (HANTA)", "value": "7363e73bd08554a9bc8745cc56a723a09e836aa20ae02633718f326296796eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119147, "uuid": "a697143a-fe61-4c20-886d-06326e9fc9d0", "comment": "Malware payload (HANTA)", "value": "fd985a63f9e22538d721c8c12f797e6e240b9f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119147, "uuid": "e4ec97a3-8ba0-472e-8594-5f566c1e2dba", "comment": "Malware payload (HANTA)", "value": "bed33cfc90106f0d97f1567deb1389fc2129f80481ca21fc54e9414f9ffbeb321163e40075aaf2b0de0ad29f21df0ad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119147, "uuid": "f7b5b596-527f-460b-9d74-b68183ea00f9", "value": "13050277056195F6C2491330F4A50F5F367CD2351A80B688F05FB2EADC5E68E8AF87A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119147, "uuid": "d5354ca1-99ee-4ee1-ab8f-371fea952626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119147, "uuid": "0261c6a9-64e6-4c90-83f6-d3f8e9c7d690", "value": "12288:bZu80QdEC3a6vyTleh8LvjVV1wSp9cMQoivKx2n6Acbw4VpIVrO1N:Nu8pdDylehgfK0iMUvKx2n/cbLjWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119147, "uuid": "2b1aa001-6499-4612-be35-249a837d624b", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119147, "uuid": "4751f364-0431-4010-a2d8-c5ce14dabddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119147, "uuid": "b770f5ac-f7c4-4f8d-ac9e-4b3cda1c91f8", "value": "A5605A82A4AA6A8145D9968801CB8477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65035a1e-ac96-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620104750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104750, "uuid": "bfcae53e-66ed-4a71-a2b6-1ff090db2950", "comment": "Malware payload (NanoCore)", "value": "cdda16bd52c7c602b534593be9149a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104750, "uuid": "3a0d3f9f-abc4-4e8b-81c1-528194e146c5", "comment": "Malware payload (NanoCore)", "value": "741b26251fa1fba9c4d5eb7aaca544f07859f82c296b8c01d2339a4ea2d06c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104750, "uuid": "43755f74-b0f2-4094-897f-bdb12b3faa60", "comment": "Malware payload (NanoCore)", "value": "5789cb8b8b1493de3733c66cd52d8b0180be6cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104750, "uuid": "e3f1afba-fb8e-45c2-9ac6-65fb28575518", "comment": "Malware payload (NanoCore)", "value": "40ddbb573e252282b6e3385ddcdb559e2cbc94b2f61d7095ce8a5d842725ef176d15824b999c3130be915e55b037fb6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104750, "uuid": "3d33b5e6-0b67-431a-9b77-79abd1f72761", "value": "2EF4E68C8E99C1CBC6B90AB882CEC9D946E94FF35F12E879B8C447C7D161345F606939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104750, "uuid": "2cda3e72-c61d-4709-8d27-027118efb5ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104750, "uuid": "9c8056b3-52c0-46c7-8b15-24a790199aad", "value": "12288:r5miJJsGELK+yZRK1Wc++qRz/C3TfpCMsv0nSCB0eXfw1AgZaWm:nELKNRK1Wnr4wPCB0YfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104750, "uuid": "251a07f0-46f0-41fe-a29a-26b91323f814", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104750, "uuid": "c3d6858b-69ac-42e8-8334-53077967cc3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104750, "uuid": "178e865a-764f-47f4-a605-4356a7956069", "value": "741B26251FA1FBA9C4D5EB7AACA544F07859F82C296B8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d04afc-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620118876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118876, "uuid": "3064de79-211c-4125-8429-b37ebfe4f0e4", "comment": "Malware payload", "value": "4849dc51af0afab7cadc56bf6a2d3931", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118876, "uuid": "fa87ca7c-7616-4813-9f35-b51322524f63", "comment": "Malware payload", "value": "746a28d9e35ca198af34d2c8841d4bf60076032a5a83f1c1cc272bb85461e6a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118876, "uuid": "7555c33e-6bfd-47d1-8f6f-0940adfa0279", "comment": "Malware payload", "value": "78a83f4360d484fda0a6914651e410b3eaa5ee68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118876, "uuid": "7ff36182-03dd-438d-a0fa-a431dcdbf44e", "comment": "Malware payload", "value": "0a868311f253f81d6c501d5eef5631af4fe20fc3bc31db83d67db0cf64449d55e5a66dd891f3823972ac1dce3906a231", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118876, "uuid": "7a87278e-6782-4fee-9a4e-b2e33be24529", "value": "A693CF5B3CAA8558E0135432195D8233A61CA6EAE509E09F27FD0C5E6E78C7C4B0B9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118876, "uuid": "92173152-22bc-48d2-b552-e966e610b591", "value": "1536:jxtWUzE5Uim9TAfl4X6lfl9ApQo/sfNWwV+aCPfsWc1scUfoIyfofp8TdNrRa30J:DWUoOJ9TWZHUwV+/fpc1scSoxfoxidiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118876, "uuid": "d0f4a606-0c24-4b9c-8596-7f19f6c810a0", "value": 91801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118876, "uuid": "811f5445-1da3-4d1e-ab51-48b2c72ec3b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118876, "uuid": "7b235b38-f8a3-4a0a-a23c-93b19ef8c0ab", "value": "4849dc51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98afdec5-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111709, "uuid": "7a1f136d-c531-4770-87c8-9c8380c0f69f", "comment": "Malware payload (Dridex)", "value": "eb2b37b5f4553eb493f1b9a658fae45c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111709, "uuid": "dbde9d20-8250-4685-abe6-b520a793bfd9", "comment": "Malware payload (Dridex)", "value": "74ba3099d9e3e136cf6ce01988ebe61501c2eab95243c551f67cffaba308fbf0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111709, "uuid": "c0cad201-ea7d-4d7f-bc5b-a023c81233ed", "comment": "Malware payload (Dridex)", "value": "97746e5d8274559f69075392d5e38e8c788de6f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111709, "uuid": "c59059fb-9358-4b83-9574-09b7c165f0dc", "comment": "Malware payload (Dridex)", "value": "a850b033b0df4f21511c41b56af6e2f0aeb8c479a1c9d314ccaa3173e83d55c5dbd8b66461b3cb7a9aef3bafe0389de0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111709, "uuid": "51ffa746-8322-49bd-8256-162ff983cfa5", "value": "20F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111709, "uuid": "019c8d2d-2e24-464f-94df-2606326e1064", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111709, "uuid": "678fff89-5f68-4b08-bac1-b36822e1b280", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111709, "uuid": "4312a376-0f87-4822-a17d-2f4e060ddc03", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111709, "uuid": "b103d23b-4c8a-479f-b41a-ce4c1511f7b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111709, "uuid": "f776178e-4014-43fb-a049-c9bf0f068c4f", "value": "eb2b37b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62070f8-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086471, "uuid": "0612fd02-33a9-44f7-8443-21b0132a5cb6", "comment": "Malware payload (Dridex)", "value": "8d8c9f5699c39b9ba9a074d2b5646764", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086471, "uuid": "c3d534a7-b195-46ed-953a-4a382dffcb77", "comment": "Malware payload (Dridex)", "value": "7530254ab234fbcd5366bb7898993088fdbc2ef977d02fe90ea1906ec1fe2947", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086471, "uuid": "58fe1383-43bc-40be-8ac2-daebe57144e3", "comment": "Malware payload (Dridex)", "value": "06a2ac64aec332b4c4b82f92f81dfafc3b145efd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086471, "uuid": "3bb405d4-a6eb-4711-a9e2-263c51a56b6b", "comment": "Malware payload (Dridex)", "value": "fa628a121ddad5922d32219ec047fbcf083dbb303bda625ed7652886f58ffc313c611737b8719e5004099f1ac8306130", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086471, "uuid": "7630e728-ae51-4ab5-9ffa-a798a6a54b03", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086471, "uuid": "4adf6aec-954e-48bb-81d7-d4fcd72ea38f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086471, "uuid": "8aace74b-ecc8-4ac6-a607-286e542c059d", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086471, "uuid": "c0d9c0cf-79e3-4c9e-bbfc-b58371b5617e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086471, "uuid": "7359d154-c297-424a-836a-b6a003003cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086471, "uuid": "c119cb04-dba1-4a5d-9b98-e71789ca9632", "value": "8d8c9f56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a11848-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115295, "uuid": "4b893445-8c19-40a9-9833-ee9957b6371b", "comment": "Malware payload (Dridex)", "value": "f3baccc6cdb1867148eb4a3c5659eba9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115295, "uuid": "e01d3729-3ec4-4bb7-b210-efaf6841a001", "comment": "Malware payload (Dridex)", "value": "759107a0db2137007c9a05b52e91a9e7d1a3dd78595d4082f67874b3243e77e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115295, "uuid": "43aec73a-7c81-4ec2-93b7-b3ac4ec27198", "comment": "Malware payload (Dridex)", "value": "d2dcd10739dee3ffd426649a718e3c382680df65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115295, "uuid": "93c65381-cb62-4700-8087-53f1d7b81801", "comment": "Malware payload (Dridex)", "value": "d96ab6a7609e89a18a929afb433fa53caf908001ec8f4b1efa7b61e65eb711537df8d558c48747db7796f2e1137d6872", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115295, "uuid": "bedb1dbb-5807-4b60-92be-4427501132d8", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115295, "uuid": "3bbbf431-6226-4cb6-bfce-f318dc4eb65d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115295, "uuid": "8cba24dc-81dd-4f25-b7e8-f77d7daea034", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115295, "uuid": "549278c1-e118-44c1-866e-1cfbf7c22ea9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115295, "uuid": "203e804f-dc72-4617-9d24-cef1305dd0a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115295, "uuid": "2b0aec35-144f-4cae-bb2f-84d0fc766af6", "value": "f3baccc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea47b30-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126080, "uuid": "1eb52729-75c1-4276-b77b-67cb34383749", "comment": "Malware payload (Dridex)", "value": "cdce1cb375043f86cb566203d0dad55d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126080, "uuid": "df9227e6-12c2-4d7f-b0b4-69f617776790", "comment": "Malware payload (Dridex)", "value": "7598af7497adc16b48470ea060f02bf4b8c8c8dd46ddb4ada1a79e263a3c79fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126080, "uuid": "a15def37-fd4b-4fcf-ac21-1591960bfc10", "comment": "Malware payload (Dridex)", "value": "34d6719e0f44b26e2766f2e53c54d5fc55d1ae65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126080, "uuid": "d1bfcc4d-fd04-48ae-aff1-0db769518421", "comment": "Malware payload (Dridex)", "value": "c904b48d67e4eb6597cf2d1569f02ecd25242f4dcb946b281fb376a1a56c62e69b17a91ed470aee592166cca296316ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126080, "uuid": "85a091bd-8722-4f4f-96d7-7355f5120656", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126080, "uuid": "cd07cdfa-3e30-4368-b410-c82c1a160c75", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126080, "uuid": "ff87c67d-fe15-4fe3-ae90-7003fcfe8065", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126080, "uuid": "76a3bc83-b2ed-436a-8d7a-5a433b2d4ecc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126080, "uuid": "b444f889-dd68-4689-a24a-27bf996d94a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126080, "uuid": "9e432b20-aa60-4895-bf3d-e6aebe235276", "value": "cdce1cb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6750c7-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108088, "uuid": "cba9533c-0ccc-4205-b9fc-a975cb81ce5f", "comment": "Malware payload (Dridex)", "value": "3dbf1bdcfeae4079ddc380f8d78f9b69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108088, "uuid": "a7f9003f-4139-4be0-ac26-3ad19a31add2", "comment": "Malware payload (Dridex)", "value": "75e9658d8f91b0e74ae68865d5b16255106bd946088284004c7a6064e3a7cd7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108088, "uuid": "9980f2ff-1793-4d90-8b47-affa38451031", "comment": "Malware payload (Dridex)", "value": "4f36af784b0aa6fb1190edfab077d76738b3ded1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108088, "uuid": "0800efa9-e000-45fd-a498-78104d4e4179", "comment": "Malware payload (Dridex)", "value": "1b04bd02c56933b257de32b635a74731bd53dbb12ddca18a5e9b13f92687af1cc488f61cee68a098489f67afeef8060d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108088, "uuid": "f16d9a00-fbd2-4eea-817a-c515d76512bd", "value": "55F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108088, "uuid": "4e09c33d-7f06-47e4-b3ed-ffad78636c4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108088, "uuid": "3c36bb89-5eba-4303-8191-9307529c43a2", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108088, "uuid": "9fb4ebee-a250-4a45-b17f-8ccddd327745", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108088, "uuid": "84485617-4c06-4422-a940-8e2aeb7515ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108088, "uuid": "3ab3ab02-f7ff-4ca9-99de-8c31355cffa6", "value": "3dbf1bdc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa14526-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108070, "uuid": "644da68a-84ae-4110-a860-0df3f2262285", "comment": "Malware payload (Dridex)", "value": "3eb4df3e11d3f7721aef0bb2137614a6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108070, "uuid": "6e2f9c65-e91c-41d4-9237-a55ed31a0892", "comment": "Malware payload (Dridex)", "value": "763f0eab21e0ef2cf7fa128310c01daf330557617dfadba9b5927c93bc55fe50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108070, "uuid": "bd444b59-7fe3-44cf-999b-aee2b5bd8958", "comment": "Malware payload (Dridex)", "value": "9fbe36e7915ca9e1619ecbdd78077b4b733a2060", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108070, "uuid": "27b69a1f-ba6c-4609-813a-ec6d2fe8c27c", "comment": "Malware payload (Dridex)", "value": "9e7c4e3d0656c0c92cb41160a380c4c958ca325d49739248da24fdc9eb44c63f2e31df083d1c3130675d3b4c5cd895bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108070, "uuid": "12eb450f-ae3d-4a41-9612-b163652ab637", "value": "51F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108070, "uuid": "a770583d-b317-4b33-91b6-7c02cf3c2832", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108070, "uuid": "cfb43f0f-b60e-437b-b65e-2fa53a47504f", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108070, "uuid": "dd15897f-1d4b-48e6-89e2-b19b1332cf36", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108070, "uuid": "8421c921-4394-44e3-b98f-ff4caf08e634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108070, "uuid": "366f8503-3a91-4a49-a88d-5857385e131e", "value": "3eb4df3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633ed23b-acf2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620144261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144261, "uuid": "0c4400c2-5fb1-48d8-ad86-5d668daee496", "comment": "Malware payload (Loki)", "value": "02c68ade0e640be3bab30307f1326981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144261, "uuid": "3091d8ae-1e3d-451a-88fa-4dab24abb27e", "comment": "Malware payload (Loki)", "value": "76455f7336aa729ffcfa29bfd7b2d558be37e5996b6906c56f6a7e7d01a52764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144261, "uuid": "cc4689ce-51f3-4f8c-9b8a-63756f165f3f", "comment": "Malware payload (Loki)", "value": "d2059928700b35792850fb5995788bd45f60a8c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144261, "uuid": "ce04cf7c-80f6-4c59-a99c-8db76a2c0a5e", "comment": "Malware payload (Loki)", "value": "b12f73a106d118284e642eaacb502d0052f49efa9af287fa80f739e67e54031b9c4161e8d74c919dabc1f140e1210e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144261, "uuid": "76ca4963-cb1f-49da-857d-bdd384bd2ee2", "value": "1424DF12BED49711C5B04937C6E2C1387B72AF829512C66B7D9F730647333ED990AE8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144261, "uuid": "e422d595-6880-407e-8063-817d34348d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144261, "uuid": "b1530d68-2242-4aea-beb3-ab7be27a26a5", "value": "3072:7eDu5P+vZJKZ0HTzk2hyLp/ChdWKEsth6xvzCKz4R6/IopNAOrseKpHKGu:wN4Qt+2NEi6xv+x6/IoIOtMKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620144261, "uuid": "5ae00646-0daa-474c-ab39-fb003afc10b8", "value": 227128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620144261, "uuid": "c2f9eef4-140f-4185-a490-9f336c0fe1ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144261, "uuid": "be55af81-229b-4d03-8e9e-5df543ae72fe", "value": "Tpxgwea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c510df-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620122247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122247, "uuid": "4fa2cca4-865a-43f3-b400-cb3830cba0df", "comment": "Malware payload (Formbook)", "value": "1ad4f36b3b11dbbde0e6d905898726dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122247, "uuid": "bcce0f25-9fa8-4f1d-934b-02030857c8fb", "comment": "Malware payload (Formbook)", "value": "7647af23ff3154b3cab47d0ad05f1c9ee4779f8bd862ef6a4e19d4b70185c5c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122247, "uuid": "1e64e094-9555-45c9-9684-aca1e1beae6d", "comment": "Malware payload (Formbook)", "value": "e3d0d30cd7396bc2d0242b719880b3859e9e6d9a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122247, "uuid": "1ed3de5f-6347-4fb6-beea-1061c91a5eaa", "comment": "Malware payload (Formbook)", "value": "0e65f83c6f113c4830e34993dfaa10420f06f0b66721c66ab3b874b8c6ed9b647afbd385010329fbc97bc813510b7420", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122247, "uuid": "785a7391-bf64-4cdf-90cb-190bdc9f4888", "value": "79640252FA8088D3CA2902F185675F5326F75F1A807D861B72FCBA5A7BB32C2041DF65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122247, "uuid": "c35128f9-94f4-4821-a727-6e91ef53a654", "value": "6144:MPXY7suD0qPW7qBubY/nVC4gJwl4GvxxmMsRD8GIzb:7suj0qB/n+JabxxmMsRD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122247, "uuid": "ed771976-5aed-4ef1-89c0-fd87389e00bd", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122247, "uuid": "c1c49874-5050-42cd-a131-1c466a242ff9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122247, "uuid": "8ddc61b1-3868-47cd-a5d3-6e05c39a2c75", "value": "Lancopdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe2b1aa-ac79-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620092152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620092152, "uuid": "bdb00c81-848d-4ae9-8ad7-2fa00729d8de", "comment": "Malware payload (BitRAT)", "value": "8e1efc18d9cb8664ff96be4b92fff2d0", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620092152, "uuid": "aeed413f-61a9-464b-9b92-d008fe92091b", "comment": "Malware payload (BitRAT)", "value": "76aaa0acf856f7e8e8354afff1afc8f9b3323412e038d2ee27f22b7c4abf62cf", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620092152, "uuid": "12fae8ed-4cba-4f5f-9270-ca749896732b", "comment": "Malware payload (BitRAT)", "value": "1fddb0f2e086431e1cf7e9433dbfad01fdb443df", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620092152, "uuid": "f805e276-128b-4775-af69-1ba773b0fa75", "comment": "Malware payload (BitRAT)", "value": "93d7d88bf8ba3c5aa1e47dd762d97d885c5726f6b1c0430840f22aa792570aabdeb8256a94c643b7bfe738f8abec66a3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620092152, "uuid": "dfdd0222-58dd-4ddd-97c5-2c2795d68bb3", "value": "6D06CF02FA41C562E2670230E9AE77BA053CF5344B2085C3B7946A385AB56D17B3BF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620092152, "uuid": "b29c1377-188d-4fac-96d4-eea9dddcd6b8", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620092152, "uuid": "3a342f4a-d081-4659-a2e0-ab9fa29769de", "value": "49152:ZXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VI6:ZXrEeZzdhjuV/gd1VzsGUqNKTHvQey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620092152, "uuid": "d2959b05-988c-4df4-99ea-de654b4fce20", "value": 3941888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620092152, "uuid": "0462ace1-b5e2-4a87-b959-0e3d50863a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620092152, "uuid": "4aeaf122-48ac-4c4f-8b4a-7a1758b34710", "value": "8E1EFC18D9CB8664FF96BE4B92FFF2D0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c3a211-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153466, "uuid": "690a6099-78b6-428f-a450-cd70b10a6c27", "comment": "Malware payload", "value": "af35416e234bd037e628ae0483f7e1d9", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153466, "uuid": "a1d802c2-b869-4171-b169-e1d25edcdc71", "comment": "Malware payload", "value": "76fa77381db81861ee201652a8498075118b80a95947506d08abbe7d2554c272", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153466, "uuid": "56915b2a-e4bc-4c3e-ac56-e3576ecb0b44", "comment": "Malware payload", "value": "542f3aaf689cbe492addc82dc74bc99f74986a53", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153466, "uuid": "30a27cc0-027a-48d6-9198-058369b3f55f", "comment": "Malware payload", "value": "64d80520ed34b08dcf3b1c0438752e6f07d372ebc5027c625dc41d150856dc73f5f6478eecef22b9abe02b41bf4b0d86", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153466, "uuid": "0cb258bf-2bef-40d6-a39d-c0caa4fb64be", "value": "37E2D50AD107E0F6DC2B0871035BF7BF4B609531E8309E85EFA05E8ABA27D593A1D760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153466, "uuid": "e51e2f8c-542b-432e-93da-5d5f51531a03", "value": "768:uR7AQOgVSoAaZMAWAuYYHQjzcypdoSrLOBGvx3b2IQglq:8TSoAas/Qjrd7bvx374", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153466, "uuid": "641a973f-a6bb-478f-a7ea-6af508379cf8", "value": 31824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153466, "uuid": "d0fcb618-eddc-4181-98c6-2ea2353879a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153466, "uuid": "f0072ee0-27b1-4961-871f-b2031d7c467d", "value": "76fa77381db81861ee201652a8498075118b80a95947506d08abbe7d2554c272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5d1ef2-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093733, "uuid": "ec07e7fa-e6ef-47f1-a36d-742f0af92680", "comment": "Malware payload (Dridex)", "value": "efaa64c9e87a3a334a975a73aa11350f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093733, "uuid": "95f724d9-33f5-4d61-a91c-8f8c6a7311ca", "comment": "Malware payload (Dridex)", "value": "77cefcd812f3f6b560ea6c772bfd6aeb38bc61edaf5ac6fe44e81f44039feb59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093733, "uuid": "1bcbaa9e-b289-44cf-8a5c-3b29b88d0407", "comment": "Malware payload (Dridex)", "value": "eef24db6fc5f51932a9bc0011e8c6f9595276f62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093733, "uuid": "0a72df1e-1994-4b53-8618-43f8ab687bda", "comment": "Malware payload (Dridex)", "value": "05962a5ef29c17332ac4fab879acc31ee4514d7246521d977052f395cf7b641a8b8008db082aaf59533ebd317c4bcad2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093733, "uuid": "a7ec73f7-7d94-4290-9649-b209c64c334b", "value": "3CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093733, "uuid": "de6d319d-ab71-41c7-a9e0-3f65d54d7447", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093733, "uuid": "7bd4c2e9-1847-4a81-b86f-4734a8b1b79d", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093733, "uuid": "74eadd95-b523-45ef-8972-114eaab35685", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093733, "uuid": "99047798-c6d6-44f2-ac2f-7bf2038db811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093733, "uuid": "bc811f3b-df19-44f1-9d73-25fa2c94223a", "value": "efaa64c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067d706b-acf5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620145394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145394, "uuid": "6f264983-10fd-466e-89ea-99b30eb879aa", "comment": "Malware payload (Quakbot)", "value": "b20f59f0dec28c944c62f14fcdeecebb", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145394, "uuid": "0caa2043-475b-4a94-bb1b-bf0b7d97d57c", "comment": "Malware payload (Quakbot)", "value": "78a9d532ef2c79aa430393c85f8f0351d6fa0578297a7d5d349701670890145b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145394, "uuid": "62e95e39-4a3a-4309-91cb-451922d8fd03", "comment": "Malware payload (Quakbot)", "value": "113cdca46cefdbb50697d6f539dcc71bb3a1947a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145394, "uuid": "e231d930-f15a-444d-993d-0bc3efdd949e", "comment": "Malware payload (Quakbot)", "value": "9e1d95b28a6162b5bff04fb9a497d121d6109b637b62bbd5ae87179b822aa54f89406439cd02478322bb8fa1bc0b81be", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145394, "uuid": "229cee03-f59c-4f6e-b9c3-140cf42ebffb", "value": "0DB3AC0BCC488AC3C02E93FE7D074DF86E4E5719D8966FEF05212F893A665631D4B46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145394, "uuid": "261422d1-8211-4ce8-bdb2-352a2786934d", "value": "3072:DvKINbjvw548LMb/oqKO8NnS8+60KcplBO:OAbT648LM7D98Np+EeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620145394, "uuid": "dc53b4b3-7ac2-407d-993a-4671b761118c", "value": 116888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620145394, "uuid": "21cbf914-a661-4417-806d-7d7a68e67720", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145394, "uuid": "6b5d7a87-73ef-473d-ae0a-349251c35936", "value": "Outstanding-Debt-610716193-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbb8cbc-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118883, "uuid": "cc2417ca-3f12-4a9d-bb55-8ee9ee8c72d6", "comment": "Malware payload (Dridex)", "value": "e986fa07411fdade91b60684d29efb0a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118883, "uuid": "4bae4005-f67b-4b98-a612-c6a24aa15a87", "comment": "Malware payload (Dridex)", "value": "791135c49312d52f8ec8db46eda4ba967ff70cae3162144487275c416508dc79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118883, "uuid": "d25d9ca1-ce84-4499-9c76-8277378dea13", "comment": "Malware payload (Dridex)", "value": "a646b9765518fab7e35c6645ed312f31cfd68642", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118883, "uuid": "a965144a-a3f2-48ad-8849-934eb9a5a1ae", "comment": "Malware payload (Dridex)", "value": "f1d944006fb322fd1a6494b34aa35be8fbbc55499feb90dc8d1cd0e3b7157964301e08b397b43fbee709b0544130f2f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118883, "uuid": "564a292f-15c1-48fe-bbe0-fd5db4d04d2b", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118883, "uuid": "a25dfac1-bf3f-4903-aa4e-0f7070aa3911", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118883, "uuid": "0f4982e2-9353-434e-93de-2582ec8d1b1d", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118883, "uuid": "a11e6e95-df33-463c-8f93-91aac439fe7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118883, "uuid": "08ad6ea2-412c-41b0-b4aa-a2b9a8662042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118883, "uuid": "e404e181-fe7e-4389-bae5-a55b616681a7", "value": "e986fa07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e61b38-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152962, "uuid": "90353d34-8666-4c46-aecd-012aa6b1aa0c", "comment": "Malware payload", "value": "94638e50f8c7f1f95e14f12fb05bd1f1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152962, "uuid": "5db0e781-8125-4af3-ac45-e594b0ac747b", "comment": "Malware payload", "value": "79672af021188a5dfac6159ddb5f71df5922e5bb6477d6abdb0be74c1297813a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152962, "uuid": "6ba48d92-aa61-420d-ae6a-5dda112e3b4b", "comment": "Malware payload", "value": "6e19dcb7e4db2e88aeab4eea67d329277fff1f28", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152962, "uuid": "01554f96-aa2d-4c3a-8538-f544ac8c7eec", "comment": "Malware payload", "value": "1a9141768f29ee537027f8b01023c529a7f0d515d5078b0e916c27934b6be1019c352f18006ab9194b453b9bc003eff8", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152962, "uuid": "5350b738-2af6-432a-aeaf-8866725bad0e", "value": "73A1E850112C1AB17346597AD26FFA52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152962, "uuid": "88dca2d2-36a4-4665-8b3a-dd89fd78b18e", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152962, "uuid": "8d353fa2-17fa-4639-a16e-cf32e27e0f03", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152962, "uuid": "1dccbcd5-72e1-4bec-9cbf-ee76294324ef", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152962, "uuid": "c7dabc5a-b8d4-435c-9796-213b4eed905c", "value": "79672af021188a5dfac6159ddb5f71df5922e5bb6477d6abdb0be74c1297813a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb2ee9b-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108068, "uuid": "dc4525bb-26d5-4b6f-ba27-86a884bccafb", "comment": "Malware payload (Dridex)", "value": "be2622d9b7f6350810fee9351efdd449", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108068, "uuid": "219acb72-7215-4915-8427-ce035ebf78ab", "comment": "Malware payload (Dridex)", "value": "7a01ad6a3538331d410cfbdd187960cce68c6af921160f0abe102b61ff11d5c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108068, "uuid": "a3f9ab86-d85f-4326-b759-a4bb7865d222", "comment": "Malware payload (Dridex)", "value": "6fdf9a1c827036ae0243c02aced4fa640b9b96cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108068, "uuid": "affc899c-d5ee-44c0-9ec6-7308c3b36b45", "comment": "Malware payload (Dridex)", "value": "eefb93d71fa6026212e9c84e804fae8867dfd83c1b3039c898efa99557580d0cc1d408a87aa6625d2c4e8e555c74e475", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108068, "uuid": "a11b1870-9c58-4db1-b416-0a3f2a525b80", "value": "F3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108068, "uuid": "5ffb081d-0d00-41b0-bff3-b2b964c0a147", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108068, "uuid": "2c21fefc-248c-4355-a8f6-dcc382cca575", "value": "3072:UA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:U3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108068, "uuid": "f9432490-ce11-4c96-9dff-8ce659264e16", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108068, "uuid": "d64bd72c-ed7e-4613-b648-1a26f17465dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108068, "uuid": "4ba66503-3a1d-497f-a8c7-384722d4c195", "value": "be2622d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ee0031-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097287, "uuid": "d7b5d24c-0f2e-43bf-b139-99fa2853d0d8", "comment": "Malware payload (Dridex)", "value": "a228907f2e5009f727bf7b22179afafe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097287, "uuid": "b40292fc-62b4-4b9e-ba55-e1c60f7f8eb2", "comment": "Malware payload (Dridex)", "value": "7aad5fc066d98fd9dd81b06df1c57661e9774f60cf55821c27f6f0ac7cc51cd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097287, "uuid": "6eece3fc-ca94-406b-9fd9-86ef08fbc12a", "comment": "Malware payload (Dridex)", "value": "067c4e4aac1e2829d671e1b5876d3b1ca73e0a9c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097287, "uuid": "ae772594-9e29-4306-8fa7-87c0b90db282", "comment": "Malware payload (Dridex)", "value": "df95288eddff83abad41e41176564c76715d5f670a58c7b6a79e9c07a61efcffefda1a3aabe65233f70222cbaa67b95c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097287, "uuid": "2236c01a-f371-440e-9a28-626e8a0a7cc4", "value": "26F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097287, "uuid": "47cb37bc-24d0-4cf3-96ae-1fb820204279", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097287, "uuid": "a7df030c-4eb1-415c-9b52-a81504afbc22", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097287, "uuid": "6fed40df-7c0f-41d3-b63b-3e8505317c6b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097287, "uuid": "f092af9d-32e4-4075-8c54-7c99195a815e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097287, "uuid": "13752d75-97a4-4a88-9c35-6aa65a424cfa", "value": "a228907f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71f2fe9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152965, "uuid": "dfc42ee5-ece0-4687-a381-2c42f0ae6e35", "comment": "Malware payload", "value": "0f7ddc3202b3c8f07f63799c4e50df57", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152965, "uuid": "7a086b24-0c6c-4d79-b5c9-dd1b77d30916", "comment": "Malware payload", "value": "7ac31cb010f7a8b9e42011ecfd6fa761a19c7f8c1bda3089e72331e692e15b5c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152965, "uuid": "41e5a03d-c93f-4b10-ad61-670846e26803", "comment": "Malware payload", "value": "9d5508edda682542aa5fcb54b102847752337b76", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152965, "uuid": "9adb941d-d8af-43d0-a218-9d7c5c4f9b43", "comment": "Malware payload", "value": "de2e9d3f664ab4069c9a2b0dc301af4faa518d50922361284b6ad061f533f5e73acb1045a56cd166c61e8446137ae8a7", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152965, "uuid": "8c4ef3fb-e368-41a0-a409-dbc88ef9b2a4", "value": "BDA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152965, "uuid": "1c218ffa-98a0-479a-9bc0-a32ac595156b", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152965, "uuid": "bcd57d60-2eb6-407b-ba69-4f99ae7b3783", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152965, "uuid": "980d6d05-f47d-41f9-b0dd-f9ef755a84e8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152965, "uuid": "cd98f567-c66a-49f9-b54e-5a0dc611705a", "value": "7ac31cb010f7a8b9e42011ecfd6fa761a19c7f8c1bda3089e72331e692e15b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1788534-acfd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620149170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149170, "uuid": "0ab72872-0f41-4490-80fe-28aad4e3000e", "comment": "Malware payload (AgentTesla)", "value": "31a54357ddfa0fae7192a6ed14894b65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149170, "uuid": "16556d76-b7e7-44f5-92b7-35b2f804ddef", "comment": "Malware payload (AgentTesla)", "value": "7acc36989994a4fccf77ec05f9b9d79cd1d0b3280f54dd21eabea1b737fa43c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149170, "uuid": "47063400-c7f3-4abc-a9b6-28a67f13c059", "comment": "Malware payload (AgentTesla)", "value": "b3ff92e6b5f224a8b03456956ec45f935ba723dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149170, "uuid": "22a4123b-09bb-4a3e-a0e3-cc4fcad37943", "comment": "Malware payload (AgentTesla)", "value": "f17127360c374f4203c43cda12da22223d72dfc3c0a2b2a1af12a183e751e1c1ad40e77caafed9ad78120fd1486e58dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149170, "uuid": "ff19da6b-49cc-4d0b-bb5f-2eb6bd4aedab", "value": "4915BE237F685652D4BA1F3458350300A7F6FD5AE621C31F29687098EDF2AC28E277D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149170, "uuid": "679541fb-5e4b-45aa-86b8-86f9171435bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149170, "uuid": "5b2034fa-6de1-49a2-b5b3-1618d1c3927a", "value": "24576:GD9GxccMElpA8wMrZwmoZ2dB4fK9eAyA:0scfEo8wM1wdZ2TQKKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149170, "uuid": "0f0e1d64-b08b-4cff-9bb3-854175bbe076", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149170, "uuid": "d7947a14-4449-4065-938f-9d5b96982357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149170, "uuid": "27c130b1-d3e9-499a-a5d7-891097b6731c", "value": "jkj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9218303-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152968, "uuid": "ecc04f29-60d3-4cdc-93da-a581c5950940", "comment": "Malware payload", "value": "4dbee1982cd74b87b1a8f89e796ef034", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152968, "uuid": "e29c77fd-b83f-413f-8a65-1692b7a0114a", "comment": "Malware payload", "value": "7ae8433cf89be3ac49dca99c0dfcd576d7b929992acbdfaa06626c3cecec7eab", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152968, "uuid": "53548d0a-0500-4f29-9b8f-81a6228e283d", "comment": "Malware payload", "value": "a3797d60dd1ef72eb60195908bb5a3313a17f7aa", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152968, "uuid": "0239aa47-428b-4604-aaae-cf6c91e097f2", "comment": "Malware payload", "value": "f2d9be9e12a01a32617c032c872bcbac59144a2f6653e3d9ef794abd7df3b5e8ac434d3863e0ce1736f8650fc4cd8a8d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152968, "uuid": "310d2a97-18ed-4fec-a3f9-c8c684044821", "value": "10C42343B9C03DC8B498AE172E9D910E8196FB8A6468F68711C0579A241E75C7FF337E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152968, "uuid": "f53ed6ee-d010-483a-b077-2883539331f8", "value": "12288:G1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+GDlZN6K:G1HxKBpxMjuBd5QUP+GDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152968, "uuid": "b2b3393a-7f82-4207-98cd-8776b7820978", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152968, "uuid": "e53c0715-ba14-4378-9e75-9de0ede4c25b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152968, "uuid": "d805fc56-300c-47dd-a6f9-c81074d4e6a1", "value": "7ae8433cf89be3ac49dca99c0dfcd576d7b929992acbdfaa06626c3cecec7eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c86c96c-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100870, "uuid": "8228f8da-2500-4370-a033-f5cadb08a9da", "comment": "Malware payload (Dridex)", "value": "f9ea63710e2aa69d38cb71788a4b858b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100870, "uuid": "4f9c0e4e-e4a5-41f9-b92f-a92bcf75e604", "comment": "Malware payload (Dridex)", "value": "7b654f504ac778afb8134c0672a17de5cddb7c5dde91e0f4ecebcbda703bca42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100870, "uuid": "dd02bf54-1ab3-4444-a23c-5868d725a398", "comment": "Malware payload (Dridex)", "value": "b5b05631f177efdb0431ba4d416eeb5e4f5de7ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100870, "uuid": "42f16556-4fd1-4f7b-9cf3-d7547a19620a", "comment": "Malware payload (Dridex)", "value": "77129f1baa233d609534825395ebbbbd8a5e9c932b02f3b756d66a26f618c914aacfa0e669efe2e38b43e34858165afa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100870, "uuid": "27279e6b-4161-4d3a-af65-1ec0c0fbdd13", "value": "5EF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100870, "uuid": "daa177fc-3643-40aa-9980-49aa47df2233", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100870, "uuid": "bf2500eb-95cd-451e-95f3-178796f7bcf9", "value": "3072:TIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100870, "uuid": "68d8366f-c560-4dac-9422-79e5c61a1be8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100870, "uuid": "0e66018f-a6f9-4a74-af24-fe06d01c996b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100870, "uuid": "facd8e24-1c70-4b46-a3ba-bd0bccd7a20d", "value": "f9ea6371_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeed5cfe-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152978, "uuid": "74556380-af25-43b8-a182-72303e2ade32", "comment": "Malware payload", "value": "024e886f3da87145c89d392b8af22045", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152978, "uuid": "aae0788d-069f-4725-9b34-ac82e9720f9f", "comment": "Malware payload", "value": "7b9b5c3cf72a47b558a95863f86c73003f3036bfaa2035f84796389d74e54be6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152978, "uuid": "c101a2df-02d8-4564-9aa1-6c192ac25a91", "comment": "Malware payload", "value": "b76423c53e4324fb4218966af2dd8bc5e4f2a137", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152978, "uuid": "09fe67cd-07dc-4cbb-a4ea-50929a2d6c79", "comment": "Malware payload", "value": "5a0081ab3dd6bb24f013549f0936071c7d83863fea84fb831a450f325a67335349d847d8d60d90a370d4a6f468708065", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152978, "uuid": "7a0c6949-28a0-4e0e-b43a-75d1621574f9", "value": "7B063346F68150D2AFBC1A704F88F3F9DB158EF4B8E2D71479A60E5F626C8492F2C464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152978, "uuid": "0c7867ff-3b73-4b43-8e1f-99958d380114", "value": "98304:l1akFnQrZ33WKCguRM/u75xLUoUka5muK9C:l1FWN7J/uNlUzIuKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152978, "uuid": "7a411896-b44e-4efa-b9c5-545324c2af4c", "value": 3731456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152978, "uuid": "bbb4d59f-8912-4c38-92b5-331ee571da4b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152978, "uuid": "61f15971-d917-44f9-8e80-0d8b960c8e10", "value": "7b9b5c3cf72a47b558a95863f86c73003f3036bfaa2035f84796389d74e54be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da3b2fa-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100845, "uuid": "b09da27d-b97e-4859-b071-3ed2cd6b6f07", "comment": "Malware payload (Dridex)", "value": "ff71aca22a182467c6e9b272db20981c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100845, "uuid": "2c422998-57a2-40c6-9927-4eee1dae1eaa", "comment": "Malware payload (Dridex)", "value": "7bcf7da78c39ca941649e0962a0e337bc2d521068b6be2f2ca1b13db277947e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100845, "uuid": "416e943c-1501-4689-ab8e-8a7061bc3e2a", "comment": "Malware payload (Dridex)", "value": "7f7f9108d9dceccedc6fb97648f14cfe1e099da9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100845, "uuid": "b0b166dd-b5b7-43f7-b6bc-b5ca1990dfb6", "comment": "Malware payload (Dridex)", "value": "381c15643fc96ebad82a419ba2865ca2095e12e0fab5b7b29370afe37a27a24c6da70ec4400ef327087fc3a2dc14045b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100845, "uuid": "220b4aee-5c24-4529-a4c0-951017938491", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100845, "uuid": "d77e37a4-653d-4114-aae4-959e275ba85d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100845, "uuid": "0a43f77b-47c3-43a7-9c4c-586a4c18b895", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100845, "uuid": "b6e8c09f-1c44-4c6c-8fbf-953271a31ddf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100845, "uuid": "905bd5a3-0d33-424c-ba81-b6a694eeeb3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100845, "uuid": "ce3b45bf-af88-4900-ad86-fbdf8cfc572e", "value": "ff71aca2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b026d4a7-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152980, "uuid": "6f0f757b-3956-4317-ad50-2a8350e0e097", "comment": "Malware payload", "value": "7b920514f99d666704f73f8482c2b62f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152980, "uuid": "0f763d60-9647-4ff6-9b4c-a2f1859aefc9", "comment": "Malware payload", "value": "7c1b21c4e4f2af13a790b9ab835ce12ebcc42032f4c6f9fff447fa436e512405", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152980, "uuid": "2204616b-0172-4335-9001-2852b827a841", "comment": "Malware payload", "value": "d739a17e16a52202a7627fac7261e768338ef7a2", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152980, "uuid": "85c62fec-c748-4b07-af93-1ae2d05afbc1", "comment": "Malware payload", "value": "58992136732dca65344b084a815ac3420f27a21e5bb2628630ac64e52ee1333d748b21b05dc140c3deb10c978df03f1e", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152980, "uuid": "0498e1f8-ce29-4b0a-ac15-8896ee7b588f", "value": "5DA1E750112C1AB17346697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152980, "uuid": "74ed3fe2-0860-49e4-b765-bf4806643f5c", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152980, "uuid": "95c6e655-c8fe-4f19-b20c-5eb34f7f9742", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152980, "uuid": "fc2f6d76-2ff6-4922-8e89-afa77750e16c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152980, "uuid": "04a8fe5f-36ee-472f-8fed-2c2c61c38f44", "value": "7c1b21c4e4f2af13a790b9ab835ce12ebcc42032f4c6f9fff447fa436e512405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ea1a29-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620104451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104451, "uuid": "0c2687b1-4b24-4ada-b029-66cf787094a5", "comment": "Malware payload (Loki)", "value": "b04726bf46166d1b502c952fc225b6af", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104451, "uuid": "1ee0b786-cc1a-40ec-a2c1-79c68b200d2c", "comment": "Malware payload (Loki)", "value": "7c26b896ec6d6aeeb8430321244816edb0910c928a3d2aa086283542a849b364", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104451, "uuid": "e2ac7b5e-870f-490e-a128-98a132289ddd", "comment": "Malware payload (Loki)", "value": "ea1d8318ba9c4fcce6651eb42342585444b30514", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104451, "uuid": "9fa852a9-e479-4c2b-ae53-9b5dd54a3bdf", "comment": "Malware payload (Loki)", "value": "b000a0186781311f3640b91dc0b123d10a63fecb114c25413c95b2f6f40e739d0f1a0185b802de67ad85dbdc54b4ee49", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104451, "uuid": "b6b227e9-a4bc-435b-a9b6-27c2ac843096", "value": "EB35230BC9235D91D3F85E3925C35BD62C415A1FF3FBD574A9BB824CB2E92C2B242498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104451, "uuid": "02c0075f-2796-40cf-9e40-2d7b5ff1792f", "value": "24576:rA6HIwliZRi58xPXh+mgk5eY8vHoLrP5y6jTS/eh/XQBm1:U64ZMYfm+ervHgrP86jTph/Xk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104451, "uuid": "9561dc52-2bc9-4c24-8030-08cb52f29704", "value": 1067228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104451, "uuid": "158e4d6a-7eba-4a52-ae9d-1d1d823d0e60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104451, "uuid": "169b569b-5f36-4c65-b64d-4adb7e9ce20c", "value": "Swift copy REF329001996045.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fe48c3-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095200, "uuid": "f7175c4e-b22e-42d4-b180-ee140e949c24", "comment": "Malware payload", "value": "fcf78c1f7195dc11475edf01346bf3c3", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095200, "uuid": "4f52c5e1-3fe6-4e6d-93d9-0ef67db5eb96", "comment": "Malware payload", "value": "7c6309371e12210e7eab8f7a701e0ed785952fe5abe01da29f66a26bd1fe9944", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095200, "uuid": "bf3ffd01-deb8-4616-bd35-ee4eb502ee46", "comment": "Malware payload", "value": "ee605c6792f36605168bcd4c876a7c67a16244a3", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095200, "uuid": "64ed74cf-979a-43cb-8f04-38dc603de942", "comment": "Malware payload", "value": "7411fd8f1cf50657d6ce8e8d1b98616e886a84fc076af84c44358073fc18b266e094964546f6f64592e427692bdb3cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095200, "uuid": "2529af66-ca95-41bf-a4df-264c531cf001", "value": "015512037108CCABCACDD57E0D85EAA95328E72D4810C29571B93E7BF5BEF930D0965A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095200, "uuid": "02870984-b687-41db-965b-c2a4dd4429c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095200, "uuid": "11133f03-a3db-4bce-a97c-6cf6d781048a", "value": "24576:T36hb7Rg8mLBD07E+CbVsdG5lveD9Xkf1k6c0B0En/:T3o3ReWPCadQlK4lc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095200, "uuid": "a3210168-19cd-4764-a2de-df8053a84de5", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095200, "uuid": "ca080121-f274-4f8a-ba13-dbe4ae978aa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095200, "uuid": "accc486e-3212-4cd6-94db-d2a71c745108", "value": "AstarothSpammer (6).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1960fa29-ad30-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620170766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620170766, "uuid": "720f1972-0c48-4f2d-99ff-16e5e8f32acd", "comment": "Malware payload (RedLineStealer)", "value": "a6a62f2848be6b0d8cdb1372f5ed58d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620170766, "uuid": "e2970305-9fc6-436a-bc43-92537884cbf3", "comment": "Malware payload (RedLineStealer)", "value": "7c7cff0a48bcfe565fb02e3a39087ce2ad56d5b1c57b229f2d0142f41b7ab191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620170766, "uuid": "afe5667a-4af6-4cf3-8beb-aa819e7c033a", "comment": "Malware payload (RedLineStealer)", "value": "7d3d18501a0480e99a44a6b3cfa5a686cfe1930d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620170766, "uuid": "bace5519-f280-4825-b8b0-ee44228546dc", "comment": "Malware payload (RedLineStealer)", "value": "c425a230559aff7493fccb3ead4100b4de229bc486782602ec8f6a5b2381631fe893256047462fda9694ba8c94a9ac58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620170766, "uuid": "6930b985-8e52-4a10-b7f5-55b04634f86d", "value": "8A76336DB05261B2D4361831495E53B2F2297E009B3C2D4A3FCE1B3E497174B6B791EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620170766, "uuid": "a01c4dc3-5db2-4c71-9c3a-005a0c593675", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620170766, "uuid": "f2940551-1214-42cc-9098-2a1d26a23093", "value": "196608:it/gPIbxAZAevGMV8SEuBtmzqdD78U/i9InW5Ft:ogPyuZNvGMVZ+qdD7xK9ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620170766, "uuid": "5a807876-bb38-43fc-b490-9accd6bbfcb0", "value": 7349157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620170766, "uuid": "81337c9e-4941-45fc-8094-b9cdfe46a1df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620170766, "uuid": "48ea4b65-a3cd-42a0-97bf-f4f8130df015", "value": "a6a62f2848be6b0d8cdb1372f5ed58d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5504a2-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620142796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142796, "uuid": "5b4eba57-9d98-4725-978d-134efba49cec", "comment": "Malware payload (Loki)", "value": "b3bc47e21c906a92967d277462bac5a8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142796, "uuid": "a0bbe7c6-5e38-4dda-bdd4-b225e83294d0", "comment": "Malware payload (Loki)", "value": "7ca7b0d4683ff0c7f1448d7168609f87e64920f1a13f5386bb7a1849400e5f47", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142796, "uuid": "356d0c56-dabe-44d5-b8a8-2813c43de07b", "comment": "Malware payload (Loki)", "value": "c570b028ce23a36f2328791ca0396e0f432b38f2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142796, "uuid": "a76fa4ad-b51a-42ff-a2ca-0b0476217bf3", "comment": "Malware payload (Loki)", "value": "8c4136199fa1d21e5443d8eba2054060de0c076df945ad45672ddb82a4910a7f612b21a8e4f25f3835fdc9e963b6a829", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142796, "uuid": "e1ac3c22-0f1c-424d-b696-2f28dc0d8c00", "value": "7A1528AC316430EDD227CA36A7DE1C1592213175A62BD60B872303BD8E1EE57AF349D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142796, "uuid": "1906ef12-6233-4823-a177-c8468ba030c8", "value": "12288:zeoLLoS60/K7yh0oQzhnXjMnCeC281WJWzPwzd0Hk+wmxeX8Th6kdKhKYTVfLvU3:aoLAZTG7MjadrHmx2x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142796, "uuid": "0cee6988-f9eb-441f-b3a3-2eb6102fc316", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142796, "uuid": "c4db4ef8-cf45-49da-b604-04688a0338f5", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142796, "uuid": "c63f4ff3-98f2-455f-8ae6-95775a57f615", "value": "INV-Impot Dos_pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e01982-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160772, "uuid": "02f87f82-6ef5-4c9c-99af-ad5ef368e855", "comment": "Malware payload", "value": "f04ef2e01572e5bcbcb65c395ca51d16", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160772, "uuid": "2f35316f-1378-4750-bf8d-78b7034f6aed", "comment": "Malware payload", "value": "7d44142d6122b41b531af99a86f77f06759695f66d02f56600e9411d07e4ad4c", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160772, "uuid": "eb63d849-6ced-40ae-8aaf-13f95e8a4bf4", "comment": "Malware payload", "value": "c63a345a9cf3ee1267a3182cc46baf5b229a7b17", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160772, "uuid": "0daec377-2130-4f0d-905a-f0f55cda4533", "comment": "Malware payload", "value": "45d7eb04a45972e8f2c80cdabd71312ae21bb5d9efffb2004fa35e5aa3f1b10004061689d67e77720d0777fb6c3bec8a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160772, "uuid": "7fc28ac4-08fa-4861-b13c-b8d06bbfd0c0", "value": "D53186B32DC291220312EA92F685582CE739940E9957344CA5DEC94DB1D0F933FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160772, "uuid": "0054cc6f-1bdc-4d48-b37b-8843a39dc457", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3K4:GEXfhexTvrtWQZUSePSiJVAyrLM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160772, "uuid": "23478e7b-5f99-4953-a14f-05fe4ca724ce", "value": 1688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160772, "uuid": "2b80235d-b132-41a5-9d8c-d79c5e41608a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160772, "uuid": "10412687-2b54-4ce7-ad99-3003899a946d", "value": "mWTDPZSm.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da04585a-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119120, "uuid": "9986351c-f24c-4db1-a998-40540a7d012b", "comment": "Malware payload (HANTA)", "value": "5654ec48d1c85430a2e3bee153eb9a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119120, "uuid": "74add422-a0fb-4ea0-93d4-8c30e7ab7661", "comment": "Malware payload (HANTA)", "value": "7d9380fb533f6af97982464579db90dcffe42067d07d570a9857f4b0e5d37862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119120, "uuid": "ff43b81d-51d9-4f9f-944e-075001e9d6ba", "comment": "Malware payload (HANTA)", "value": "9cfef69fb81f389785902aa50240f6d866eedd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119120, "uuid": "f07533ba-8cf0-4575-80dd-5d92c06b1b5c", "comment": "Malware payload (HANTA)", "value": "666031e9ea0f01e31694c805aa0b6984905b05bdc81235a91a6638bf64228d09a6abfbd1295cea49143f802eee7d7443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119120, "uuid": "3364578f-6349-4c5b-840f-1af357c2d5e1", "value": "1E0512BB642151BAD6192330F4A40F0FBA38D6340E80B559F14BF2EADC5E59D9AF4378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119120, "uuid": "7088ae5c-6ea6-4f35-95da-12ddc6c107a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119120, "uuid": "7cbbafdc-d69e-4099-87d8-f3eefb56644c", "value": "12288:4OihLDnl8i7+QFQ+93EpZLQ4hkiCCKmVwqZkR8JlxZswQo+j6L0+SVFN:4rtZ3FQgUfJuzCKSw6DJzZLLSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119120, "uuid": "4f71ced8-c1e2-495a-939d-fed815104f70", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119120, "uuid": "5674c3db-af4c-496b-99f5-8ba555ad6e2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119120, "uuid": "1d69124e-8cbc-4928-9ff8-d899410cf56e", "value": "5654EC48D1C85430A2E3BEE153EB9A60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c00c0c0-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108063, "uuid": "4953be74-a4a9-4b7d-ab36-bc61a08fa895", "comment": "Malware payload (Dridex)", "value": "fd006816688e9aa425727aceffe79dd4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108063, "uuid": "5d919f6f-7435-4e5c-a5a4-ccef1c42d6dc", "comment": "Malware payload (Dridex)", "value": "7dd0a181d2defa8ce80cc15ea29c1a9b0318e6b027cde5ed25f86929fb01bb8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108063, "uuid": "1201685d-86e3-41fe-8420-bfab9ef498c0", "comment": "Malware payload (Dridex)", "value": "460311a0f11c4cd6a4b079c36963eecd02d61e52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108063, "uuid": "0584f735-6346-44bc-8240-1f7e7ea5fbf8", "comment": "Malware payload (Dridex)", "value": "3a0d9060ba74a3dde5a08605d9b9a4aeda712a30f1c8d164ee904f12d6d2ed256d5bbe66bf573084e4b7000b7a4b7e7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108063, "uuid": "bcc37ebd-39ae-46b2-9265-7f9d516450a8", "value": "56F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108063, "uuid": "0ae94ef8-f5ed-4a08-ab94-aed5026cc4ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108063, "uuid": "2a5feb41-e30b-48aa-8710-0e43016b3b8f", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108063, "uuid": "85b0a2ac-21aa-4499-9309-d60aadc0c7fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108063, "uuid": "95252a46-e773-41a5-8bda-a73f7500d8b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108063, "uuid": "84c7cd93-0e13-4bca-b2d9-66fe59d7cf0c", "value": "fd006816_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30db9bc-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153468, "uuid": "ee3125e1-c814-45e4-84a2-e6aa22c82f84", "comment": "Malware payload", "value": "83162c3dc1f3faea344392e5d9bd0f55", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153468, "uuid": "7c6b75d3-dd55-4004-bc28-e3da9c710fdf", "comment": "Malware payload", "value": "7ddc6cca06dbfdd8e81a077563386104609160e8f7b974b807786adf98909239", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153468, "uuid": "0a445dfd-ecce-4b36-b184-124b102e4449", "comment": "Malware payload", "value": "f1186498856950af38516b005383016a81259184", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153468, "uuid": "25deba47-9e39-4e59-87f5-b2d2af4565e1", "comment": "Malware payload", "value": "06d20169d673927a4bd7da032e33142632e87353b45b413b363d1f4b44b4433d7ab3a4bb4b8bf5b9573bb339b55c6560", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153468, "uuid": "468c6c4e-1f6b-45b4-adcf-001727bf201b", "value": "1AA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153468, "uuid": "508e800b-2ccc-4630-891c-94ea5b10d9ce", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153468, "uuid": "c40a1673-07df-4828-b4a7-4046e6478437", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153468, "uuid": "c53238b1-6d9b-4bc4-aacb-a2cc72c930c6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153468, "uuid": "41020e72-ad89-4290-8a53-d199b805905f", "value": "7ddc6cca06dbfdd8e81a077563386104609160e8f7b974b807786adf98909239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159d756c-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126092, "uuid": "e52c6ce8-0732-419f-b444-08a1950651cd", "comment": "Malware payload (Dridex)", "value": "0a71c57894e4d1c2920555821082aacb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126092, "uuid": "554d3cf4-a670-423f-a831-4b1aeb24e94c", "comment": "Malware payload (Dridex)", "value": "7dfa906225c2d4872c41b42a51d671b6b9f5100ad2a1b5b4602d245523109c2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126092, "uuid": "019e0700-3ae8-49d4-b1dc-162d914b9dee", "comment": "Malware payload (Dridex)", "value": "8cf0d0ab2c4db2e3e264f4c56156a64361981782", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126092, "uuid": "ad7251fc-b737-4715-8b92-7e27213d6c1e", "comment": "Malware payload (Dridex)", "value": "6bb0e21ed6cdee73786067f8691161d3ea75b306f3e019c60cb6d14ee75bfa81742fe30d8ab46db2764f1e2c143a9574", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126092, "uuid": "c0a87779-104d-4c7d-9fd2-698a8977117b", "value": "09F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126092, "uuid": "009b006d-2f61-41be-a046-4ebcb37ad358", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126092, "uuid": "017490e7-db2c-470a-bb67-f15047abd237", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126092, "uuid": "e9a541fc-d627-49b0-96ca-e04a56889853", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126092, "uuid": "73a887a5-6d52-4b62-9437-fbc989012c89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126092, "uuid": "99da878e-6e4e-4ca7-ba51-2b9fa11c1c0a", "value": "0a71c578_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b98f1c-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095190, "uuid": "11d6fd60-43b2-4fce-b31a-1cf3e36c94e3", "comment": "Malware payload", "value": "1a330ea1186ed26a1635f7625dad5a09", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095190, "uuid": "028df2f9-ba9e-445e-baae-5a243559f21e", "comment": "Malware payload", "value": "7e1e2013efc0b9ec1e5cc90be6b43c3419f88236e90de98101c2d3ad1f3ef78d", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095190, "uuid": "8198cbde-0e92-4c41-a77d-334dd3417e8d", "comment": "Malware payload", "value": "bb3dc1580275d434186671bd79842970ccf6c7c1", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095190, "uuid": "c53d7a16-d733-42b5-bc78-5cb46da3afa7", "comment": "Malware payload", "value": "9cc7d3e0fdb49b05711efb7640e2d6bf2562d5adc8a9a478d53b736a34609c7a3f9447009f4dfeb238c3e1ce27e94bec", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095190, "uuid": "3a27867c-b8ed-444b-a928-3dacf06d6280", "value": "4C5512137A18CCD9C6C5863F4CA5DF694368E22E4801D29579B2AEA7F8FDFC31C09159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095190, "uuid": "28385219-409a-4783-b1e7-6ca71d6ce0ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095190, "uuid": "ea7431f1-e355-46e6-b1bf-00fd394cbccd", "value": "24576:1Olpwwk8jZFFQRnYuolaH3fVwupHVNfMqaODgoZnUw/xbCZV3cJLS0En/:gpwQjZbQDoQNfNXae9gZVyLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095190, "uuid": "a6eb9ed2-b332-44f0-b897-f4d0d169b2e6", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095190, "uuid": "066fd4fe-492c-475f-aab8-5db4f8774499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095190, "uuid": "2014d470-2aa8-4c61-9941-8e0065301df3", "value": "AstarothSpammer (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e8355f-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133362, "uuid": "2834bb36-6a63-411b-b074-46ef5e4a7ba0", "comment": "Malware payload (AgentTesla)", "value": "7d3904d6c520a459b57d804bc54e313a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133362, "uuid": "30b66dd8-5a6b-48f1-8f12-343a1e66b5f9", "comment": "Malware payload (AgentTesla)", "value": "7e62faffb62feaab58ebbf73204c4166669a857fd93c2a019e55d740929bc1f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133362, "uuid": "516cd5fc-c822-4909-b969-4587fe0278a3", "comment": "Malware payload (AgentTesla)", "value": "5d00835d8c1933d5c6f4202caf449159575ae047", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133362, "uuid": "afdc484c-b1c0-427b-92cd-cdda8d84b941", "comment": "Malware payload (AgentTesla)", "value": "f316ca46d9cce989a9859b5fcb11d5dd75c555b694436a36118d32ebec66b6b24050c82c44c64788ca37e6205ad9ca5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133362, "uuid": "fe2cab2b-fefe-4596-a1aa-551fec1d9796", "value": "5391D8B1666C6D11CE548867E96DFD2316E7F55249CB2E00364FFEF20B2D3102A76E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133362, "uuid": "52472a33-efdf-4255-9d5d-2760ff0d64da", "value": "96:ANyiz2JOP8PmZ/iSJkIREdnVddxFKeaxWwDpI0IY8g5:Aln0waSGRbFpwtI01b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133362, "uuid": "9ff63a09-1c29-450e-a131-acb0366ca599", "value": 4217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133362, "uuid": "5a65b227-ed1e-4c3b-9a07-be989d9f528b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133362, "uuid": "fa19f15f-5e4b-4620-b6ef-b611a6b482f5", "value": "RFQ _ T-628 _ DI fire detectors.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e076a196-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086489, "uuid": "dddbadaf-c336-4088-8a75-b2c8997c03e3", "comment": "Malware payload (Dridex)", "value": "e0dc1e3ac9d22cc4387a3a602cd1a738", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086489, "uuid": "3bff9660-9248-4ae4-b3bc-1be88e7ce246", "comment": "Malware payload (Dridex)", "value": "7e89461c505874b1512c7db45e82f1b2044402e9185a4752ab3d0be9ba5a32e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086489, "uuid": "47aeadd2-9853-4934-b464-515b7813c75c", "comment": "Malware payload (Dridex)", "value": "54588f0df6bb132a51d80a2045a1574fc1407bcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086489, "uuid": "09e95285-8eaa-4b1b-8886-f72c2e62ed6a", "comment": "Malware payload (Dridex)", "value": "63f343ab2ff1426fd85f948115a3c0f776adb61e1cbc43cf249b344535969ccac2803fad55286d783fce5399bd7e061b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086489, "uuid": "96d78c07-af3c-44dc-8d78-7d322f5722c1", "value": "25F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086489, "uuid": "86fbcd06-d68a-476e-a669-dbe84afffa29", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086489, "uuid": "f093c607-0bdc-49e8-ad56-b3e07f0b017d", "value": "3072:oWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:o42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086489, "uuid": "a53539b8-1929-4ad5-a38e-c0bb10a7814c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086489, "uuid": "3a9f0960-849f-4904-a9d9-e0fe048223f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086489, "uuid": "d3fd462e-681e-4a53-80f5-7047a30cff79", "value": "e0dc1e3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc656f6e-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097273, "uuid": "fe780fa7-3b96-436b-b20c-ed2d3918fa78", "comment": "Malware payload (Dridex)", "value": "7032f84c332814353c09728d323b28e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097273, "uuid": "ce6d7cdb-7e78-4803-a08a-57e007d240ab", "comment": "Malware payload (Dridex)", "value": "7eed7a3dbaf73ef47a207c8d2984213474958af56a6c57705307d4560d1b42d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097273, "uuid": "f9225a6b-1599-4a23-8b5f-a932a276f750", "comment": "Malware payload (Dridex)", "value": "21ed1a01cb003a69c4d746f834476ba7d412aac3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097273, "uuid": "fd8ad9a1-2172-49da-83b3-305019e8801e", "comment": "Malware payload (Dridex)", "value": "1d4014fb53e974eff4339ee749e09a34f72a0e206cf4634bce77d47ff41d20db541b1c1dd6748ffab39e885b227a391c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097273, "uuid": "0aa64ffe-4a40-495d-afee-dee8b8c3a369", "value": "DEF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097273, "uuid": "30a6b412-98c5-476d-8375-4248b40648c7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097273, "uuid": "8cc87aa0-d1ca-4bef-8fc0-23407543be83", "value": "3072:LWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:L42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097273, "uuid": "bd5a4fdf-5a17-4c19-9b44-ed0befffafb4", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097273, "uuid": "7383093f-1a66-4b01-b238-0d325ab9f7f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097273, "uuid": "92af7b14-7215-4ed6-bf02-52b16546c6bb", "value": "7032f84c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce232d8-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620122453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122453, "uuid": "45ee7861-24b7-4355-9b7b-3769d8a87198", "comment": "Malware payload (RedLineStealer)", "value": "0ba6261401e0f3cff99d77300dfcfea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122453, "uuid": "47223827-be0e-42ef-b69e-8c770ffdc0dc", "comment": "Malware payload (RedLineStealer)", "value": "7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6bb99c5256670b47edd33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122453, "uuid": "85a4a9ac-a57e-497b-a1f8-7e0b2407be60", "comment": "Malware payload (RedLineStealer)", "value": "97facb0813150932fcd2c6ae52a305873c208cdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122453, "uuid": "17c86b45-c7e2-4f92-88c7-f91e315e94cf", "comment": "Malware payload (RedLineStealer)", "value": "8d1539d8ab885f482b8467c8ee6973c491ebdc8edb3bebe1fe883f571ce92bdd5e4d63b1cafc55af20f25814fc235ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122453, "uuid": "066aefdb-bcdc-4cee-9bd2-c566f50c2faa", "value": "89934D26635D8B05F7BDCBB574B001664BF2E0CE6011EBBA8EC5B4DE3E1678326445A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122453, "uuid": "44744b80-d0af-4238-8eae-f0a717a745d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122453, "uuid": "40674750-dcb0-4750-8e05-fd7b30ea7c5a", "value": "1536:/ZzQ4iCfr2GluxA8kF+eu4vtJM1UhCBX+8ab3A6spoiDkGyJpdNisxM1gEOT6z56:C4FSchPMq8BXPO1tiDlyjdNK1zOez0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122453, "uuid": "b96dee79-0b5f-4292-8bd2-98a84794f9e4", "value": 94120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122453, "uuid": "2949cc26-ed7c-4e5a-a779-38a51ee786a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122453, "uuid": "d9bcf333-3ec2-4432-a965-ee4b7b494a0a", "value": "7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7b1dad-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126400, "uuid": "0e2bbf31-832b-48c1-9960-54bc3d6887b4", "comment": "Malware payload (AgentTesla)", "value": "903bb062450bb9d25956a0a142423fae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126400, "uuid": "b818c833-f44a-4f00-89fa-0f3b5b1bf704", "comment": "Malware payload (AgentTesla)", "value": "7f9e25dbc73444854c29939a4acbdb4a0479658e095a74ebacabfe2b60f5addd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126400, "uuid": "ec152ea1-bd39-4e54-bed9-4b8b31f32531", "comment": "Malware payload (AgentTesla)", "value": "702d7a9027bdc8a96d79a966436d2dd5fc70fbd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126400, "uuid": "4e721c10-1c82-42dc-9e55-3822659dd7f4", "comment": "Malware payload (AgentTesla)", "value": "18024c3cbdda035e8b18e23b5df1a4994ba3fe8901beae6164b48f3ca07c4c390a8a8821f1f4f23223daf45d1afc1e86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126400, "uuid": "d544203c-3898-441e-8fdd-afc2e3be59ca", "value": "0DE423DBC0BEF160AD3F1BAF6CD5E2A1D25F6D3499BD9D710AC883A10D26DC01E26944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126400, "uuid": "ac0faf38-99d4-458c-a4fd-14d2e68417b7", "value": "12288:HrD1Vixn1zek3Sa64LRsX3o9xMABSMGy478a2cvIxd8yeNttVbKa35vDs:9kt1ikia64LRq3AxRBSVthmFeDTKahDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126400, "uuid": "1874192d-5935-4c00-b99b-cc32cf9b1fdd", "value": 660411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126400, "uuid": "6adec57f-44f2-4e9c-85fc-27c436c20870", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126400, "uuid": "d42a4e38-1053-49b9-b463-433fcf975762", "value": "ITINERARY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0ee28c-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620152998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152998, "uuid": "e5818982-1726-4608-9e45-c826834b6916", "comment": "Malware payload", "value": "3286b7cf8d42cab7ebdaf8e9252dbf6a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152998, "uuid": "9acb4364-1cae-40e2-b244-e4141094dab9", "comment": "Malware payload", "value": "7fe8f97130c4fcd4a354ff33cf4a8a76197b4cb3bf47b8a1ebbb5669acb6c79d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152998, "uuid": "e398a131-b426-4526-be52-d695a7401dbd", "comment": "Malware payload", "value": "30edac36562362081b96aa9fcc320cd8fdd43842", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152998, "uuid": "a8540f43-be5c-42fd-a79d-ca30e3b11d84", "comment": "Malware payload", "value": "58f0608c73ee6d6685d957b74b5fd08ea31381b24c99449a802ceaa4814024eac691f53360349fa3f4ef082dcce5c973", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152998, "uuid": "b031d2da-e63f-489c-8f7e-c912738fb115", "value": "243633082265F8FDED460E293B7349F0C0A016F1594259E2CBBE6148457E9FF1BAE673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152998, "uuid": "d38844e0-d7e2-4759-a248-e7558a7b642a", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+5:0XSxVJG2fLAqFOfT9sMYNM29SAFN25Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152998, "uuid": "acc66547-b7e7-41a7-a852-a9c572a393fe", "value": 4923392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152998, "uuid": "571faef0-15df-4427-b3f4-193794a9cadc", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152998, "uuid": "2ecce042-6d99-4a69-b207-535c15a4a1eb", "value": "7fe8f97130c4fcd4a354ff33cf4a8a76197b4cb3bf47b8a1ebbb5669acb6c79d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d471f2-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090034, "uuid": "bf5ce776-a790-4132-b8bf-e186c808862e", "comment": "Malware payload (Dridex)", "value": "2c4193d90e661528974a1c4768961210", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090034, "uuid": "a9b8764b-51e3-4eeb-a3f7-4ebfe52db685", "comment": "Malware payload (Dridex)", "value": "7ff430904fd92dd9cbbd6dff04bc7e7ddd94b169370be01d8403aa25e5c8de1f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090034, "uuid": "2cfa9fbe-2771-442a-8430-64a79c95c896", "comment": "Malware payload (Dridex)", "value": "0be3aa87ffdd53bb73b3a5f655d386c7a3b23672", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090034, "uuid": "5fdbc926-44a4-4e8f-a43e-847f7a6c7bcf", "comment": "Malware payload (Dridex)", "value": "2c26651abe6588060df1496c0bd257caee9231bdc7cb0e1d3a7b17fb5424a2951437416adb91a4dccb9117e8f59268f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090034, "uuid": "f8b56a37-d480-45b9-95f3-e0f8da018a38", "value": "F7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090034, "uuid": "22f2ac41-1ce8-478e-ae64-940b4c79e5ba", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090034, "uuid": "dc19cd43-ddcb-46e6-af73-7d9728960f32", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090034, "uuid": "f0f6b784-89eb-4696-a0bb-13a41a3b0c25", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090034, "uuid": "8927ff83-fccc-431d-8075-bc9f13322fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090034, "uuid": "6c49c8cb-9b24-4759-bcf7-080ec4b2de5f", "value": "2c4193d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18962ca-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153009, "uuid": "c25a1ba0-8381-4494-9b45-7137fb2fe9fc", "comment": "Malware payload", "value": "c407290169ab18b0c43561e2d1160372", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153009, "uuid": "53403e69-820e-4c30-b99b-e988eb25dc5a", "comment": "Malware payload", "value": "80b6d4041c7240e8a1afc1e3534f2467bf859d713d7c3e57af2112b65fcaf9e9", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153009, "uuid": "1d5c0a78-d371-4885-87e5-e1a8ce3165e0", "comment": "Malware payload", "value": "260dafdc6d31394573b653b038172c1108954069", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153009, "uuid": "5d295d70-000b-4e2e-bef4-74e3a8a3600d", "comment": "Malware payload", "value": "3b8bb909f136d582f868f65b316ed03360e9b833ad9ebfdeb313added06c5ac784f396214c293c84195d363c41973a99", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153009, "uuid": "f67f4dc8-e50a-4d36-8e02-ced18330677d", "value": "974633086326FCFDD84A1A296B634EF1D0E022E41D4156E28F7A6008457E9FF57EDA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153009, "uuid": "2bb19a54-6330-4ab7-9a42-8eb3ce98802d", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+2:0XSxVJG2fLAqFOfT9sMYNM29SAFN25Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153009, "uuid": "0486a57b-e9c6-47db-bd9c-ec65599e75a7", "value": 5615616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153009, "uuid": "85756529-674c-459a-89f9-7d151fdbabed", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153009, "uuid": "0747c7ed-6c7c-4e18-a58b-6fae02988116", "value": "80b6d4041c7240e8a1afc1e3534f2467bf859d713d7c3e57af2112b65fcaf9e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8074d645-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620152470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152470, "uuid": "58a5f830-d4f8-44d4-a9e4-ebf3affc25bb", "comment": "Malware payload (SnakeKeylogger)", "value": "c7943ac45408082b2f91c4915fd2c3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152470, "uuid": "d5546572-bfc0-44a2-9f4d-079445edfc04", "comment": "Malware payload (SnakeKeylogger)", "value": "80d39762bd4a96b119db6f921abc7d92bb46ce5b56ea2a3661ccbacd51506d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152470, "uuid": "5fec9fad-8b51-4a5f-ad04-49d8fd61ddab", "comment": "Malware payload (SnakeKeylogger)", "value": "ed35a21f7051ba581c0551dc798c82df7e6bb19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152470, "uuid": "5f9030e4-c9ed-4b64-8c66-0704602348d7", "comment": "Malware payload (SnakeKeylogger)", "value": "943a6eae34d997473e6e212a93fcf656207d38143eb8f62712eb523ec6bf14ab2e085111a803ccf3068dc98e317f0a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152470, "uuid": "484c7240-75bb-48d3-8c34-20696595bff3", "value": "8105DF277FA85656D0BE5F381835031067F1F15AE725C34F296820ADDDE2AC28E637E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152470, "uuid": "cd9218db-bb41-4908-ad3c-f08cf397feb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152470, "uuid": "ff10ab44-1940-43e5-850f-2fc8c1d92739", "value": "12288:o66xTvnz9KMTnc2VOAzLtsUxMmVLmjY4dTmT0/qQePZHLQpVysx5p49wipyGE31p:oRUUxlm9rqCWsx5p45cnfbSMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152470, "uuid": "6b954687-0622-4d00-bc62-698eccf256b3", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152470, "uuid": "587b1a2b-464c-4f41-b1e4-7cd4b3ee39a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152470, "uuid": "00665fa5-cc1d-48fd-b5d9-9b80759feca2", "value": "IxJ7I5vVmLx6QS7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcaad72f-acc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126050, "uuid": "fbd2e6d7-bde7-4d83-a271-85d0506316e4", "comment": "Malware payload (Dridex)", "value": "bf10a8ed4d586da97b7bd82e9a7dadc9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126050, "uuid": "b77c69aa-dc77-4894-951d-6f9c6fd08be7", "comment": "Malware payload (Dridex)", "value": "80d4f947608b4f0d30ac8129b5223c115043723e58ea44ef199688815743f5ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126050, "uuid": "bd3054bb-b2ec-4f5a-901b-df0a7ebfac8f", "comment": "Malware payload (Dridex)", "value": "a7ade70b22af0faa085abcb34ce3b38c0738a955", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126050, "uuid": "e354a987-8f2e-4d27-acae-a73c13f17967", "comment": "Malware payload (Dridex)", "value": "c967ebd42dbf0a7d028e6785ff6cada4a5cdefb8215ea35da034b23b3816b851bb7d7bb3c0ec8319f77bf7227a4e4ee7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126050, "uuid": "8fa28451-ced0-42a4-8795-16063f6bcfad", "value": "06F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126050, "uuid": "c8c6cacc-4bcc-4555-bbc0-da35b2314508", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126050, "uuid": "67dd9d00-dfbd-4261-b9c7-34886a3f53b7", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126050, "uuid": "09410957-dbf0-4292-a0ed-4f24aec20ad0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126050, "uuid": "1a3fd2f3-6264-42f4-9fbc-e7ba86fb0518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126050, "uuid": "5bdafaa1-e782-4c0e-98f1-eddc926bb497", "value": "bf10a8ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5162c3fb-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100852, "uuid": "0a9a932a-25c0-47d9-a64e-16749150d38a", "comment": "Malware payload (Dridex)", "value": "bce6312ddda8b5773dcd10b29bc56c25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100852, "uuid": "1f8dcdfb-7462-4c06-8368-a6764b6f0b20", "comment": "Malware payload (Dridex)", "value": "8188b75edb9888ca31fca364416c370cd34ca77ff87383f46ce6ff8786139842", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100852, "uuid": "eae29cf5-a23a-4c76-9ca8-143ec254c4b9", "comment": "Malware payload (Dridex)", "value": "5871acb1d67df2d35855b37b4f4b146ab137b8ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100852, "uuid": "d2340006-591a-4b45-bed5-6e8314a00979", "comment": "Malware payload (Dridex)", "value": "6be95061a004d80eaf51b1c23d35e7526c6635e7290a0fe1967dd04151f0245a4004a7f51b70a736bbb6dbb2cbcfbb31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100852, "uuid": "4c8421af-8573-4729-a696-e78012eff3f8", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100852, "uuid": "7a10fcb8-be48-4768-ba28-9b1d6901ec2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100852, "uuid": "51d4bd6d-1097-4222-af21-c0027ffd3d92", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100852, "uuid": "777ad849-b54e-4e1a-ba36-a6dabbe37102", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100852, "uuid": "f3646323-f9ea-44c0-b525-a6a096d266ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100852, "uuid": "f8ab9740-a886-4ec4-aecc-d638d85ae7b1", "value": "bce6312d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c495a092-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153014, "uuid": "05542f82-6141-4bbb-8e93-70fd681a0841", "comment": "Malware payload", "value": "c6188b30af82a5d5f768d4702a8a1ef3", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153014, "uuid": "8b398237-b7f3-41d9-a543-77824dd5d033", "comment": "Malware payload", "value": "82bac6ed97a429d7d70cded99b86a9e764d8167060d18e69f2756a965c040887", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153014, "uuid": "9ab421fc-d31e-46ff-8259-ed9ad06ef8b0", "comment": "Malware payload", "value": "c0818793591be3bdf6cb6469336be316ec6615d3", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153014, "uuid": "68a3f71b-8714-410a-9efb-a590109bee66", "comment": "Malware payload", "value": "6d12eefbd4ca254f6cc8af31fbda22faf1487e6cee08c9c26f34fa2fca8cf8c209eb9d684bb466bc7732a68a74c7eba8", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153014, "uuid": "c1571fe1-2434-481e-94e9-6268a9613f73", "value": "0E25337863E331EEB56C68719DFECA2B502FEDCDC03BCBA055975284600153A9BE5A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153014, "uuid": "b735bb26-70f4-4662-98b3-dac1bf5ca957", "value": "24576:tNF0+xOOasdIE4Uf8FUeT0mUPVanRHwPdmjs4tiS21yY820pI1Vec0r:tT0+oOBiXLUNaRHKmjsbS21i2F/ecc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153014, "uuid": "b25a42f6-1987-4715-a0ed-7c57e4c5c0bd", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153014, "uuid": "d97071ba-bb86-4d16-a1fb-7c3f9e84b70e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153014, "uuid": "2b3b9e4c-d53c-46d8-a3fd-825815590cb4", "value": "82bac6ed97a429d7d70cded99b86a9e764d8167060d18e69f2756a965c040887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db7facb-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133568, "uuid": "208953e4-cc1b-470a-9527-7f0e6ec13f2e", "comment": "Malware payload (AgentTesla)", "value": "92063f6f648e7642aeca603780cc0955", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133568, "uuid": "496fe868-3885-49b1-8612-448a57f23f42", "comment": "Malware payload (AgentTesla)", "value": "82ef3328a2ec113a17b123d3dac940a0c204a6cb1d636e29860751e8daf1a21c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133568, "uuid": "076f7ae5-2bd6-4a48-b5c6-aff881e2aff0", "comment": "Malware payload (AgentTesla)", "value": "aa413df7850d0b902b4c39514a84add8ffd2e141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133568, "uuid": "32102078-40bf-464e-b458-b1c586d451ce", "comment": "Malware payload (AgentTesla)", "value": "37099b3d69453caa4fb05f6d1b01bf501eaa2497ac5165dba4fae3980703c35f366f996025b257488db8f03b4f9e1ef6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133568, "uuid": "0ad78038-5160-44ff-a689-88bb0b8345f1", "value": "15A5285223A46E45F93E57B48730441C47F6BD17DBB2DA9EA984B0891FB37C08F1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133568, "uuid": "90944ca8-32a6-4378-bb5e-dfdf13fdde21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133568, "uuid": "634e2705-709d-4a23-a9de-707fac71b668", "value": "24576:pmumDZE1XcRjjXZNoyqS2nCkZfMPBDmIP:pm3au5jXIRdnId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133568, "uuid": "b8589fb7-fa9a-4ec8-adef-84aabcb1b794", "value": 2258944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133568, "uuid": "da6a7ed3-69f2-4e56-85f1-48c4bd675603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133568, "uuid": "37c3c7ce-14d9-48c9-9330-261163453c7a", "value": "P I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb738d0-ad00-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620150452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150452, "uuid": "8b00fad4-cc53-4e13-b40a-7c654c086492", "comment": "Malware payload (RedLineStealer)", "value": "83f9bc0db9a3e0a33ffe239592be398a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150452, "uuid": "a8efbcc9-8e59-4c64-aa84-37cfd26ecd7c", "comment": "Malware payload (RedLineStealer)", "value": "82fc0a861b0d9c8cb886b7a9a75f8050d1d6a015de6c775256b06c21e7e48ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150452, "uuid": "00ee5f51-b1e9-443d-b31a-3ba7b13511aa", "comment": "Malware payload (RedLineStealer)", "value": "195cd1c5f01d08e5ee6e9ce15ac6bdf66a8c2788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150452, "uuid": "848bb47e-c914-413e-b60f-0b851f95dc3b", "comment": "Malware payload (RedLineStealer)", "value": "79f9187dce0cc0449669a8f4eb76905549809eed2c1e5873afcadac344b7d76d5f28fc0afb830e208c761d717f67ea63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150452, "uuid": "a8882c83-2256-412a-9aef-94551eb20c0b", "value": "B275BC70376882E2C0E75530C48FB71516642CB6E6E6E4B3F2947FA81B51383EF653A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150452, "uuid": "9d1fd7ff-8762-4aed-97ce-8b76defd71db", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150452, "uuid": "fb8a1d4d-4bdb-4caa-a338-e1f147899064", "value": "49152:jkQTAuIuPZyoybUoAtg+JqIadoXDXt78K/OOQYCp:jauXUowKg/MDdup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620150452, "uuid": "c01bd8d3-49ad-42df-a406-894f5610e0a5", "value": 1603072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620150452, "uuid": "c6aba1ea-bed6-4be7-92b2-cf94644f641b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150452, "uuid": "2d16c685-1698-44d8-b6e4-8e1139aeccd4", "value": "83f9bc0db9a3e0a33ffe239592be398a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bc1b06-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108055, "uuid": "a6bbbce5-9c0c-4234-916b-cb86d745774f", "comment": "Malware payload (Dridex)", "value": "12216ea2cf33410cd0c96eac99fff739", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108055, "uuid": "7a5708d6-d9f2-4481-8efe-78c2409e26d1", "comment": "Malware payload (Dridex)", "value": "833c14963521cb9b221399f97cba1b74ba5ff89e6b512380de5fac55370c2688", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108055, "uuid": "3e135f20-918b-4dc8-a105-b7f2cc8f6efc", "comment": "Malware payload (Dridex)", "value": "5e309a27760f5a510fe2e51f47a769b431b27a5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108055, "uuid": "42a1a362-a2c7-4013-87fa-a97d883633b2", "comment": "Malware payload (Dridex)", "value": "f08f05936bf134ee26c00a1d4749ceeb65ac3fafaf6b2b480acfed18ded0b4389d9a1e89ad329c7fdf6dbab5c6387e51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108055, "uuid": "642e551f-3460-4c13-b930-528d52a6e11f", "value": "87F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108055, "uuid": "2d3b2de7-cae4-4658-b363-11fd29284d19", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108055, "uuid": "f32e52ea-e6dd-413d-8da9-98ba5a6e73a1", "value": "3072:sWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:s42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108055, "uuid": "06ba3320-c65c-4951-8a49-b65aa0e69b41", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108055, "uuid": "3526147c-0459-4c0b-adbc-e8814ddc7fd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108055, "uuid": "788a7fd6-c9cd-48c6-b628-498c33ea48a7", "value": "12216ea2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a146c3e5-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095402, "uuid": "1c1e6da4-7eeb-484e-949e-9efff542baae", "comment": "Malware payload", "value": "eb7ed670cea535f9f152ac7d0c7f9981", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095402, "uuid": "cc474d5e-93b6-4f6b-a822-6b4a37c52326", "comment": "Malware payload", "value": "833e8c0d2e8a0913318dd703d3baaa80fe6708737e927bc5f801cd3600a230c9", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095402, "uuid": "c6140f57-7720-4e96-8d02-bb3752c6bf8f", "comment": "Malware payload", "value": "76313d1019fdcbd3fc53a8815083247b36ca64b0", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095402, "uuid": "f414c02e-699f-45ed-b90c-8e5b7712757a", "comment": "Malware payload", "value": "19e86ae3a16de2d4869d6e7c2df4912e0ced3dc04276a788eaebcb582e28c7fd55e1f96679cda6bf14917908e4aae0ee", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095402, "uuid": "bad194e0-34ed-4994-ab4c-e451583f9793", "value": "99451203B309DCE7C7DADA3D4D89DA291319EB291840C25176B16EABF9EEF531C0C619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095402, "uuid": "5c982ebd-920c-4bc9-94b0-1d034c138262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095402, "uuid": "a7db83eb-03fe-49d2-a8b1-33f0197229c8", "value": "24576:Kz8/4ZDaKjRKcTRbYKOaO9pGR+Ka1x9YPCxyBQg0En/:KgMKgZzO59UBaXHxCQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095402, "uuid": "ec5b6f7f-531d-49cc-8acc-87668e5189b6", "value": 1260544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095402, "uuid": "35045b4e-1d4a-4154-8f4f-2c2e49bb5444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095402, "uuid": "cd9947d4-b967-438b-a21d-b6ffc3d50cf1", "value": "833e8c0d2e8a0913318dd703d3baaa80fe6708737e927bc5f801cd3600a230c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c771ebc1-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153019, "uuid": "1050138c-3af3-4cf3-9bb4-ea66618d1f6c", "comment": "Malware payload", "value": "b036b7873cd1d14715dbd13619b8b24c", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153019, "uuid": "bd94527a-b4e0-441b-a670-bcedbaef4805", "comment": "Malware payload", "value": "83427ceba405ef199f3fe548e683793ffc6605d7fa7dab83f3fa4aabcca7f895", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153019, "uuid": "d965cff5-f647-4f4c-b6a7-1e1f56bedd3b", "comment": "Malware payload", "value": "d249fbdd32ea09179fe4fe53f64526a88da33bbe", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153019, "uuid": "5dd156b1-98d8-4e8c-989d-20da3db36e44", "comment": "Malware payload", "value": "ea4b94d18fcda3b63102040844a60ed92c76f98ea7fbddc1be698e90072f2e3acd7e3fb9e1b449a43937f725ea42308d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153019, "uuid": "406aa431-6c98-4cb0-9d38-80a494c0e673", "value": "E595335129C017CC95D4C91B1F8C9937147BEFC63824AAE362E1DAE2210EFC4EED69B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153019, "uuid": "ab671ac8-0224-49eb-ab5c-935ee517bdef", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6K:G1wwAjzIQOMK2GNKsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153019, "uuid": "15557678-80d8-43b8-b0ed-d2ee75dc0d67", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153019, "uuid": "77399f65-762c-4124-aa19-e87fbdedbf4f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153019, "uuid": "7537f47a-064c-4fee-8498-72f90355eabb", "value": "83427ceba405ef199f3fe548e683793ffc6605d7fa7dab83f3fa4aabcca7f895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c6b432-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620143815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143815, "uuid": "71fbec45-0098-42b1-bacc-70029977e9ca", "comment": "Malware payload (AgentTesla)", "value": "ba01df16e4c876e078348fd4479a8fdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143815, "uuid": "41eb04ee-6b56-46ed-b24d-50c8bbec72b0", "comment": "Malware payload (AgentTesla)", "value": "8353e30c6566795da3e5aa38a22b4707ee895cfa115ffa399cfbe7d57d00f91d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143815, "uuid": "0c6e38ca-f3b2-4984-b30b-0a9d649b31dd", "comment": "Malware payload (AgentTesla)", "value": "6c7f20976d3e7d9bf9f8a410cbc54962d1ef52bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143815, "uuid": "ffd0e883-1ce8-464d-afb6-7aef3348ada8", "comment": "Malware payload (AgentTesla)", "value": "a343af619b73039fe9345de4daca572c29f9005230cea98bc934517964b74d6f0775da24e1f291f5de3e97302944e50e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143815, "uuid": "85a742a5-66b9-44c7-8a25-2eaf44ccb684", "value": "BCF4BE277FA85612E1BA5F3814350300A7F5E50AE325C75F2D6860ACDDE2BC18E677E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143815, "uuid": "f35f8d82-c8aa-47a6-8a43-351c62c871b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143815, "uuid": "9a1111b2-42f3-4d13-98f3-a13b7836d125", "value": "12288:OxIvnbBjqfKMpnc2FOAeqL6oPUxMnHIqKG6BcmKd4pC+sO6cHksc5w3sLj19nFY:OVHUxCHIqKG6Bw5yTc5yo19nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143815, "uuid": "b403d831-134f-467c-a5e4-c45f9040b4e7", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143815, "uuid": "cf5677c3-4251-474e-8a52-1e1ab606c2b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143815, "uuid": "e9078ded-9915-48d7-87a3-a89ebcd4cedc", "value": "ba01df16e4c876e078348fd4479a8fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7bd0e7-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126450, "uuid": "13a3954b-84c2-4afe-91dc-2470605a62e3", "comment": "Malware payload (AgentTesla)", "value": "5263bdbbe79f061842d02a0d9e4d3bc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126450, "uuid": "75463d9b-da62-4d10-9f7a-b1db08903a55", "comment": "Malware payload (AgentTesla)", "value": "8385f873ba724ecdd312e9d62bc3c05c877bf79d17785414237e1285ea9d370b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126450, "uuid": "fd73f3c6-ee91-491e-b504-4d7466c40c4a", "comment": "Malware payload (AgentTesla)", "value": "700a891c35da2550964d81833b8bceb0b10fb1fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126450, "uuid": "ffba7189-7653-4a26-ba22-30fac0d49990", "comment": "Malware payload (AgentTesla)", "value": "36521b34203b34f3fe74a48977a6bde0fcaf1760dc9ec547cc26786108e404095b936864ce478a93b92d2772ae1fbc51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126450, "uuid": "e0d35a98-b611-41f1-b387-712deaa33c9e", "value": "C8E4DF3292601E6BC77D30F4E022D20153F5C1427919E7C93EE121E9E6C5BD9AFA1B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126450, "uuid": "647121b0-e3b1-4170-b8c5-a5b15991d4b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126450, "uuid": "d8168c9d-544d-476b-b18e-5c8970d926b1", "value": "12288:PFAp1EMry93KMn2ZnUtAADPj8EYilOOF6HTzcf4MJwbRu8nJ87EmKyC:PFA4jKzUaADb8zilOOSTYgMwR5nJ87EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126450, "uuid": "6384cdf9-827a-468c-b334-261cc95e7c84", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126450, "uuid": "50211765-5dd3-401e-b51a-f39d575bd2ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126450, "uuid": "83fb9ffe-1c32-49b4-8cad-59fbe472d1f1", "value": "ARIX SRLVl (MN) - Italy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df97b0e-ace2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620137299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620137299, "uuid": "0bf8a191-4a61-4f6c-867b-e39885702c4e", "comment": "Malware payload", "value": "db77d41af0752a92edf97c654b539f5d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620137299, "uuid": "6dec7e08-d3cc-4b88-a50b-052b16ce652e", "comment": "Malware payload", "value": "83a179e30673c8901d9890ca4c54a5adbfd966da4127c0489776763bebad7f94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620137299, "uuid": "b68a2918-0856-40a8-8535-7c10e49ef595", "comment": "Malware payload", "value": "b46c5487a2e18b157495177d0370b184b401cb2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620137299, "uuid": "699bec01-1c37-4a62-96b4-a7a176091062", "comment": "Malware payload", "value": "c2f1f26166d0540c299241a278726436af7d3cdbe9903803349f3021198bb3fca9d99deb3f0087652038809ab72b5f53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620137299, "uuid": "18d4c30c-b336-4a64-beca-cae70be41ec1", "value": "5753F1BB43B73988CAF072F1467C954259CE26C984863BCB7D883D7E6E448C56725E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620137299, "uuid": "ea79a5cf-cedd-4355-945e-e08e9aaa0d25", "value": "768:yaSTUQHyNjnn4bDsefA4MDNOLB6tMyA+JEjee9nHcE6V5v/TF9Q8vi3wWlnbr7xm:fSYozpL1B6tSBjeeJcxfv7nuT+laRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620137299, "uuid": "3e55b8a6-520a-4c25-8c5b-0078104dd059", "value": 61598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620137299, "uuid": "e61d5a45-59a9-429d-8e02-c2c54088c1d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620137299, "uuid": "21623ba8-8823-467d-bfa6-6a14277c802d", "value": "83a179e30673c8901d9890ca4c54a5adbfd966da4127c0489776763bebad7f94.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aba6f9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153039, "uuid": "a055dc6d-df84-4189-89e0-550f60c3eb98", "comment": "Malware payload", "value": "9aebbd8ecb9c7a08f43bdcdf73698880", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153039, "uuid": "5ca2434c-bd8a-4a00-87d1-fa27f534bf42", "comment": "Malware payload", "value": "83b35ad3595e87a9aa4b99c64f03b15f1d9b6dbbfe7b7ccaef17a0efae6a832a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153039, "uuid": "53150ebe-3ae1-481b-b19f-9fe95bd4b534", "comment": "Malware payload", "value": "7a860ef961c485fe77e7f5bc9a74001802299c33", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153039, "uuid": "9d6f3f64-775e-4ac5-8682-76388fdc947c", "comment": "Malware payload", "value": "8a94d42a52f37342a148122c845e8d0cf82469d06a09e878c3497260afd9f2a1c07d78c904a2ec31a32ab7a262a4b828", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153039, "uuid": "997d133d-52b0-4b85-bf2c-3370cda6b69d", "value": "D2419186139AB9F53E51A527327B8C00F9D8D1C614C5EF476CFC39E6288CD88AB746D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153039, "uuid": "fce8793d-2fdd-4bbf-ba79-f91dd4a1abc7", "value": "48:vsps1s4sssgsUspKsAsMsWdsOHsMsIL4lss/:vus1FpdxKKVJ15HJte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153039, "uuid": "6710a002-ebf4-4fa2-95cb-1faff04e1cc6", "value": 2046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153039, "uuid": "913d32f2-e98d-4415-bdc1-775aed6ffc7f", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153039, "uuid": "9be31155-7b92-40fc-ba6f-fb754ff84023", "value": "83b35ad3595e87a9aa4b99c64f03b15f1d9b6dbbfe7b7ccaef17a0efae6a832a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59be52d-acd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620131568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131568, "uuid": "6221bd5e-a3ca-4235-a5bf-33b1c233b29e", "comment": "Malware payload (Gozi)", "value": "a952840b01f89473d33440df6aee1fc9", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131568, "uuid": "3fc1fd4f-8956-4cdf-8f49-1ebb6a59d64d", "comment": "Malware payload (Gozi)", "value": "83d9e62cebb8f222083e6d6670b0ca5e82459c8d7815b0c415c9d1964bd56583", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131568, "uuid": "aeeef905-9d01-4954-be06-5d93a6f86ac7", "comment": "Malware payload (Gozi)", "value": "864445248c2967a09550bd455210159c669766e0", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131568, "uuid": "c31c7a47-26a6-45c8-8dfa-4fbf4145ec49", "comment": "Malware payload (Gozi)", "value": "9c4c6b4a004b12d1273e7d94d14dcc5667b158e108293a392d08bb9acfb08c8c18ec6c2e46a5c0de6be11321ba415a1a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131568, "uuid": "90fadd0c-001e-4012-8d68-7af7f4569f96", "value": "A415CF2238C1C232D9636438097AD1A08BBCB4241D2697BF73DC7B7E1F7659252359EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131568, "uuid": "36760c73-b6e3-4365-be9a-ddf8a9f2d8a5", "value": "144296335e11e836679bbc0168a3f68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131568, "uuid": "021230f4-496c-43a3-b1bc-ea645a298be0", "value": "12288:PvidtsWhSvt4ZWeWQFlBegSwCHO+ExeaIsrscw05c7BBC8emGjRPmW/7/zVjbZw2:PvidKWhy7erlBegS7esa5cDKjeA42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620131568, "uuid": "a3c6e96b-0a5f-4352-b3e5-bb8330af58fc", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620131568, "uuid": "94c85f6d-72f2-475c-b073-12c3b2b4e89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131568, "uuid": "90f312e1-68ca-4109-81a9-aa14bbfbcf63", "value": "a9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41442c12-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108126, "uuid": "f0814b1e-acc7-4f6b-881d-7034eb598301", "comment": "Malware payload (Dridex)", "value": "84a5dcca16670575a28a040255c5301c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108126, "uuid": "ef854e9e-6fc0-47df-ab17-816dbdd44357", "comment": "Malware payload (Dridex)", "value": "84809be831c2a18387a223194f23b91c9ba3fa22746ba988c2fea37cbf61a8eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108126, "uuid": "d026495c-f4f8-4aed-bfb3-770e8ffe5c0c", "comment": "Malware payload (Dridex)", "value": "d2f5bec2498d2efb6660fec8fb898e7186183cd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108126, "uuid": "3d90e49a-778d-4f14-964f-7467ec37745a", "comment": "Malware payload (Dridex)", "value": "af02429b62610898cd3788cf4d2a8af31d7730018edcb71f04b13c45adef55d1af9ccfa3d2da2206a9fb7b069900056c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108126, "uuid": "003ce3f0-0a1e-427b-afdd-4da3c8765f1b", "value": "A2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108126, "uuid": "6f09b2d9-c880-4b1e-9750-4f24888ecc1f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108126, "uuid": "f7ce76e7-5085-43a9-a778-7bc0b77ac7aa", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108126, "uuid": "781094b3-5c3b-4a39-a02c-a42d724049e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108126, "uuid": "d60d5619-0e1b-4c2d-8a5e-ee2b244015c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108126, "uuid": "57e64718-c81c-4b0d-9dd7-8cbfdae3ff66", "value": "84a5dcca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd95789-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126236, "uuid": "abe1af75-e6c0-4766-8d3d-0960a9ac8d77", "comment": "Malware payload (IcedID)", "value": "2d02cfeb2fec67376e6edf64e02e5bbd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126236, "uuid": "ea9bb4a3-af2f-4f1d-8ec4-70ae2b97e768", "comment": "Malware payload (IcedID)", "value": "84cf484ffbb205ae0b20cc3d67f28a7dbdb5a2a78f3f73e438f4c0e5c156954e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126236, "uuid": "1aa299a1-79be-46a9-8f2d-6fe2f9f4ca24", "comment": "Malware payload (IcedID)", "value": "bf7c5888c4cda276d258ac52d46c6fe40ac0ce08", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126236, "uuid": "7551d7ad-bfa8-47d7-8076-8ad9d594851c", "comment": "Malware payload (IcedID)", "value": "afebe918c12ca7e65bf8a7d7b6446ab166e6466065e0a975f9cd6c8296e6b4bfd10482b70b87309a8fd1071b0299e22b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126236, "uuid": "22672a41-2af1-43fd-8b20-f843dc886357", "value": "B28302353971126CD212954AF505B21DE7568BF0E1F2AE2E0E2BDAC095C5AF503ACFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126236, "uuid": "825184a9-657c-4480-9093-d162a704caf4", "value": "1536:fyVoJDC1IiGUKfeIxI19pSQMOIzi2IR57yv06iJAyehNR2EBYH/+sKDTUxJmq6/:a0D69GU/yQjIzsJyv0DlENRDBGWLExJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126236, "uuid": "f54dbc94-b870-433e-a446-bbc4ea138eec", "value": 83761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126236, "uuid": "f1c70577-c8f3-4196-98e1-01075d8591f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126236, "uuid": "4ab36ac1-b312-4b8d-930d-5e4ad88ded2b", "value": "xx_xx-86.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe718c6c-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115315, "uuid": "51dac473-283b-4e79-8156-c3bc27436344", "comment": "Malware payload (Dridex)", "value": "752a6a259128a5c3ea16b29019979106", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115315, "uuid": "6b453f63-c0d6-489c-91c6-b9103c39a085", "comment": "Malware payload (Dridex)", "value": "854414b96d61c2c8e47bdabedd3e326243ba8cad25225e38c0ed4dc90485130a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115315, "uuid": "0fc733e7-e465-47c0-8ce9-39b376f77f64", "comment": "Malware payload (Dridex)", "value": "a6247b4989552333f80e520e3c8a1fc9e137f223", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115315, "uuid": "bcc038ec-3c2b-4685-bfac-639b033b1665", "comment": "Malware payload (Dridex)", "value": "35727551c141ea5f7fab8e4b4cefda0fbf81212b3cbf9c9dee05c34349bdc9d5a8fb3c9f7f2e0a6c00fbc34ccdfe0f94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115315, "uuid": "c5df2dd1-86c4-407e-84bd-a864304e8dbf", "value": "34F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115315, "uuid": "03e4a455-f355-47fc-826d-94d6b7373a0b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115315, "uuid": "3d8e11d3-d18b-4af3-83e1-38611a3f33a7", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115315, "uuid": "8edca034-38a1-4bed-b201-5375e05777ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115315, "uuid": "6e5f375d-0f0e-4d7b-af62-7a18d5e30c81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115315, "uuid": "574df883-8e06-4f94-8477-3003a272edd8", "value": "752a6a25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e3080d-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160745, "uuid": "7c18b078-1472-4b18-a6e4-5f7c26ce79b7", "comment": "Malware payload", "value": "6796bec330611839e5b3f90d0c99ea43", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160745, "uuid": "51bb5efe-43e6-489c-979d-eeefb8e948a8", "comment": "Malware payload", "value": "8560aed5872f2ec5802b6083e7dff7338d2c3ef2a2676032aa0ab609a4c27c1f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160745, "uuid": "2b333d6a-7cdf-49df-827f-9e763f12bfa4", "comment": "Malware payload", "value": "425a83d6e4874247917064776ee2df868ad441de", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160745, "uuid": "222cb7de-5cf2-467c-b07f-e10d8b8d2222", "comment": "Malware payload", "value": "d0b8cbbff2ee6e7ec9ecb62e84f490e28ad1dd2e4ed1a6010f29cb5bb2d56691307ab877aef212a71ffca17d2cd18599", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160745, "uuid": "8f299128-9dda-4cf3-8dc8-4ba50e5e1655", "value": "A83164B32DC291260312EA92F685542CE729940A9957345CA5DEC94DB1E0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160745, "uuid": "317a629a-a589-406b-934d-b398c6276c0a", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3kM:GEXfhexTvrtWQZUSePSiJVAyrLMik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160745, "uuid": "69a2af9a-8ae4-476f-aa08-39f01c13165a", "value": 1680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160745, "uuid": "42ff9d4c-be15-4efb-b45a-948c8da2e8c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160745, "uuid": "1e307ef0-1b05-4c3a-a0b6-16d7b66ff400", "value": "ia6ah8ib.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b28dc9-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095376, "uuid": "f83cafd0-7c05-4388-abc1-fc2f629bfb1f", "comment": "Malware payload", "value": "580768551c67d5b78ebd33a3820884d9", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095376, "uuid": "880d6665-97cd-4b3b-8403-8cef5b57b3f9", "comment": "Malware payload", "value": "85adc52e2b6106ba570c492e6069539426f37734730014e8200bdabf9861ae7f", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095376, "uuid": "c1643e2f-6b7e-4272-89f7-8e356cf78710", "comment": "Malware payload", "value": "7bf516f77303f5e9aabda7730423730d346e2f62", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095376, "uuid": "c1c2956f-85c6-4eb3-b527-09434b015f96", "comment": "Malware payload", "value": "268b60ed34d8dca889576312c9c91d68c0e7a34c5bcb5a13dcdbcf9eb69e74d50a020100274dd3ca260140567ad2f17d", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095376, "uuid": "6e9ff163-6f9f-4003-bfa2-510002cda1af", "value": "E2050203B548DCEAC7C9963E0DD9DA581358E72C0911839136B67DBBF9EEF931C09289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095376, "uuid": "8d4e7074-3c28-4084-a7c6-2183279669cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095376, "uuid": "21ad424e-59a1-432e-b178-21a8d501431e", "value": "12288:qxLYOVBi/TYI9OHl7cNcJZE6iiVd1R1MDHVYAB9lb1b8TrM4hKcl0cyuR0VVQl6c:qpYoOkl4P6dnMDuAB9lxXJVdpA0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095376, "uuid": "ce414054-2cc3-4fa4-965c-c624e9f2cefb", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095376, "uuid": "5802582f-0dc3-407b-9dec-3b3cf6ac3ab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095376, "uuid": "fefe3ad1-1abc-4989-b56e-7cd3280e2a9c", "value": "85adc52e2b6106ba570c492e6069539426f37734730014e8200bdabf9861ae7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6d7183-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100873, "uuid": "e205b6a8-5dd5-4ae1-8655-d4fc7529f05d", "comment": "Malware payload (Dridex)", "value": "5f47127d9b6da260e57af89fa705687a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100873, "uuid": "42abd1ef-f813-4ebb-961a-f50a3b991f3e", "comment": "Malware payload (Dridex)", "value": "86036239c072df858c8f82c46d8582c4412be295c5b9fd2ef25fee790234fadf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100873, "uuid": "09c9c938-dd49-4d49-9abb-4b4cfc423a8e", "comment": "Malware payload (Dridex)", "value": "507e4826e75a3f9954797556ccca32498e5bbf55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100873, "uuid": "900d1809-edff-49ea-bd0a-41439801d114", "comment": "Malware payload (Dridex)", "value": "b4cbf241306e3c0a931a52824111a4bba21b1725a48c9e75aa812dfdcb445bbf8f1115784c5f7e273ab61b250740ec59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100873, "uuid": "308b1bbe-a803-4e55-a4fc-742045f0aaab", "value": "87F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100873, "uuid": "a9d981b8-96c5-4a75-8d8d-dbab80b16f4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100873, "uuid": "38e18946-d799-47ab-9452-88c66d2a1b00", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100873, "uuid": "558c4938-6f64-4dba-af9a-3e84a51eeed1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100873, "uuid": "c688ff16-a094-497f-989a-081d6d7369b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100873, "uuid": "80a380d2-8478-44e7-bc56-25c9f2b15fb0", "value": "5f47127d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4a0a49-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142534, "uuid": "4b468943-c63c-4277-987f-f7a49da09a71", "comment": "Malware payload (AgentTesla)", "value": "d89b6fdd641dea38846e7839ccb6bf92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142534, "uuid": "f708e9b9-011b-4c8b-8dbd-939538a617d0", "comment": "Malware payload (AgentTesla)", "value": "861b167e20811e8f4763da56a9c0926463b2eca1366a8626041f42b91e8f2b2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142534, "uuid": "dd243968-84f2-465a-b6c6-76204c033d6f", "comment": "Malware payload (AgentTesla)", "value": "725cb30a2ec580223df19df46a1264e935677ee5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142534, "uuid": "5a297391-7dda-4633-9d02-76d3734fdeae", "comment": "Malware payload (AgentTesla)", "value": "9ff0963bbf2c0287f1a611649d8353b1c3a069ccee643f2eeb85f1da6194c5cc821a78446c1aa4bf2e81296467bb1d42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142534, "uuid": "52860d5e-edcc-4c6a-a7b9-d9b3966326c0", "value": "5EE4BF6233D4AF98F07E9B7580255200A3F1BD0BE721DA9DBEA530CD89F1EC58352766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142534, "uuid": "a31a3599-d258-46ed-a33b-0ec883bcd8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142534, "uuid": "4d42c7d8-9be5-42b6-9e21-660bb05a2731", "value": "12288:Lngpwg2IIyOKMIyP5ZBgOx2K7YB40Py7hnxskRsAP6:7gpPFOKZyPmM2w0PytxskL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142534, "uuid": "13d543bb-6b32-4a3b-88ea-fbdab38e1fa3", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142534, "uuid": "ea6ff30f-1ba0-4b1a-a275-95317d420ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142534, "uuid": "4f845c02-1086-4c61-bc85-b5bf13ad9309", "value": "d89b6fdd641dea38846e7839ccb6bf92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0024afe-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086515, "uuid": "66da69e7-d459-45d5-9b09-5b2bc8db8e65", "comment": "Malware payload (Dridex)", "value": "545f0434a7d868e7e6bdfd2e9a49ff17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086515, "uuid": "cf879467-d6ab-4187-8fd6-bde02fcbd8e5", "comment": "Malware payload (Dridex)", "value": "86b37c661fd84ac2a6b49be76bf21bac200923d5305783bc4003eb68da461de0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086515, "uuid": "6814e4b5-748a-4dc1-ae1e-d9c4deee354c", "comment": "Malware payload (Dridex)", "value": "f74b71ef96b0f3c6b5784520849c650200eeb0e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086515, "uuid": "6e1fe7f9-9115-4631-becc-1dd7df8383b5", "comment": "Malware payload (Dridex)", "value": "c6b7745959f1f41d22e078d2086bc0ded64f2b8fc073b5f885beaadd9ae08b03c9db0e88aee77a0c1da43c7c32229e44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086515, "uuid": "dd70e89f-e3a4-48f1-bae5-0e12ff4a86cb", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086515, "uuid": "3ba9a134-7c2d-43e3-892c-18f4c7cd85e0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086515, "uuid": "0d3286ec-c2d7-47bd-a423-63edf1d55e5f", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086515, "uuid": "aeb6c09b-551d-41b8-87e8-10a8ce8cb409", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086515, "uuid": "978f2a04-0c10-4e91-ac7d-951c110f5005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086515, "uuid": "d44b0238-2511-4494-8b3e-5086d6d3ee5b", "value": "545f0434_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb808774-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620144060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144060, "uuid": "6327046f-6ff3-44fd-9282-a7426ab798cf", "comment": "Malware payload (Quakbot)", "value": "75787cf47dbf1028a446f633c67af5ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144060, "uuid": "ca393838-ecf2-4391-9844-fdd95903733d", "comment": "Malware payload (Quakbot)", "value": "86e0e5ca743f5098497ac8a35c5f953089b9b2126e1014b8b8ccd4b9dbf39c2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144060, "uuid": "73678ffd-1958-48a9-b982-735813710008", "comment": "Malware payload (Quakbot)", "value": "c6ff35b3c78682e7999782fad913784cb96c4d5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620144060, "uuid": "2fed7be0-d10d-42bf-8872-37b1b9f48718", "comment": "Malware payload (Quakbot)", "value": "80e3efe5e3a3bbed85ab99c26359a09923c1a128cdd5777434cbeb3dbe7edb48529a91117bafe4ebe7806968efafc251", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144060, "uuid": "18dfaee3-a1c8-4357-b500-34ad893b2267", "value": "B9A4B0ADAA32C666E2152FF1E2C71F98475398D53120570E45B01F2E3E9D3E83C3AB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144060, "uuid": "733ddec4-52d7-400e-aa90-ceb9325cf2b8", "value": "c7f129decb1948fe596b367e0a726495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144060, "uuid": "4cb5c133-a383-4bf9-bb57-1fda342b89ad", "value": "3072:NJpfClqR2d3djh8lxxURt1XX/2kOrhidWCnW/G4Jx5SW2+xQ9OoqAC9uSkDql:jQh8lxxUf1ekOakB1K9OXAC9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620144060, "uuid": "f70c3630-6a35-4085-9411-a14c363dc72a", "value": 492186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620144060, "uuid": "8740f900-4584-4d3a-a500-1ba3e87d4507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620144060, "uuid": "52a6daac-6f99-419d-aaae-c364b8695a8b", "value": "75787cf47dbf1028a446f633c67af5ef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c839446-acdf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620136170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136170, "uuid": "a07cc5e8-04d7-40e9-81cf-b08ab6df89b1", "comment": "Malware payload (AgentTesla)", "value": "4a99d877018f30de83c9cfe46541a4d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136170, "uuid": "cf31b7b5-eec5-4e2f-9e06-b9d49231ee65", "comment": "Malware payload (AgentTesla)", "value": "8707ecc0a4c23b20c51f608c251d83d130c9987217f4351d01f355cd005bce0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136170, "uuid": "74dd9379-5767-4f58-b53e-0b7a975a6a80", "comment": "Malware payload (AgentTesla)", "value": "c5870fd062129bc05ca85ce6c94c5ec90aa4b88c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136170, "uuid": "be7aa288-4d23-4ea1-9294-395839747d9a", "comment": "Malware payload (AgentTesla)", "value": "6d2460ce2d7a31a31dd8c3346bdf8e5dd4fbd1daaeb506b7f6ca184c7ee167d60ef2c8e8d52d5ef90c8bd9ad5b5de386", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136170, "uuid": "b16e35d3-2aa2-4878-b331-3e226be975cd", "value": "20E4CF2233D4AF68F17E9BB580255200A3F0B907E721DA9CBEA511CD4DE5FC5C3627A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136170, "uuid": "01e667f0-fbbb-4d0a-8abf-23b44f2cbf55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136170, "uuid": "b8dd754b-306c-496a-9921-2a260e3cc212", "value": "12288:rTgL/C+wIzOKM9HL9A1cFAL81woC+5bO6oh4uBNvQA:fgbYsOK2HJA1rL81K+5b1oRNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620136170, "uuid": "b91c6888-40de-4b26-8af1-9fa6fcf7af9f", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620136170, "uuid": "4100d048-9ccb-4167-b11a-e4a071bb3ad5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136170, "uuid": "aa528b56-509e-4226-8e6c-ed5f40856490", "value": "4UFa32rSDVEyUvb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92dbac8-acbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620122125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122125, "uuid": "406fca4f-4884-466d-a1bc-fb57d1e98b97", "comment": "Malware payload (ArkeiStealer)", "value": "e73e4bc10b7f598be39d301c1fe89961", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122125, "uuid": "d3426033-fe93-4c91-b7b9-be3e05f708ce", "comment": "Malware payload (ArkeiStealer)", "value": "87bce52ffa3eaa55981a2dd9af96ce156249a9bfcfd9b3930252cdeff9e8633d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122125, "uuid": "04820629-6f13-4b7b-a128-a94baa2a2f8b", "comment": "Malware payload (ArkeiStealer)", "value": "b4d75eae000cb9c26421773d321366242aa13ee3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122125, "uuid": "4c799ae4-065b-4548-bafb-ad2b0b703b58", "comment": "Malware payload (ArkeiStealer)", "value": "d852cd82d98e4a37396feac64e04eb560ac7fae617fa3296114d2fdd031b2863dcf92f5db9db1f8548b212b8ce81b3c5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122125, "uuid": "7175132b-f63e-45c3-ba82-67892370cb01", "value": "B276337AA10244B9C02208334C8F6376F2619A40AF6E14CF5BDF7E751966B861BB53F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122125, "uuid": "667b5cf6-c68b-42ee-9721-5fe30b1911a6", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122125, "uuid": "db4d7227-5c53-445b-8b8a-5938639afcfa", "value": "196608:itfJOKblgaWrOiNqqJt+lq+YTvxBNJOfZMOs1TQd:QpblgVFtJt+bwJYf+pQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122125, "uuid": "2837aedd-6648-42ae-a3cf-1fba001bbc2f", "value": 7355198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122125, "uuid": "ff335237-b609-4bf6-a33b-075b8eb8c9d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122125, "uuid": "e3cfdf31-efb0-48ac-aa07-880355f7d01c", "value": "E73E4BC10B7F598BE39D301C1FE89961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1072add5-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126083, "uuid": "81a9042c-cbe0-4688-a627-c8baba953e1e", "comment": "Malware payload (Dridex)", "value": "faf01c9e87934325230d6fa61dd1ec42", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126083, "uuid": "f41633e4-0dbb-47af-bc52-5747d92f4383", "comment": "Malware payload (Dridex)", "value": "8861d136f60c209dd3d4533984179a26148c2a27a610b39bc82b3d370a7266b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126083, "uuid": "ea632a6e-7db8-41f2-aad3-eacecfdd3461", "comment": "Malware payload (Dridex)", "value": "14e2092d68a93e1921e9ca1e514d46f4aae4a19c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126083, "uuid": "1b6842ba-4110-4ac4-8186-2dcee02eda3b", "comment": "Malware payload (Dridex)", "value": "0e725ff4e60e556c64f66c06b65dcb7a3d0cc112f414ec3a106d03b4bf74359362853d9e936df66395db24aef5fe8645", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126083, "uuid": "9bef4fb9-0a11-4574-a2e3-adf3549831b1", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126083, "uuid": "03741a07-a90a-406b-aea5-f83c53b98838", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126083, "uuid": "3fd2f810-7b5f-4c79-9fe1-39fd5661eaa9", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126083, "uuid": "e09fa58e-9308-4d0b-9755-3acac9e36372", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126083, "uuid": "1918aef8-bc6f-4296-b5e9-2d784a335a41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126083, "uuid": "912bd3b4-7306-43c8-bb42-d5a2066cf4b0", "value": "faf01c9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df791aa1-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153059, "uuid": "2c62f8c2-d71e-4d39-a981-e448de32d238", "comment": "Malware payload", "value": "b8a672fe3ee15eb069cf5b84dc74ce77", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153059, "uuid": "2a474fc3-55e1-4320-a535-ce6bef27a2c3", "comment": "Malware payload", "value": "88bfdfd28202b13e605e7804f68f44dd6f8ed104705be9a286bfc343325827be", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153059, "uuid": "6bf676f8-a28d-4a7c-bc28-86db3a0c663a", "comment": "Malware payload", "value": "41dfcd9ca1ffb2db1c059ab4f56581377ebff6f7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153059, "uuid": "4b0c1e1b-548d-4368-a0fa-36078037550a", "comment": "Malware payload", "value": "a936017311e91b7dc5ebb6457fa3079c5f2efcf46748b913d6bbd2b25e6fae8a5e5c46881507c71d4f8a820bf7e65d25", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153059, "uuid": "b7e69efd-2143-4b6a-bd24-b9e32b9f73a9", "value": "C0063335B4BB74782A06DBE25708DC3127F6D30A3E6A372A5FF9A88F911450BB67C144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153059, "uuid": "406772eb-fa64-4a25-b0a2-05b180c443f5", "value": "98304:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HVCjzrbXbe8gGjA8:KnD4Yqqvc7hvLFOMojzrbLVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153059, "uuid": "d3082f90-f881-44fa-bac3-8d6606f0c822", "value": 3678208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153059, "uuid": "d5767491-c1e8-474e-9e80-989ac59fa6f7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153059, "uuid": "8ec118a5-3fa6-4bd8-ac1f-87ee07f65e18", "value": "88bfdfd28202b13e605e7804f68f44dd6f8ed104705be9a286bfc343325827be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fac644-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118890, "uuid": "8b54bfda-9460-4d94-ae0c-a6bff2443f83", "comment": "Malware payload (Dridex)", "value": "118e26226e4fa6d2348c675c4f39c7e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118890, "uuid": "9028cd59-066e-47f8-b955-a5ec4895be68", "comment": "Malware payload (Dridex)", "value": "88dad677f5051a042f8e0a1344a837b507d758aa60f32ea4c5f5902f24975ea8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118890, "uuid": "89f31d04-0209-419a-b1a6-9819af6ed6bb", "comment": "Malware payload (Dridex)", "value": "481f8c60db5154cd21f799b179e0bf7a2427158b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118890, "uuid": "1a8a0299-3ef1-4bf6-b8d4-91cac3a5363e", "comment": "Malware payload (Dridex)", "value": "35425cf04d567dacd663416311fa2b03b31b33a42d0c3de0b6ea3d46960ad5145f5c2912542198b1c2ab2eca0e4904bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118890, "uuid": "92857716-d752-42db-8141-dd1d8ce5b5cf", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118890, "uuid": "4ad9ca64-5de1-480b-9e54-a4e5fec184c5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118890, "uuid": "65350b0a-8b55-47b7-8145-0b250e09a420", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118890, "uuid": "cf17e96b-aebf-4fcc-9cd5-d49790248bbf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118890, "uuid": "ecce876a-6936-4850-b98d-f88c12ef49bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118890, "uuid": "46abcf97-2225-4486-8f5b-04f5e2c4d078", "value": "118e2622_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690743d-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126066, "uuid": "8b4cb00c-5fce-43d5-8c48-46070de8eac4", "comment": "Malware payload (Dridex)", "value": "726a3ca59ef9aee4833b759f5f63a0c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126066, "uuid": "67984246-b5de-44e1-a2d6-758a8eb81ecc", "comment": "Malware payload (Dridex)", "value": "8926ceccf1abbfae89f1d3fcb96acaac60d90a2ab1c3060dde4c8d27ae219eff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126066, "uuid": "221382f3-4476-4f89-8133-0b4c9fc426cb", "comment": "Malware payload (Dridex)", "value": "a776825f5b0a8cd26ddec3ad74f393ba469ed736", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126066, "uuid": "6b9382f3-bc98-432e-9431-14940b2481b2", "comment": "Malware payload (Dridex)", "value": "d51ef309f5f741f9fadd7bea3942527004d149ac5714752f664bbee5d3619c027616524d9330680290c64f2797d7e267", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126066, "uuid": "ce398e85-5345-46c4-98b5-b620133a5320", "value": "E0F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126066, "uuid": "ed82126a-40a8-4cf2-9d1d-1c5b49ffcd6f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126066, "uuid": "064a6dc2-8faf-47f5-9f08-f1d4564a788f", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126066, "uuid": "527d97f7-f92b-4771-832a-4a2904964955", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126066, "uuid": "f56b2bc0-0a79-44be-af2f-9053e93a9f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126066, "uuid": "58fb1e3e-a936-4af5-9112-375d1f7d6ac6", "value": "726a3ca5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771b6aa4-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620143865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143865, "uuid": "94344ef0-4e67-4ded-b926-9e20d37c3cb7", "comment": "Malware payload (AgentTesla)", "value": "682e89458bc1329479029352bafef781", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143865, "uuid": "5665647b-1b00-438b-9414-4bfdf8c9651c", "comment": "Malware payload (AgentTesla)", "value": "89948b9216d1be8bc742e87858056127d87ed4bda87539f1cfcc7c3811117735", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143865, "uuid": "a4988a57-b052-4df7-bfc4-e73af23313de", "comment": "Malware payload (AgentTesla)", "value": "f726a85cacc3d7695fb5c1870cee2a9bb9f1f5e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143865, "uuid": "f1a4bedb-2964-46fe-8cd1-5335613ea8e8", "comment": "Malware payload (AgentTesla)", "value": "df563e3a3af8727f484f98018c4d03835526abda9063e090b8c8eaa1b0c4b08a5cdf2d8456a0e9d58a9909581e33d71e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143865, "uuid": "b3339a17-d86a-408e-a7d8-2457f61c1dd4", "value": "23B54B5162A46E45E93E57B88770441C47FAFC17DB72DB8EA884B0991FB37C08F1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143865, "uuid": "a6516ab9-2cf6-4a30-8d90-c36d1b349ff0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143865, "uuid": "77bcfe18-32b3-4229-b8da-11d546e36383", "value": "24576:boEIMW55ZE1XcMM6ahjPJhb9B4xll1r7PBDmIt:b4VnauMM6ghpANd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143865, "uuid": "b955b77a-eef7-4835-bca2-26bd3ab4a54a", "value": 2311680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143865, "uuid": "e0a0e7d2-f1f5-493e-92d0-c2129ac84d2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143865, "uuid": "6af52bc9-0277-42fd-b3f6-65ea8eae7049", "value": "682e89458bc1329479029352bafef781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c772f105-ad1b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620162038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162038, "uuid": "325d7943-dd26-405b-bff7-f02f02567293", "comment": "Malware payload", "value": "415ea2401b410a0be1fcf3152b05e1ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162038, "uuid": "ab0a349b-06cc-4186-ac51-364a1e9a210a", "comment": "Malware payload", "value": "89a547a6fc34bb5e07a2990ad71b8531505df2948cda93251ed21e06ce7bdb7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162038, "uuid": "b7528c72-d4c1-4c9e-b2a1-567b02d25b28", "comment": "Malware payload", "value": "6d38f2925ed626bb275dae1dbf633e9f1e07c2e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620162038, "uuid": "44385e8f-aafb-4f2b-b7c1-493e36cc4d15", "comment": "Malware payload", "value": "f08776b4d69234d82d07b1721efe751d50f626e16f781c1e485f54d235ea9ae3a731b5e418c9641ce01f1a36392ef441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162038, "uuid": "c46c4eb4-11dd-4176-be75-581084b47aed", "value": "838533286B381771B086991475C2B3231BD938D40F167D199D0B7E87F4F9AE2EC936E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162038, "uuid": "524e22e9-d7c7-4b2b-bd5e-fecb43083755", "value": "49152:4WRODb55sK6Rg0j9c3Zqhlgv9MYV31Oxwo6R1C:4Wg355SgG9c3kloOwo6R1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620162038, "uuid": "59bbcdbf-c75e-4ef0-986f-cee394158498", "value": 1817344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620162038, "uuid": "4000f7a2-0836-41b8-8ac6-ebef9e57111b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620162038, "uuid": "96adc6eb-c404-4caf-a420-4b5bc024f563", "value": "grsd-rfkill", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208bbfb2-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108071, "uuid": "c1b3ebb3-990b-4ec2-ac5b-53f5755fdc38", "comment": "Malware payload (Dridex)", "value": "357caf38f85513424ae48420cf523aee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108071, "uuid": "0898f36a-3d69-493c-8ed6-e0a4fa1489ad", "comment": "Malware payload (Dridex)", "value": "8ba6cbd8f490c3e090b0e72cd95a9d8d537958d37fbbaac369c754e6f1b4029b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108071, "uuid": "e0233dce-63f6-4071-9ebe-0a8fcfb208f4", "comment": "Malware payload (Dridex)", "value": "e8db42ae728ec8d9ffbb9cbd9cd7b026214a89b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108071, "uuid": "828cf287-8c3b-4871-b3fc-c20f72be47a7", "comment": "Malware payload (Dridex)", "value": "666205e54c264bb0618b25c9f4ee8326591e49aa3c3daa438aa63433a820681e01adf4d6fbf65683066766ffb50f2395", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108071, "uuid": "66547ba3-16e6-465c-b0ba-0a5b625dea40", "value": "CAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108071, "uuid": "8838c725-882a-4b70-b2c2-0831fc879315", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108071, "uuid": "994a8dc3-ab33-4c5e-b193-f413010249d8", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108071, "uuid": "b7220c88-2232-42dc-85f7-65311e8426ae", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108071, "uuid": "deabdc28-00e9-46f4-ac77-c15aa78f2d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108071, "uuid": "f1284546-a102-4949-bb22-f94dffd3a49c", "value": "357caf38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750d6514-ace0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620136560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136560, "uuid": "f21b69ff-8ef0-4c03-9e32-032be2577485", "comment": "Malware payload (Loki)", "value": "efac0baa095bf155fde379c3b180f5e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136560, "uuid": "a73885bb-0f97-4d68-a59e-48b360e1179e", "comment": "Malware payload (Loki)", "value": "8bf2fb9f4686b128f0ecf8c5512fca579317147575eef3c6f423e5280dd751c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136560, "uuid": "4a3e7378-8fff-4415-b297-f8b249f8046e", "comment": "Malware payload (Loki)", "value": "6dc40192cd8424a04c446fc458475eb03b37c2ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136560, "uuid": "a9d7abe6-cb29-400a-8bca-05d9731b6349", "comment": "Malware payload (Loki)", "value": "e01ff67dcad96099d6c63f44638899d4e656c779f15b09a5d2a56927a35cf6e2d07082c39e93b097fda195b142e5e619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136560, "uuid": "ca7daad0-411b-4f1a-80e1-2f6f38dddbcb", "value": "CDE4BD277758AF69F1BD573A9454059093FDFC0BD722C6AD3DEA20DE89A0F809360782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136560, "uuid": "0fc3682e-ec80-45c7-9b67-e1c84648397e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136560, "uuid": "60027972-1ff1-48de-80c6-25d5fbdccd4e", "value": "12288:DfaRqbC7OKMtR2nrBeA0i6/2tjO+u/Sz7zHy5DI/gNa/536k:mOvKEA0i6/2tOziLy5LNa/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620136560, "uuid": "0398f66e-56ba-44e0-9681-104ab0686d99", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620136560, "uuid": "8f97fce8-b310-4ea7-a2e6-548d9ade7192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136560, "uuid": "86084ad3-1116-482c-b461-9ac8f6907e0f", "value": "DocumentosSantander.PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a298c9-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153064, "uuid": "19319f38-1492-48e7-ac11-35c6f40baec4", "comment": "Malware payload", "value": "bfe7d54ea019675d5c59132044de96f9", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153064, "uuid": "853c0152-ec37-4fb6-8cbc-6a0c43f8dbe5", "comment": "Malware payload", "value": "8c4a9a9d7b322b2f7dca33bf7014ee8d2c69208f9bf301950759603ed752fdd1", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153064, "uuid": "04e6b157-989e-4d16-b9b5-82c0fbb1d392", "comment": "Malware payload", "value": "1d278a830496c30298d0884c27c488d6f17b504e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153064, "uuid": "a6b16f82-d0ce-41c1-ac53-2f13fbc3b830", "comment": "Malware payload", "value": "40f52771643cbaf2735bd09c99c1609047e51f806badd80b3ce85c308ee20f4bdb4be2f39b8fd1bc7cd0b6480d66d03c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153064, "uuid": "f1d335ca-a5a3-4a63-b6cd-291ea72052a3", "value": "3465330832BB7CD4F9EB053927621894C3B932F1C049B09577981CA656772FE538EEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153064, "uuid": "672e05ae-19c5-4355-80a4-01df7561cfd9", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri7:IDSOgOhntWID2I0WkAfMtjNA2zT2VYR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153064, "uuid": "d16bd719-4841-4fd8-a9b3-7428d3c23ffe", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153064, "uuid": "240a666c-8796-4cd8-bb20-94d19511b250", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153064, "uuid": "e39b909b-e591-4b8f-b549-ea42a4b777cd", "value": "8c4a9a9d7b322b2f7dca33bf7014ee8d2c69208f9bf301950759603ed752fdd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371240cb-ad23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620165232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165232, "uuid": "b95d5758-6ec0-46b1-90fc-3ec89d8e957d", "comment": "Malware payload", "value": "d96b7886c4e00e171709fd82c54ec891", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165232, "uuid": "783622cc-7c4d-4bcf-9eac-3c50cb8a8b73", "comment": "Malware payload", "value": "8c852c93612eb6464c5e42d8a600e0b73d3e2e73ad56b223dd02fa9fbc5d1364", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165232, "uuid": "2485dabb-ed4f-4c6a-8840-3eb25c7db4bf", "comment": "Malware payload", "value": "922686230beb3a2f879f4e6e789d36a962e32991", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165232, "uuid": "4b430ade-8da8-44af-9e0f-7ce68824e33b", "comment": "Malware payload", "value": "5289788de6dd06644c10efaa6f5ec0eddf91ef796d8f29510d59ded96f6ecd69308c277165daeeefb22da0d6d5dca050", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165232, "uuid": "037ee407-3f0c-412d-b3f7-674cd96ca218", "value": "DF24F108AFE5D70FD9B14F789CE2C23877717F11A846F28B6853B24683793D45880EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165232, "uuid": "e8c5b764-1ec3-4464-a3af-7dcd4943f0f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165232, "uuid": "235b602b-26f4-4f7c-a27a-643402e0f885", "value": "6144:67D4Qc8ETb/cjMiTqjRwQyxKp5c0jCKB:yD4Qlsb/cjMiTqdIxKp5c0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620165232, "uuid": "402fe603-a90d-4ee0-a203-2b0dfdff9e8e", "value": 225592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620165232, "uuid": "908c4256-ed66-4bf4-be60-e08483f17057", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165232, "uuid": "c2311f86-a0d1-4525-beb1-e5586386076e", "value": "SecuriteInfo.com.Trojan0057be311.75.23245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e385e3-acff-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620149842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149842, "uuid": "b5711907-e0cc-4e32-9985-3f0ef90ca7fb", "comment": "Malware payload (AgentTesla)", "value": "901e61918c3c108ebe8d6eabd18d0cc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149842, "uuid": "c9157f7a-80d3-4f8c-915c-da9df70df979", "comment": "Malware payload (AgentTesla)", "value": "8e7e22725654ca02a0c9d079fa96ac9b53f131cf029076b90934b50a23a36ccb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149842, "uuid": "08b3cd84-9cd6-4aa5-a392-832fbfe51ff7", "comment": "Malware payload (AgentTesla)", "value": "bbc834bb8d6a92e7070276884ccde86c0e2f6f38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149842, "uuid": "86fc8cbc-3c56-4657-90a4-0ef0f924d682", "comment": "Malware payload (AgentTesla)", "value": "228fa5e3b2cc17332f5132a8441813c83ce77eedc750902c22cc487fd482a9b7e5055d726c753ebbf34d746d33bbfaf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149842, "uuid": "15fbb57a-ced4-4b46-b604-92964aa03df7", "value": "4645BFB875047DE22A6F536BDA96ACDD13A627239ACBA4CD806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149842, "uuid": "ba04d334-927a-4aba-afd9-826b89776249", "value": "24576:/8KByfuwF1U89tdfwCUXDPEqaRHsFJA7kEqw35hudSykT5IxCj0vUtThWkEDR4I:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149842, "uuid": "cdc70f66-f855-4dbc-8420-ed2126e6624d", "value": 1259855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149842, "uuid": "1ca25030-5164-401b-ae5b-8cf3e6a5a7f9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149842, "uuid": "5b29589a-b329-4c34-9b53-5a5a594dfa05", "value": "PO5421-allignright.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd78587c-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097275, "uuid": "05124f66-b0a1-474c-bf17-2cdd769c33f4", "comment": "Malware payload (Dridex)", "value": "dca4b460b9688f7bf4597b1b95f4ac1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097275, "uuid": "3b5ef59f-1834-493e-a67d-1e2a7d6b4ff9", "comment": "Malware payload (Dridex)", "value": "8f007847f750dfb65ef2d176da40c8bba4c840509a7b0d1d9733e55ec333cabc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097275, "uuid": "04cb3d6b-12a1-4b2b-97a7-c7ac7a598b39", "comment": "Malware payload (Dridex)", "value": "febe4d7308ee21ee9eb15bb7996be9b078fe1f46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097275, "uuid": "e390b822-6e53-43ba-97d6-872efaf6d074", "comment": "Malware payload (Dridex)", "value": "b7e22874055494bed4f4a276505af5bdac0916fceed531c0f01baef05319bfb5c01e3538b45f0d26ac2549669c463ce6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097275, "uuid": "16c17972-7664-42f3-92ab-72c46f222599", "value": "DEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097275, "uuid": "e300a60a-3ab0-471a-9978-3a9ca09c5a2a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097275, "uuid": "f6dcb883-a3fb-46eb-96bf-676720c60554", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097275, "uuid": "cc5954a8-b29b-4faf-bd16-b566bb1bbf4c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097275, "uuid": "daee1708-4242-43b5-aea9-1772ea85499e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097275, "uuid": "969b6c9d-900f-48d6-90dc-11dea2343733", "value": "dca4b460_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70222ce-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620093721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093721, "uuid": "7a2792ff-46de-4dbf-8803-79fd5572dc64", "comment": "Malware payload (Quakbot)", "value": "afded9051b57da3d5ee038ed55f1956e", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093721, "uuid": "2ab4e2d0-de76-42db-9490-1d331aa82134", "comment": "Malware payload (Quakbot)", "value": "8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093721, "uuid": "6a42d1d2-5f0d-48f8-86ed-c1c886586907", "comment": "Malware payload (Quakbot)", "value": "e94098508736fed3f30b9d20018738859c9998b9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093721, "uuid": "e016f418-b9b6-42bb-ab88-610340b13721", "comment": "Malware payload (Quakbot)", "value": "77265f5b694f31d4cbbc09a42b8a7639c110bc1e0c5cae6dc8f89780b77d9850fb63e31d1b8a22d70ba2b3bc6c1b6549", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093721, "uuid": "22a5b359-3796-4138-8eae-51e8c9e2a9c1", "value": "D2259E22F2E15837D5333A399C7B9654AC36BE103A34AC866BF51D4C5F397813D262A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093721, "uuid": "94b8eb0b-5838-4c4e-a3ed-daa41e7ee1f7", "value": "c78e72cffb958a289ff6446e74d06494", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093721, "uuid": "17f71c10-a8f1-4d62-90c7-186b052ed1d5", "value": "24576:+pc3GtzEGWX+Vm/sKYuaXy2xxaOZmkvUnWkx:+pcvgasrXaOZBWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093721, "uuid": "215d6e22-a277-49be-afd8-4068bbf3f24c", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093721, "uuid": "8ca61929-ac41-48ae-9bf3-6f490d8409b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093721, "uuid": "20950e56-9645-48c6-ab2f-ebaed59e9964", "value": "afded905_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233d322a-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108076, "uuid": "b2a612f1-934c-42ea-babd-77b58e3cc0fb", "comment": "Malware payload (Dridex)", "value": "128990cb9cae4a6ee6a14a21246da8b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108076, "uuid": "565792a7-9e0a-4110-af46-691a4b4af9ae", "comment": "Malware payload (Dridex)", "value": "8f7934e7a601f1d86ce431afbb30cafd0c437100feee3d5dca2bc63922f1928b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108076, "uuid": "0565ba2d-8d4e-4e80-afcd-d6111af2f9bf", "comment": "Malware payload (Dridex)", "value": "9190e90a0f10f4b4703f2ab7a2c98d4a1b2ac262", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108076, "uuid": "f2d84c86-657a-41cd-94b8-5856512f3071", "comment": "Malware payload (Dridex)", "value": "bca1b6f8720ec568af9d832219c34e8692732e50c8b4ee08cd81119aee7b1a30afd4d7a472bf2eb284791459b64e49f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108076, "uuid": "072e25fb-9a9a-4200-b295-e0a73189388a", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108076, "uuid": "df27d354-1d62-4403-9150-5e418f79753a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108076, "uuid": "0c2df00b-07e0-46f0-9e10-730f5e399737", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108076, "uuid": "378cb717-613a-4160-930b-c8d44c4317b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108076, "uuid": "bc509ee3-9acf-4024-ab58-6a2a71d27d2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108076, "uuid": "bfcd2986-1972-457a-89fb-54b5890d8de5", "value": "128990cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ce2704-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115279, "uuid": "6c395e25-1e4c-4b60-aa7f-4ff461d7bd20", "comment": "Malware payload (Dridex)", "value": "97513783e8ab923f3f8da42ea38ba22f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115279, "uuid": "093fe109-074c-47fe-be61-d569232cdab4", "comment": "Malware payload (Dridex)", "value": "8fdd0da2063c4a0c6d28bfa15644c3b7dd8a545a818dcda249d035d55a8aec0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115279, "uuid": "7a705345-63cf-43c5-8736-d6ae124b51a3", "comment": "Malware payload (Dridex)", "value": "f28fd2a92e80a037df5168fd5f65143bd4e38da1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115279, "uuid": "c624ac7d-a584-4152-9715-4ef131a94acb", "comment": "Malware payload (Dridex)", "value": "9af72755c1bc298dc014329c5464805b5d646218ad89aad05860875a6522c14129a99ae258ea2b2dc9f3a3ff57143aa4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115279, "uuid": "23280a80-ab1c-4a47-8666-c81d0826ffa7", "value": "70F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115279, "uuid": "90635aa1-cd81-4342-888d-ebe53d8be6d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115279, "uuid": "beed90ea-7919-4476-b171-3613884e3bf5", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115279, "uuid": "3f3a874b-319d-4937-8da2-df31930cb98e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115279, "uuid": "439180ab-c627-4812-97b7-7de624f5b09f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115279, "uuid": "a85eb8a8-9b62-4eef-abac-d6b8fa4520b3", "value": "97513783_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef20fed3-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086513, "uuid": "fd607a98-8be7-412e-9b4c-a8952d1516fa", "comment": "Malware payload (Dridex)", "value": "88ef7e0656dba2cb73ef6c9e4b1dafee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086513, "uuid": "96aea291-3777-44a9-abe7-d7ea85cdfa01", "comment": "Malware payload (Dridex)", "value": "8ffd799f223011e0fc19fac0762b4ab0eb49b2281629dd5090781a250ca039df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086513, "uuid": "8dab1bcb-9b86-4b88-9e7b-f07bae1d0b1d", "comment": "Malware payload (Dridex)", "value": "79906faee69b05dbbc6a80a218def9871c015541", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086513, "uuid": "2cef36de-ff6d-4559-856e-a251bcb9a95c", "comment": "Malware payload (Dridex)", "value": "e34972df6f66960c7dd2659f5e74e0c444a22c65131934007d936b59e8b395fdc8d7d7965ba085e4e88a4b32337a9095", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086513, "uuid": "16a66457-c8d8-4f3f-b327-53d1be0c8f8b", "value": "7CF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086513, "uuid": "c93aa5c6-61c7-4774-92fd-3fa10ef545f5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086513, "uuid": "55ad541d-8242-4d93-a4b0-dcbb99c41a71", "value": "3072:KWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:K42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086513, "uuid": "b984bc93-a341-49b6-8c9c-18373691bcc0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086513, "uuid": "7ee057cc-fc22-4312-8c74-793252d39e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086513, "uuid": "b1a073e7-e201-4cea-aefd-d03e903aed70", "value": "88ef7e06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878826a2-ac8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620100083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100083, "uuid": "d439dd60-3e8c-41d3-bf56-d741b839cf1b", "comment": "Malware payload", "value": "f09019b39bd866616607a6afb5af3457", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100083, "uuid": "8b4923e0-9360-4a64-9e74-f34d8c91b9bd", "comment": "Malware payload", "value": "90231e4bfaf820b54ab82771e4988fa8177f3457dc270eba81a95d2140db2868", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100083, "uuid": "88fb6be3-bd3d-4666-976c-d96d5f19717e", "comment": "Malware payload", "value": "7a1ad172689ac2ee07cd5acc2d76702ed4b6de43", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100083, "uuid": "19e5d240-9f8b-4635-941c-ff528dcd547c", "comment": "Malware payload", "value": "5dd0b3137697117c0fd7fe4869fb1c1c37626104c9e1118940e583b004caf9ac01e9c6d5e215c651d0e19dc09825914c", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100083, "uuid": "06e25b50-6c03-4f25-94d7-73284bbc3a6c", "value": "B6D10A5C9E910A5ECFC86B6026A8F69C018C7B765BC868F6783C5BE35F86B7B0713401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100083, "uuid": "ac69a4bb-3543-4736-a684-a453f6ffa5f6", "value": "192:IlPxiRiNTEtdY9AD/3P8jETuVZuyFpOcLuS:6IeQ49ifP8jEIZuyFpGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100083, "uuid": "bc830c7c-4d35-4e23-b369-8f30c1f57706", "value": 6525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100083, "uuid": "e22f5c24-f56c-4f53-b4b8-63035f98b256", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100083, "uuid": "3245ba74-5f7a-4892-84a4-4d0dfa86d48f", "value": "zi.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f7bfc4-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620104423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104423, "uuid": "baf90975-8533-4f8c-8ca5-eee6fd7e9740", "comment": "Malware payload (NanoCore)", "value": "0f14a940f2fb7ae9a30b2f0079b13630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104423, "uuid": "3f291b79-1596-445e-a286-dea04786542c", "comment": "Malware payload (NanoCore)", "value": "910f9987b35db8d13a06bb8feae8274601bb8afcdca3afcfed64ca8a66f498a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104423, "uuid": "8556aa6a-59e7-4431-abcc-7f42e39f708f", "comment": "Malware payload (NanoCore)", "value": "183f706b9e8ebfa0f2c412477bed2fb4e798f35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104423, "uuid": "4bc4d2c8-22c3-48dd-9f40-9eecab9d751c", "comment": "Malware payload (NanoCore)", "value": "d3835120cab20d570688d0c6827d27c3e0ea20afe8c4990d95f8349fc7965625612c112f5083a53d68696dcfabaafc99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104423, "uuid": "28715b28-532f-4b84-b567-9d35d8d4f73d", "value": "AFB53A113BA45E48FA3E57744674046847F6FD05DBB2E71EAD88B0991FB7BC08B1A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104423, "uuid": "33147382-898a-4005-815e-aad989a7d144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104423, "uuid": "59e968a7-11c7-4a8e-9737-8a7b3c70880a", "value": "24576:JrsZpIDp4rlncZ1Fcpt4mHfgdRdUhPg+5HJOS:Jrs+dUpt4m/gdR6gq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104423, "uuid": "27ad6720-6874-4cdf-8859-09bcd47e3157", "value": 2373120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104423, "uuid": "e95e406c-7b57-440e-865a-c9a967c5fcc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104423, "uuid": "be97b111-f299-4169-966e-d3c43f98a664", "value": "invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff15f57-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086434, "uuid": "bb0cbd04-5f5e-4177-8f4f-be38fd625f91", "comment": "Malware payload (Dridex)", "value": "85b3a64f5b249c56e9af739dd2a1f7b1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086434, "uuid": "1ec9a418-3540-463b-9ef5-602799f5b8e6", "comment": "Malware payload (Dridex)", "value": "9167779524b0ed97f6ed885b9e8614e0ba3e1c8c9f14c51089c2b93a443c2da2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086434, "uuid": "a32257b7-37c0-458b-b8af-d4dd50aa6809", "comment": "Malware payload (Dridex)", "value": "dff5cbc88585c9977e0d557a88f90db87abcf953", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086434, "uuid": "d1017e06-22e1-48bd-9ca8-9feacee2fc09", "comment": "Malware payload (Dridex)", "value": "a9c3d3e266169ef63ded594f4cac600e873e5785a9794c41e4af32869d88bb6bc17ebdb62b5a2b39408a43d93656e3c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086434, "uuid": "25dbbdfc-234e-42c8-bf35-265c42bbd64d", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086434, "uuid": "5918f2f8-d481-44bc-9525-ec10da1980e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086434, "uuid": "634d5884-18e4-421d-8ebc-67e70478fab3", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086434, "uuid": "e82c2c4a-7444-435a-a991-c042173758f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086434, "uuid": "3547258e-3914-4e95-9d6e-73a4fae68fb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086434, "uuid": "6a51e01a-5e92-4c54-ac88-be7312467ca3", "value": "85b3a64f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b67e9e-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620104374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104374, "uuid": "e6ad9dd5-0729-4184-9213-c9f0ea67817a", "comment": "Malware payload (GuLoader)", "value": "a66f5aae13e49d78ae5e59be4b52dff9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104374, "uuid": "4ebdd04b-7e59-4748-a5c9-44bd1f9e9745", "comment": "Malware payload (GuLoader)", "value": "918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104374, "uuid": "f6337d02-3776-4a8b-a36f-aff44571d244", "comment": "Malware payload (GuLoader)", "value": "d219beef547fa0f55cd978cadd36d86e9290c07b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104374, "uuid": "4079a359-bbb5-4b85-a8bc-a50766ae90be", "comment": "Malware payload (GuLoader)", "value": "284599d3bddf55fb5b4a89dfb19359e29550d2bfff35b6504a26b0433d1ebc189938372c6c8490ee62e08d82df982863", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104374, "uuid": "1aeeaea9-20ab-4cff-969b-b007922b445c", "value": "CC34F7326E04949EE9AD2670A415C936F3162C1471092E5F7EA1FFB137F2A836DF5E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104374, "uuid": "8e847b79-aafb-43ea-bd25-9ff12a6de01b", "value": "1536:TV2p+voOGIhkbIVb2ayvnF7lJswgtzz2i63kmA7Gw4mDAI16luJ17hH0SPtnw2i6:TbvozICHDvBJkzz25aPzAcHj9w2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104374, "uuid": "1b39d219-b4a1-4633-9d16-981444bbb359", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104374, "uuid": "078d0736-c3a5-4315-92ec-8660c503278c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104374, "uuid": "33d35620-a1a2-470b-a0e4-8bc655e12f2f", "value": "Specification#300_05-02-2021.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0782f023-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097292, "uuid": "05b6bc5f-7547-4c56-881f-ffd5cf2fc00e", "comment": "Malware payload (Dridex)", "value": "f1a664e323955d7dac48d29160e4ee21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097292, "uuid": "49b305d6-d66d-4bdd-8ba6-097d18d05e54", "comment": "Malware payload (Dridex)", "value": "919810cfd2372b917a308a602342b8f2a3e0dbc55fe692fec439c1d989b1e4f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097292, "uuid": "eb6a57a4-708c-4094-8974-c6a6442941c1", "comment": "Malware payload (Dridex)", "value": "43a1f376fb4d4e2758d475025b85dade9942956b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097292, "uuid": "b6b4ae51-f1c1-40e6-9b0c-bd7bf39ac836", "comment": "Malware payload (Dridex)", "value": "548e810f6ef53cd20842f8e0ceaa7ec6e74b38ffc2a48b4c026e4c0c65f7dc60b5c2e758d6f2a51062871fe0e8975ca1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097292, "uuid": "21dc2171-46ce-404e-b661-a34509692c2c", "value": "42F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097292, "uuid": "6d006667-16c1-45b2-91e3-48f2c51f4268", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097292, "uuid": "024e0ecf-97d6-4b12-a7b7-f361e40508d6", "value": "3072:Flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097292, "uuid": "9c14ca1b-36be-40c3-bebf-3360358e729e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097292, "uuid": "0b591118-c09f-4d97-a79a-6da0b0ffa8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097292, "uuid": "1b64d5ad-ef45-4a94-b047-45287e405079", "value": "f1a664e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac24885-acb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620117322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117322, "uuid": "21ee1286-05a3-4a1e-9334-5823ed800364", "comment": "Malware payload (Formbook)", "value": "ff44bfe6955f4d11f915b4a0b818fc7c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117322, "uuid": "c753b1d5-90cf-48f8-9c31-d3156e9ef65e", "comment": "Malware payload (Formbook)", "value": "929fd55e632471f4f35295e574c6814a3de9662398b7a606e352ecba9c52de7e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117322, "uuid": "2c2a85dc-e1d5-4b66-9ba0-e14189099a64", "comment": "Malware payload (Formbook)", "value": "3e094caff011346ad02aeafcb5769a519cf10dc0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117322, "uuid": "383aa78a-0679-4824-a22d-735b30b0ec12", "comment": "Malware payload (Formbook)", "value": "1c30c76c7b674786e6d7f4162fe384788ad5d873558ef11c8bdeb8169eb7e724dbb239c49d5d1b413df65f3fe20c6575", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117322, "uuid": "fccbbb74-047c-4773-b94c-0d1165d19283", "value": "EDF423542BF48760FA3D57BA163610610372B82AE627E71E1D58307B1D77B02CB267EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117322, "uuid": "58fdde5f-d2e0-4729-a7fa-3e3c46a37663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117322, "uuid": "131f12af-c27b-4def-a7c3-1bfbf76704a9", "value": "12288:HTbGgj7huimS1wg0s/1wrLG1TvYmZVaIEjAYlwidyEggqEWMseF4YhY/bWGJdM5M:Hb9P06wrS1ketEjAY2C8xC4V/b/JdcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620117322, "uuid": "f92ad61e-23b8-4f95-941e-e6bf0360995b", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620117322, "uuid": "8d633b05-c658-49e1-a2df-577c1054a64c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117322, "uuid": "e59318f8-7647-43ac-bb59-471f03ad7ce9", "value": "w73FtMA4ZTl9NFm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42d80c7-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153067, "uuid": "0877418c-e2b6-4e7f-808a-7ad4f4b305d8", "comment": "Malware payload", "value": "48eee9c2121eb3a585dac58a703afea1", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153067, "uuid": "46c97943-d58b-4c25-98ea-b17d901eeadf", "comment": "Malware payload", "value": "92f92497f598eb6195fd44490c9db0dd8b2661b1fe3d7d82719de5f444672241", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153067, "uuid": "7d9cd424-5501-4863-9207-098f18df34a5", "comment": "Malware payload", "value": "288c0fc898c29794e0e847fda1854cb21f68c126", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153067, "uuid": "5bee8513-59f1-43cd-ac2d-dd61044bf5b5", "comment": "Malware payload", "value": "07265dde55a77c211f7abfca5d216e5ffb09b82e0e3200c7a38e81f46db9ff3bf853d1f1c4466294f5f7ae1b671c3f36", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153067, "uuid": "fc49e07b-6b28-4b7f-9e91-7743e52fb0cf", "value": "6453190AD103D0F6DC2B01715357EBBF4B20A236E820DE45DFA0DD59AA77CA17A1E396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153067, "uuid": "df14d4e3-7b4b-4fbb-a75e-6f0b4c42fddc", "value": "1536:8TSoAas/Qjrd7bvx37/At1txU9RMNBs4hKfFMKww:8TTAhQjrd7bvx3jAJxU9RGBJMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153067, "uuid": "2edd39ce-954d-498d-a32a-f136a50204cb", "value": 65404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153067, "uuid": "25b09018-f60d-441e-8e5e-f6edf43a2cc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153067, "uuid": "18807f4a-6dff-4521-badd-a8455192b54d", "value": "92f92497f598eb6195fd44490c9db0dd8b2661b1fe3d7d82719de5f444672241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7d114c-acc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126506, "uuid": "5963da35-42ac-4fda-8447-126f30de294f", "comment": "Malware payload (AgentTesla)", "value": "ea14b0aeb619c3581fdf35d4267c11d7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126506, "uuid": "94647244-c191-4c6f-9df8-1bb9e4ef360a", "comment": "Malware payload (AgentTesla)", "value": "9341d90e5a577c62eb21075ce6fe98b1c424d385bb806e8363cca57263d79798", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126506, "uuid": "9c1c7f18-900e-4d97-8e80-3c24ee3f0c10", "comment": "Malware payload (AgentTesla)", "value": "63bb2cb4011b9ae3323595f7150617a54e6d9007", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126506, "uuid": "8190ba3f-3480-4b24-9a59-5859ae816526", "comment": "Malware payload (AgentTesla)", "value": "c60f6219a02ff7d742a78240603cc63654f79d1c8d9723783d6c7cf737482f28483681325d6ce4651d30a38cb05f8554", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126506, "uuid": "6937a90b-28ff-4fbb-afe9-d81653f50e76", "value": "54C423190F1831F165D0CDFBE7304D057D9EFE4E25F9A69B20175A60C242382ABA7E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126506, "uuid": "1dc22a6d-3f22-479d-baed-1c69a9f05c94", "value": "12288:A7C9EG8Lz4TdlgW7NDR0ck9T3pQydj9H9nMnelu7uE:A5G8Lz4hlgkDeckWaj9mneMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126506, "uuid": "b3c0ffc3-c11d-4e3f-9cf1-4e68880101df", "value": 566461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126506, "uuid": "3169103b-6b67-4d9b-96a5-383bbfdc2c3e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126506, "uuid": "a8d64a18-6ea6-4146-85af-d796305ec56f", "value": "INDIA ORDERD CH2323ED.Gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e549ae84-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153069, "uuid": "2969adcd-4993-481c-9429-a16dcfdae988", "comment": "Malware payload", "value": "07c60ef29d0d7f815f6a3fddf74ef916", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153069, "uuid": "38b88736-c0d2-41ee-8c19-ae83245cd6b8", "comment": "Malware payload", "value": "93c77fe47a2fd87d5e732eea1e6c884a6c4ea9dd0070ca85339a490d2fc9254a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153069, "uuid": "fcafcadf-e0b9-4b44-ac35-492958fab889", "comment": "Malware payload", "value": "46467dbc8acbcc1c56d788cad19e84a1330680c4", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153069, "uuid": "1b67dbe4-dcd6-4db5-ad2c-0174bb655fd7", "comment": "Malware payload", "value": "c342adab3dfa78f6eeb6afdb13f6463da9bfd765c4f2edcb74e886543aaed95db8a644bd23a3881ac3a308563c8291ff", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153069, "uuid": "8b95729d-953b-430d-beeb-b9440ac06f4c", "value": "D9A1E650112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DA8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153069, "uuid": "ab8f49f5-cffc-43e0-8836-c252e3b1fc45", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153069, "uuid": "8bba7438-89fa-4400-a3e1-98dc1560b9bf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153069, "uuid": "8b6e066d-5820-420c-b56c-22e92820e23a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153069, "uuid": "59e364c0-35fa-4c93-acac-4027ed9a2672", "value": "93c77fe47a2fd87d5e732eea1e6c884a6c4ea9dd0070ca85339a490d2fc9254a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b5f5e3-ad23-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620165235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165235, "uuid": "527bfbf3-5a4b-47b2-885b-617197dc0938", "comment": "Malware payload", "value": "43de3367faeffa04f28ad1e3e1f154eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165235, "uuid": "1f1a8457-f959-4ece-82f2-8ad551610a75", "comment": "Malware payload", "value": "93d3f7173b0983274a93717c4c605ff9e85d6cce59a17bd965ca881e436c1954", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165235, "uuid": "ace4eac4-675f-45e8-bc80-e51c01dcfaa0", "comment": "Malware payload", "value": "f75d1719bb9a2f6a628a521a827bfbf26e44b9a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620165235, "uuid": "f14680bd-b28c-428b-8a1d-ea31693d1f24", "comment": "Malware payload", "value": "5d42d5b064aa37bb4655b208b56656a7d2cf535c07f04aeceed0311e0c061582db4e4f65d1fea2e65dfd0e5dc18e7af8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165235, "uuid": "4f085ffd-ef14-450c-8556-e76fea212d3d", "value": "0FC4CF1590D29250F1634AF62C9CE4D866637FB2947C2A03F324A7ADE219184DEDF73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165235, "uuid": "7aab2afb-b0c2-4351-817b-dac4458ddd3b", "value": "e0b95b70cc2345cebd99fb194d72b462", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165235, "uuid": "3927e7d7-9430-40dc-9a77-920e4de1904b", "value": "12288:z/d/UuV4YKkN1+c2FoTZ9CM4uWpgr5aZ/A:zV/U616DqTKM4uvQZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620165235, "uuid": "d73cdac6-a2b9-4060-8942-e987ff81e78f", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620165235, "uuid": "04ca900b-f0f6-4f70-b775-44d3d1f1d300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620165235, "uuid": "77292199-2699-4156-8866-5af11fb9d578", "value": "SecuriteInfo.com.ArtemisTrojan.25081.13158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800f066-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090072, "uuid": "f337efc7-705a-40f7-86f1-e4fb5d3d06d4", "comment": "Malware payload (Dridex)", "value": "3d96b5ee340944bb53fc4fa82a4e182d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090072, "uuid": "d81f66c0-fa48-4945-9e67-c7feca3d1b34", "comment": "Malware payload (Dridex)", "value": "93ff051d039c2ae44d372e0eab667b4346ce63bdce78c0bdb9b2f27f62fe522e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090072, "uuid": "b4a241d4-aac6-49f0-bf68-7080307e7b98", "comment": "Malware payload (Dridex)", "value": "1245ebafa3713c25730500bec1860b3ba053e3ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090072, "uuid": "9f90a4ec-db7d-4e67-bb49-115c33ba82c3", "comment": "Malware payload (Dridex)", "value": "f3a27e354e9b0f0ce142e20624548fdae492efab5dfbedc21abab8042a1ce0e8a28245a45c695a5066051b0eea326267", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090072, "uuid": "47049fed-6ccb-41a7-b290-4e87880f0b1c", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090072, "uuid": "21895c6c-c84a-4cb0-a45e-a3dbfa6011c6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090072, "uuid": "9889e06b-5f34-43a7-82c2-cc790757e64b", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090072, "uuid": "ae79e457-e50d-4238-a117-b7af675963b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090072, "uuid": "28d86400-e436-4468-93a7-7a757621df87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090072, "uuid": "d74a15e4-b380-4bc6-8641-373c094482cc", "value": "3d96b5ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1434091-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122541, "uuid": "1647ea29-5d6e-4bbf-a0c4-13d12f6ad33f", "comment": "Malware payload (Dridex)", "value": "2291bda397a28bbf1ab94c3192fdf6e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122541, "uuid": "b186d166-597c-4f7e-a249-49c3be454c13", "comment": "Malware payload (Dridex)", "value": "944919954a09d5d3aa2e6ec60173adfdd1c5ca3a6b662e27a7d03b67d41c922e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122541, "uuid": "1e7af404-45a8-49ed-9900-fef269ebfbe3", "comment": "Malware payload (Dridex)", "value": "84a451ded6416b36127df90f2ccf3c955db17c68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122541, "uuid": "c27299cc-4f03-4f36-9adb-274f0cd9741f", "comment": "Malware payload (Dridex)", "value": "61c55819ab30ac8b84f7efdd7f998a9fdfccd646ab109bcdab67315fbdf372ade65865a90d13c1b2fe4bcae1d8567325", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122541, "uuid": "e1652d76-4318-4840-9caa-1f8037dc2ea3", "value": "D5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122541, "uuid": "9eb9f7fb-a5ec-47b4-af97-68c315f00065", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122541, "uuid": "98f78456-0265-404a-aaaa-ba9360cc1205", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122541, "uuid": "3ffccc9f-2dc6-41b0-a88e-25643aa20014", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122541, "uuid": "d8dde4f0-bf49-4ed1-83cd-041f347c5c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122541, "uuid": "b5c7efd3-03cb-46a9-9b4a-5a7930a0f3ce", "value": "2291bda3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f155cb-acac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620114044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114044, "uuid": "0043e415-cfd7-4efc-bb3a-26fed64b7ded", "comment": "Malware payload (Loki)", "value": "df32605de60aeb2f415927686fd455e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114044, "uuid": "4febbe38-11b3-40bb-9391-0c11f5727297", "comment": "Malware payload (Loki)", "value": "945aee9e799851eb1a2215fe1a60e55e41eb6d69ef4cb1b0fc0ab7e53489c67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114044, "uuid": "b57e70fc-fd3a-40a7-84b9-7dbce2a7d96a", "comment": "Malware payload (Loki)", "value": "c8adaf3337e20aff23b33e319a9794e22095e73b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114044, "uuid": "32e09ba9-e3df-48b5-be56-273b04f61f58", "comment": "Malware payload (Loki)", "value": "127ca2f0899ae7a13b766f70a985206fcb3c78d7313e541a7faa0d7eb2288a21a9479bf8357e3cb56dc884c9ceba0996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114044, "uuid": "6df390bb-43e7-4980-b753-3bcfd627a5fb", "value": "4D04F10532E094B7E49506B15C76C6BAF7B7E52041354A2B3BF06F3F2E32712CE1929A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114044, "uuid": "f022e54a-9f58-4eda-b48e-b99100667283", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114044, "uuid": "9ceaf411-9d18-4253-8c8c-7ae1dce910e0", "value": "3072:J1E/rS2paccKntce45gdi4RrCsXC4qZOGaKa1RqATUsf+SCRxw1oJsGKLs5uwj:J1onnFdi4R2U6HaKUqATUs/Qw1HGKLMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620114044, "uuid": "9d04a7ee-10d1-481a-bc50-5109866d3e0f", "value": 182872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620114044, "uuid": "7b8d1c17-62d3-4fab-8842-e4b797b6bca4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114044, "uuid": "70d2f5a7-5296-4c54-af11-8fdc95f5a513", "value": "945AEE9E799851EB1A2215FE1A60E55E41EB6D69EF4CB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44aafaa-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153470, "uuid": "94bf0880-87bc-4946-bf9d-fd9450757de4", "comment": "Malware payload", "value": "66d43043fba21658f700f2fa7a333fcb", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153470, "uuid": "1f0006f9-cb3c-40c1-bd7e-aed9f2629e44", "comment": "Malware payload", "value": "95116a39f0f3bc265a507583e1fa265e19f0f0f6650d18c71e375e2b88384632", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153470, "uuid": "6cd82366-2cf1-45f4-ab30-d0706784e5bf", "comment": "Malware payload", "value": "0dcc06ac024aeea131f4b2e0931a5142e026a86c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153470, "uuid": "897a18d3-03ff-435d-bb97-0c94be755b3f", "comment": "Malware payload", "value": "e620ed5f47c8d6734164b47c5d5f29a341e3baa73149cf844fc9a14e4ef51288915c6c8c321a298abf4935ef932e6b34", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153470, "uuid": "e7649602-da10-4ab8-b5a6-2c47d9362341", "value": "85A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153470, "uuid": "4144a96d-475e-4b09-94d7-12b6f22e3497", "value": "96:rtRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rtRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153470, "uuid": "03621780-27a4-4ff5-9beb-6f52d8693532", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153470, "uuid": "3e6a038e-7535-4c96-a6d8-7b234bd8fc5d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153470, "uuid": "7c202641-fd11-4870-841d-36334fe0638c", "value": "95116a39f0f3bc265a507583e1fa265e19f0f0f6650d18c71e375e2b88384632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef680458-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153086, "uuid": "2a8e2dee-e0b6-48e0-b610-f914a965bfb6", "comment": "Malware payload", "value": "2fe72650c5bc6a58c87c997e42a7c34b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153086, "uuid": "1421f8c2-bea7-40bc-a008-0939d147d0ea", "comment": "Malware payload", "value": "9555a99f3b8e192b59b2548b88a347fb0bad0b5d032014454b8021dbe8e094b7", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153086, "uuid": "e2ed2457-7111-4bc6-accf-efaf442b4033", "comment": "Malware payload", "value": "cdd3c14317b4b79ce077a8a0fbfb3d9a40b573bc", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153086, "uuid": "5f4723be-d0ad-428f-bc32-c1c189a1b35e", "comment": "Malware payload", "value": "f420464794cef9aedb250e0f320305f8048d40135e0e657c79c1991176a539bfaa0525efc109d940641c655b76b045df", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153086, "uuid": "78ccbc20-25e4-4017-a28e-7f6c55c276e5", "value": "9B56332CE0ED7DEE46489C7493DEDB1071AB0ACEF0A5D711E42BD94B0C1A32269FD568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153086, "uuid": "cab61fff-0766-4add-9be9-eb024e1a7213", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFLBLRV2BpA87:td69Qg/JFeQ5x7bhE8SSdP8v+nV2BpA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153086, "uuid": "bf19d8c3-8667-4649-b7b6-9324bbd6fad7", "value": 6180864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153086, "uuid": "e43ce770-0228-4a24-be18-1c8a3666dee4", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153086, "uuid": "53490833-d025-45fe-a64a-bed760b2659e", "value": "9555a99f3b8e192b59b2548b88a347fb0bad0b5d032014454b8021dbe8e094b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1f5eba-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "4013c317-cb45-4006-b040-5352ed14d5f1", "comment": "Malware payload (Dridex)", "value": "9126291b12cacf08defbc6fbf8e9ecf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "2dc2fd2e-78d2-4827-b110-c1e36e118348", "comment": "Malware payload (Dridex)", "value": "95a8501845961feade8c82a9aaefa92c552bfaa54784c0986582a6fc086413cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "94c3fe3a-f61e-4df6-b329-7714ddc3bfde", "comment": "Malware payload (Dridex)", "value": "3d5fa5f93176ff000467532c8554f633fa8e9155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "9a74353c-ff9c-485a-8c09-ded99280389b", "comment": "Malware payload (Dridex)", "value": "51a13d328f4cc098c8b6d503227de2a05697e3e24a755b013166c323a66d7c97edb4aab598ec7002ab42cc1ceb9c03da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "7b63a9ed-c0fb-436a-a0b1-f95030475c7b", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "00f197b5-d69a-4051-87c7-96ee8c41eb44", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "7bcb3429-1462-4d2c-b57a-d7f18266c05a", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111738, "uuid": "381e4ca3-2620-4be2-a782-9c0660f8ae6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111738, "uuid": "6d2b0761-6739-43d0-9461-2068899307a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "1b23c5ba-b8c6-4239-a6b4-9c3cfa0ab441", "value": "9126291b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ec2eb1-ac70-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620088275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088275, "uuid": "ff124f23-1175-4cd2-874d-083b081861a4", "comment": "Malware payload (RedLineStealer)", "value": "83266f04c5408ef7bc34322915eff1ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088275, "uuid": "8ffcb2a2-fcce-44f3-a3a9-aeb4b8928a6d", "comment": "Malware payload (RedLineStealer)", "value": "9658197c370e5eb1ab5d88687883b342f5b2accda492657e9cb3ca9412ac06ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088275, "uuid": "190f9234-92d6-46da-ac37-55711fab467f", "comment": "Malware payload (RedLineStealer)", "value": "f3873df5bf26f7ec46cf95e673b1eec847ee1727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088275, "uuid": "b64366d5-4ecf-4cff-920a-284ccca6fd9a", "comment": "Malware payload (RedLineStealer)", "value": "491c06aac09a419f84ee49bb0f0288a179a9dab6e1e9bec4bdea877b56587bcbfbb31ba65f678d53d3e611b7c28c168c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088275, "uuid": "89cbdcf7-1534-4cd5-bf04-5bb7554725f2", "value": "B6922921B7E5C736E6CE4BB895F980A54271E0A50C02CF8BCCC842616B27BD55B727E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088275, "uuid": "9f502dd8-3f34-4558-9ddd-2b1e255694a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088275, "uuid": "3775959e-fad1-4c03-b3f2-845a87ed3340", "value": "384:MsEiHYWRF7SK6ekyvFvPuhfUrla2ohBKoWAnr:CiHYe7zsiWfUrWhMTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620088275, "uuid": "d6b75df4-ceac-4311-b725-5dc5ed25fb90", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620088275, "uuid": "f7586a90-ba62-4f07-b680-384a6716b9df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088275, "uuid": "df4bd419-cd09-43b2-8c31-de86727a8101", "value": "83266F04C5408EF7BC34322915EFF1AE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5db2bdf-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620122549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122549, "uuid": "91213f99-7aff-4ed9-9565-fd27e94541ad", "comment": "Malware payload (TrickBot)", "value": "a8331229532b5c12dae297134cbaac58", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122549, "uuid": "b071494e-2b6d-41dc-8f3e-fca3d277c313", "comment": "Malware payload (TrickBot)", "value": "9754089f79d9c9293dcc9c604c6328284a7942539a46c13112558a39c92a5e41", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122549, "uuid": "0789d5c6-81d0-4fec-9b09-bd848163ee35", "comment": "Malware payload (TrickBot)", "value": "241b1d866d26dc749cfd3a06e15f86556ab9fa11", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122549, "uuid": "dfc0f19d-a375-494d-b5d0-1146a797b2b9", "comment": "Malware payload (TrickBot)", "value": "36beb24488fdf328e5c3c821b3a064352063ad42733ac0a1a2db1833ff0076c798ccd057b92341d287a363cf6550db2c", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122549, "uuid": "88fc7c6c-9c8b-47b9-8b0f-b4df3c6d1885", "value": "19B4E11A37D1CC77C1A355B90EE2DBAA72BAFD604F728A8323943B0D5E326D14536316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122549, "uuid": "7c12da1f-c13e-4b43-a2f9-531bf117a129", "value": "ea97e91275f65096e0769ec8f21f572b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122549, "uuid": "d053065f-0368-4c2c-a070-0efb5f7963b0", "value": "12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttYwE79U2QIRB7suqo:ZXQUIsQpMsequrmGnWI4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122549, "uuid": "3ceb6fcd-bb99-43a3-b847-fcccef49e65f", "value": 541073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122549, "uuid": "99c8e678-e55e-47b3-9eca-f26b8b5e626b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122549, "uuid": "90ad6b9a-18fd-45da-aa20-cc852b2945be", "value": "a8331229_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9752cefd-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095385, "uuid": "26e95624-f318-4a84-8d1c-81b3de5fd9d3", "comment": "Malware payload", "value": "b49479eeaad1aab163361da78c95915f", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095385, "uuid": "a7895213-9817-43d1-81c7-be89cf5a0aa5", "comment": "Malware payload", "value": "97adb29b80a535523c20571b48ae7b7b8f5ec2bc8ddf6fe22dcf08b7197badf3", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095385, "uuid": "d10ea4cc-a4ea-4a85-aaf8-b601a4f2ce81", "comment": "Malware payload", "value": "88cd2cc08ff2ccc9e87cb3d60ff56913811aac3f", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095385, "uuid": "c0750477-53d7-44f3-93a0-9b219ad5175b", "comment": "Malware payload", "value": "64a7125098c4cf66c51b15886530e86413d563287c40409144115dbabc74c2a7c5bd1eb1730debe403ccbed6f1dac14f", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095385, "uuid": "6dca8258-0604-4134-b6a6-bcc87c773342", "value": "6E050107B549DCABCBCA827E4D98EF1C4328E21D1860C29575756EB7F4EEF432C18269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095385, "uuid": "9931834a-6a34-434e-a8a5-fe968a077184", "value": "24576:BgH7Zexydk2xqG3J1Ud0nIvDiqK6gybO0En/:BzKkct3J1gvO6g+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095385, "uuid": "329a3f77-35cd-4ab9-8bb8-c6c3ec50f6ee", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095385, "uuid": "8327561c-dd44-49fc-bd23-05ed629c9a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095385, "uuid": "501176ae-df0d-46fb-852e-263ce4fc8dda", "value": "97adb29b80a535523c20571b48ae7b7b8f5ec2bc8ddf6fe22dcf08b7197badf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00c14a4-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097252, "uuid": "3ad018c3-223b-4055-9a59-6af03560fa81", "comment": "Malware payload (Dridex)", "value": "406c0b9150567af2ab35f1db6fb9bffd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097252, "uuid": "2bd91a67-183b-4ae7-95df-93598c7343c3", "comment": "Malware payload (Dridex)", "value": "97b3a7635e09c4b1bbe5a760f6f5f709d8342becbb6dbfe3db218407aa990096", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097252, "uuid": "b52bfaef-9ded-47be-a9b3-7a22a953048d", "comment": "Malware payload (Dridex)", "value": "f41a76a4e5fef756dd27af0145215fc3500dcbe1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097252, "uuid": "188906b6-184d-439b-83df-5a8e2bd82644", "comment": "Malware payload (Dridex)", "value": "cd3e43a0f455bac70cd1866eb7adf5c7912c5551c3550c94c0f827392503544536eaef44d43e29c97130bd7d38fbd0bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097252, "uuid": "7d64c2b6-7dfe-40e1-969d-9ea25184641a", "value": "5CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097252, "uuid": "d3f1ff77-e155-42c4-a702-df75d860dfe3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097252, "uuid": "e684aeb0-eab6-49a9-8db4-cddbda7cad7e", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097252, "uuid": "74b070b6-c31c-40b6-8a3e-567bcff51452", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097252, "uuid": "981db90e-d424-45d6-b1c5-4b0659693428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097252, "uuid": "751a1d01-783d-43b5-b9c5-06016a8a6a06", "value": "406c0b91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912aea27-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111696, "uuid": "87187446-dc34-4bb1-b2a6-20af173dcd7a", "comment": "Malware payload (Dridex)", "value": "44501aeb939ea2b8027ceb53c20542d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111696, "uuid": "fcccb102-bc9d-43ed-a840-ad08668622e1", "comment": "Malware payload (Dridex)", "value": "97e0e61b47b43a3e3fcade149da339d7e26ad56f5fb0725a5bc0b191515e2eda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111696, "uuid": "bfaaf714-69b3-4c4b-8890-e2f29415e7fc", "comment": "Malware payload (Dridex)", "value": "3069d9b4fb446bb11dfbded3c7a122f805780477", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111696, "uuid": "c184e34b-885f-4ff5-b00e-88e0f95aa6ec", "comment": "Malware payload (Dridex)", "value": "b7042ef3a5d9cf065ca24ca5debcc7653abb19cbdad24e6859d7fc0ebe858740ee73b8ba33f4c20245ac54afbd054e84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111696, "uuid": "58061305-e911-47ee-81bc-aac22ba5d587", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111696, "uuid": "5767a126-120d-4969-82de-05a855689c14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111696, "uuid": "c038769f-c67b-4c3d-b474-f8fc2c487108", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111696, "uuid": "d1e568bd-e118-42f8-bb09-290af46b2bcc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111696, "uuid": "e3b6f348-6363-4f17-889d-a27656e0852e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111696, "uuid": "a3173618-9441-4833-ad91-57c2881b92b1", "value": "44501aeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791ccc33-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "b1308897-2602-48e4-beac-3a7238a51fc3", "comment": "Malware payload (AgentTesla)", "value": "f40f9b893ced71cb1ca32422ccd18d75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "157d6465-0132-46ee-ae29-8bb740f34c22", "comment": "Malware payload (AgentTesla)", "value": "97eba4e44b5a777231316e709cb9eda7bd9670034fdac573724347196acfcf57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "7a98729f-3041-44f1-bdb7-0f1235cc9831", "comment": "Malware payload (AgentTesla)", "value": "0d109db09fc59e2c15b17f401919be62ff061742", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "1fbe668b-5211-4362-a6c7-78783b9a8754", "comment": "Malware payload (AgentTesla)", "value": "029cbc7d27c6034d1d18b1b99fc04efcd5f1cc795fc745266b22d4f9d405974865f9dfefc0c6168961c1b35b2e917797", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "6e3d9be7-d2dd-4511-a9f7-ca64ad550dac", "value": "3515DF277F685A51E4BE5F3418390310A7F1F50AD621C30F6D68609DEEE2AC18E677E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "59bd3e53-974b-43c1-9c2f-934b03c5497b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "3588c84d-cbc8-4832-9e1b-233ddee16355", "value": "24576:yKqYxyKgykKnC2wtUQazELj4UlqERz1i/JF4O0h:qe9kD1KQtFRz4/b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152458, "uuid": "27f06eb8-b245-4fe3-bfb9-1bd5efb22495", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152458, "uuid": "3ce4a788-9416-400e-b95e-758925d0b73b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "5dec4ee4-b9c2-4dcb-87d7-709eb12435fe", "value": "20210504_20210405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5869429-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153472, "uuid": "43935356-abcd-4ca9-91a0-ae6df150d2a0", "comment": "Malware payload", "value": "33d9daacef7c1abac90192095ea420bb", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153472, "uuid": "c756c302-e531-4c87-9346-ed8d2b35ff32", "comment": "Malware payload", "value": "98611ac1a14d7f374ef021062357b9e1673b23cc74ea0d38be4f4d9964008e48", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153472, "uuid": "27c31444-b7be-4326-ad62-a738a1205a86", "comment": "Malware payload", "value": "f20128dcdbfae0041f3aac604a6a0e86640bcee1", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153472, "uuid": "e4e7c78a-df7c-48a7-9b49-a34579335ce3", "comment": "Malware payload", "value": "ddf1cdb9c3349c88eeacf31e96a0fb4ae49d0680b9a1e5ef2a2c1bcd562339f32f14c4f62e1c26f7e53f24e396ffab01", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153472, "uuid": "0e71eb86-e8e1-4ab6-b009-eca09a2cc583", "value": "A6110AE017F0D87E577BC52EB1E0C069BC659C96B591010DD42E2C62B15F8D0F0BEE91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153472, "uuid": "cf26cd79-2068-42b9-be77-df70197735f8", "value": "12:z5LKb3JKIXKm5LKmJK7XK75LaoxJaYyXad75LOxJyyXCk75LTmxJT6yXTb75Lpx4:lOR2LYDn66kdOTdV3daxclpd+u7Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153472, "uuid": "aec42a93-3216-4eca-860d-81feb1f86039", "value": 1045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153472, "uuid": "70de5957-5bda-453a-a493-f5240bc6e89b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153472, "uuid": "1910b105-94ee-4802-bfb5-decc25d8dc48", "value": "98611ac1a14d7f374ef021062357b9e1673b23cc74ea0d38be4f4d9964008e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee34a499-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115288, "uuid": "a1bf3eae-03c6-4277-9162-358716f1b879", "comment": "Malware payload (Dridex)", "value": "f872abd278f5247ec4caaecaede5312b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115288, "uuid": "ce472368-e9ab-45ae-b005-4ce36ae5eaec", "comment": "Malware payload (Dridex)", "value": "98b5974600bb9bf1b425075e2fcea238be013b0d6ce4ce188690824250c2bebe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115288, "uuid": "870c53dc-9c4f-45da-9213-1bd166bba597", "comment": "Malware payload (Dridex)", "value": "9b102c63b8d52151b1b1a7cf186dd7109c510574", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115288, "uuid": "bcc62aaf-2517-4df9-a080-53b0e41e018c", "comment": "Malware payload (Dridex)", "value": "51df6f33e62e8438444303395b4a406dbf41016262590b74d1c66e2fa7018dba674191c3580b9f8bdf237f183f989db5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115288, "uuid": "2163d695-31b5-484b-9010-b7f9fa1a5589", "value": "55F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115288, "uuid": "f0494215-1edb-469c-a04a-93822eb749bf", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115288, "uuid": "4011ed5f-990d-424c-9c4c-aa276fd9a505", "value": "3072:riFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:IeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115288, "uuid": "9f49c5e0-f5aa-4bbd-9339-b6310f40feae", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115288, "uuid": "4426d03a-6ee3-4940-b661-d0e93523e4ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115288, "uuid": "5452ed54-8f63-49cf-a2c2-bb27f8bdf7e3", "value": "f872abd2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af69bab-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097297, "uuid": "6719c9d9-150c-427b-bbc5-df276cc2cb3d", "comment": "Malware payload (Dridex)", "value": "8393a846ab844787c845a8a47aa51ab2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097297, "uuid": "e9e9abd7-23e3-45a8-a691-99cc02e38349", "comment": "Malware payload (Dridex)", "value": "991a41ee57787a643d523f8e9817dcd6846dd74c1c6c1b5bcd6011b7a6eff612", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097297, "uuid": "240f1a71-a1a0-4cd0-8823-c801d6f64b28", "comment": "Malware payload (Dridex)", "value": "19edb208c52b13eba03fbf4281643dbb555a8436", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097297, "uuid": "3c75984f-c432-4b9b-be31-4552a403f486", "comment": "Malware payload (Dridex)", "value": "57047812dad207895389c4059eb442dcee45f0e05c3150321b104f532e5bece35b05be6e5abc0d8a049ef5e509a0545c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097297, "uuid": "3ea8602b-7980-41bb-8e7d-472196355ea1", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097297, "uuid": "95f00616-186c-4850-8c48-f13a97e556b1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097297, "uuid": "30794a12-8728-425f-9684-faadf1d19ee4", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097297, "uuid": "be604115-d795-4d80-a980-1bc965ecac15", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097297, "uuid": "5b15bf4f-68b5-4ede-acd3-a5114081a692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097297, "uuid": "5651ee8c-71ab-4687-b1e9-af8ecfe870f4", "value": "8393a846_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15484ea-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153089, "uuid": "4bc186e0-c952-4cd1-a4a6-07720e586465", "comment": "Malware payload", "value": "7561f977bdd18caccac050932bc01cf0", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153089, "uuid": "c0a8cacf-82aa-4863-9fb5-6541cc1bf95b", "comment": "Malware payload", "value": "994bc7418ba2a445e922bf03b1469a5dd1c9b7024d45e302a476b566b4563bad", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153089, "uuid": "e6433290-5f98-400d-af24-ac82b91a1306", "comment": "Malware payload", "value": "e80a1aa32da4b63dc60f8d492b9d4cf7b5f7202f", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153089, "uuid": "b2f50339-541d-435a-90f0-704bbe9df4c0", "comment": "Malware payload", "value": "5c9083a7b5d30188d0a884e203045bad397f2bf709318cda95e65d85e745987509311d4859dd89fc6a76f6814a318b70", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153089, "uuid": "c6662673-4849-4c77-86c6-43cf6743c828", "value": "36A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153089, "uuid": "64764618-dcac-43bb-a39a-c727b261370d", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153089, "uuid": "212a79bc-92c0-4a17-b507-2745e9725998", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153089, "uuid": "f587e1ac-9a3a-47ec-a959-7c90de6983c7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153089, "uuid": "f1cc320d-b47c-441c-ac1b-54e4c57d1384", "value": "994bc7418ba2a445e922bf03b1469a5dd1c9b7024d45e302a476b566b4563bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed63089-ad0e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620156306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156306, "uuid": "d2a5d670-f310-4568-b280-fa7a733de689", "comment": "Malware payload", "value": "0a0781f33e7f060990ff7da1386b5e1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156306, "uuid": "435c6284-860d-4458-8c1f-4ef6e440be99", "comment": "Malware payload", "value": "9951410ccc923a8d3de04c7652b2115ec3964d97cce0acc2f51f7bce56d0636d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156306, "uuid": "7ed58a4f-a024-49ee-8ee6-bff16a8fbdcf", "comment": "Malware payload", "value": "a7b23b0b511924c9111a22ff96439afa42a3c4a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156306, "uuid": "9e8e66e8-05bd-4913-b824-144193f774ec", "comment": "Malware payload", "value": "b398df27f650219da4ab32b98568b0980744e6d34f8e29fafe59614ad734e36155c1f1ec0431911785b7623acc5483b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156306, "uuid": "768f6a79-8dd8-4614-983b-9a4775cafd44", "value": "29742373D3094CD09BE0CEF4AE19BA18E21C1394B5169535ADE37948DACFE934894BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156306, "uuid": "cf5f036b-c6d3-49bd-bb47-7d48f4312782", "value": "6144:DPRjemFsBIQtgRV9xRrz36aUJnv3tIX+0fdlZ3AOeGwXRWMTSJ:pZLQ6RrxRr2Hv3tIrfdEOxAWMWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620156306, "uuid": "f934b3bc-d432-4346-9eee-33a9fd51bb30", "value": 367316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620156306, "uuid": "39d0f10d-be3c-4824-a846-dc54183f34fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156306, "uuid": "ea74bf9b-9e10-4368-92ce-0a799a6325e6", "value": "05-4-2021_06-59-10-PM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b859f9-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095160, "uuid": "bda758e9-22fa-47bc-8150-7b935568c573", "comment": "Malware payload", "value": "c1296c09604bff16c571cde559b0886f", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095160, "uuid": "6723a62f-5c1d-44c7-96e5-5bd1b18199be", "comment": "Malware payload", "value": "99915ca1468f408bde66b30aa62305029b8b0cd28f2c01ca3e55d25c48815d29", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095160, "uuid": "1475a99e-b817-45bb-b5dc-0d2c0ec2f81f", "comment": "Malware payload", "value": "426259517a7b839022dafca4de971ccf709c8f72", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095160, "uuid": "43a8e509-8298-4b2a-91bc-c7bea6d485e1", "comment": "Malware payload", "value": "d6b004c7527c307104b3c9522e6e5458fbff781157f978947f67bb677dca0a5052377ce500ee09a92d77489da0b8fb58", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095160, "uuid": "69fa8710-f64a-48d8-bc73-1115b464debe", "value": "7F06D74549BFF2E8EF4D431C437804ED5F824E3628A7BEB517AF7EA2852731E0049A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095160, "uuid": "58bd205f-ab77-4ae7-b0ac-dc04785e52e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095160, "uuid": "b856033e-261c-4ca3-9562-eebfa56f3aa1", "value": "24576:nvWCMslKpd2Iu2I98lpSBthO8CUaWeGdhvLDL+y1IYD7Y0cq6cqM1:neCMvsIu78lGh6Ahvr+5Y3qM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095160, "uuid": "071323f3-32b3-4959-82f1-f2e1c51d1eea", "value": 3769872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095160, "uuid": "009783d0-3f00-4f48-b00f-9dfb2496637e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095160, "uuid": "3f6a2b8e-4104-4394-8901-3b73aeb7b34e", "value": "AstarothSpammer (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ae43f0-ac8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620100074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100074, "uuid": "66bfed65-43cb-4f46-99fd-71595d023e5e", "comment": "Malware payload", "value": "aeb88d2e23f01796cf9767341fc55a1e", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100074, "uuid": "b366d5a2-d567-4667-a126-55889125365c", "comment": "Malware payload", "value": "99dd9d868b8db2315b32a3b1c157a2b0af5b2a72fa9aa518d0e6c5a520328e97", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100074, "uuid": "1dbe5fc4-3e7d-4a14-a4e7-212a33fd3d23", "comment": "Malware payload", "value": "4cf78140dd95be4842f42571d8647e619c5797ca", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100074, "uuid": "6ae13fc2-825b-40a6-80d3-8197f64824f5", "comment": "Malware payload", "value": "4d4a08df2aaf7dcfe80aa9ca7a98dc1263c31ac830150986bfec9d6847c50848926804a953555bc015dfafc8329fc241", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100074, "uuid": "fd7fe7b2-8fd5-46af-ae2c-b693ae3f131b", "value": "0FD1FABC9F792A2ACF5833A87235D59C12CE3A6D678978F7397C23251F817625A01045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100074, "uuid": "b7cb34d9-4606-4e95-bc4f-4f70f5017370", "value": "192:IlPxEI3X7uZvGNuH7Hu7FI6XyPqtEUo9mj/9Widq:6p3X7CGNuHSXyKEUoIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100074, "uuid": "55104e21-af76-4471-9494-0e527d567093", "value": 6719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100074, "uuid": "b88f7598-9907-4856-b034-263afef2aa9b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100074, "uuid": "2d0dc376-a195-4d92-8545-867a9873c320", "value": "z.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e8c5f4-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126203, "uuid": "9a741d25-96ca-4ca1-8a34-10c05e2a0af9", "comment": "Malware payload (IcedID)", "value": "225d40c2bc2ebf3fec262005afc8a078", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126203, "uuid": "31846c62-e978-48be-af46-31e6b30e0bad", "comment": "Malware payload (IcedID)", "value": "9a36ed6c4308b8c5ce794de97d00e7c9bd38e6a1d347523174a94a2e0851208d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126203, "uuid": "5a1ee17f-1d38-4a4d-88ab-98e1481bee06", "comment": "Malware payload (IcedID)", "value": "35c590955d9d9c2725bc5bc5e27b27be84faa9ca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126203, "uuid": "8309dd42-8217-431f-90bb-90973cda5d55", "comment": "Malware payload (IcedID)", "value": "5bdeff454853fa2917a83fda62130ff98de13fb0ab3a09a9cf9472a4f2061ab54faa94e671bb5d6f3f4746af49e9c71d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126203, "uuid": "99567d16-172b-4a54-81e3-1a97df29105c", "value": "9D831267F832116CC15A0905F844F21CEB568DF0E5F7DD1A4E27A9C146412B22EB4ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126203, "uuid": "dd1dcbf8-8845-4574-9793-fca82d9ed29d", "value": "1536:yzqeShw/OaURzRhv2feIxI19pSQpOIzi2IR57yv06iJAyehNR2EBYH/+sKDTUxJs:y/Sq/5O7yQ+IzsJyv0DlENRDBGWLExJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126203, "uuid": "585914c6-255b-404a-bb83-facb798aedac", "value": 83764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126203, "uuid": "b12dbe2a-71e5-4e2b-aa43-770590c533f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126203, "uuid": "2a627104-6a8a-4de3-b8a2-19873ce60a7b", "value": "x_xx-20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28a748a-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153091, "uuid": "920ae35e-c27a-46f2-bd27-e48146133c02", "comment": "Malware payload", "value": "5e0eeebe6c4820131d3f7491e4e3a674", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153091, "uuid": "b4481ba8-b59c-4f89-900c-9185a9a1f102", "comment": "Malware payload", "value": "9ab290041ac26038d1f5ecfff18764bef968828fab787c489758245f588b72bb", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153091, "uuid": "fcd9b264-e0b2-461c-9829-99ebb5be5515", "comment": "Malware payload", "value": "40154daf7399a1c1313097032262cce252b6db66", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153091, "uuid": "8421a622-aa4d-4db8-91bf-44bea6f18c0c", "comment": "Malware payload", "value": "317110e860c297fb02c561dea3dec791a359a7e25ad52c794fd55f408fa1c6285a251f97c3ecf315afda1078aebfe985", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153091, "uuid": "61fd8e5d-21b4-48ff-afc3-745236131d47", "value": "76A1E850112C1AB17246597AD26FFA52B50EC81B097B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153091, "uuid": "8ecd904a-f5ac-4953-891e-b033c0e616cb", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153091, "uuid": "6829f0f1-75f8-4b9d-bd6c-6b2f357b5d4a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153091, "uuid": "e4fffb02-6cb3-465e-a70a-df0bab5301ab", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153091, "uuid": "04c65d1b-1865-4a36-ac30-1ad9dc3e6716", "value": "9ab290041ac26038d1f5ecfff18764bef968828fab787c489758245f588b72bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cbc4be-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620086504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086504, "uuid": "4e2850ef-e103-4c93-b754-eb44530ae108", "comment": "Malware payload", "value": "f4ce1e58b0a46681573b8df6cf52291c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086504, "uuid": "d4f956f9-7f48-4e81-bb11-7e729e619166", "comment": "Malware payload", "value": "9ac91884b3df6f412843d7a481269ac30877993d1da184a80b37b91e3ce549b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086504, "uuid": "3a5fa38b-e979-4adc-99ff-e352564a3fba", "comment": "Malware payload", "value": "d041783c5a91ca7bc38c1be5e92439410686588e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086504, "uuid": "4eb70fa5-dd71-436d-a4b5-74a2f4a71419", "comment": "Malware payload", "value": "0b26865d1aebdcfd31978190977586ac4340a92fbc9b58797dc638c1bd60811d621318aacf95d0d6b7233addaa41c062", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086504, "uuid": "e62398c8-4c32-427a-a31e-4f74dff716a5", "value": "26F53321E5B3E654169281C73B5AACBD1694BE3B1CE7097E8F912F64082DDF3D0E902D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086504, "uuid": "4a579ad1-f01e-4727-99c5-b3dd9ace7a27", "value": "98304:prL2YGvLo9dW9rVLNuVjt1XhxtqwPt4+wNKWzIJ7WO2:5KDL0dgrVLMXX5NwN9zUaO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086504, "uuid": "ae81128a-2d9f-4591-a04f-6113778de3d6", "value": 3340021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086504, "uuid": "f2127c5a-21a7-4e19-b1ae-3174c12cf708", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086504, "uuid": "1698c27c-34e3-4f83-9081-1dfd4dc8c419", "value": "f4ce1e58_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0283c0-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620111738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "7e6068c4-f970-463f-9177-c70440c544ff", "comment": "Malware payload", "value": "827f07e2994ce57588e7b3f0f6e0c84f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "eed74c0f-c32f-42eb-af9a-10bc5662506a", "comment": "Malware payload", "value": "9b9b67a2b9ec5a15044430a9f5d9ce6a7f524e1feed186a96309256df686cfdd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "dd1ec81c-ac3b-4698-bc00-998747449eb3", "comment": "Malware payload", "value": "eda91bd75a571c72fcd714ca1cb0e5f06d16cc1c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111738, "uuid": "0cc01700-0c62-4232-8313-eb0747e86520", "comment": "Malware payload", "value": "56fcbcee1b29edfc225b44785f54d27986c71ff44b87fff43f9e4fc77389eadfd4e088ca62d53eb432f639650e14586a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "7cbefb61-89d4-43da-bf9c-5a002495095b", "value": "3316018AF745A82FC9F782369276421A56174D198B83EB870AA5713C1DB7DC04F4BECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "ca4eb225-b764-4a2f-82af-f3d759a79f2a", "value": "98304:zudp6mH/YrzSNMDEQsyoCj8V6OzkRrQzPu1:Kdp6mKz1/DQu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111738, "uuid": "9876d7df-4e1d-44b9-b0d9-9dc5f3356ff8", "value": 4208309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111738, "uuid": "abc05005-a89e-4f93-8b36-8fe4640550e4", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111738, "uuid": "d098c850-d5e4-4548-9ad0-e3e84e68c1de", "value": "9b9b67a2b9ec5a15044430a9f5d9ce6a7f524e1feed186a96309256df686cfdd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa227ca0-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093699, "uuid": "f4c5566a-1e2b-4f24-b37d-da14c0eb015f", "comment": "Malware payload (Dridex)", "value": "583f5e1f0e7341c6ff81fb78e87f2030", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093699, "uuid": "ec560ffc-d90f-400a-9183-1349c1d0191b", "comment": "Malware payload (Dridex)", "value": "9b9e602f59d0be9a062a69eed7a8656c48e8979c4f8a7d075d6efc339c3c1d55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093699, "uuid": "2decd937-9cfa-4982-8f19-240bba082d93", "comment": "Malware payload (Dridex)", "value": "8511d79b67d79c742f8491c528c0be01e2e89421", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093699, "uuid": "77bf6af9-9961-486d-a760-afe4319d7983", "comment": "Malware payload (Dridex)", "value": "b0bf557e6dd287493d84cc3d308d0ce9e327b5e5ad3230ee1c31aef3fe53f0ed8bc9146398442822435adbf6d5325835", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093699, "uuid": "ea83466b-c89f-4bd2-af30-b9279829012f", "value": "9AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093699, "uuid": "44a4883a-b6c4-414a-ba90-1aa46996aec3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093699, "uuid": "c01598fe-d7e4-4e77-aacf-0a9f6cfaffde", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093699, "uuid": "ea2ff758-9cc9-433a-afc9-255bab592b4f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093699, "uuid": "f774f6ea-ce6b-40ce-b109-86ec5f5a6323", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093699, "uuid": "6ae24302-6be0-4d2c-8d74-619b3938aab0", "value": "583f5e1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110379db-acb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620117064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117064, "uuid": "5110497a-6025-4d29-902c-cb016e4ccde0", "comment": "Malware payload (njrat)", "value": "e4b9076e0909775d85a39706c0337d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117064, "uuid": "aff5b2c3-8f63-4d7b-9caf-d7933f5e273c", "comment": "Malware payload (njrat)", "value": "9cf93c4c0c4e0b609c5f21e3b49099009e5010cb2391dea6009d73e1293e1c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117064, "uuid": "95131e70-958b-4cc2-982a-a7c392ab3695", "comment": "Malware payload (njrat)", "value": "8d7afc8519439840d5959f95c6a234cf572d4fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117064, "uuid": "4748dfe4-0807-4a21-bbb1-df543092a576", "comment": "Malware payload (njrat)", "value": "36acfb3e3af8f47ab421a33faa2e885874bd67d765a7e0acc9597182783276a3348d3e13fe98ccd507f16c002a4fa3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117064, "uuid": "9c9a1981-9d23-4842-8b63-63b4f14dce9a", "value": "2D455B086FEC4719F53F73FA84E5607023B8AC416757E30A1AF875AA1872363DD8919E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117064, "uuid": "456a9ff6-da08-4966-8a73-c8c1a22e6f58", "value": "12288:JxjrJSpmaxIephPrYDKpZZQyG5b/MF/aMDb8BtRjA7XcYNclB:rUNZeDKpZZQyG5EF/aMHCR07zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620117064, "uuid": "5365a4fc-0c49-4497-8b5f-ffd978d4e25b", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620117064, "uuid": "8f509927-146a-4dd5-99e0-bcdbbd3efafe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117064, "uuid": "00de209a-6902-4cd6-a66f-ab2964882b24", "value": "e4b9076e0909775d85a39706c0337d0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5345e7b7-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100855, "uuid": "9ae8e075-bfcd-4167-9f64-bcccde6538da", "comment": "Malware payload (Dridex)", "value": "ee6d7cd9366bcfd9049a3a1593305d8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100855, "uuid": "7e7e4cc0-0e4b-4170-b962-00861a067c38", "comment": "Malware payload (Dridex)", "value": "9d767ea5ecfd9bbdcda4e2aba71369bd692ec8bf9f991fb80b2b97124ef4853f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100855, "uuid": "8f2d8fef-9abb-4d64-b153-da83e09deb40", "comment": "Malware payload (Dridex)", "value": "db4968921516938bba8ff0f8053f56bd1fda2ebf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100855, "uuid": "6f8da225-e0dc-4584-85b7-08e6d4d793cf", "comment": "Malware payload (Dridex)", "value": "2dcec3cec2aaa2061bbf61a66b895a17a3ff974b99ad9c41128d3c2d7bf77c1b778b2902aa4d61660cd8bf4d93f1660c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100855, "uuid": "93715730-faf5-47d5-811d-ac04771dbbf8", "value": "0FF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100855, "uuid": "d4cff4d0-2636-4a70-8d1e-8e8bb6d625c7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100855, "uuid": "cd4f9fcf-83fe-40ca-b49e-60a9144fc637", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100855, "uuid": "0aac1ae8-b6f4-4f36-92b1-6e7f9c26d6bb", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100855, "uuid": "0c85460c-4432-4724-92b6-627bbfb50523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100855, "uuid": "99735e75-9d0d-4bed-9dfe-93d29bc35a8d", "value": "ee6d7cd9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdefa4b-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620142403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142403, "uuid": "c9b9cfda-7ba1-4d05-977a-a70e111c5909", "comment": "Malware payload (Formbook)", "value": "5551346aa9f251895021b95a2a7cc390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142403, "uuid": "798c9817-5a76-4c68-b796-ac0d68d3242f", "comment": "Malware payload (Formbook)", "value": "9e189d8d48a66d2f53c972275642da7cbc8ad51b20f04cf1d592bef360db50cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142403, "uuid": "65af63c4-accc-40d5-aa7d-7927fe6067d0", "comment": "Malware payload (Formbook)", "value": "acbcecf7599d3c33f6f2a36c0947cfc633d0a406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142403, "uuid": "44161174-fa53-4548-9b7a-2be273d820f1", "comment": "Malware payload (Formbook)", "value": "bf13235625fc72c7b60bce553def61ef9911739e7dd5e54709f5ffa729eaf8c9c4a6cf4845df0a5438eca5ae55645e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142403, "uuid": "1a5fe193-483a-40a0-8083-2948b8356051", "value": "E4E4BE2633D4EB9CF07E9B759014560093F1B947F721DA8DBDA920CE49E1FC583A27A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142403, "uuid": "59c5bc78-6b0b-46ba-b345-86539ab35381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142403, "uuid": "32b8c59b-a88d-4a38-b6e3-90e8501a09b5", "value": "12288:62gypDoyIcOKM5r2uA2rUaML6/tsXpeAr9rF2gRGnURucvUkgDavaijBCir:zgypPzOKp4tR/2XpeAr9rFvzu0Z4ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142403, "uuid": "1f9e0419-0011-4a2c-a5bf-5953115caf11", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142403, "uuid": "5a64e8f2-3fe7-4448-8529-b8cf31c6ca21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142403, "uuid": "6bd2b823-c783-481d-89ff-73c2141870d9", "value": "5551346aa9f251895021b95a2a7cc390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1783fa-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097271, "uuid": "897bda70-4a0c-4172-a0ca-2730ebda832f", "comment": "Malware payload (Dridex)", "value": "b0617f882cd3a22abc066a1b19dfe92b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097271, "uuid": "9a0d53aa-e7f8-446b-880e-a33f68471c86", "comment": "Malware payload (Dridex)", "value": "9e479e4750f5862231be7a7632a281516818fba3b33e8daf086412787bf87524", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097271, "uuid": "72935dcb-970e-4f60-90cc-41b1be0a31fa", "comment": "Malware payload (Dridex)", "value": "ecd5b987e23de9afb63b858fba696b739c5b0818", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097271, "uuid": "4a3428f9-6932-4dff-8bb9-5edb39419e9f", "comment": "Malware payload (Dridex)", "value": "8d46f00f8546a62dcc8acb485ddff4da96d9eef12938f78312d151db82807b90b2bfbda630db23527f57768b88b7012c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097271, "uuid": "61ba46ae-50f7-48a2-9c18-83d16ce0fabd", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097271, "uuid": "499a04b6-5d1a-452b-98ea-1b67a43c7602", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097271, "uuid": "64176f66-69ab-4e18-a0cc-a8bdbed3b064", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097271, "uuid": "6e7262be-f7a9-4871-8959-a4034dbe2df1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097271, "uuid": "846f09d9-33eb-4f40-8e42-56be7e0c3ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097271, "uuid": "1681fe6f-56af-4fae-a34a-344a5941d840", "value": "b0617f88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d79d67-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122468, "uuid": "81b9d0fb-0c1b-4c78-869b-e9f70ebb73dd", "comment": "Malware payload (Dridex)", "value": "de8c4ce176258bf1bb63975e1271b33f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122468, "uuid": "73a22809-4bc0-4555-a515-141ce5d1e92c", "comment": "Malware payload (Dridex)", "value": "9e6a4a68d2671e1b49a3c837cc9d1fe45be5537d75b62743c7455921290d9494", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122468, "uuid": "1cf027c6-c7ad-4725-9448-587e57e87fcb", "comment": "Malware payload (Dridex)", "value": "f0a3c24b2481d1d2fb3d033875d7edb21eee07ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122468, "uuid": "8d62f37b-fe29-43b9-aa1c-ef284c01c8bf", "comment": "Malware payload (Dridex)", "value": "9a4851235b6fcb9d58dec47aa43129dd96b12a23cbbba81a5ed098d08a4bab73172c80103e84c0a096a74d40d22b9ef2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122468, "uuid": "6a19695c-c7f7-4079-abbe-781ef0e2b55d", "value": "67F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122468, "uuid": "8f5a30e3-079d-4f3a-931e-f72b69b43302", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122468, "uuid": "09d75a5c-4683-485e-b9a6-5c4db92cf11f", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122468, "uuid": "4f1b791e-b88c-40ec-bc18-e958e4fbeb81", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122468, "uuid": "e7163db5-b2b1-4f9f-bbbd-17f7fbe5c770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122468, "uuid": "09dccd91-1405-4aca-9585-205bd65c25e8", "value": "de8c4ce1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e720d5-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093714, "uuid": "d88ece4e-779b-4dc3-b6de-3080f1e62798", "comment": "Malware payload (Dridex)", "value": "929a0ad5ee3a4d939eeb6f971d915d3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093714, "uuid": "d5af3d38-db67-4f6d-bb79-00b62507645c", "comment": "Malware payload (Dridex)", "value": "9ea0bd946e66448919be4810d387bb4318747b8d82edf6b89863c2cea3a9645e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093714, "uuid": "5abfb453-1bbc-48af-8333-b852a3b84c96", "comment": "Malware payload (Dridex)", "value": "2bbf58e8a5279d6e39a8bbe2c99d64c28978c07d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093714, "uuid": "e5c4ac8b-0fa6-4ba5-afc3-9e4ff6631c16", "comment": "Malware payload (Dridex)", "value": "7f941685ea5589eec98ae56ac37bf640b970709d0767af0442e47efe491481c406b973a67fc6870e57fde5a402e5808e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093714, "uuid": "2286dac4-df30-4066-83f0-e607b569ac72", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093714, "uuid": "01332ade-02fb-453b-8109-f3deeaea2239", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093714, "uuid": "825525f3-ed48-4a67-8726-1cf09af926d9", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093714, "uuid": "acc6a318-634c-4bb9-a315-eb27ae84a7b6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093714, "uuid": "202a7869-a8dc-474f-bd6e-836de6b51684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093714, "uuid": "8a52351e-68ad-4365-b7f4-231b53c04e19", "value": "929a0ad5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6159d4-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100872, "uuid": "a12ab573-a7e3-45c7-9c80-e8dd53afb171", "comment": "Malware payload (Dridex)", "value": "02e928303065e6ea48e8bc22fc71ca4c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100872, "uuid": "c0f6d1cc-065d-4062-9d5d-4dc63a5f3ded", "comment": "Malware payload (Dridex)", "value": "9eeb38f922b8aaf9d1e2fb88b9f797e9cc6e63cb6994a5b30ce76d90a6ea68fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100872, "uuid": "4877c01c-d3b7-4f26-97a5-2cdc0f52c703", "comment": "Malware payload (Dridex)", "value": "5de5f07515253aef2b5ef7b7166264d3d24bfec3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100872, "uuid": "cdfa0a9a-290b-4849-92a8-1cd5a07979d1", "comment": "Malware payload (Dridex)", "value": "8a25e74ee9cf443e342ebd504cc652024a8b585dc221729be8f69a2fcd514f045039c617995e59607d52cea792c56152", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100872, "uuid": "4f3951e6-cb7f-4efd-8ee7-00be28fa5fe8", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100872, "uuid": "1307b05b-38f0-4527-a489-ef238dd5e7fe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100872, "uuid": "b1c91480-9a79-4ce2-a6ed-b0ec3af75ec5", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100872, "uuid": "d19042c3-113c-41fa-ae1a-f5038fdda0b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100872, "uuid": "da48bd40-dc1f-4ab0-84e4-1896dabe4777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100872, "uuid": "34e0c88e-564f-4fa7-a7bf-fc046ce1ff16", "value": "02e92830_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847883c8-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095354, "uuid": "750183ec-b232-4732-a22c-ffbfe5665bb6", "comment": "Malware payload", "value": "559058a4aa97ea72cac354a44f4686b0", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095354, "uuid": "e5b82aef-13e8-4bc0-b997-5acda0a2619e", "comment": "Malware payload", "value": "9f27705fab70cb6b47b62687c5a092ffc3198dcdaeaef5e813684d8bf838216b", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095354, "uuid": "3065a3d7-f29b-438d-a242-d171c3e77ccc", "comment": "Malware payload", "value": "2abe4513213eed974f71204f768caeb2057a64ac", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095354, "uuid": "8d23c631-7a4a-4599-9d7e-c6d66f0dcc0b", "comment": "Malware payload", "value": "5c5b9403bb42d91b4512627275a242e8ea00cd04aa8cacf4b9ee636d66bc73a75a76ae6a769bcf8881cd27339ab3d741", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095354, "uuid": "05efdf43-d9f1-47e7-a361-965a2a0170d3", "value": "03D4949D722075EFC89BD4769E985D68AB60747B431B4203A0271DAFFA4D987CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095354, "uuid": "fa5c55b0-4c6f-43ef-9bcc-f74c401da942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095354, "uuid": "b26d2d4c-bc3c-4d11-86b8-58079ea115a2", "value": "12288:ZBUtbMCK6UINiYcIwYdk1K6GiCiZEc4r/9mSSvdCgAFGXo3Eqi/svnx1BKVhxoS3:ZBGbCZI8j3GiCiZV0En/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095354, "uuid": "2b8c58f7-1700-4eb0-80cf-ca0a582c07db", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095354, "uuid": "7aca29e0-d036-42e9-b310-c907b95139f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095354, "uuid": "53af7a09-324d-425e-b570-005955363483", "value": "9f27705fab70cb6b47b62687c5a092ffc3198dcdaeaef5e813684d8bf838216b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3944ceca-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118850, "uuid": "38b2d54d-c0a5-4ec4-a562-9c05fd2ddb09", "comment": "Malware payload (Dridex)", "value": "e577256bb36db4051e57e05b6fb06190", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118850, "uuid": "127829f5-1a3f-4843-9b68-cd65db52dbac", "comment": "Malware payload (Dridex)", "value": "a26b3f8c95df734563d0a31fbfe4870ed1bd9ecc054211d66cfbaf0b8dbb2006", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118850, "uuid": "dc3d07db-c69f-498e-9f6c-beb7da1426e8", "comment": "Malware payload (Dridex)", "value": "7ba8478fc2eb9137d2f0240975c3f6473c360119", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118850, "uuid": "dcde4ad7-50dd-42c7-9af1-e6fc1f457ec5", "comment": "Malware payload (Dridex)", "value": "25ba405be7c12e4875140aca01b8523df24840cb1178a6a58fd3c777d9493668b738b28b0bff180b482a4cb263b67225", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118850, "uuid": "6b162672-0e87-4f8d-9c37-7ea9a9b4facb", "value": "03F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118850, "uuid": "ba07cb14-11db-4527-a9be-6e755fe1bcd9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118850, "uuid": "d3149697-7674-40b0-a57d-79d7b9283700", "value": "3072:mWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:m42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118850, "uuid": "2ad2b56f-062e-4f4f-b475-e5a19770785f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118850, "uuid": "3d7666c9-532e-40c2-9ada-a159a7ff4eea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118850, "uuid": "a327a39f-9515-4f78-b1b1-e274d4acf059", "value": "e577256b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c603d7-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095428, "uuid": "a1cce2b1-d63d-4b9d-bbbb-2fcbd89fd0ee", "comment": "Malware payload", "value": "af2da0d7a10579950bfbc65ccaffbcd0", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095428, "uuid": "dd851bc9-8dd0-4ed2-9b4a-158bdee6aa5e", "comment": "Malware payload", "value": "a2c28e353d28e64c2bb74b63b1c81510f3436d0433b56fb4820763c614e77b20", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095428, "uuid": "a610e899-c78e-4022-aff5-0a22952ca7ed", "comment": "Malware payload", "value": "3307c3aa6e37142176bb95c516404e532b8390ab", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095428, "uuid": "e2d35a2c-efed-4c92-8d12-66cffcea20ec", "comment": "Malware payload", "value": "8543dad2fd9603c9029b1294228bd39bb40662b3f06c90afe805b972e2154044b76c4d6bca42f8b79a4b0be8c851bca9", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095428, "uuid": "0879f73f-d2bb-4066-bfe6-988591c502bd", "value": "D2551243B5189CABC6D6827D0C85EF680328D62D1811D16536B67DBBF9DEF530C0E2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095428, "uuid": "647c3c13-1d75-4eab-a3e2-21420bc691ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095428, "uuid": "58008ad4-d4f1-4c39-a77a-08053995df40", "value": "24576:/vegJgDbJuiitI2Qwz0twlWMo4QY/PHHSkL3OKyk0En/:NeaH8KWMbp//HxrOKyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095428, "uuid": "1d7215ac-e918-4763-802e-c613f9726e05", "value": 1325056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095428, "uuid": "8f00bd30-ef10-4038-8f7f-04320f4fee41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095428, "uuid": "6bb6c86d-995c-42c1-b925-490d90874456", "value": "a2c28e353d28e64c2bb74b63b1c81510f3436d0433b56fb4820763c614e77b20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599636be-ac71-11eb-abe1-42010a9c0039", "comment": "Malware payload (TaurusStealer)", "timestamp": 1620088839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088839, "uuid": "f95facbb-8e98-4077-89c1-03f8a97a6427", "comment": "Malware payload (TaurusStealer)", "value": "823be0d8a6071ae72ddf518a0f67b6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088839, "uuid": "86d34ef3-d1bb-48ca-aed9-696970f27c9d", "comment": "Malware payload (TaurusStealer)", "value": "a2e57e0250fe19b1495f61a62739d949ee6c36f3e672d33aa70f76c82f0aa6c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088839, "uuid": "39c53eea-08d7-40d3-bce4-7390056c00a6", "comment": "Malware payload (TaurusStealer)", "value": "5ed2121688a2ac718772ff5981f3df628cbff540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620088839, "uuid": "a48bb0a0-b54f-4d00-bf40-041ce2b6fbf9", "comment": "Malware payload (TaurusStealer)", "value": "168300560bbd69d81683dbdeb587f97c33afc3b1c9f38276835721d0060693567f09a8f99a0e682d083ca9847956c417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088839, "uuid": "0b539c6a-cf13-4beb-9c4f-e3464acb9335", "value": "4355133214916962F8E7017788E22142671A3EA5F87C7C06BF503AC603B52E49FDD6FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088839, "uuid": "2d10cff7-3252-4ba8-aab2-01ca3180de66", "value": "7fc4d66145cd1ae101d85c50fe6f6e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088839, "uuid": "0c652614-e92f-491e-a540-8d6ea5efaea0", "value": "3072:II2fIQNPuJuej+VezZSRjQ+LaFcRweJ4QQ9eZExLF4D2tNKy1gRZ+cw:Ih2kejlk59RjKQlZE9g0Gic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620088839, "uuid": "391ec125-837e-4d05-8538-1eaf11deeba4", "value": 1386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620088839, "uuid": "dd6c9486-557b-4895-939f-e46502a08c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620088839, "uuid": "ed89ab54-0770-4f52-b972-5008a3617b45", "value": "823BE0D8A6071AE72DDF518A0F67B6E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e586e9-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620143779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143779, "uuid": "325a4035-63b1-4433-bc1d-adc89f9b60f8", "comment": "Malware payload (AgentTesla)", "value": "40b7776a47fc1062ec85c3e31c91eb81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143779, "uuid": "7de0a2b7-cb50-430f-812f-f61b00848f82", "comment": "Malware payload (AgentTesla)", "value": "a34349626b55e6a946fd59e9a59f50da9cf8d50418e69fd337ad523526289ad2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143779, "uuid": "d532f3f6-3ac9-4e54-9a4d-88edcbeabb7c", "comment": "Malware payload (AgentTesla)", "value": "f7fa298d4c174d4e43ca92e5c8186db4589253f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143779, "uuid": "d0f6ca64-1a3a-4c45-b600-9b8bf5f275fe", "comment": "Malware payload (AgentTesla)", "value": "36407ba2e7ec6f13ce406b94d01ad32ebefcc93bf4806cf606d278e49dad2054ed38664b31dcce0f782409800cab9b45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143779, "uuid": "9c63ff4c-dee7-4f81-86da-f16f255ab6e4", "value": "9FE4BF2633D4AF98F0BF9B799029520093F1B51BE321DA8DBEA511CD4CE1FC583527A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143779, "uuid": "e3b5c3b8-052e-4b9d-b867-5a80aed3e746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143779, "uuid": "65b96845-6f2c-45aa-b283-fa6d6bf9e0c6", "value": "12288:9ygYbzLIYOKMUrPxLagZIF5S3yrn3tiegkRn78QaoBIDNfbtvc:IgYLbOKplPZwP73tNRngQDkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143779, "uuid": "872d4570-70cc-47c4-9482-01c6da1bb6db", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143779, "uuid": "2bb093b5-833f-4a38-a027-dc1db04617a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143779, "uuid": "b3f847f0-f83c-49ca-961a-bd9ebd8c12e5", "value": "40b7776a47fc1062ec85c3e31c91eb81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5af5cac-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153096, "uuid": "f9d35037-51bc-40d6-a6ab-7e763f001ccb", "comment": "Malware payload", "value": "20099df7c5eb807f843085eec0c9a31b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153096, "uuid": "956a375e-16a9-4986-af0b-62c044b4a3c5", "comment": "Malware payload", "value": "a47090d0084a4dd6a2406f78b37924421d231375cd4d02e4329c68560ce7a671", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153096, "uuid": "ba170aaa-b11c-4b6d-9c0f-31e45afa0b05", "comment": "Malware payload", "value": "da6c08da4a0679facf47eccece0b21a650350ded", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153096, "uuid": "254ada6b-cf92-4e56-8c8f-700966f15dab", "comment": "Malware payload", "value": "9048513a3fcdb6eed790ea05b82195e745fcce99af4835946dd6d0c1228b5ca8d6e02d062ee9aba0265621ad251c95b9", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153096, "uuid": "9e64de0d-40c8-4d40-b8aa-dc9c563a0042", "value": "83B5330C1375B8FCFD5E062937634EE0C2A972E5F94261D2A2641CA85D3F5BD03AF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153096, "uuid": "dcbb25f0-22b8-44a2-9944-20d55f92b84b", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfpB:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153096, "uuid": "23a49e6b-7347-4d8b-8e34-52c308d6f08a", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153096, "uuid": "1620d8c0-2867-4652-adb0-ba4455fd8dc6", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153096, "uuid": "d36c6d52-a299-4c99-93e6-5ce2c259f9d3", "value": "a47090d0084a4dd6a2406f78b37924421d231375cd4d02e4329c68560ce7a671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873e5516-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093640, "uuid": "f066a432-1b32-4a42-9465-57c767c98e86", "comment": "Malware payload (Dridex)", "value": "b40f7c36f4fd65c540c1e94d3496ff70", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093640, "uuid": "fba29a81-0036-4a8f-ba91-0b3b10cc7efd", "comment": "Malware payload (Dridex)", "value": "a4c9d9ccef19e91dc9a83c9b5266e925920803e78bfa1c97d9c21a3481e44ebb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093640, "uuid": "1a45c161-ac69-493e-b4b9-b499d94a59b4", "comment": "Malware payload (Dridex)", "value": "bc3c0fdc1f03adc2632fdd704f64dbbb4b9fd73e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093640, "uuid": "8510eb50-5006-4d96-a03a-a8cd3bafbefa", "comment": "Malware payload (Dridex)", "value": "8f607538ecc3e7d42c1a463d1f06d7ca59e1f947a8bfcee3678bd79ddf43da392219fe2728ece6118900ac365ab4841d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093640, "uuid": "5a2c10d3-c0bf-4e62-82ab-6ba5f2983693", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093640, "uuid": "e5713bb0-ff94-4051-8335-f90da55b37d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093640, "uuid": "74a03a7a-9497-4da7-a727-746c6d669036", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093640, "uuid": "ebf30dfc-d44f-47ed-9334-ac3a65d57622", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093640, "uuid": "f903481c-6c91-429d-a707-4bb43bc2edcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093640, "uuid": "40dd8568-c649-4f3c-a097-04ec53d0179b", "value": "b40f7c36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdab2928-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153110, "uuid": "ca00bd5f-2572-4b61-863a-f3bdb33c646d", "comment": "Malware payload", "value": "37f042247cb7296f238a711e5bde3148", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153110, "uuid": "5f346891-7b70-453b-bb8d-978a26235b0f", "comment": "Malware payload", "value": "a4fad656c0679ff37aa0ec46205148acf74e9bf250fd471ebaea5c4b0660e947", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153110, "uuid": "977d22c1-30c8-476b-918d-5f6a1caf9b29", "comment": "Malware payload", "value": "9bfcf7621cd37cf6256e32d747788428fef802c7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153110, "uuid": "e367fd9e-9efd-4d3b-ab4f-6734446b32d3", "comment": "Malware payload", "value": "442b355cb7b6f844f71172ac86af0ba3c014eb7f60901cdc4a31c2b8c776ad29a42642f0416c4c0a8493f4dc323ca157", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153110, "uuid": "0da2072e-6ea7-4d24-8271-fdaac621acb0", "value": "62F5339CF0ED29FE82E46671E1EBFF207027A9CD706193515CE7E5890817260E4E9E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153110, "uuid": "eb7f3f82-9052-424d-9ab5-f73895bd2262", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4h3:tos909Qg6ecEZHyEexmLaI9MY7bxTE83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153110, "uuid": "feca1e0e-eb76-419b-ab74-d1ecc3617ac5", "value": 3616768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153110, "uuid": "becc8430-ee61-4ef8-b9eb-c2cf3c76855c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153110, "uuid": "7de52168-6fb0-4b51-b2e0-9bc2aaf1dd36", "value": "a4fad656c0679ff37aa0ec46205148acf74e9bf250fd471ebaea5c4b0660e947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae419ee-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620104116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104116, "uuid": "5cc8f66a-dafc-44b7-9769-e47d73879b0a", "comment": "Malware payload (AgentTesla)", "value": "2ade0573f90cfa00db112679977dd7be", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104116, "uuid": "5da62dcd-2833-4e02-8c8a-00fb388e2f8f", "comment": "Malware payload (AgentTesla)", "value": "a542ed2a1f7d88eefad1628664cfe4533870cbca8ab2d564dfb70abd569c2776", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104116, "uuid": "504e3ed0-4d16-46d3-9850-5afc9a3e3f7e", "comment": "Malware payload (AgentTesla)", "value": "98dd3adc496ccb78ed36ef2d177e74fcfad86165", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104116, "uuid": "587224d9-d1e5-461f-bcc5-198b76002076", "comment": "Malware payload (AgentTesla)", "value": "22ba36ec403c43881d4e7bfabdf3d66a8dfa2fba306a556cb733023756f5d4baa3237c3c903333e80b8ec69eda4d61b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104116, "uuid": "49ebfdbc-fdbe-4091-9358-5cbfc7981e91", "value": "28F42303477DBCDE394CA3EF3A57A73F299A316962A2908B051C535D14AE258523FF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104116, "uuid": "79892e86-db2c-4176-bc52-80b5976184e8", "value": "12288:Cokq2fDvsxjCgRqpYyNAcv4WwULVw/WNPWjiwxN8RLMQiC3LLVkjjG4xk5dgF+Eu:CTpe2UQNv4YIYVwxN8f3LLVojG4SGF+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104116, "uuid": "1640b479-ea9d-4f1a-8ae8-5bc97df86f9d", "value": 765198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104116, "uuid": "23327003-86f9-4bbe-a381-eba518bfa2e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104116, "uuid": "de808a1e-63e1-48c6-b729-53e3c2d88186", "value": "attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f09cc60-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620142563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142563, "uuid": "98acdd93-5372-4fb2-a739-b28b07eb59a5", "comment": "Malware payload (NanoCore)", "value": "d4fad25d6c1355a4c67213e0dd62f306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142563, "uuid": "29008ee5-c00f-481b-87de-e50d99fb9370", "comment": "Malware payload (NanoCore)", "value": "a5f9d3b38612d88169c4cf6f934a93fcf3bbd772f2f3e5ac1e4a7f0b4ce6d115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142563, "uuid": "f284bbc8-8da2-41c2-9f8b-1e16d9d87252", "comment": "Malware payload (NanoCore)", "value": "28470472420f3b1062ed51a67a45e638929a99d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142563, "uuid": "ad7fd60a-6459-44f7-98d0-2848850ff64c", "comment": "Malware payload (NanoCore)", "value": "b9b53fb122930e47b352f1368959386d6b90db694ca5a714ddc635eb630bcd65b3771ec22dd73e2ac9af10ae3bed7304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142563, "uuid": "c99f283d-ac2e-44f4-b9a2-b4df7e7c0ed4", "value": "9815CE27BF685656D5BA0F380835031067F5ED19D721C32F29A8709CEEF2AC18E667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142563, "uuid": "f470d6aa-a3bd-4ac6-976c-71876e503800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142563, "uuid": "e690a733-17cd-4b80-a076-e93d3fead92f", "value": "12288:dcHTBHP3f2KMenc2AOA3LRskxMApiRdIbIPedKibvB9lOKjfqJjKMC5nz4DGb7F1:d8FkxjmBPeR7AJjKZF76E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142563, "uuid": "f5a4afa8-9a5d-47d6-98cb-9b3eebed1cca", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142563, "uuid": "1255f4c5-080f-4f0a-8506-78a0c149df40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142563, "uuid": "571c7234-3ab0-4d9e-86b2-9f464f3915cd", "value": "Balance Payment pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501790a8-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118888, "uuid": "d74a13b1-5007-4983-80c5-799d17bb2e74", "comment": "Malware payload (Dridex)", "value": "c6f60c0553871d810c82cf042e818ad2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118888, "uuid": "d1d0320a-c386-4734-a1ff-8dd0c1dfbb0a", "comment": "Malware payload (Dridex)", "value": "a6a5ca04c772b59646b61be7d090ba008f3b68ee58a84e724160c8beebc1d93c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118888, "uuid": "340d8f07-21cd-4f7f-b1ac-ad2cf10e14dd", "comment": "Malware payload (Dridex)", "value": "b063a2349b1e20ed4325c60406e99817d1efea8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118888, "uuid": "45414614-803d-46f4-9705-d54107d32c8b", "comment": "Malware payload (Dridex)", "value": "4bf74a4ed5d15ade8e91b2d22e2a6d8ae2ee088c747945c6dbbd694310776c0124fbe669029ea360f127e61e6b5573bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118888, "uuid": "f3c1d578-6539-4e59-b921-d99c69c6e1a3", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118888, "uuid": "1f7c03b6-f168-4725-9a39-64597b20b35a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118888, "uuid": "b80cf81e-eb4f-47f7-be95-cf8b78fab78c", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118888, "uuid": "8e7906c2-54df-445d-8d08-d51179961259", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118888, "uuid": "e12cffbd-1ffc-4f2c-93ac-4c09f4328931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118888, "uuid": "f4a896dd-38b7-4bbb-bd28-4095c36fa6ef", "value": "c6f60c05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d2c5b4-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118895, "uuid": "e4d4bf03-aa8a-45e4-8662-b75cba727de9", "comment": "Malware payload (Dridex)", "value": "5b0883ec37ccd92354ddbedf252031db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118895, "uuid": "ea050c89-d428-43aa-ac6b-cf687c0e0507", "comment": "Malware payload (Dridex)", "value": "a7036f80f4d88a4e4f3653e0a958f22425414e9f68061c94f614ebdca03dbcfc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118895, "uuid": "2a314cfc-8b2e-4ad2-a27c-15996c390435", "comment": "Malware payload (Dridex)", "value": "a02423bdebe3a55aee292b6d74bad56b3f780079", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118895, "uuid": "2e161b41-a495-4b79-8d64-c3fdebc672ae", "comment": "Malware payload (Dridex)", "value": "1e1b99f04965f68a707749d9029c5ab48e2c82a300a1f8cbf986c87799ef596f404f8755c25cd1c617958748a890ce6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118895, "uuid": "4a4dc840-45cc-4abd-830b-4d10839165af", "value": "E8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118895, "uuid": "951f98ca-b8b3-4ccf-b4be-d2687888e77e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118895, "uuid": "7c99942b-6dd6-4511-930d-81125db19696", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118895, "uuid": "3b6f7280-3281-4cdf-8a86-c8bfbeeba93d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118895, "uuid": "84c56ff2-9e03-472d-9dff-4ea00ac9c7f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118895, "uuid": "2aaf9f4f-58bd-4ac7-9ea8-127b49f239d4", "value": "5b0883ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dc46fd-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620120423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120423, "uuid": "81035c82-3ae8-45b6-b57a-1a20b1942db0", "comment": "Malware payload", "value": "5d28663b832470f10d5fea13e7761c60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120423, "uuid": "a306b8d2-c303-4765-a4f0-3b72a8639df7", "comment": "Malware payload", "value": "a7294e174451a40548bfb8781e0e614c4a0565c0d5a08ecbb8042eff5607b42d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120423, "uuid": "f6722cdd-7ead-49de-abb0-0433af3eab29", "comment": "Malware payload", "value": "7a8c1c6e0a82f17014060d59d3717b03bc9c444c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120423, "uuid": "6b99751c-9a78-4e2a-b684-35ea9964613c", "comment": "Malware payload", "value": "f2cc143668976b80426e3120584b70791f4df94f2e7a3504f93443c47ef002f20634dfe30566c499a807de7dff734b5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120423, "uuid": "07790cff-2146-4d2e-92f4-d37e472f79d5", "value": "136423BF40864463E61BC6FF6C9809B245A1FE23DBA588DDB90CE253B765513CF1A123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120423, "uuid": "862d20cf-0d6f-47cd-a61a-71cbe627330f", "value": "da2dcae38cb7d5fb4bb2e12742d74cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120423, "uuid": "b50c1430-e2c5-4c69-87f1-8da57d88eb20", "value": "6144:qF/e84mFpQxRQo7bR44Mjh5dCfirdt4ARkT+NqmeJePhBHlocqwU/6gtOVd7b/EZ:qddFpQxqk446dX4DOPeJejh9Nga/EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120423, "uuid": "ec856194-fbdf-4cb2-a70d-fc64bdac51ed", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120423, "uuid": "02392ed8-6ac4-4eb6-87b2-2c3b06d90a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120423, "uuid": "b731501d-07c6-4931-8926-87ecc2b1039d", "value": "400000.ImagingDevices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b665317f-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620095438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095438, "uuid": "52c5f6f5-6858-462c-b1a7-71519541ce37", "comment": "Malware payload (BitRAT)", "value": "a413753e53366542a825e733692fb7ca", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095438, "uuid": "24b79166-bb72-468b-b581-68e3f210716d", "comment": "Malware payload (BitRAT)", "value": "a7509109ca99980dc9bcecf2218cf2978a6dae3fd4f2cc91d37af51fa3ab7931", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095438, "uuid": "5bc10a56-00b7-42ba-a5ae-dbbc18325914", "comment": "Malware payload (BitRAT)", "value": "fce655b3d14e6aae6b67638e7ee48bebe8538c66", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095438, "uuid": "ca17cf9a-e1dd-4eb7-b043-1cbbefe8af46", "comment": "Malware payload (BitRAT)", "value": "8b6da6c86ca8f7a60de82c283743532ee95e9f31496471a89858c7ffc8beba6f4ceaf368ae8adcb2c32f86780da219f4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095438, "uuid": "73c8a5dd-218e-49d1-a949-ae75cdf160d2", "value": "6CC690988939D1483AB05EC815C2E129E12A7D3EC684868D38F9D4FD67E2F43CDD6787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095438, "uuid": "e42bd806-eed7-493c-896c-0a25f8842e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095438, "uuid": "f183d8bd-4cf0-4887-9978-94ffd6b63af8", "value": "6144:TrrJnYAWIyu/blwDgq+CBpNkSJF0PVMMDrJyv2Y3i+6DYgORUXqCj4Avt4dtWzqQ:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095438, "uuid": "8c0ece24-ca8f-4524-afe6-b0789a22d978", "value": 11650048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095438, "uuid": "0f026c8b-ee31-4284-8d93-ba955768c840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095438, "uuid": "5d00a257-4600-4f97-a14a-78b3c48d9c90", "value": "A413753E53366542A825E733692FB7CA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6bb8e1-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118885, "uuid": "49eeb641-773a-4a0b-995a-d913694a7271", "comment": "Malware payload (Dridex)", "value": "11698c657c34058e93eb807b7053a193", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118885, "uuid": "90912751-a83c-4d2d-b41e-3b4c4326ee12", "comment": "Malware payload (Dridex)", "value": "a7ce15d62e182589061746b09cedbf63d94c22367bc6e0268e4a6f21c856b725", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118885, "uuid": "5416e6cb-0821-4416-923b-192e6743dba5", "comment": "Malware payload (Dridex)", "value": "09647708aa31b4c3e2137650eefbc0398fa80f87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118885, "uuid": "6bac9f6a-d895-48ff-9f88-16ccdef0ddd3", "comment": "Malware payload (Dridex)", "value": "d038c320e49f4e845ad430643578b3add3b5fad7c6eb63d288348d5279e77fb1b0f595a797b5f9bae37acc0a1b265a2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118885, "uuid": "db088081-f05c-4dc3-ac89-6329f31f3d81", "value": "08F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118885, "uuid": "ec8dcf44-9305-4994-9622-1953a22055ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118885, "uuid": "72c67860-5742-4bab-b1a7-b9cbdeb5e409", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118885, "uuid": "7a3f121d-5f86-4383-b8cf-22cc8765cbc1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118885, "uuid": "fbc336e1-92f5-4208-8722-cc56f9f5449e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118885, "uuid": "b26386e1-7178-4c4e-a908-0605bfb7f778", "value": "11698c65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec2703a-ad06-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153112, "uuid": "8dd589db-c076-45a3-aaba-cdfd2fc87f9a", "comment": "Malware payload", "value": "4f2c4f2a1a19e16d9e46f8b7eb5a6854", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153112, "uuid": "c14bfd5c-5093-4439-a3a8-155a4c11caf9", "comment": "Malware payload", "value": "a7f1e895c485f01c55f6af3bf9f29446446896a09f27c8122f20c84932269861", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153112, "uuid": "cc709c63-335a-47bd-8509-b38244564cc7", "comment": "Malware payload", "value": "0e2dd208c0ffba7066f907996ace4d64fa065020", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153112, "uuid": "e3a84349-1995-4a31-8449-5fa2cc5b6e97", "comment": "Malware payload", "value": "e23f876d96a19a271b9f257eff93f6fbf3730d18d24bddd69087f2f3d843f754ff14c11c5b56222c336ab1254283c774", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153112, "uuid": "d3ddd164-6672-4a13-b27e-7971084097d4", "value": "B6A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153112, "uuid": "0a548dce-b62a-4a26-b396-4964e98a54c5", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153112, "uuid": "6eeb9ac9-2378-45fc-8923-ad3695a96436", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153112, "uuid": "254d612e-5527-4063-834a-cf7302a12961", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153112, "uuid": "e42acca8-2e5a-4c3c-b081-5f8e04a31ccb", "value": "a7f1e895c485f01c55f6af3bf9f29446446896a09f27c8122f20c84932269861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c1ab96-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153474, "uuid": "b3a03d62-89a9-4b41-aef6-2936e7074f3a", "comment": "Malware payload", "value": "6f376e19775a2472f995f19084291f74", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153474, "uuid": "2a5ef184-52a7-48d3-9d88-660e4673b7d0", "comment": "Malware payload", "value": "a839fee5fe1995b65dc177fdd7a6ebd3c8e57962fbbf024bce7d732631d04e3a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153474, "uuid": "53335815-310d-40a1-aeea-33460abe9d46", "comment": "Malware payload", "value": "f99e2acb52cdd8195b4cd1b2ef283df519449705", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153474, "uuid": "987ef197-c72b-4dc6-b7a8-e07c94598568", "comment": "Malware payload", "value": "0eaf7dc6fb017cb305b0571a8f3bb56808d4fbda2afe290ad803a2e53d1100987b177820d1b4eb84de658d9f243a5b59", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153474, "uuid": "86c0db89-6fe0-47ad-92c8-823d2214d8d1", "value": "97A1F850112C1AB07346597AD26FFA52B50EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153474, "uuid": "93724e7c-7db3-4edb-9aa9-76a00cf93ef3", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153474, "uuid": "2522b991-b1b7-4ba7-9ee3-8edd716ce51d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153474, "uuid": "5e598c57-99af-4dce-b6aa-905eba687125", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153474, "uuid": "5c1ed9c5-a1a1-4cd2-ae04-b6e91b751756", "value": "a839fee5fe1995b65dc177fdd7a6ebd3c8e57962fbbf024bce7d732631d04e3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00023014-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153114, "uuid": "ed610837-fac9-4638-bbae-e36f8bd62708", "comment": "Malware payload", "value": "a420f7a60a40f3ff3a806a01feb1dfda", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153114, "uuid": "2015257e-1f2a-4cd4-b020-fddc128f3c67", "comment": "Malware payload", "value": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153114, "uuid": "e92ff250-2e98-44d1-a2b8-ddef37e0f69d", "comment": "Malware payload", "value": "1ae65132b036de51bcc62f66b51ae362e11182af", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153114, "uuid": "5d239c63-e219-4f19-a9f2-d39a302be9c4", "comment": "Malware payload", "value": "a66d4ad2aa2f998292151d31129b661012e95e8a0fa5a2ba46a47347620dff0597a8c59ca237cc890111078b7de266a5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153114, "uuid": "6e4d52f6-6ca0-410d-989c-881987057975", "value": "51E0C0703DC2D6A02D88032EE61BCDAD1FAAF36DBC6A5112852B7353D019091DE26860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153114, "uuid": "ca9c6e0a-fee7-419f-a004-cc762e3e587a", "value": "12:4c1kSs8+BGm8/zAbN+Ms57FTPEGXMnouG:RuDRO/ERnsrPEI8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153114, "uuid": "6488c9b3-8aac-4bec-83f7-7612bd86842c", "value": 389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153114, "uuid": "76e743ac-388e-4fb2-b1a4-848990766869", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153114, "uuid": "317f9323-2564-45f4-94d5-6d08fc37de2f", "value": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fca228-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153476, "uuid": "a1eaf625-efa2-4641-8a74-a5623026134b", "comment": "Malware payload", "value": "2f3865dabf73b044a06c4d293cd29153", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153476, "uuid": "9e47163b-a473-421a-8577-bc9744024475", "comment": "Malware payload", "value": "a96a27ddd3321245694c7c49f60dc081e3df1c48a5416aea9b3eee5cce303852", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153476, "uuid": "ec32cfe7-5f58-42fe-b5c2-71311211a060", "comment": "Malware payload", "value": "748f488d73ad40166230ea384bc6b636884d6e33", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153476, "uuid": "17f18802-b969-4163-a385-f84a2aba5b9e", "comment": "Malware payload", "value": "e6ef7eecf61d5a1bc612422432354b508bc35c17d007a96cdbb3d118546d8bff905bcc908ccd5f29f33e52a0f00b7cec", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153476, "uuid": "627243a9-819d-4eec-a29e-ed07ade5b875", "value": "CB4163CE014262762D5A9F5F7AAC8E077284D5F5D4D43EA0ADD83BA988CDFB43180746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153476, "uuid": "d1c85302-7aa8-44aa-b1b4-c4567b234de7", "value": "48:vsGjBQGo1WhKyMwF2McMR/SMW2PMvlwVG2G9W:vs1dyfcP+hVEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153476, "uuid": "d50a03ad-b1de-4f66-9845-6fded8ee3be7", "value": 1903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153476, "uuid": "e01c72d1-c4ec-4152-9db0-6e0ce5a20c02", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153476, "uuid": "e0875fe6-150b-424b-a172-a0b957fe7263", "value": "a96a27ddd3321245694c7c49f60dc081e3df1c48a5416aea9b3eee5cce303852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5554dfb6-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126198, "uuid": "1ea988b1-1920-44f3-9af6-e2822d71beb3", "comment": "Malware payload (IcedID)", "value": "2a3d96f5457e24e8b8ade652e615bfb4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126198, "uuid": "a8a0e080-2da4-4467-9861-7888283e1e6d", "comment": "Malware payload (IcedID)", "value": "a9763b59e46f04675d60453c99910ce4dd7e72c9302964256612d2a18be7a5c9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126198, "uuid": "014cfe37-d324-4e89-bfd0-c9175ee010d1", "comment": "Malware payload (IcedID)", "value": "caa93a1b75bcbfff2ce4036a775f4d138ad927a3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126198, "uuid": "7c5b386f-8021-4511-807d-7f5252f89d94", "comment": "Malware payload (IcedID)", "value": "b96ca7e1cb63ec969dd26c16c4c853a3e6fc5f1f4615545aa60e081e6e2e2c0c28c776bec6b173a4942e53f61b772be4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126198, "uuid": "8d26d107-3836-4031-bdbb-d1bea8d2ea1c", "value": "11B3C0BDD502E4E2CB69DC3DD1167412AD5B91877F0FE61F208621AB0803DA76E352AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126198, "uuid": "c8ee2d4b-a0f3-40bb-a931-6f4ac79e53b6", "value": "1536:iutuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:ikuocrZDKGopH8x+8HdoLqp6vif+zUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126198, "uuid": "bf430b11-86f1-4f98-bea7-72bdac277f01", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126198, "uuid": "87513eeb-4873-4e6a-925d-949b60c52e69", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126198, "uuid": "a31e5315-63a8-414c-864c-f204e345396c", "value": "statistic-2072807337.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013af380-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153116, "uuid": "404a0e9b-01bd-4a40-9a88-2b2b21ffffc2", "comment": "Malware payload", "value": "004992433dbaf0931485afb0e4a7a343", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153116, "uuid": "0483f7f8-caa6-438e-8d17-9214f1461f77", "comment": "Malware payload", "value": "a9f55f1fcb7808809f977d06651e22d5139b06042826af9a1fcc5254e1c7993d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153116, "uuid": "11f8119c-7daf-4225-b68b-46f17c5cc166", "comment": "Malware payload", "value": "75d7be7dd50d32a295296c9bc2610adaaa9779f2", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153116, "uuid": "fd649fad-0d10-4080-91d8-548e215785a8", "comment": "Malware payload", "value": "96feb59ca1c4735ffd5aaba3bc00dcc439aa2800429a276d8e0f040777446724fdc59a3ee0537e69f4c9a1c6ff8264dd", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153116, "uuid": "5df6bfed-6374-4c9d-9bf7-d5080a8f6e75", "value": "F35143C9014242705FAFEE9373A6230DF5E295F358C27EC091EC79EA744DD1426D5B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153116, "uuid": "e85cf0f2-6eed-4f8e-ab29-b05100643296", "value": "24:v6Le0LINOeLGLg2Lub1L9LZ6pSLUL4kLV+LP9uLDLJwZSLKG0:vMBIN7Yv0hzGXKunvKG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153116, "uuid": "4ad3cf96-eca3-4e43-9e18-982be5a321bc", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153116, "uuid": "57cca98c-ed43-4ab5-ac24-aa4c4e2edd0d", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153116, "uuid": "b2a8660d-570c-4df1-b375-c2b2e71946f7", "value": "a9f55f1fcb7808809f977d06651e22d5139b06042826af9a1fcc5254e1c7993d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d452e20d-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086468, "uuid": "45c10111-ff13-46e2-9e11-626b46302574", "comment": "Malware payload (Dridex)", "value": "995fb9750b40228d71ab01a6b66b9a38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086468, "uuid": "efe01e6f-0c51-4f7d-bfed-59b533a55120", "comment": "Malware payload (Dridex)", "value": "aa9100f911b6395af156bc9780073e5e660f6537829725214557957c6eda16dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086468, "uuid": "9b8fb0aa-b743-4df3-bbd2-52fbf5f4bb9b", "comment": "Malware payload (Dridex)", "value": "0ae3e180c3d84f6a100bbbe8a92cc8193b2c3d91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086468, "uuid": "e695864e-5f9f-4359-8591-1967d1d6b286", "comment": "Malware payload (Dridex)", "value": "ca5eba1f3dca515b1ee1204d7f74d9d53d3c0b47bb6999532c62932ec9f6adec4de6847991c34f8e5de10f075d7dab27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086468, "uuid": "4b61a293-d830-4c3b-b246-93fe2078974c", "value": "FCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086468, "uuid": "2197f9e8-674d-43f7-9814-2face7fe48af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086468, "uuid": "2419131a-1445-4ce8-a325-c94ef3b0bcef", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086468, "uuid": "c4182eb4-2350-43c3-a890-b78e0a6da551", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086468, "uuid": "61254c93-51c2-493c-b2c6-8e0138d6ae3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086468, "uuid": "98db509e-aa8e-4cfe-b780-1f29c546cf82", "value": "995fb975_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0270658c-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153118, "uuid": "3e647904-ab55-49c3-92c0-15f27242e049", "comment": "Malware payload", "value": "62f052e3591617d1e9df65857a8ebb74", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153118, "uuid": "f01a6eb0-d03d-4d64-82f9-a715d6715fe9", "comment": "Malware payload", "value": "aa9cce4f7259ed94760eed95662a4006b7cc651aa75465f31bb82460f70b3f6c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153118, "uuid": "b7c1ee3d-35ab-423a-b884-447824e64285", "comment": "Malware payload", "value": "33491e6c9790203638d06e2afc29e99a191f6348", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153118, "uuid": "385e048e-c788-4d72-b40b-d6dea66d09d2", "comment": "Malware payload", "value": "3b1f903ca80c8308affd705e0231d8d9a55d778726c3f333d587663c08b60b125466c445a28fc3b7eb8a8dc0a7d0a022", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153118, "uuid": "34fd51f5-dbaa-43fa-b2d1-1303a82ea80e", "value": "C44178C621B24DB91F6BDBB3F2FC0724B78CB4E598C81E0067DA78ACA89CD003461646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153118, "uuid": "c2914e6b-3288-49fb-bb90-5f9804ad95fb", "value": "48:wXN+XwIXek4XFrwX+MXX0jXIMXKEXmvUXr6j:wXN+XwIXl4XF0X+MXX0XIMXKEXmvUXrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153118, "uuid": "e46ff6fd-d8dd-4053-9ba0-75b43bde5ac3", "value": 1889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153118, "uuid": "31a45c64-33c9-488c-8eb6-dc6696b30326", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153118, "uuid": "7f5dc3c4-dea9-47d3-9542-c23718d68287", "value": "aa9cce4f7259ed94760eed95662a4006b7cc651aa75465f31bb82460f70b3f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e447fb7e-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160798, "uuid": "997278ff-cb7b-4776-b9ff-883dddf10eff", "comment": "Malware payload", "value": "2271084bcad00d265b3e9a57e0b79dd9", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160798, "uuid": "fb0e6969-daf4-4319-a238-ce9e5702f228", "comment": "Malware payload", "value": "ab1a3e55a8f81c1e30c465bc2288975a4684abc0114f447b0633d589864068d8", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160798, "uuid": "e1878b26-1e04-4b62-a7f9-1655e5d7c4ce", "comment": "Malware payload", "value": "9f2526873edaee92d9e11dc8b8499164d66b9a16", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160798, "uuid": "013e9de0-cc0c-49b5-aa6c-165296e7e29e", "comment": "Malware payload", "value": "d0a79aac9ed907bf0f69d981842e535e3c296529c33a596ba47114fae78e99e1068628e8f5f971104736cfb1bd1a52ac", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160798, "uuid": "9a66b069-afa0-4a50-842e-14bd64e88a48", "value": "083165772CC191260715E682F694482CE734940EC897345CE1DE954DA0D0F932FDD2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160798, "uuid": "d880164d-57ef-4a9b-b58e-3a7f02184c0f", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWj6GCnSEGqBYZbxIkyyD++ETTTQ/Tviwdy:GEXfhexTvrtW+FSviw6yri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160798, "uuid": "9d815726-4774-4612-af16-094793121d04", "value": 1515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160798, "uuid": "a561d036-1078-44e2-99b8-bd9cd1597adb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160798, "uuid": "6992d9e1-f23a-4f9f-aa92-4f205916e360", "value": "TXFVmauk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc2a6f9-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126162, "uuid": "b927314f-4ffb-4001-8f57-ea425ccf9858", "comment": "Malware payload (IcedID)", "value": "0fbdc8a2acd4dc782821cfa4fdf75099", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126162, "uuid": "df7b59c3-c67f-4a40-88da-fb6178870cab", "comment": "Malware payload (IcedID)", "value": "abd13b66e40db6ad8a4489667c1a1d58fde38e7388970bfbc4d8c7b3fb6cb04e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126162, "uuid": "196b774b-b37b-4e3d-9929-12eccc3b7afb", "comment": "Malware payload (IcedID)", "value": "e407df0a3a3ceed4c3e9aed5716974a45cd5c542", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126162, "uuid": "f3f18b83-7663-48b9-b534-5019fb050889", "comment": "Malware payload (IcedID)", "value": "5185a8b9369c17ffb77302f1596658817ecc3c8d058011fe46119766d3bdf66eb72e308b0976f08e3908fa0b40abbd91", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126162, "uuid": "6558afaa-e230-454b-863a-c620ea9175d3", "value": "A7B3CFBDD502E4E2CB69DC3DD1167412AD5B91877F0FE61F208621AB0803DA76E352AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126162, "uuid": "e2b03368-9632-4614-8120-05dfa6f83040", "value": "1536:8utuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:8kuocrZDKGopH8x+8HdoLqp6vif+zUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126162, "uuid": "e503feb5-706c-4aab-999e-60e1edbb0db9", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126162, "uuid": "45a5a9c3-c0ff-4132-a096-0200c3e694ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126162, "uuid": "a45f5167-f4be-4ef8-b84f-6e7c07f9f51f", "value": "statistic-2070252624.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cded62-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153122, "uuid": "4c770e28-3385-4151-a6c5-a85f769eb460", "comment": "Malware payload", "value": "6d27d5cf12ae7412b414233458059ffb", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153122, "uuid": "a25591a2-8002-47e5-9e42-808d7de09cdd", "comment": "Malware payload", "value": "ac687234cf7f721f37c8199f23cac5582788b34536c48241217bdb7549d15a29", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153122, "uuid": "ec94d2e7-c8a8-40c5-beb9-d45d5ce3e9cd", "comment": "Malware payload", "value": "60f187f6d15bb523a2e507ff5aa4ae8030c48133", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153122, "uuid": "5409baa6-ffe9-4d75-a03d-d87faca7e59c", "comment": "Malware payload", "value": "c59cb5d73177f11fc6c568bb5dfcff444a46979b888eb8fa6bfdea383e51ae2d79ee9027e94d5d5f37a8711163857c4c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153122, "uuid": "51406a45-9958-478e-a018-a71c16ce3ece", "value": "C705234699C03DC4B0ACAD1B2E8E8509509AFFCAA078E64741E4ABD7105E75C2FB333D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153122, "uuid": "c59f7ddc-88a0-40af-890d-1e80251dd9d4", "value": "24576:G1HxKBpxMjuBd5QUP+GDxDQjKS4hoczMK:G1wBp0uBd5QU2GmjKSGLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153122, "uuid": "cce2a9bb-908d-4295-9ce9-737e48e5bb37", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153122, "uuid": "82f76b52-6637-4601-9324-f737dce5601a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153122, "uuid": "b87c046d-3013-46d5-9e57-a2ecec627469", "value": "ac687234cf7f721f37c8199f23cac5582788b34536c48241217bdb7549d15a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8814c054-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111681, "uuid": "f91339ca-a0ee-4187-b40f-8bd498916d17", "comment": "Malware payload (Dridex)", "value": "5f2e166e8f80b23f4b44b58cc217efe8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111681, "uuid": "79376e2c-01ef-433c-af29-69a438473d84", "comment": "Malware payload (Dridex)", "value": "ac83f582efbca501f495deb6427c7e880dea6e36f6c6e35e219565af98357b57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111681, "uuid": "0eb5a591-3b61-4bf8-93e1-a4a7758d9977", "comment": "Malware payload (Dridex)", "value": "712f5f9beb81e89dce6206d1b5c26ac0616aa306", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111681, "uuid": "327c0d00-432e-4202-a6fb-1a5b7f66765f", "comment": "Malware payload (Dridex)", "value": "f2ff951a1285dfeee21e9836d8587810b1f7aafa850547fc42c7d9684e854b921243f0b106b729ece9423f79b438cf8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111681, "uuid": "8541052a-deaa-48d7-83c3-31deaf57b83c", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111681, "uuid": "63ef0f6f-28dc-4d9b-8753-f0cb8dd7cd3a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111681, "uuid": "07e4e1b1-ac25-444e-907e-6747daa5f846", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111681, "uuid": "09a6205f-cf59-4902-85c9-231066fe5beb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111681, "uuid": "ddeb6d70-a875-4ff1-859d-69578768ec61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111681, "uuid": "d846bc77-9124-4e6f-b790-15b512a1126f", "value": "5f2e166e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59da14d-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097262, "uuid": "40c10acf-931a-4c7c-80d6-f2a737caeaa7", "comment": "Malware payload (Dridex)", "value": "180f69b78ca2e8ee5dd480ee4a1e73d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097262, "uuid": "95bda9e9-4758-4a60-b0d3-32789b806a4e", "comment": "Malware payload (Dridex)", "value": "ac9b57333df224d124e5775edb9885048522cb3750c3ce12a8ce9d38a34a9c4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097262, "uuid": "ee4caa98-ceb8-4805-8b97-df1c1e13e285", "comment": "Malware payload (Dridex)", "value": "eb84cde47a2b06aecca9c67a02c91c88e42aa76f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097262, "uuid": "4fa88de2-86ff-4ac6-bfb5-5058d99a8a2e", "comment": "Malware payload (Dridex)", "value": "2c51799869814506baa8428610cc08965e0072e699462fa7d3319d8a46f0f24b32f3dfa949a18c93a1c2e122ca4a8031", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097262, "uuid": "21ce18ce-66e3-481d-b1cf-10d74401069f", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097262, "uuid": "b1b2a726-1c39-4526-8f9e-4b8ef7e269bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097262, "uuid": "727d4c8f-cc7c-4403-9ff5-499031543ab3", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097262, "uuid": "d7ae0b78-37bc-444c-aabd-29e7ea2a3075", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097262, "uuid": "fee89dcb-5831-4676-abd8-6a27648879f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097262, "uuid": "332732cf-f4d4-405e-82a5-66acfc617d85", "value": "180f69b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0218dafc-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620141950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141950, "uuid": "9ff73931-12cd-4d6f-93c8-f2335a2e0f30", "comment": "Malware payload (SnakeKeylogger)", "value": "d6b608c55871cf8d00f5daacd3d8c858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141950, "uuid": "602bf92e-56bb-406b-944b-529e0a13001c", "comment": "Malware payload (SnakeKeylogger)", "value": "acb59cfe4c0dcdfdbc835fce99582cae54d6d3afb2233eab94a0a22bfd2c2dd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141950, "uuid": "af9e78cb-7484-46a4-b888-57bcb6dac320", "comment": "Malware payload (SnakeKeylogger)", "value": "3a53fd8d9d5e5b136aea4083f6881a18c59414ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141950, "uuid": "33ae2638-208c-4e81-97e9-78bfdc9c990b", "comment": "Malware payload (SnakeKeylogger)", "value": "0c41b784d865a5f5885afb56c7aaa219d08806e725d1c3c751642383f855d6618c1e27e0f78cd7e95580a0cb21bdf2b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141950, "uuid": "b9d44b93-35be-4c96-bf91-c0993016a413", "value": "AB05BE27BFA89651D0BA1F3418390310A7F5FD1AE225C31F2D647059EEF2AC64E267D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141950, "uuid": "a04b7997-f099-4ff0-be31-3cb8f102b055", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141950, "uuid": "8e7cfee5-ba1f-4ddb-8f12-2f7a31be3c33", "value": "12288:HCzLBD/3zsKMSnc2AOABLwKdExMtWXDEEl078yoFSUX4vOJb0MXRfsx3A4zAzUzk:HkQEx3OMFSUXDaMml7c8RolB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141950, "uuid": "98256144-7614-49ca-a2ef-d05633360444", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141950, "uuid": "3fdf94d8-e827-477a-a327-b04f2365d2a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141950, "uuid": "1e2fc150-b5f8-4768-9c17-875e34945aa9", "value": "Presupuesto urgente PST56654256778982, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061344aa-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153124, "uuid": "ec9d0890-6522-4e64-86b2-f4c5c73ec77a", "comment": "Malware payload", "value": "b76b43c6ab17efcac6e59197dfd3f5de", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153124, "uuid": "39af9de6-9bf9-4ee2-9b01-db5ea52d1555", "comment": "Malware payload", "value": "acd781a4780778a427df4a3dc90ff066fb73a226480638c1007b7bdaad5d4bdf", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153124, "uuid": "6221d355-83f8-4071-8bdc-90c7feb19fb1", "comment": "Malware payload", "value": "74495f69a689e4fe08fd5b449d7dd965b592f6df", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153124, "uuid": "698ded8b-7d66-4901-b5f8-48fa736eab3e", "comment": "Malware payload", "value": "ed913aa59bbdd41045c76c71e682dc8cdcf5acda1695fddcbfaea77a78431163b9ccc0679aaa20f39af5a69af27cb7f9", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153124, "uuid": "275c6987-9a1e-4fde-9c92-6a7ebbb55bbb", "value": "C1A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153124, "uuid": "17709057-2d92-4ef4-ada6-5320f653f973", "value": "96:PRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:PRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153124, "uuid": "8a2e7499-adae-452c-9ff8-2a211a9527f0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153124, "uuid": "864aedd4-4bbd-4381-a7d4-54fb4c315021", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153124, "uuid": "c6dfe319-8189-4b10-836a-f04841aa7a8b", "value": "acd781a4780778a427df4a3dc90ff066fb73a226480638c1007b7bdaad5d4bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cceae3a-acb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620116628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620116628, "uuid": "cfa2e2b3-265e-4890-820a-ef037288b834", "comment": "Malware payload (Dridex)", "value": "b6921ce0f1b94a938acb6896cc8daeba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620116628, "uuid": "8b3131bc-70f8-425e-b808-a5a1c40f7ce3", "comment": "Malware payload (Dridex)", "value": "acdb2120e05dd8633ccb5bf6d1c542a132066d116c7d41aa4235c70f43e0a7f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620116628, "uuid": "76142916-846b-43ea-ab35-9f5d8df741ee", "comment": "Malware payload (Dridex)", "value": "932606b71dcdf84a83fb1ad61ba3251242f59477", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620116628, "uuid": "1493fe50-986c-479e-98e5-384a18bcbd21", "comment": "Malware payload (Dridex)", "value": "bf5cae3d4894411b5d3bf1c60d9789f6e02bf3a38d72a186da658a989b88d76f058c85269ec940ef99e74df0160bbe1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620116628, "uuid": "2827e448-8034-4f81-b4d9-9507e7c2bfbb", "value": "9233F26BFEAC9448ECF3647DE47684D8161815C522D3E76F3D06A19C26430B34B88FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620116628, "uuid": "d80aa7eb-29ba-4315-a48b-f4ba0b5b3b16", "value": "1536:d6a62hJM5uOrfok1w9Ut++LmoLBkmpLrP:dgeM5drfxpdxkUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620116628, "uuid": "61f685aa-0371-41fa-981d-e9123e4fbb11", "value": 54449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620116628, "uuid": "328ede58-e1b9-43fc-8548-7e5e9ebde2d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620116628, "uuid": "ab1fbf12-b0d5-4c07-8af3-f444de586ca0", "value": "292453 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f97f717-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108123, "uuid": "84f7919d-e2ab-4ec9-a04f-b5feffd71a12", "comment": "Malware payload (Dridex)", "value": "5bf60f382c63776a2a3a61a02c9eab7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108123, "uuid": "cd4ee4ed-302f-4821-a81b-cd07d658aa67", "comment": "Malware payload (Dridex)", "value": "ada7e34b54deb6537735247bc387c93903ab716330925204a1c0ab2d00432d8c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108123, "uuid": "86ca9b07-6e98-498e-bb0e-dd7548efbd4e", "comment": "Malware payload (Dridex)", "value": "23c925d0705e7bf078f829912ef33224f597217c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108123, "uuid": "d4267459-c00b-4744-9c72-8ac4de3e1dd4", "comment": "Malware payload (Dridex)", "value": "b11da14723aa622846fdb4cdab6284302e79848814d33f37f7de6e04ce1cdad2981dd023d003b7b408d9946379795934", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108123, "uuid": "9f591866-8a92-4b1b-9a24-6655bfdc78a4", "value": "A4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108123, "uuid": "499af10e-73a8-4e0f-b690-f947b3e1212f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108123, "uuid": "e8b69518-459b-46eb-badc-6a3b24254828", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108123, "uuid": "902953ff-5fff-40cd-906b-d33799ba48ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108123, "uuid": "a7bcfdac-b7ba-4775-bb8e-260ec5dfd42b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108123, "uuid": "e3dd771b-2e2e-42db-b7dd-6a9454861c8b", "value": "5bf60f38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dc99ec-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086518, "uuid": "168f1cf4-522c-490a-a844-9b3ba1057a8b", "comment": "Malware payload (Dridex)", "value": "8241be1799197962286e6f211bb86e32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086518, "uuid": "6a9fc876-04f5-4f5f-9bd8-ab4070102b16", "comment": "Malware payload (Dridex)", "value": "adb78675856e026ff82f2fc2ad4a114b99f62ab4ef06e6df975b47a0516844f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086518, "uuid": "30d9f99b-33a7-47c3-a501-8b30bb5f29b8", "comment": "Malware payload (Dridex)", "value": "63161e17985516688e5f97e99bbed920234cbd86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086518, "uuid": "82cd99fe-a44c-4c21-98f7-755694de35a0", "comment": "Malware payload (Dridex)", "value": "ce3f0b2b5d282f7b4a21ec524293cefd3aa3938b14a56d5917434ee3dcc2105a8e6e722aec39bb812a6f2ec11785b717", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086518, "uuid": "3ce702c1-66c1-4c40-a14b-6d5981cfa0c6", "value": "D6F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086518, "uuid": "d0a5f6ba-d603-4fd5-8750-e4139bba4294", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086518, "uuid": "7e6165e0-80ca-4c5a-ae99-e38a3b11051f", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086518, "uuid": "6a9305d4-2f30-4968-ae8f-36ceb920681d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086518, "uuid": "7d901f6b-8fff-4f18-be25-11fa6bed7fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086518, "uuid": "fac65958-5f05-402f-b850-652d2bc82bb0", "value": "8241be17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0d791c-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153137, "uuid": "0ff2d187-fef5-4824-9781-22d6a03a9985", "comment": "Malware payload", "value": "5f196f19e716344cd574bae28f20f180", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153137, "uuid": "730f3225-6e21-4f97-8f45-de1f60708dcd", "comment": "Malware payload", "value": "add0ecf54528a4c28539b276d4ccd1cbd2539ea80bed4090ba3aaacd85a9a13c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153137, "uuid": "1eee68ea-ffed-4262-99df-69f44be6637d", "comment": "Malware payload", "value": "a7f7a28011f306d73d8dacd29ca7f34227aeafba", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153137, "uuid": "56b3a564-3bc9-4ff5-8844-4e32fcd8548b", "comment": "Malware payload", "value": "d328500fa068e8b2bba4ac6c0fcd5f163c6338dabceeda196c93a94c88708ca6153d534c29e2aa954073ea7cc078ea5e", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153137, "uuid": "c6210c8d-2d92-4332-b755-3ae53bc475b3", "value": "6BC533AD71DE28FE82E4E732B7EFED283016A58D602187906DA381CD1C16131D9EDE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153137, "uuid": "d9ad8ce3-07a8-4877-8b57-b8abe0bc11b0", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hO:tos909Qg6ecEZHyEexmLaI9MYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153137, "uuid": "2d821e0c-a06c-4746-a448-ab16474d9972", "value": 2707456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153137, "uuid": "5bfe09fd-fde1-46e1-b124-30c24bfad1cd", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153137, "uuid": "5c1c5ef8-b1d0-48a0-b4c9-a4f0e3911a00", "value": "add0ecf54528a4c28539b276d4ccd1cbd2539ea80bed4090ba3aaacd85a9a13c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abc09c1-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108034, "uuid": "dce8ec9f-ff2b-4bd2-9c63-9b39d2eb664e", "comment": "Malware payload (Dridex)", "value": "cb7f2558c5bdc62dea91e423c05acd39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108034, "uuid": "4854263b-9588-4c7d-8590-f820877f7620", "comment": "Malware payload (Dridex)", "value": "adfabf1f15f19ac3a343cd83c32a4733e3a3716ccd792f2b7480c51ea3b7a6ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108034, "uuid": "a2476dc9-2633-44ae-af4a-35b09eed1416", "comment": "Malware payload (Dridex)", "value": "80d150774f92b526034c4c7eb3b8482290c0bffd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108034, "uuid": "4dd86ab5-5081-43f4-bc43-39486f571a93", "comment": "Malware payload (Dridex)", "value": "480161358ddbb29b043560ea539b8e1be2ae8bf3a611dfd31eb4579972eb9bd742f99633cda97b03eeefcfeed7550b9d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108034, "uuid": "95e0f57f-1c8d-445c-adb1-cf12bf0d124c", "value": "9CF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108034, "uuid": "af92c13f-68d3-4af4-a410-35c84df9be49", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108034, "uuid": "502c0cb5-3e71-4b8d-9197-b83c7e936c33", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108034, "uuid": "9d91b4ca-9d2f-43a3-b761-95aabf903a71", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108034, "uuid": "7de362ce-da12-4517-86af-47fb7af4cc8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108034, "uuid": "a1c77359-5597-4e91-9bca-88af8fc0e174", "value": "cb7f2558_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c584d9-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095218, "uuid": "868ab2ba-ecb5-4f6f-85d9-e1a2108a02db", "comment": "Malware payload", "value": "ad733cbea7b45cfd89d10f2fb5e6adc2", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095218, "uuid": "43423766-3136-4145-bc04-10283d4a36c5", "comment": "Malware payload", "value": "ae0a99c5cc44699f19c5967df89e034876b214da707275a33bcf7298697ac184", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095218, "uuid": "fcd5fe54-d150-419e-9019-20b0ae5f7a91", "comment": "Malware payload", "value": "5d2d0273a1fb588c9759c3bc2d0d78491352c183", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095218, "uuid": "f317fea7-eb02-4655-90c5-5858057566ec", "comment": "Malware payload", "value": "ba8b08eb0c717a94111cfa126ce7a949600f382441e265cedcd1be812be970b4cb38f097eee0d977c2863f72ae017109", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095218, "uuid": "b9fdfe64-7d53-4825-bb91-03e500d58ad3", "value": "D6C56C89715275BECCAFC475BE6C5C64E66039E6530AD2036033A9DABA1C797CF081E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095218, "uuid": "b32facc9-7365-4fe0-911b-1f8377fceac2", "value": "32c5de998b5f069b26c94c8143b13c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095218, "uuid": "d4103594-2b45-4dc4-9396-671ad20f3591", "value": "49152:65zs34n4fi2GKi2Gdi2GKi2GKi2Ge4myhRb4mmTZmVxnF9Ju:sQo4fi2ti2ki2ti2ti2mdR2snpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095218, "uuid": "d044e888-0053-4c08-ac49-4dbc46bfe600", "value": 2618368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095218, "uuid": "da5ec097-b748-461a-aeff-21fc87f85e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095218, "uuid": "3352ec48-c81d-44a2-a637-25cc1735717c", "value": "AstarothSpammer Cracked By zFxbixn & Nichaen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7a4bbf-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133379, "uuid": "091261df-5786-4dfb-92de-dca067a671c9", "comment": "Malware payload (AgentTesla)", "value": "d9b7736721f916f9da67529ebd2bbf72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133379, "uuid": "1d4b8e83-d1ba-477b-a6ee-e190b7d10bf5", "comment": "Malware payload (AgentTesla)", "value": "ae86688173bc179c5ee6a48d56618aa007a77720213568e5d4115430829f2cac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133379, "uuid": "ba4eb349-c38d-4d69-8c5f-ea1028bf5ca1", "comment": "Malware payload (AgentTesla)", "value": "d6b891983c8f3175123baa2a8ae94a3e28b6864a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133379, "uuid": "c8ca63b2-13ae-473a-9089-7d4401dc497e", "comment": "Malware payload (AgentTesla)", "value": "6f8a5a44ca100b7299ac41fa3249198533b5d18e7af7bc9028bf4ba9df6ff17253b1b3b784247951c36d1081e3dfad16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133379, "uuid": "5baaff8a-e7df-4c2b-b197-4f7e70e8c91d", "value": "20B54B5123A4AE49E93E57F48730451C47F6BC17DB72DB9EA88470991FB37C08B2A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133379, "uuid": "20a8c608-1160-4570-b28d-5adef370aa79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133379, "uuid": "3fd670ce-1203-4aa1-8d3c-f477b841a0b1", "value": "24576:54EdVTHevz5ZE1Xc/aIquRr+qD4OjJMQIQUvwJuOPBDmIe:544T+vz5au/aaRV7ID6uId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133379, "uuid": "b17523e2-a9e5-4280-b602-38fbb228f269", "value": 2287104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133379, "uuid": "96a9d517-3362-4c55-96f1-23bfb1f93321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133379, "uuid": "395e4bfe-8509-4d12-a07e-f159d38a51f6", "value": "ARRIVALNOTICE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b032a16-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620090077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090077, "uuid": "90432bda-e0bf-41d8-9606-c1b69a88df6f", "comment": "Malware payload (NanoCore)", "value": "f908098af6b73a5ea4081a3474030196", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090077, "uuid": "6cfbb273-b7ab-4db1-b2d0-dd774069d77e", "comment": "Malware payload (NanoCore)", "value": "aeb4339ff4e4d6f8249236e1280111324d84920c23a169cffc67577ab9f69217", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090077, "uuid": "120e3ce4-e1cb-4153-aa33-27b3c6dfd167", "comment": "Malware payload (NanoCore)", "value": "7c92b17c6e2ede3e3bee94c41603795c93d53c89", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090077, "uuid": "87e8b8dc-48d5-48f0-a901-4bf1aaf04eee", "comment": "Malware payload (NanoCore)", "value": "f80601f76660488d2122892fa0ea2b60f6d249fadb1c5bf2fbfd87aa6de27f3d3eb7c6966b3321af9846da62746fc0d9", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090077, "uuid": "6675a1d1-f256-4ac3-8706-45217cf38684", "value": "8AB5D1992EB3658D7B68F4A315A88F80C93FF83249F991D7320953025F56B427812FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090077, "uuid": "17f61ce4-32d9-4476-b515-ceb5a822fee8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090077, "uuid": "aa68d418-66a3-454b-bef7-35a4b41ffab2", "value": "1536:6cvkyC4QOoyJ+e6LlKK6Prm6P/T6jAnJ6RIB6P9J/e6LoB7/s6/nYBew18hZEMGd:Bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090077, "uuid": "6b44e952-9eaa-4f40-bc20-7f4d0617aa0e", "value": 2311168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090077, "uuid": "f038e8c7-7aa0-45e6-8e7b-fcbba87dcee8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090077, "uuid": "f438d7cf-e501-4672-9cc9-24358eba1f51", "value": "f908098a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9f2d1e-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086506, "uuid": "7ca1a3ce-1055-4119-a4fd-77fc04a9fafb", "comment": "Malware payload (Dridex)", "value": "e7a4bb06403138a70507ca7d95cb0b0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086506, "uuid": "cef2ddd6-734f-4e67-a75e-858a48b7061c", "comment": "Malware payload (Dridex)", "value": "aede27c73210d82e459f72960e920e0d1e5e24ac88cd9712e6930d61d9dec86a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086506, "uuid": "327abfa1-c529-489d-bfab-6868f25d9a54", "comment": "Malware payload (Dridex)", "value": "23b15ac25c5e89aabcb20010a2ce5fa37a54c74b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086506, "uuid": "51d9d196-075a-45db-abcf-da3ddc9f95d8", "comment": "Malware payload (Dridex)", "value": "a078091b3a941044bcc2d0ddfc514366c9bd7c419a609d7abe101dafe12a52d60174aa9354a0c6f1478261f27f93577c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086506, "uuid": "61d765bb-dca1-44d8-91fd-508f4a8c04ae", "value": "27F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086506, "uuid": "50c63eaa-e063-4348-8e1f-561ce2a90983", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086506, "uuid": "d04b7f36-fd43-4fad-826f-b6c0a9bc54df", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086506, "uuid": "4d56d501-d390-4dc8-8fbb-cef2e23d6a08", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086506, "uuid": "c1870eae-499f-435b-af24-8ee54c5dad11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086506, "uuid": "46ba96be-2f65-44f3-8531-9dbc85b7d37d", "value": "e7a4bb06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17060d46-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153152, "uuid": "9311f48a-949c-4a36-b989-b5f2bbd8a2a2", "comment": "Malware payload", "value": "cc0f565a632fb1e430fb66813454e173", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153152, "uuid": "8ecf7a61-d1e5-451e-b0db-f7870d9c6438", "comment": "Malware payload", "value": "aef44846729ec8db8a3b85aa9fb1f1caf8861819c17ccc631435e2df0b4d3da2", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153152, "uuid": "19d6d819-f031-4fa4-820c-1721ae186b00", "comment": "Malware payload", "value": "32aa3acd9c508061cd7966f893d8784c28d45e99", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153152, "uuid": "c3915e17-3433-4d4c-83bd-f91a76b53c5d", "comment": "Malware payload", "value": "d057e5884a46961258afd3239bfa287ca6a7dffbe1766b1f189cf0ff04d59394f666493b54461a6e21871b97731fc2ab", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153152, "uuid": "eb97f0a2-b3b7-4830-8d24-6ba0795fdc11", "value": "F7B533B971DE28FD86D4B273ABEFD928302BA58D60258790AD7341CD1806231DEDDD1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153152, "uuid": "82c879ed-8645-417e-b7c9-f0aad97e9390", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLl:tos909Qg6ecEZHyEexmLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153152, "uuid": "049488cd-6c24-4973-889f-19289d3e2b52", "value": 2465792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153152, "uuid": "0c795bfd-d99c-467b-980f-ebd12b04ea6d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153152, "uuid": "29582bf4-3b4d-442c-8b9a-689080aa8253", "value": "aef44846729ec8db8a3b85aa9fb1f1caf8861819c17ccc631435e2df0b4d3da2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9473ae63-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620093663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093663, "uuid": "a04dd816-7fab-4ffe-a95e-5fb6e881c746", "comment": "Malware payload (Formbook)", "value": "c8080fbfc825b01f11973566f1a3e589", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093663, "uuid": "8090517b-8a03-4f6b-811a-443d4cc5e0bd", "comment": "Malware payload (Formbook)", "value": "af801e43101c06e3366d942715a8b10f90f12ec3437cab1b8a0cc3872101eebe", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093663, "uuid": "62d03d74-9d3d-46d5-b0c9-b272cdcbb02e", "comment": "Malware payload (Formbook)", "value": "9aa04e64414bef6504b211615f7fcdbe84cd75df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093663, "uuid": "8c4c0cfc-9481-4b80-80e0-4eb9c174981f", "comment": "Malware payload (Formbook)", "value": "71fdae827b838ad852260df4e0d0a3bf00832b93358977ed77da969bcd9c07bd3ec57d909957d65577d99630d8819c30", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093663, "uuid": "116ac120-7bbc-4e5b-ba11-5619128e7284", "value": "0684BBACC49746988F86ABB86B1F2F85114C7A6EF744A5337234977527E2C7B901383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093663, "uuid": "3e77a2b8-c247-48bf-9148-49dc5c37a005", "value": "6144:jH5dzMKnIGWZelMba7pAlU+mJhnAQsrNaGfxp+h+/LOwYn1E1vADCWgol06l6uON:AOwAokd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093663, "uuid": "f4ae8a87-b3ca-4849-a17b-ed8335b5d2b9", "value": 385915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093663, "uuid": "343b515e-3372-4992-8170-fb3d883d7711", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093663, "uuid": "05bd6ce5-b6e4-4121-ab0d-59deae70cd4b", "value": "c8080fbf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2dc21d-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153163, "uuid": "e1a9567b-454d-4328-9350-8647263f532f", "comment": "Malware payload", "value": "3d34241b563e2188fef0a83870720143", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153163, "uuid": "e990f548-5cf7-4049-b44a-3e53e08cf765", "comment": "Malware payload", "value": "afb416cf66e46797127eec201a60d396fdf1d275fb124b80217a473340a08045", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153163, "uuid": "cc9dfef3-da81-49ab-8a46-71217cdea7b6", "comment": "Malware payload", "value": "03f0933079626f56215a5ccbb61ee2d8be513936", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153163, "uuid": "001dc207-f78d-4bbd-bd5e-786e930cf923", "comment": "Malware payload", "value": "fac3262c3515957af33520db570bf0710df35a529df374da7b837977da2a32f1ae88b4a3c39010688d1457d43410c35a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153163, "uuid": "2599d8d5-797b-4211-86fe-a7e5d374441a", "value": "A5B53351B607249AEE441AA0DF0CF6B9A950CFF1B5D1C770F9B05F4B23B8A582F6C851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153163, "uuid": "a39ed2a9-51ac-4792-b153-5a469b1bfecb", "value": "49152:l1UdkOgGKlJkHZrZ39xWgpsc9Ersdu9LxhM/uZd3cKLN0x2doXoLf:l1akFnQrZ33WKCguRM/u75xLUoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153163, "uuid": "4ef780b0-b6da-463a-9845-e6d6f603b23c", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153163, "uuid": "adb0313c-aa9b-4da0-8e70-2381c8f2a0d5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153163, "uuid": "b653387e-3efe-4dce-8d81-98a5bea51a5b", "value": "afb416cf66e46797127eec201a60d396fdf1d275fb124b80217a473340a08045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6de2c7-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153165, "uuid": "38aaf8d2-000a-4df1-95fd-95244ab84b5a", "comment": "Malware payload", "value": "45f969541a3927720fa8a623211c7a68", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153165, "uuid": "202ab8b5-942a-46e2-aac6-ef518655a44f", "comment": "Malware payload", "value": "afd38dddc2d56d66e896bf96b2e8b122a2361cc09c69ab59064a9dae91117483", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153165, "uuid": "c84ad350-9dad-4fd8-b153-6bd17a9b1c3d", "comment": "Malware payload", "value": "a7c2ca4f86284f1ab36e90d8acae9ba261e0c26d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153165, "uuid": "43525483-63f7-4245-9564-9b934c6150be", "comment": "Malware payload", "value": "ee87a8580f648d2a0023ac387f000d50bea0888e852c987988ab2850a92105bdb429fafa307bf6b28530a39e417ac7c5", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153165, "uuid": "a6f8c2a5-ed63-4f31-904e-d460cfe94f3a", "value": "B5A1F850112C1AB17346597AD26FFA52B90EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153165, "uuid": "d5036a09-d0a6-49fd-96ed-e992fd199bcd", "value": "96:ZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153165, "uuid": "d8032e4a-d97a-4948-808e-26c631947250", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153165, "uuid": "ef60560d-cbc5-47a6-9b26-e2952ac5f584", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153165, "uuid": "7099d527-dd83-4791-aeb9-2b8f838dfa09", "value": "afd38dddc2d56d66e896bf96b2e8b122a2361cc09c69ab59064a9dae91117483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5536a2b-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093691, "uuid": "16bc6494-1315-467f-bb12-a0440298bfa8", "comment": "Malware payload (Dridex)", "value": "5c1719bfa55042094ddfb97b1d5260b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093691, "uuid": "f0bd2435-bba5-4fc6-952d-cacdc04ab396", "comment": "Malware payload (Dridex)", "value": "b034f8fa0ff76747750feb683bfdd93f7bbdac6ab6e1264beba20fe49fcd280c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093691, "uuid": "116affb8-9ccf-455c-a6df-4005ff57e9fe", "comment": "Malware payload (Dridex)", "value": "afe8e8ac5968f2cd560bdffb12b18b10eacb2bc7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093691, "uuid": "35ece41d-5877-469d-9c1b-745ba0b1a60f", "comment": "Malware payload (Dridex)", "value": "4ae494054b85edc24123c3ad6530a78228e6eefbddabbfb472ac3fcb6566ef8c4024b08e0699a921f52fc834506474ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093691, "uuid": "49f0a6e5-6721-498e-92f8-642d285cf64f", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093691, "uuid": "1dc535f7-d769-4089-b08b-4da3bf1270fe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093691, "uuid": "af7b4638-a2f4-4249-a7be-3c872c165fc7", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093691, "uuid": "4d469b7b-8f85-4ecb-9261-4c2a88ce8441", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093691, "uuid": "a64579ca-1d16-4c5e-b424-4b9f45dad1af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093691, "uuid": "7c83ab3c-5296-497c-95a9-44905369c0e7", "value": "5c1719bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409abc9c-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118862, "uuid": "c2f3e6b3-2dd6-465b-b838-60545e51a50a", "comment": "Malware payload (Dridex)", "value": "4efbc7558363bd2f0e876092d762b9c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118862, "uuid": "92dc8ccf-069f-4221-925b-79f538b98578", "comment": "Malware payload (Dridex)", "value": "b062f984ffedb9c25d426cf8013b54c65440109e755cf0a59707c542c3952b20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118862, "uuid": "819fabf0-7768-4998-97c7-70a0e54a9abd", "comment": "Malware payload (Dridex)", "value": "43bf2a3cd0558f2eaee0e84999b93056257bc901", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118862, "uuid": "d8f5140c-8faa-4e8d-8a43-bbeb6d7cb497", "comment": "Malware payload (Dridex)", "value": "adbae3b7a9403b687fd109fff8969498209c9a917900c99089f8155b6aad29027c3e17ccebdd84c9a32dc8d4fb4c035e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118862, "uuid": "8829859e-8f69-4fed-9659-184079f96174", "value": "39F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118862, "uuid": "282c25c8-908f-4a82-b0d2-0d51367381bf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118862, "uuid": "e9931d3d-f068-4be7-9b72-c4da3b9405d0", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118862, "uuid": "ecbe7896-9643-49f8-899d-a07d967ed0fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118862, "uuid": "83ed8212-b74a-42ef-bbe1-38e4e63c6b77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118862, "uuid": "fa56f105-b68f-4e97-ae0d-8d4c70695028", "value": "4efbc755_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57560c1a-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100862, "uuid": "fa94a977-f42b-4189-82cd-762335bc800f", "comment": "Malware payload (Dridex)", "value": "d563f70ccb62361afcb5dea24d4260f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100862, "uuid": "55a4f01c-7b45-44cf-bb42-47eedac47178", "comment": "Malware payload (Dridex)", "value": "b065bc223836f748280ad4b9772dc08d27f8bf56916eaee89396728fda586527", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100862, "uuid": "014e3230-14c4-4577-b51a-92935bf23a56", "comment": "Malware payload (Dridex)", "value": "12ee671d659e511922ee496b2cbf2655955ad4b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100862, "uuid": "ddeae821-207a-4178-a698-fe1c2c25bdfe", "comment": "Malware payload (Dridex)", "value": "4bd44e35865fc8b88fc1f330100b5796102d8499e8fe9e3bbb83fca82c9bf37dab053df06ea8c08fe2492263adcd31a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100862, "uuid": "ff062297-90ba-4238-8550-4cbb51019abf", "value": "76F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100862, "uuid": "050c0f10-693d-4a0a-be53-07de820fb8ba", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100862, "uuid": "5b24f932-be5e-43d9-843e-672feb852879", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100862, "uuid": "e0cf2a27-96c2-4eb8-a2d9-93313ba4445b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100862, "uuid": "a8db9f63-7ec7-460d-83a7-ee44dc63cc10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100862, "uuid": "c2addc2f-3ff0-4207-89ea-77ae2f88289c", "value": "d563f70c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c9c6b5-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1620115244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115244, "uuid": "eedd898b-3234-4f3d-a89c-420d81a8a9e1", "comment": "Malware payload (SilentBuilder)", "value": "e1df57deebdfeab450bf91049acff902", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115244, "uuid": "e5e44e6d-efd4-405a-a367-e800202650e8", "comment": "Malware payload (SilentBuilder)", "value": "b0cccc9e79029c5b0b4e835e22e783a37ded6a300ca9d1738e554b126dd0969c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115244, "uuid": "7dd76143-caa8-4d58-b35e-370a9c024efb", "comment": "Malware payload (SilentBuilder)", "value": "0037a523a17be3411b88072f7ceb3cc0ef384da7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115244, "uuid": "4a9cdc7f-404d-4e4f-85d4-1da7e61596f0", "comment": "Malware payload (SilentBuilder)", "value": "56173f494ba9c8a3c08dfb0c41e54679252e4ea2348c93b0de466e7a397f98dd65b531d7c02e2bc01a343772d01e7ced", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115244, "uuid": "5161c457-9804-4e4b-afba-d7cc53ccd60d", "value": "8254C482A112952CE1544F36D826417F4AA7EEAA7B38F1872C04FBB7BF771E12F41509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115244, "uuid": "be0c9089-a6ce-4b87-857a-aee5b6070c9a", "value": "6144:YcPiTQAVW/89BQnmlcGvgZ7r3J8b5ICJK+T5gE:lDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115244, "uuid": "bf20daa4-881d-4d4f-b236-0f2020a60126", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115244, "uuid": "d8bea9e8-6d54-4286-af55-f7d97d46f1b9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115244, "uuid": "a99cc901-d84a-4b36-9587-a99f7ea19bdb", "value": "e1df57de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2425445f-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108077, "uuid": "83ae87d7-d166-4752-85aa-696c4b87fc60", "comment": "Malware payload (Dridex)", "value": "30ea26b11a02eb044ac4ad45a6d547f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108077, "uuid": "67811411-0f89-45b6-a267-9c3c7b198e24", "comment": "Malware payload (Dridex)", "value": "b1944fc1965af902d471bb4c761f458a4d0ea5cb96e31674ec8017c3453cc24b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108077, "uuid": "6620a67f-26e5-436c-a45e-10a50f83a75b", "comment": "Malware payload (Dridex)", "value": "63a8dce99f6bcce1959d71a8ce11c3221eea31e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108077, "uuid": "15adf831-99f1-4c6a-8214-dbd6efa446b1", "comment": "Malware payload (Dridex)", "value": "89f917d8977213c967497f45f86704525a7fb55c4dca3d851845bea293b5d15567390ee610de74ba4eb929eca7ee7fce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108077, "uuid": "557c8a81-00fc-40dc-b5a9-27b77b3e5a62", "value": "8AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108077, "uuid": "f833ee55-dd07-4872-85fd-0cc48ed91327", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108077, "uuid": "52ce6797-4431-4ad3-8c8e-987d9b04e379", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108077, "uuid": "096e8407-4a10-4a14-8573-2f02a9c94848", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108077, "uuid": "b2bb42b8-1c15-4003-bf9f-650d8c68636d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108077, "uuid": "c515f7de-57ee-4143-a508-3e2c8bc7ca05", "value": "30ea26b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdf8ac3-ac9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620107265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107265, "uuid": "1dcf7738-5ac0-4c57-8d96-701ce2b8c1f9", "comment": "Malware payload (NanoCore)", "value": "0e68933769da7703ef9476ffc7062601", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107265, "uuid": "8e18100e-d95a-42ed-a7a9-1418f918f7e7", "comment": "Malware payload (NanoCore)", "value": "b19f350e914df52a5a2583ae35c021eaa2d6c9071d932de08716eba70630a998", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107265, "uuid": "cbea0597-f8c3-42d6-aebb-383ad9622a4a", "comment": "Malware payload (NanoCore)", "value": "d80fff2255323b88d0db142550d4289bb21154e7", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107265, "uuid": "606a757b-712a-48b7-8aa5-145ae08fe1cb", "comment": "Malware payload (NanoCore)", "value": "9bfb1ca00e1734090ee87a0d5c58fa69efe0375107d5f320bb63db878ee7136a85f85fbd83b8301bb723239dd9dc2bbc", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107265, "uuid": "cfd5157e-98dc-4d0f-8ae5-28f89241523e", "value": "D315239DE9E4EC6827DBC4AC8518B38C73C595108D251A7E34BACBBFC2F121B5D9650C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107265, "uuid": "d345fd9e-fb8a-4d52-926e-5cee8315f9b0", "value": "24576:iXZd4X9XkCjN8cgPFSQevra8xVFWpZdK8Q/V/:irMEFSQeWvHQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620107265, "uuid": "dd07e6be-9fce-4a76-90df-8309f1d4d588", "value": 911146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620107265, "uuid": "ca6b391c-bfa8-45e9-8283-583af16341d4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107265, "uuid": "59f2499d-72cf-4fc2-8b27-b041339d1663", "value": "REVISED NEW ORDER REQUEST FOR MAY,2021.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2558acfc-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153176, "uuid": "f7e84b85-8296-4dbd-b0a2-d1a952ee8752", "comment": "Malware payload", "value": "807dbe19f2af813c2596c20895fbbcca", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153176, "uuid": "05fae860-56c7-47b4-aa2f-466a9496ff23", "comment": "Malware payload", "value": "b1aa659fac61ef071be0195f4f1cf13f801d4dd09092595d7ef7d20214684476", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153176, "uuid": "878e667a-88a0-44e4-b450-e3697cce5fe3", "comment": "Malware payload", "value": "f20fd56485c0775c7213f3d7ff559f2d07aa89b2", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153176, "uuid": "7a032661-86e8-4486-ab91-a3cb55fa1e27", "comment": "Malware payload", "value": "8d56bf4092ab8de89fc162ef0ac245b1c0debd07689c8d15ecd6e9c163c8b9c0977abbb1859f0cbbac4692118c6cced7", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153176, "uuid": "1b24a9ec-ddb7-4166-a923-7d1ffc30cea7", "value": "2DB533B971DE24FD86D4A233BBEFD928302BA58D60258790AD7341CE1816231DEDDE1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153176, "uuid": "15bde91d-4681-4216-ba7b-0dd35f3636fe", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLS:Hos909Qg6ecEZHyEexmLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153176, "uuid": "c888f37b-9ddd-40bc-8262-af68856fbe08", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153176, "uuid": "7702aef8-021d-40bd-802c-26b27bac49f6", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153176, "uuid": "2175554a-6eed-46ef-b16c-5f6482bc9b2e", "value": "b1aa659fac61ef071be0195f4f1cf13f801d4dd09092595d7ef7d20214684476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c118cd9-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152463, "uuid": "2d9b36d4-ae2a-4d2e-a8a4-bc609e7f337f", "comment": "Malware payload (AgentTesla)", "value": "8c2987ef25996649be1a2d6f2150a30d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152463, "uuid": "274e3fa4-f944-4560-bf44-8f30568cf9a9", "comment": "Malware payload (AgentTesla)", "value": "b1f7ca6e53ff7dd757a49539f5e5c18bfeabbe24b06270ce08df45f1c2efffff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152463, "uuid": "09f5cadf-336a-4ed2-b428-ec267d0e0993", "comment": "Malware payload (AgentTesla)", "value": "2b8425dbc57e93fbb2a9bf6d45a491ccc15f0d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152463, "uuid": "5a4289d5-17c7-4eea-94b3-8142abcb3d96", "comment": "Malware payload (AgentTesla)", "value": "8e4d7c9f7cac9ba1f0f3dc051d4a92f0ba2485d229ac647a4d61a4cd13e703305102d759817647a79355d4de252fd1d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152463, "uuid": "e2168caa-6ca6-4bed-a7fd-8845d0869c2a", "value": "3EE4AD277F685652E5BA5F381839031097F5F10AD325C34F2DA860ADEDE2AC18E637D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152463, "uuid": "890abc2a-7956-4957-a0ef-c5a09a716737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152463, "uuid": "7009811b-7b7a-4fbe-8602-241b39e1da2e", "value": "12288:Yt/TBPnNHKManc2gOAQLJtQYxMxJrw9a76Yij+fKFKATuQyrz9+srtgO3pP2:YqfQYx8J09uk6fKEDp1L5P2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152463, "uuid": "ad40e468-6539-4868-a6cc-b7326edeac0a", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152463, "uuid": "7011593f-31e3-441d-94da-18d8aa31479a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152463, "uuid": "d14df70a-fd63-4094-9945-7ab3f274b9c9", "value": "lT2TTQACRLGKK8w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4293810-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086495, "uuid": "7df96b9d-a655-4c18-8a59-7420fd476f13", "comment": "Malware payload (Dridex)", "value": "af43745ef4e91a592284c22d4ad62495", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086495, "uuid": "b6c8f8b5-f057-45eb-a401-ddbfff68c984", "comment": "Malware payload (Dridex)", "value": "b21c73e64df20555701578abc6f09b1c0cb9ec19fa2159e3e7796d2d3882f40b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086495, "uuid": "66d7d5b6-c70f-4cd2-9114-b94b22459815", "comment": "Malware payload (Dridex)", "value": "fde16a153ccae105b9a968f5f0e6043e16e2195f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086495, "uuid": "8501795e-5d2b-40c6-b8c3-73d84475765d", "comment": "Malware payload (Dridex)", "value": "4e464633598771a16495a10d694c386cead62cea6278a82cef5fa010f0ff243870641ee6b396e05bc454a7bc5eeb1e30", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086495, "uuid": "e03b089e-e123-45eb-9918-79f4d7418f5c", "value": "9CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086495, "uuid": "523d6602-38f0-4cd6-b42b-120289018c5f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086495, "uuid": "ef8e107a-fcb4-4b72-b307-4e59cfa7dd97", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086495, "uuid": "38654c40-603a-4a59-8a63-58948147ed51", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086495, "uuid": "35b66ff2-8c2b-452c-92c8-031e6cefc724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086495, "uuid": "c0f2387d-6df4-4b7c-9777-d941aa904062", "value": "af43745e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2c269c-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160732, "uuid": "01e921ea-2a1e-4a17-8122-422733b30cae", "comment": "Malware payload", "value": "3426fb6b312f14a006ae4dc3fce4417a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160732, "uuid": "38dc43c8-aa4b-4114-b232-b50067bcfa79", "comment": "Malware payload", "value": "b3249f9f94ac813fd87b2cf3295620a760bd2d389d55ec1575cd307c9dac54e3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160732, "uuid": "729e2e04-a09e-47f4-8a32-17623d66ec52", "comment": "Malware payload", "value": "026d24a927eef5448491431d131d1b223b77618a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160732, "uuid": "196ab014-a389-483c-b1d4-914b1ed5e0c6", "comment": "Malware payload", "value": "b600763f0ee5599d4044d04aff00abc987f47976779dfc2f2edffda1271e1a2234f7226359c6c344d334eb58658e2b1b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160732, "uuid": "b0a746de-3c13-4ec9-9da3-273196e57250", "value": "2C3186B32DC291220712EA92F685582CE739940E9957344CA5DFC94DB1D0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160732, "uuid": "240ded0e-72b2-4d23-8719-da96762cbe40", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3+M:GEXfhexTvrtWQZUSePSiJVAyrLM+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160732, "uuid": "8003ad71-f0e0-402f-8cc3-b609efdd1019", "value": 1690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160732, "uuid": "f514a50f-78a2-4750-99c1-2d5ff09f7b13", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160732, "uuid": "71136b1b-f725-4e89-8f20-1e18b7269a91", "value": "Gs3L8dwC.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31f8098-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093741, "uuid": "2b86fee5-d235-4aba-9128-8f2483352bf8", "comment": "Malware payload (Dridex)", "value": "8c2f335b000c11f107e7e32f9d749124", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093741, "uuid": "06170ce7-6541-4db6-af6b-44434b20af16", "comment": "Malware payload (Dridex)", "value": "b47287b2c5e6d68f4be55031891aecfbd272e1c833e8829b481ec6cb6fbe1189", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093741, "uuid": "ac712600-85a0-4137-9362-9bb1c6df205a", "comment": "Malware payload (Dridex)", "value": "644424edc74f675c80949815e8de5b2c022bd4e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093741, "uuid": "2c7b7bf9-9da8-4567-8399-ee3262d69b4f", "comment": "Malware payload (Dridex)", "value": "0ec039f4e47a32624c94466e4eea30f4b3153874bc0b304b3a97ed23fde32f3c0703af4f642b35361984bb26a258cd9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093741, "uuid": "925cad27-2c2c-49e9-9abd-95e5e746d2dd", "value": "3BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093741, "uuid": "2bb311c1-e41b-4a56-b8bc-fac0e04ad2cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093741, "uuid": "f2e0e34c-47d1-402a-a6c2-edad3af2744b", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093741, "uuid": "689eb9be-edd7-4729-8a25-9099826f1d0a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093741, "uuid": "6f3f3f9e-6860-405e-9466-35d9d76aca42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093741, "uuid": "6869e2d1-f4c6-4a3f-9a48-c521cf4f120f", "value": "8c2f335b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c0ea9-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093659, "uuid": "979dca13-e2ea-4dea-b557-ab7c6d034ca5", "comment": "Malware payload", "value": "944e9ab9ed997f96a302cba5527dce55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093659, "uuid": "d4895e98-3d79-4df2-8065-ac4bb7a7f111", "comment": "Malware payload", "value": "b4edfbae7eebb593fa9c6e8eb6990f6c2bbb4d9aeb3b16714c9d1ad307bb9808", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093659, "uuid": "8e153f83-96e3-453b-b7cf-e28431860513", "comment": "Malware payload", "value": "fb0fd605c0b390f7f47b94f53380d206dcd971cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093659, "uuid": "b9ef7528-6773-450c-8e3d-de9b51e59032", "comment": "Malware payload", "value": "85cb1243a47c8bc851648d8908f748a42d2725e95c528395c4ba01b6a514eca21e1a8f32a9bf0d131d4e501814dad974", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093659, "uuid": "07e28539-c0e0-43d0-8014-7bf56d8f7127", "value": "6A726FD52A5C8933FEE5393215536A087E3DB7D7F86DB1DF348EB10A2B63A008282D51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093659, "uuid": "c1fd9c98-0567-4252-a370-e4c70ce62b94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093659, "uuid": "b3ad2462-3951-4de2-bdac-32b93bfffe43", "value": "384:lo8DJ/cX4xaV0NfCqRo333Wj9bkzYcE+8G8PZ:3d/OWJpdwYcE+85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093659, "uuid": "c9395a80-1495-421f-b7e5-0844f4a2013c", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093659, "uuid": "f6135073-0e56-46e3-a7f5-402f322e298b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093659, "uuid": "2a5f2858-2eca-4c46-bb8f-5b3707bb7866", "value": "944e9ab9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4ce48a-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153186, "uuid": "ecbf11d8-eff0-4cca-83a2-c097a801743a", "comment": "Malware payload", "value": "29a102d2a3c47c57670b80898a2f6731", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153186, "uuid": "e2802c93-0f02-4f99-aa06-8d752f0ad442", "comment": "Malware payload", "value": "b5908eaa084ab8e25fa44329b743f82cb979894742aecfbe2fd4625c25de512f", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153186, "uuid": "ed0215c0-f7d3-4774-b2cf-b475c2c07135", "comment": "Malware payload", "value": "e9de0082b23b3d23a134458c03905b79b1144e5b", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153186, "uuid": "81c45c72-7bff-4a4f-a749-72f271876e1f", "comment": "Malware payload", "value": "a6e83fc066775e0b8a80a66ef8f7834335f67581c68be55a31775dea3bc1aa61da777930456e006f24d56b87986a7cd9", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153186, "uuid": "e123fdb1-b838-4ca0-956a-31fd8673198c", "value": "1D85330C21B97CECF9DE02293B7289D0C2ED32E1A441B1D676595CA55E6B1FE038ED78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153186, "uuid": "4fe914e4-967c-454a-ba5b-564bf7cb4baf", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYya:IDSTOhnXSI0Wk5jG2nfBtkaeya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153186, "uuid": "52c4ecc7-6627-46dd-948d-5f1eb8d4ed14", "value": 1810432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153186, "uuid": "99350a45-61f9-4e17-8d6b-ec6c182d9821", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153186, "uuid": "66df19cb-1636-4f86-a5ea-ea232270dd2b", "value": "b5908eaa084ab8e25fa44329b743f82cb979894742aecfbe2fd4625c25de512f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807e0a32-ac6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620086757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086757, "uuid": "8e7fb750-9fd6-4339-8f75-b8f5c5708645", "comment": "Malware payload (RedLineStealer)", "value": "6c21c42b564d98a0242600d92dbb9aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086757, "uuid": "74a80639-205f-4dad-ba71-84916ba40f22", "comment": "Malware payload (RedLineStealer)", "value": "b5e9f31e9150c4530dba7fa1d830fdc736ab939aecd563332e0856c7041f3de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086757, "uuid": "f5013d40-00fd-47ed-a14e-aebb85d669b7", "comment": "Malware payload (RedLineStealer)", "value": "a8e3d6fc12ef1e957b5d3e6fe9e7117106da4486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086757, "uuid": "3bfe88b7-0a4e-42f7-8bcf-829cb6eadb8c", "comment": "Malware payload (RedLineStealer)", "value": "47bc507e24312550c3f951fc88073db643dcecf7b9249f4a0478f95c3c12b95c4a1f75e655f883ef9b969b99f6ae3868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086757, "uuid": "6c71e1ce-18ce-48c6-b4c5-181caab8df41", "value": "E414BE1075C0C2B3C4BA143084F6CB799A797036177A96D7BADD2BBA6E512E0A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086757, "uuid": "d06ec332-ba62-4796-8d66-f5adbb8fac19", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086757, "uuid": "37dfe07d-b57f-4a83-af1b-f87bd46e6dfe", "value": "3072:eDKW1LgppLRHMY0TBfJvjcTp5XBB66NSAsTTuGa0P+N:eDKW1Lgbdl0TBBvjc/BgfnTBnP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086757, "uuid": "d225b5d1-3b08-412d-a02e-27a9b4266603", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086757, "uuid": "ede2670a-eb64-4d72-a08a-92b99188e887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086757, "uuid": "e80592ab-746b-4941-8720-41f702a93906", "value": "6c21c42b564d98a0242600d92dbb9aee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e56da3-ad12-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620158257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158257, "uuid": "7ff14ad6-a82f-4e64-9d04-82b3dde37437", "comment": "Malware payload", "value": "cce6c363c0ff7ac663cd71c5906069a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158257, "uuid": "f2456ba8-ea7f-4864-a403-40c50fe7c975", "comment": "Malware payload", "value": "b65eed317058df5ddd4247ec93ac2b555ae2c29b751ee455ceee3dd9b670ecad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158257, "uuid": "5fe506d3-ece8-4920-887f-f04741904732", "comment": "Malware payload", "value": "98ad5e24bf99fbb4cf7bdcaa54b6d720064dc810", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158257, "uuid": "01d0124c-15d0-4840-abc9-8bdfa47e77dc", "comment": "Malware payload", "value": "35649f56dc8e494ca1c1d5cc8d534844ad485bccd9e52833a06ed19a83e1d1b3af2ae7c60d0a10fd6efdf73a834609ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158257, "uuid": "6e1a8fdc-d3b6-40f9-83c1-bd6be3e5a024", "value": "2F740281AAD4E347C4344A76DDE1C738BF306F01BC11E29B58AFB79687327A12926D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158257, "uuid": "6086124f-4877-4451-95ac-447ef6e13598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158257, "uuid": "ab1ead83-1070-4df2-afa0-2691fc8fee40", "value": "6144:FL4Qez8X+5KBrIxuNWUwJm4OdB17ZDs0s7xHAVkYifH4TWcwb8tFHQK:V4Qez+YSSjUAmdr17Zw0+geYqH41wb88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620158257, "uuid": "b3a0c735-b0cc-42f1-adf5-4fd62d940be0", "value": 343352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620158257, "uuid": "825b880e-b4a5-4c26-be60-0c8f81f62806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158257, "uuid": "0107a635-3d3e-4d44-a6e6-3bfc00dbe887", "value": "SecuriteInfo.com.Trojan.GenericKD.46243806.32106.30285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f1d20a-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115306, "uuid": "79e5fd1e-6976-4fb1-b03a-f7cb8065e145", "comment": "Malware payload (Dridex)", "value": "3f58415367a4f44302acf8811a7f2d40", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115306, "uuid": "80bd9834-f881-49a4-a6ac-096acdbc9505", "comment": "Malware payload (Dridex)", "value": "b6abeebcd82141a925ff43973e5f7136f6186a61c21367a657bf71f37e5c8606", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115306, "uuid": "9f1ea2ce-9b51-4917-be8c-14cd1bcafcf6", "comment": "Malware payload (Dridex)", "value": "e7d0f2dd7be5d3e7b13f293757447ef33ebf110c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115306, "uuid": "9fe6ad37-f393-41be-b833-9ce3bf181f73", "comment": "Malware payload (Dridex)", "value": "2fadf00c01b7346bd39ed80e83fabd456ff2b2c89e47d361a00cc14a032ee5dd9588c02e3c0ec36b58f87a0128f98d57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115306, "uuid": "dfe3d011-1553-40f4-ba4c-fcf596c6c5da", "value": "ADF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115306, "uuid": "e80d7c92-719d-43a7-876f-d8cf62e75824", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115306, "uuid": "d5d26711-de8c-4584-aa26-b5ac11087528", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115306, "uuid": "8299797c-8488-4f65-9c86-baf29aedb434", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115306, "uuid": "d85f58b1-6549-412d-ad43-a422b8b58359", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115306, "uuid": "66d74e7e-0e3d-44e7-be34-0333929e2023", "value": "3f584153_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a981ea7-ad33-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620172137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172137, "uuid": "4d92d847-6c5c-4aec-b2f9-5d43d550e46e", "comment": "Malware payload", "value": "a87171b0419709c09a7d6cbeb72b4226", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172137, "uuid": "a8e6e8c7-e950-43f2-b795-9404d2ab8cdc", "comment": "Malware payload", "value": "b6d48b53934123849fec2b92d7f1f8a056ad7f1f9a7bec54e3d58915a106f523", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172137, "uuid": "a88bc291-c1dd-40b2-9e5c-25db53b0b540", "comment": "Malware payload", "value": "f3bbae1db7f5e019c025edd61a720caffa6aeee7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620172137, "uuid": "a9005544-6cc6-4e37-9f03-aeb6e761bfa8", "comment": "Malware payload", "value": "7d6d638a210706b9a179aa43463437b0845250e85e52bbc5de238cf95661394b9e28023e176fc6663286c3047d13fdf6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172137, "uuid": "20b846cc-f708-44f5-92f7-3f45517944a1", "value": "5FC518149ABFB43942774B594BC843086B5A3DF271BCF76C9A48426C1A267C2DC493BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172137, "uuid": "b12ff175-92da-4822-9ed5-1d44ba605aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172137, "uuid": "ad417a9b-6591-4564-b516-3509f7ba629e", "value": "1536:NniecIbRi3hM8rHWF4WGck7D0LQtQBtjFtsrBkhu9DGTQz96OLVumBfdTlU7Asic:NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620172137, "uuid": "80ba87fe-f089-49ad-b4a5-687cc66765ea", "value": 2627584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620172137, "uuid": "c8d36b42-be0f-4cce-b12f-64d214b8d6e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620172137, "uuid": "64c77c59-eb1e-4029-a598-929e72631b06", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.28048.5235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf91f67-acd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620131365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131365, "uuid": "1c6a0208-829a-497c-932f-40d951708195", "comment": "Malware payload (AgentTesla)", "value": "674fc630fa51d395564d05a786f77ac9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131365, "uuid": "32129adb-192f-469e-8fe8-1a753d11af5e", "comment": "Malware payload (AgentTesla)", "value": "b74220a4c59c9e948990c4d38589cba962c5d975ce8506b58fe5adaae2b4911f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131365, "uuid": "c5334d9a-23c4-4fc2-96f0-6796b5693cfa", "comment": "Malware payload (AgentTesla)", "value": "2f1e4130e094c5470132d811a86750e336ff3029", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131365, "uuid": "a6f24bc2-f6a7-44ea-a668-da893bb7c192", "comment": "Malware payload (AgentTesla)", "value": "fe437e5a70f9fd2cfc7d6d18229cd7c0417fb1a98094f040fa54e1acea0813c3ec36ef1fc2bd3e46493897572bcf27ce", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131365, "uuid": "aa0f830e-caa0-4865-9bd9-d5f348f0c3cb", "value": "B9A42398DBA11729C4A2FAF5C3432FA605B9CD60DF4CE6E4CDDAC147A3C75E1403A262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131365, "uuid": "8174ea87-f284-49bc-8970-0fcfb97abe11", "value": "12288:c6KmE0U4RmGZCHa4lprHbnfMrpaGm3BbhNHB6F5pd:c4E0yHa4zAata/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620131365, "uuid": "a797618d-f5b9-4d82-9484-33343e6480cf", "value": 486222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620131365, "uuid": "21137111-0030-45c6-9772-91e37ee12b3f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131365, "uuid": "016c620e-0cfd-4576-b56e-5591aab0f864", "value": "FW RE TEXGEEK INVOICE & PACKING LIST - SCAN & SOFT COPY.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1b5954-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133431, "uuid": "47f1507f-677f-41e7-97d6-246abf13a9de", "comment": "Malware payload (AgentTesla)", "value": "5f5c3e19ea34bd2aeb57b431fd01206b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133431, "uuid": "0be1e0f6-4d64-4ef8-8d26-5e5dbb2c323c", "comment": "Malware payload (AgentTesla)", "value": "b79ac89bc99c4d0d1c6bb50e874b665b054630ede73ab55978e99d1023b8723d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133431, "uuid": "b6265295-fda5-41ef-ad23-d1d75ed839b4", "comment": "Malware payload (AgentTesla)", "value": "463b2c35a0e948bbb3edbc1b432128396222c30c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133431, "uuid": "63088e43-ca42-4a74-9c5e-3ac7aff74ee3", "comment": "Malware payload (AgentTesla)", "value": "9beaa3159ceebce960b91fd68dd370027292fc329bf7ee2ea83a3232519b3812c06f9959a93f0cb363c01d55406e3356", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133431, "uuid": "08cf0f50-8df1-49b9-973a-388ab660b2f7", "value": "CDA4A9ACC49742988F86ABB86B0F2F85114C7A6EF784A533723497752BD2C7B501793C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133431, "uuid": "f6964cb8-3ea7-4460-8a4f-7ad19a635da4", "value": "6144:9irxbhnKcwAgsgx+r+VcdQ+Eg2AqZhp40fbLV7kMZltgsmyoYPdi4VP8lQ7m6trG:WHkYyLbwhZO9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133431, "uuid": "7b482659-10f6-4e6b-b091-078bb52ac59e", "value": 452110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133431, "uuid": "baa935b1-8f92-467b-8405-67496c072127", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133431, "uuid": "3ad9cb8e-e1a1-4e2a-ad64-405062075af5", "value": "RFQ INQ HCH2323ED.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55ea230-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160719, "uuid": "cf83dd5c-79c4-4967-a934-7002595fcfbc", "comment": "Malware payload", "value": "e117a9df46f0e3fa0b0e4a8a200af3b3", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160719, "uuid": "edb85128-1c9a-4348-bf07-a3869fdf33e7", "comment": "Malware payload", "value": "b7d2c7d313c893cc095691b908b4ec0624ca851b9b14333ae8aed8d3119e7d20", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160719, "uuid": "b7e0b848-9775-4bb2-9a5c-6ec7a1083f56", "comment": "Malware payload", "value": "811a5ed7db218b0991758cc8d710261dcd4f0062", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160719, "uuid": "54d629e7-74c7-4b45-af9c-c8850b4630ab", "comment": "Malware payload", "value": "be3e502babd42dfcbe439045e2abbd4c2965ff3723235539fcc645112692b915fa26dd08cdce3a4392f4c8d3d85ca71b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160719, "uuid": "f876e5cb-bff8-48db-b2f6-6e40b4ebd0d9", "value": "6B3186B31DC291260312EA92F785542CE729940E9943344CA5EEC94DB1D0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160719, "uuid": "27f51e62-6ab8-4e76-a905-680c4c740d1f", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3f5:GEXfhexTvrtWQZUSePSiJVAyrLMfZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160719, "uuid": "dd82e4de-5070-4ab2-93d0-4b33d890dc9b", "value": 1701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160719, "uuid": "4de0dfb6-d3b7-4280-95e3-513c45151b67", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160719, "uuid": "9ea52070-63a0-478e-8edd-e9fbd2b9e779", "value": "EMY1xGPZ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3436d826-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153201, "uuid": "778d774b-2494-407d-bcc1-a4a73bb3f4c7", "comment": "Malware payload", "value": "1f9668ccc51ae39b24a89841e441c213", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153201, "uuid": "3a36b37b-33ad-4c4c-8891-dbe45b09fec2", "comment": "Malware payload", "value": "b8515f6a03bbad3fb13810d33c0b6d2995edb09021b7e17e856c906f7c9a7965", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153201, "uuid": "7b3ad172-32c9-46e8-ab30-03595eccae0c", "comment": "Malware payload", "value": "b5cc412e1ae6c4b6616c69690a121daffc645a28", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153201, "uuid": "1f9c1bf3-5d52-4772-92ac-4e491c53604f", "comment": "Malware payload", "value": "e47d94c3809b5ef0ab7bbdc9612f51079035cce935207cb988e0724ada4a7e121f0a5cffa281d55b056e8ead671bfc74", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153201, "uuid": "f5df13ce-9e58-4c0a-9177-e4f3d7031d15", "value": "AC95330C62BDBCECF99E12193B634DD0C2FD72E1E441A1A1A2545CB45D3F1BE039EAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153201, "uuid": "a20a1e84-7e6c-4915-98fe-7633184ca5cd", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25:IDSTOhnXSI0Wk5jG2nfBtkaeytFOf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153201, "uuid": "8a11a94f-8355-4c11-83fe-68f344b33cf7", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153201, "uuid": "25b1b83b-2c8d-4a48-81f9-5d7929fa9979", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153201, "uuid": "54d53210-99a9-4e62-8998-2e575463c71b", "value": "b8515f6a03bbad3fb13810d33c0b6d2995edb09021b7e17e856c906f7c9a7965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3a56e3-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093679, "uuid": "3c4c60a1-3120-4892-91b0-545212b7f989", "comment": "Malware payload (Dridex)", "value": "4ea371b50ea8ae84af33dd9cc0d80819", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093679, "uuid": "894c0b99-ff7d-430d-ac9f-96e6cf0f14de", "comment": "Malware payload (Dridex)", "value": "b90ade54c1c83696f0f1cca3f9c8d0074f77494bd26fab6962b12649ee824f74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093679, "uuid": "467adc93-b49b-45c7-9d9a-e89b3e068958", "comment": "Malware payload (Dridex)", "value": "3adf28e72f7bc07101c22eaaf0c632ef53110e37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093679, "uuid": "c981ca60-5438-4c6a-8948-3e3a9bd1c184", "comment": "Malware payload (Dridex)", "value": "be78face2362a0a8a246c85dc428c603edf292a1fdbff3d0dc31662242a65f5ee7975f40d80d440ebbeb797b7959824e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093679, "uuid": "2bfe54f7-3a0b-4d43-a4b0-0ef9fa86fa8b", "value": "A7F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093679, "uuid": "bce1c8ae-fb04-4a51-b5c9-45508cc8e0e5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093679, "uuid": "54de98ef-a4c7-44d8-80ce-5226a6e96552", "value": "3072:eWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:e42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093679, "uuid": "e4b7a8da-3f06-4013-9b26-43aa92f8ea0f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093679, "uuid": "483ce1c1-548f-48a3-852b-2b457395469b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093679, "uuid": "abf27d32-242d-472b-897a-c1a158451e30", "value": "4ea371b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52426c1-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160692, "uuid": "5461ffe3-c0f9-4cde-8ad3-1603c2cb0045", "comment": "Malware payload", "value": "cc2579d42b253f12f78146f21cffa463", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160692, "uuid": "6856f8c4-199f-4c71-a1af-5e42c66b1d32", "comment": "Malware payload", "value": "b9926fca59f1ad24297a1019ca20e3040034bd42e44d970cbc78c815ceab0fde", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160692, "uuid": "a7649b11-2309-4f5b-93fd-b0b4b0650ac8", "comment": "Malware payload", "value": "2e27dc7d215e55dba742e14296fc331e7c1f147d", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160692, "uuid": "ee99e159-e5ee-4395-acfc-755091c3df34", "comment": "Malware payload", "value": "3442919c1dcb53842c7d5e185f952717e2ca6196b47a7a0d3ca07c02c37f54c73f24dd8c49063f54bda28835afa44967", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160692, "uuid": "888f88ec-66f4-4eb2-ad1e-07d014f72833", "value": "843184B72DC291220312EA92F685482DE729940E9943344CA2DFC94DB1E0F932FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160692, "uuid": "c723f97d-312d-4130-a37c-90d000533f04", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3kX:GEXfhexTvrtWQZUSePSiJVAyrLML7qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160692, "uuid": "afb9548b-609e-4c6e-a4c6-cb2472dbdd54", "value": 1709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160692, "uuid": "e4a80a7b-6ecd-40c0-8afd-5f5c75bc8a27", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160692, "uuid": "96cc78b3-bdcf-4775-88b6-e88ec07e6691", "value": "BQHBezHr.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd35654-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142586, "uuid": "dd554f0d-4251-4177-88ce-9f41fd687a1a", "comment": "Malware payload (AgentTesla)", "value": "954c7cafe054c0c92abef34f0a2d3bce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142586, "uuid": "6da4881f-1f84-47d0-824e-5b3547c73bd2", "comment": "Malware payload (AgentTesla)", "value": "b9ff91376b6166438f9fe2c97ee8109dcf16f41724ad15224f81eca4f00beb8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142586, "uuid": "f246e045-75a3-4a6b-8848-63b137ea598e", "comment": "Malware payload (AgentTesla)", "value": "2f77010501f248c7e2483511d75144c3f32fd724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142586, "uuid": "70cf76ea-9c9c-4733-9c30-46078fa7196b", "comment": "Malware payload (AgentTesla)", "value": "b145625fc9562ab14b1e72062ef3671436ac474f422e669b4b5938734dba7ed1c588232efa4c40cd5d16a208776c80ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142586, "uuid": "3ac494bd-76a7-426c-ba73-0c226a444a38", "value": "DCE4BF2633E4AF9CF1BF9B795025510093F1B907E722DA4DBDA510CD89E1FC183627AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142586, "uuid": "2e135d30-9afa-4f2f-a98b-13e963725813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142586, "uuid": "99f6fd28-3709-47bd-b3d8-63baa039261b", "value": "12288:ZDgwdYaDjtIjOKMUwHW6DDrs9m60iElAzyBHJn/eeLoLdAv1:FgEYsRQOK3eW6Xrs86lElAzyVse0Lq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142586, "uuid": "a75ee0e1-7b61-4673-b9e4-1a125774f54d", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142586, "uuid": "e36e79f8-8f7d-433b-8ebb-8da0e482a4d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142586, "uuid": "abf4df8a-7449-4d60-a707-bdce306cdfde", "value": "PO28421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f451abac-acc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620124747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124747, "uuid": "abb9ea39-1342-4a78-a006-e3192dc9508c", "comment": "Malware payload (Dridex)", "value": "10782e2241323a2f47cbef1fb7475a90", "object_relation": "md5", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124747, "uuid": "058db1d0-5450-4535-82c9-16d9aaffd634", "comment": "Malware payload (Dridex)", "value": "ba456dfc76d43bd258c193889dcc1a347d65fb5aeae43066e671f719aaae60c5", "object_relation": "sha256", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124747, "uuid": "7fc09f53-1e94-444b-a43d-b6d9b9566492", "comment": "Malware payload (Dridex)", "value": "e86d971ed3595934f29d4f737997a51085e6cde4", "object_relation": "sha1", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124747, "uuid": "982cebea-9355-4639-8c44-e13f8db89cec", "comment": "Malware payload (Dridex)", "value": "09e04e60511f924bfd5cf7f2e35d3a8cb9aea234475c91caf6406d7016970928147b05d0fb9bc31bfe8167f8aede9fa2", "object_relation": "sha3-384", "Tag": [ { "name": "brt", "colour": "#F6DBD1", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124747, "uuid": "97aa0e31-a0db-4220-989e-77d04f0aebc9", "value": "4033F26BFEACA548ECF3647EF47684D85208168522D3E76F3D06A19C26431B34B48FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124747, "uuid": "dbc49646-6ba5-4433-9409-9dfdbb48330d", "value": "1536:d6a62hJM5uOrfok1w9Ut++LmoLBkmpLlp:dgeM5drfxpdxkGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620124747, "uuid": "6b3a4ca9-9e81-451b-9161-bdf20e26fbc1", "value": 54449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620124747, "uuid": "3562c631-8152-48b2-9141-664e5cdb143e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124747, "uuid": "1a4129b7-680b-4d58-a221-f9cdb792184b", "value": "303255 .xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0da7c3b-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115293, "uuid": "3f765106-f391-448c-b53c-9529d6497e68", "comment": "Malware payload (Dridex)", "value": "fafc4a1e62e7eb6b23829a4e85fc2eb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115293, "uuid": "37b0b9c9-2c6c-49a1-ab6d-16816bc5aec1", "comment": "Malware payload (Dridex)", "value": "ba98c1f2bd9bdf22673809d6a0691f0659a7f14ccb744152b1b2e5da4cc037ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115293, "uuid": "7ba21a3e-1314-4fb7-b7ad-61c38c519adb", "comment": "Malware payload (Dridex)", "value": "3ea0adb92d5a522885bfdada121be0721369d99c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115293, "uuid": "b565e39f-d671-4bb0-b0b4-ba65b2cedfee", "comment": "Malware payload (Dridex)", "value": "f040342af2796021c857278612e3bb9716c53e022799688259773e7f2949a1a45e0a08ceb732b17a89c9ca726390df54", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115293, "uuid": "465f920a-07f1-4949-beea-1cf202a396c0", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115293, "uuid": "df834291-3909-4462-8681-db0b02f1df67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115293, "uuid": "6464abef-4863-4aac-8776-09ced60dc933", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115293, "uuid": "ec332bfd-5b47-4f31-8534-cbc65d87ab0b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115293, "uuid": "2b174e34-7d06-436a-9f45-0537836068ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115293, "uuid": "004ec7e0-2a61-49ea-be5e-a9e150433da4", "value": "fafc4a1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9176a236-ac83-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620096664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096664, "uuid": "43916d57-9389-4667-8324-fc1ff029291c", "comment": "Malware payload (RedLineStealer)", "value": "9ffeb510285c1c7450b00cad5cf7e28b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096664, "uuid": "0e7d9b09-0a36-4c10-9a16-25cb496eb802", "comment": "Malware payload (RedLineStealer)", "value": "bab076688d1bdf3ce559a1a8ae33172b39a6e342609115ee4bf7646a863ebc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096664, "uuid": "67a33e3b-0122-4247-9511-65985ebe29ce", "comment": "Malware payload (RedLineStealer)", "value": "9b2db42751d4715d345ebbc1982118d91a6f9257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096664, "uuid": "31707693-cc42-47e1-ac5a-faabf5a6aa8f", "comment": "Malware payload (RedLineStealer)", "value": "796476c6460bc7c13ab0cc0a225961d72c9b7d682c1eb98ace071cc5bc2eaea975bc1ed66816861e4d657e2df17497eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096664, "uuid": "46979e4f-c1e0-4c3a-9342-008239a7299f", "value": "55639E5071B26F61D67843F2043651704BFB36CA6821EB1D2ED771D9DA3ABCAC610B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096664, "uuid": "592055b1-0af6-46fc-abee-98a1441494d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096664, "uuid": "a1ba43b1-839c-44b4-8d19-6ef11c3fa8f9", "value": "1536:udOsOr4e9+8AkeMkDoEYkSv410vYRPuyP:8BOrr9JAH0tkp1SYRPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620096664, "uuid": "0cb1c90c-7266-4038-9f5f-5b23cc798d2a", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620096664, "uuid": "a2fd3e9b-cd7c-478d-93f7-4c67d8802b80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096664, "uuid": "01fdac1f-a246-47dd-b1f9-f809a4b1fd4e", "value": "9FFEB510285C1C7450B00CAD5CF7E28B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450de4fc-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620096965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096965, "uuid": "630346d0-c719-44fd-aaa9-be1106a7c7c0", "comment": "Malware payload (Loki)", "value": "12e011473358c7907096c983a28ad1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096965, "uuid": "cb8209ba-f13a-4b23-a780-fd42f5d45a64", "comment": "Malware payload (Loki)", "value": "bace94cb893b08f8c1d439ec11ca8c209ee1350d8ccfc1cff7eb14f80a9e9dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096965, "uuid": "4c02e08f-e390-4b01-846e-5fcc3297e4cd", "comment": "Malware payload (Loki)", "value": "e046059192219116a691577018450e4acac01c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620096965, "uuid": "be3e8de4-6fab-4c52-b879-860f7f645f38", "comment": "Malware payload (Loki)", "value": "b6152b1a1a4fed4dc7e2a48f5d6dbb2faa4d5ffc7104d85326815c598eb895d24a7d3b5ef5ba720dfa529c5d7fae21cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096965, "uuid": "2b83ce1a-0ad4-46e9-8860-c7dda448756e", "value": "9FA5375296609E5FD82C137790214704D3F5FE4066F6EB8E7DC5F1EAAAF3A824F02492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096965, "uuid": "b65e3e3f-1cc8-4fc6-8059-11299f14f7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096965, "uuid": "86403339-1ac0-4f7a-87f7-8f4a6e5a5632", "value": "24576:xQwmd+OwIPK+11cHqfC747GH+B5HJOSYj9d3keU4vaASoL3g:xQnFzEKzi+h7YZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620096965, "uuid": "72fa5b87-fa1a-4d6b-9fce-c2318db61968", "value": 2201088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620096965, "uuid": "f25ed994-4f28-4f11-92d0-c5475ee2cdb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620096965, "uuid": "0b5b37d1-ae24-416d-b5d0-34d289ea78cd", "value": "Invoice 32108322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b034722f-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122485, "uuid": "15ae4880-a49f-492f-b70c-7bf67599fc4f", "comment": "Malware payload (Dridex)", "value": "b982fd7a7d5db8bdb5138e1424f5e0ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122485, "uuid": "8a024169-47fa-47ae-9b3d-8208b73f075b", "comment": "Malware payload (Dridex)", "value": "bae9d26d4565c125d2bb02a7c37d559c8ad266e081847edafc6d261fa5d3957b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122485, "uuid": "4f723622-3f94-4c22-9b14-7cf880f1e7b7", "comment": "Malware payload (Dridex)", "value": "958df2e9c92bb76656197f6d900081c73713f42d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122485, "uuid": "6fcd0979-53c5-487a-9021-7e440c3dbf77", "comment": "Malware payload (Dridex)", "value": "16e37708f721d728a22e51e380c86199ab1f8e05245ae645f7d53c7370c5c08e77bc660131551abd79f7682d005858ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122485, "uuid": "5970c63b-fc75-4bf2-b170-c45622f27cc6", "value": "F0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122485, "uuid": "600d01bc-df27-465d-9c82-b3b124007ccf", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122485, "uuid": "fe6d1e29-7e8a-4845-93c7-6b1e36d13054", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122485, "uuid": "ef1c7572-6222-4e28-b697-be7554ebbc46", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122485, "uuid": "89e1222c-a894-49d7-9ed3-388363e15518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122485, "uuid": "40dc07f4-1102-4ec4-878d-14183b2fbc3a", "value": "b982fd7a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd55f7a8-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095449, "uuid": "c61150f1-a314-4758-a3e9-30bf4884c88f", "comment": "Malware payload", "value": "6c9e16291c07900cfd9e7a08d64c7fc0", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095449, "uuid": "d92440d2-b9ee-43a1-96db-26ef7cd8d2de", "comment": "Malware payload", "value": "bb1dc11731d9792f6c5793dce534afbd80db216de83dee7ae2a9eb3b6aaed34a", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095449, "uuid": "ea66c105-9370-4384-8edb-a69d85f1db8f", "comment": "Malware payload", "value": "5f7b587a6c2e887b56188b97a16ecbc567861a8a", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095449, "uuid": "f5a10a43-c6d4-4de2-ae42-b8e8cc343f8b", "comment": "Malware payload", "value": "5b9931b4f32a44db95ad8a6c8dd6ab03a3a5109bf7f9624693b4f816a6897e3672bfc53b4bda44f501cef76bb3599863", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095449, "uuid": "94979f4a-0ba0-48f2-8d14-62673e9bbf8d", "value": "9006D74549BFF2E8EB4D431C437804ED5F824E3668A7BEB517AF7EB1842732E0049A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095449, "uuid": "bcd817f2-7440-429a-bb51-85c1c3a84e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095449, "uuid": "934a7090-01f6-48e3-b60b-bc7ed9d56010", "value": "49152:V7HYBLzKiWHPiT8ky3Xyo8MvYyouPRywvDe1:aBLfWHu8kyzNosyKDe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095449, "uuid": "b0df5dca-78b1-4354-971a-5ef561f0af56", "value": 3766288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095449, "uuid": "7236b5ad-032b-461f-9835-caf571ebd463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095449, "uuid": "7e6a8d83-abab-44f9-8161-c8fb0d282cc1", "value": "bb1dc11731d9792f6c5793dce534afbd80db216de83dee7ae2a9eb3b6aaed34a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d31be6-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620143800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143800, "uuid": "9273a639-b3ad-4b31-92c8-daa075be807e", "comment": "Malware payload (Gozi)", "value": "d0444db75cfd8076e5ee3fa9586e00cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143800, "uuid": "29aaa850-10cd-4ec4-ae69-f68e573ba2e2", "comment": "Malware payload (Gozi)", "value": "bb5480c21a832b918bb504d84450129527c3e0c4c49924ecd874e880a6fb54c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143800, "uuid": "e055c900-8788-4c0c-94ac-917606e239d6", "comment": "Malware payload (Gozi)", "value": "0c2f1c2a5e60393b2aa598f02e0693c6ab91af13", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143800, "uuid": "d8890b01-45ec-4284-94bc-d38abb9da4a0", "comment": "Malware payload (Gozi)", "value": "ff7b400efbe20a042de5bdc4fb980371e85fb7d1977ae0a063775cec6359b4b08b910e87440bd820c6caf554f108a7bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143800, "uuid": "2ae11325-d32a-4ba3-a8c0-a0d360b8bb78", "value": "C3C3BE0CF7E950C1C5DA3AB750B19E287228EE128DB4243616F62E797FF71A37C29485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143800, "uuid": "64bb8f7b-48ff-40c2-9b98-ed048a1d30a4", "value": "3f728412058b62c418b1091768b74d7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143800, "uuid": "0fed731d-f09f-40ca-b5af-91b385ccd81d", "value": "1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143800, "uuid": "4b6d0ef8-6723-4b8d-82e0-601b0531925d", "value": 121883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143800, "uuid": "a0d23aab-f6ac-48b6-a293-15d46a25c355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143800, "uuid": "05ed9629-7ce6-4d3e-a7a6-020a779fc11f", "value": "d0444db75cfd8076e5ee3fa9586e00cb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b365201-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153213, "uuid": "bb90da02-fa31-401c-a6b1-ef4be5bd83af", "comment": "Malware payload", "value": "f5419cc2d84383d9f4c002ca65afe3b8", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153213, "uuid": "cd28c054-8dde-4bd7-83a5-83274f0c5421", "comment": "Malware payload", "value": "bb81f43175445a40a6da6329113735cc660d43a1fa551387ab058729e60343e1", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153213, "uuid": "e3d560b9-78ff-4541-9bb4-a6877da1936f", "comment": "Malware payload", "value": "9ca1b67b36a34e41a0de850bfa5ce7217114b483", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153213, "uuid": "79ef216e-5734-4d78-9b78-49f4f1213e8a", "comment": "Malware payload", "value": "cc59dcef1f08a978208f7cb854832c5e3433958b5e9c1df2c1be482e0b323c924bf19bbde1a3fbfd1a6db68be416374a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153213, "uuid": "f96c96b8-3d3d-4a8a-81ed-17647c4c01fe", "value": "5CA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153213, "uuid": "fc45ec42-f3bb-4d66-ae8a-43bc0dcd956a", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153213, "uuid": "29fa8f3c-0e99-477e-b0d5-d02e2fae6d96", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153213, "uuid": "73b307a9-4c6d-46d9-9a05-d12daac1f2ad", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153213, "uuid": "6f8c922e-933b-4dba-a27c-ab0511defc6f", "value": "bb81f43175445a40a6da6329113735cc660d43a1fa551387ab058729e60343e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c54895-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097289, "uuid": "738ee316-0995-45c7-9ae7-7d13600c3ba4", "comment": "Malware payload (Dridex)", "value": "8de6f36f1a5d9e8a1dcba7d36d5d9350", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097289, "uuid": "b93b0e52-8b9b-45b9-bec9-1d969dad40b0", "comment": "Malware payload (Dridex)", "value": "bbca384e6af2c159da555e48d52306db0ff89a2293fe56981ec1cc6f1c047b58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097289, "uuid": "dc513e82-4daf-475b-9368-acfe0b670f3f", "comment": "Malware payload (Dridex)", "value": "6cd5d2f2d41a31e80c5f50bd337eefcd6c88014d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097289, "uuid": "bcd91052-11c2-4f38-a0f9-c8f8d2183a43", "comment": "Malware payload (Dridex)", "value": "90d31f09a28f920f3cf6b02af746f844e39a36b3aea83b3729b62488664a8b25871f7bd91fb06f77f957c2803011b1ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097289, "uuid": "ab101ffd-481f-4d0f-a47b-50ccc5fc49a1", "value": "5BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097289, "uuid": "f6e504f4-8052-4a77-a463-500a0eb6868a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097289, "uuid": "60678d7f-61e4-4412-aaec-45d3c34384c5", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097289, "uuid": "2a6c6bb3-7412-4e21-a82d-01362f3a8b05", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097289, "uuid": "b59b6684-f776-4a5e-9bdf-9823d82d0c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097289, "uuid": "8d990eb3-97cb-4dfe-99a3-512f6803e0e3", "value": "8de6f36f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c7da4c-aceb-11eb-abe1-42010a9c0039", "comment": "Malware payload (LegionLocker)", "timestamp": 1620141257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141257, "uuid": "3f04a488-be2e-4012-8d40-001da8ad4f7d", "comment": "Malware payload (LegionLocker)", "value": "50dc32bf584f9b54ee51016fa6e67363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141257, "uuid": "d55442e1-6183-4cad-a3da-cf22d7f7baa3", "comment": "Malware payload (LegionLocker)", "value": "bc016ebc1751fe99de886be19c2c3e0baefe69cb046b10838cb15bcff3c7e603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141257, "uuid": "2d139801-19a9-430e-9db6-9b6fc422ac3d", "comment": "Malware payload (LegionLocker)", "value": "f0d015f92117ac541569b56b1db646021825035b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141257, "uuid": "4ad4d174-8177-41ea-801a-9ac8cd6b96e8", "comment": "Malware payload (LegionLocker)", "value": "aef3bae553b3f7f0977c6caeaa83256593ff9bc11f6a413c666dce9f34ae95d794a5e62a1abcdef8aac5f022bafdaef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141257, "uuid": "dfa1671b-f0de-447d-8ecb-94b22bacffc8", "value": "E7F2C3DAFBE88139C244A6F458D30D095232D673B942926729D801B9CA737DF78CF693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141257, "uuid": "a1e70402-0e06-416a-9b9c-a41bcb6d98b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141257, "uuid": "38ee5617-f331-4042-a58a-b360fff5c67c", "value": "384:F97pwzzYoZ492dJRFdp1wXTlyG9IwIwOhq9sr5NcpNWx0pmgLESp+aqcOR9FKRQu:FtPoZRJRFhwjPIwm2Q51E+bcO3IRSO4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141257, "uuid": "52de28f8-601a-4244-931e-6459dccb642f", "value": 34866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141257, "uuid": "24992c19-d84a-416a-9195-8b6bc689263b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141257, "uuid": "0ba864b5-202c-4a26-9e6b-d237cd8e9c5a", "value": "333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c276e10-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620141699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141699, "uuid": "c05d0afb-a15b-471c-ac77-3d0540fe4705", "comment": "Malware payload (Loki)", "value": "deebff890e5a3cf56143a8e5f70c494e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141699, "uuid": "72be0792-5060-408e-a0ee-514a4ebbc6e3", "comment": "Malware payload (Loki)", "value": "bd22e6fdeaeeb5047191e6b7feaeb3a152f43b20b9d464eb51add07c29a1e8de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141699, "uuid": "45f1afc9-d3ea-44b7-8fa1-13bfdcd21680", "comment": "Malware payload (Loki)", "value": "c48ca3466b49887848ddd36db47265fb3918ba21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141699, "uuid": "72f4391e-0729-46df-b324-98f6a5a7ee6b", "comment": "Malware payload (Loki)", "value": "16baae1936558c24a19e91cbeada56f3a1a4cf1664392df4aaeeae234527637fe4bf3c66a01c09d4ef8ef0be500a441c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141699, "uuid": "7ef45990-8612-47e5-aadd-642f5289b4d3", "value": "361528AC316430EDD227CA36A7DE1C1592213175A62BD60B872303BD8E1EE57AF349D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141699, "uuid": "2dceac0e-f3b1-4383-9210-a7320648f4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141699, "uuid": "692e66d1-f7c3-4c12-82bd-cdf496740232", "value": "12288:jeoLLoS60/K7yh0oQzhnXjMnCeC281WJWzPwzd0Hk+wmxeX8Th6kdKhKYTVfLvU3:qoLAZTG7MjadrHmx2x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141699, "uuid": "6e52dc5b-2644-47fd-a391-d15db1d3b876", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141699, "uuid": "44f426d6-138f-41a7-8e2d-8d95da6239e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141699, "uuid": "e474ac25-5c39-4fff-8f14-a7c262c2df48", "value": "INV-Impot Dos_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ab73fc-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620142257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142257, "uuid": "b9e358bc-9437-4fe0-8911-d2ba4c345f30", "comment": "Malware payload (Gozi)", "value": "18d613d02eaf8d339feebb21f578f329", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142257, "uuid": "3a07bfc5-a2eb-486c-a894-62bc5564cd7c", "comment": "Malware payload (Gozi)", "value": "bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142257, "uuid": "6194c79d-e03a-4bea-81bf-457b563a6a74", "comment": "Malware payload (Gozi)", "value": "01ea39853139ccfe82f0bd19f8963d3ccebf8e8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142257, "uuid": "a395ef15-26af-4a8e-90e8-bad87b0317ef", "comment": "Malware payload (Gozi)", "value": "34ef17e4c60b447427fc29b093b0f4bfaffd0be26960a35344f99307fb588a8ec081685bc94a8481e2cdfdd22d332a7b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142257, "uuid": "e5cf5052-82f1-430f-9070-c268f9adccd5", "value": "6CB4CE1131D2C135D16247BE482BEAC147FDBE654F351A9B3AC87B8F2E36092A739712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142257, "uuid": "6cfff16e-93dd-4e1f-8fef-a8036525fb94", "value": "61abfa6d76443dd7d018df0c9cf8b0a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142257, "uuid": "ee30cdd4-5ac7-4f00-94a9-c634d255869c", "value": "12288:CddaT8lLVrp6I7MsfHqWxSWlNTjGoLYTbgOJpXLH:Cddhp1YCMuFx/jGo0XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142257, "uuid": "1e48468b-7902-41b3-8e04-5b6436d52bc3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142257, "uuid": "076cddc4-d31f-4baf-ba56-2cec6c23491f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142257, "uuid": "963158fa-f57c-4f56-a726-1c5a3021dcf0", "value": "18d613d02eaf8d339feebb21f578f329.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1ad51a-acd2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620130555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130555, "uuid": "28c6054f-68d9-41bc-bf38-5c840cca30bc", "comment": "Malware payload", "value": "cce7511fdef2e7375416561b991bd99a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130555, "uuid": "81e87961-6c48-402f-b800-40d6663b92e0", "comment": "Malware payload", "value": "bd4db8f3012e9f2d14e39aa9cb321f7fd69cb4a49677fcb9491a2e77c82391d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130555, "uuid": "421d5511-de18-4e96-ab00-6cac5b8a9a76", "comment": "Malware payload", "value": "4ee32c7f9aa7f8ce80f5632f7c65999a0fd4dbb0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620130555, "uuid": "229fb588-9d4b-49e8-88bb-7024946f9613", "comment": "Malware payload", "value": "15768e6bd9702ce8f14859e99a084df91dd1fe35520b8efe900b1f6f3aa2023599a0f0d8b5eccedac960bcc669d09b23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130555, "uuid": "80764366-b106-4dcb-bac5-2e2729dee88e", "value": "3FF202983E13898BC533257E750BA85679C70F6A301F496C21FAE1298BF331CABB5315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130555, "uuid": "baa391d0-2c4a-4d50-bce8-19ad79fc70f7", "value": "768:TDoQtBTX941eYFDgNbl5PatCbYUmQAvv/wY24kDQ:XtBTX941eYF8Nblpuvnwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620130555, "uuid": "2eb97963-cb0e-45eb-acb2-ed376a9d0ff3", "value": 37440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620130555, "uuid": "f08e467d-ef2d-4f6a-857c-9f82a4b71d9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620130555, "uuid": "c98fa02c-65dc-4d4b-bd41-b99502fa23a0", "value": "SecuriteInfo.com.Trojan.Linux.Agent.HIT.23398.17075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62261aa-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093692, "uuid": "c3c67272-1456-4bc4-af51-0bbbaa23581f", "comment": "Malware payload (Dridex)", "value": "e9a1457d1998fa508db09483c8fe6e17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093692, "uuid": "ea100a21-143e-4216-a762-341fe5ae39cc", "comment": "Malware payload (Dridex)", "value": "bd90606cd1b4299c9859605df3b9f5f62594da2cb9be804fb2d0d925114729d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093692, "uuid": "ae7de5a0-c1b5-4b42-b45c-7d2c8a3b2983", "comment": "Malware payload (Dridex)", "value": "1e0dfab8e0e68554b3f7f215fbe631ff472c2484", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093692, "uuid": "db17b47b-48b5-4d58-8390-a4851229f192", "comment": "Malware payload (Dridex)", "value": "4cefcc1d699380fe28c84da8af2b07262f7407d3158da0b59eaf4445c83b01e79c764ec6d97086ad9b88eee9b78e6281", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093692, "uuid": "e685e80d-1398-4820-88fb-c6679bb8511f", "value": "E3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093692, "uuid": "11c1fa80-dbef-4858-a88b-1bd39154a766", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093692, "uuid": "d682b037-2b51-4220-b7bc-206652345875", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093692, "uuid": "4aca6370-2985-47ae-91ed-680a470ed977", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093692, "uuid": "fae25991-cb56-4100-9c41-aecd2d464846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093692, "uuid": "1aaf63d0-7c52-4cb2-81aa-b012ff5d7ef4", "value": "e9a1457d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11fe4da-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122487, "uuid": "46889be3-dbda-4162-9c6c-fe9e46c36cb3", "comment": "Malware payload (Dridex)", "value": "0eaf55063a70e6503a1d47f6d68795fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122487, "uuid": "d99fc4b3-fd3e-44df-a1db-2478b81b009d", "comment": "Malware payload (Dridex)", "value": "be1011ca8d8ec3239c99d941606296c1a9f41cfa912a4d6b1d4d43ebe2c5ed1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122487, "uuid": "004bd39d-184a-4bb2-8ada-46be628831c3", "comment": "Malware payload (Dridex)", "value": "0865e8e2eaea0ba2151c8a56fb37be765c21bd98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122487, "uuid": "dd3e3cfe-ba56-4ab6-a6df-16379ab934b0", "comment": "Malware payload (Dridex)", "value": "e7297dbdc7afe03539246afa10ead90e5b3db323f7a8421ac219fa06b3bc4aea1af4e439a2edb3afe3374e4f9a2d3f1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122487, "uuid": "a433acc9-cba0-4ace-bca6-ae124c0d4a76", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122487, "uuid": "483ea35b-4a2c-413a-a4b1-1779f4be7e4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122487, "uuid": "4c024e89-3c2e-404e-bc97-8ef2a9d868dc", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122487, "uuid": "8fe06bb8-6c12-4d4a-b4fc-2624a20e21bd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122487, "uuid": "a9d8f2c1-a030-40a3-9f10-47be3118f39b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122487, "uuid": "ab87384d-7942-423f-ac64-58ad898ad918", "value": "0eaf5506_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be93919-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153241, "uuid": "aec26bc0-f910-47e0-b7a9-c89df314f10e", "comment": "Malware payload", "value": "a5c77902270f86b662e5177894da3dd9", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153241, "uuid": "77995a10-e5dc-4c54-9741-419d17eee594", "comment": "Malware payload", "value": "bec7189998e06e6dcd2f0b7b040bdfa264bcd9832fca33cf166b42b92a01efa3", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153241, "uuid": "65a0cdde-a567-4f8c-993d-2831e4c23679", "comment": "Malware payload", "value": "d30eafb097c8891940e5572d92962bd7e7bdd08a", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153241, "uuid": "32c6b141-dee9-4b34-b8b8-11798ee66696", "comment": "Malware payload", "value": "e007a7a7f9a91c4a407bc24d982e5e13f1bdf8180e0043463b62b79256b171aeefb13b191959698d5fddf37ac1cefdd9", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153241, "uuid": "58b78448-06ec-4932-b202-a5e62e7463d9", "value": "BD31B6CF21A14E746CB5AD2B326ACD4570DCE5E71DCA2FD92CED3AE9549CE047010A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153241, "uuid": "b42bb1f4-7311-4508-b915-8c530b601baa", "value": "24:vdS5+dSMdS/c4kdSkasdSEdS7sdSge+dS2EsdScdSKJdSEdSD:vvTT4kfbb3Re+DDxJjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153241, "uuid": "71b5ddee-23c2-4eef-9162-03b031616c77", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153241, "uuid": "7f0bba7d-dc33-41d3-ac32-85ead7dc9c79", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153241, "uuid": "c62efb62-a99e-4b68-8c18-1f7b4638d5ca", "value": "bec7189998e06e6dcd2f0b7b040bdfa264bcd9832fca33cf166b42b92a01efa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a4d737-acdd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620135270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135270, "uuid": "a8f946df-376f-4d6b-bbb5-a4765dfd8e84", "comment": "Malware payload (AgentTesla)", "value": "b2b3633436e5fd34c73e9cfd9c4160a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135270, "uuid": "b62d6d5f-6b24-4f5e-9320-28d840176a2b", "comment": "Malware payload (AgentTesla)", "value": "bf5d80e41502cbe3e4c6af87106406521d7dff65160a069bdc84f24a086f5381", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135270, "uuid": "cf11b840-0d6f-4553-b179-541e46dcb538", "comment": "Malware payload (AgentTesla)", "value": "fa2c80fe7adf8d76ba283686f0d2691cc2c59037", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620135270, "uuid": "5da06699-034c-4c09-a155-23c29044ff07", "comment": "Malware payload (AgentTesla)", "value": "fd5b1b54881a280a7253c1733927e3bd32214c3e9b391bb15dc8b100ebfb834ae56a8667fe4ea532e91de65ac96c5fe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135270, "uuid": "86d4cb28-6ead-4521-a660-dcbbd12f59ea", "value": "3625499E365072DEC867CD369A682D28EBA0B57B830BD243905319ECDE4D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135270, "uuid": "76ac4438-d5d7-4608-8b3a-8d65100706e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135270, "uuid": "6b7eddcd-8909-4b99-a203-012fc30ccd3b", "value": "24576:C8f+l01gJaKzaJabALIBykk2Tc4bAdpQb:C1l0OXzaJakL6Dk2xm2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620135270, "uuid": "5dd47621-42e6-45f5-807a-3e23752e1009", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620135270, "uuid": "c5461507-0dc4-4509-9efe-9fbc038062f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620135270, "uuid": "2783074f-e6f8-4515-b115-fbd88baccfcb", "value": "QuoteXrequestX-DAX31312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809092ab-ad00-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620150323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150323, "uuid": "ec83295f-b9e3-4259-aacc-58c2bcd35aa7", "comment": "Malware payload (RedLineStealer)", "value": "12080fddfca9768211d6c8cd008779ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150323, "uuid": "90664e97-fab4-4366-894c-b28c1955c523", "comment": "Malware payload (RedLineStealer)", "value": "bfb157e7b8e765774b40afe45332d1af26dd89c8784f758bf99ec42801d1696f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150323, "uuid": "539a8aa3-e14d-4cf2-b939-18b5a379812b", "comment": "Malware payload (RedLineStealer)", "value": "25a58be719c785ac544f020ed99b4ea5f8bf4a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150323, "uuid": "b68f9fe0-4eeb-4adc-b94e-9cbd2f9753e3", "comment": "Malware payload (RedLineStealer)", "value": "89986bfcd130e000eddda531038ae9f0bd1d3f90faf7ee327010ea7e79cdd5518e831ce111c51e49cd8626684e6c643f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150323, "uuid": "c87e57f6-fc67-4ab3-bb9a-297373cdefff", "value": "1675BC713BA982E1C1D32171C58EB75514665CB2E6E2D0B3F1583FA95B003A3EFA53B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150323, "uuid": "3235b4c6-1cdf-4ad2-b770-d46d93acb6a4", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150323, "uuid": "56dbe90a-96a4-4fb4-b370-d0ce520ec4ff", "value": "24576:Rk70TrcVc4VnjRgGDeHeleTjMwcqykT/gnwR/xA4y1jBfB11Q6bNwoUYBZn:RkQTAVRnxxli4wcDApJaL1jbnbNwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620150323, "uuid": "35133e91-d0b5-4cfb-ab4e-70baa8c6e2da", "value": 1601536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620150323, "uuid": "bc804437-b9e6-479c-aef6-a4e46f79bad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150323, "uuid": "a3a834f9-9951-44c4-bfaf-9fd0f708caa5", "value": "12080fddfca9768211d6c8cd008779ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7343d54-ac93-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1620103626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103626, "uuid": "47196cae-d7a4-45d0-a767-15e87e733dee", "comment": "Malware payload (YoungLotus)", "value": "c71bc644e5a8670940bb091f1e6f7002", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103626, "uuid": "fdbb643d-1bc2-4da4-821a-2ade54b0bd98", "comment": "Malware payload (YoungLotus)", "value": "bfe5a7e03d6d57dae9d1eb74e5a1d837a04ac3c9c9822e1ee26c6a586c6a7342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103626, "uuid": "3296c387-bb93-47ea-a26f-d0d376dde099", "comment": "Malware payload (YoungLotus)", "value": "afcf8f1a476a69c5437f26f4f5fe9e804596384d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103626, "uuid": "c690b0d8-1604-4a8e-9dae-e7a99b345c5b", "comment": "Malware payload (YoungLotus)", "value": "ccf2559ae9c87b8a8e333fa73287eb5f69670ab2e816549c790f0ffa70eab448bc41b5bb7b70e063cdc9034faa41f6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103626, "uuid": "799acfd3-894d-42dc-bc34-6bdaa8d5184a", "value": "0D46237711290145D0F6C93EC53BBED972F756374D81E8F8A4AAE9C22736EE0E102693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103626, "uuid": "a39cf22c-6fb2-4b25-85aa-00481ac48066", "value": "66407d48a07473416c3881accab69aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103626, "uuid": "3a7b3511-5c50-4d8c-bc39-34e3743fca7c", "value": "98304:nHaZutELxnX125iYCpMEDD+SchEif9HRO3qCtyaiAb3xAaWeX1HYDW3kxQGY+WMQ:HaZkAnFVYA7D2EORshoAb3x4YHYaiQGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620103626, "uuid": "f09feeb4-015e-4abb-9726-b062d2d36bc8", "value": 5560320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620103626, "uuid": "6270b905-c8f7-473e-bac2-60888d1f7cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103626, "uuid": "e42417ff-c84d-4e63-960e-ab56d37a5a71", "value": "vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b36f5f-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153284, "uuid": "bb3b0394-d38e-4a56-8549-d464428381e6", "comment": "Malware payload", "value": "8f4315b893390b8b3d688ee0225a9f37", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153284, "uuid": "266971ce-8ebe-4170-903a-b8656593c539", "comment": "Malware payload", "value": "c01bf89c4ee557d43109da30cdb07b3aa3cac230ce36fd8036c4efd95f532ca2", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153284, "uuid": "700b92e0-d952-40f8-9e79-2ce41683329d", "comment": "Malware payload", "value": "564e9d71e1b6ef19e278721adddc83d505f5a8a7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153284, "uuid": "cf47ecac-b3df-4313-be18-04ffb2ad7ed3", "comment": "Malware payload", "value": "eaf386cada4289f3ed26995a3f392347bad9f6f128c9019de18231a30659a3b5060f037f8ee8ecdb324e7b3cbefe594f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153284, "uuid": "c92e9c43-5e97-449d-b173-5f22d4660ec2", "value": "68A1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153284, "uuid": "55342da1-595b-4344-87ed-445036cdd7c6", "value": "96:cWRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153284, "uuid": "988e317b-b563-46b3-94a2-824883ba0de4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153284, "uuid": "7f02bed3-7697-4025-b6e8-b1a91d1d17a5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153284, "uuid": "3262db59-ca66-4d9c-a297-474d28d20e7f", "value": "c01bf89c4ee557d43109da30cdb07b3aa3cac230ce36fd8036c4efd95f532ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26faa7de-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108082, "uuid": "3c5112b4-4177-4d38-8b06-8f03da61b941", "comment": "Malware payload (Dridex)", "value": "2dd1208381dc9484d3f6a9b023904657", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108082, "uuid": "f08e2e66-b194-41c1-a209-74527fef9eba", "comment": "Malware payload (Dridex)", "value": "c0423cd0cbe447d243c93af29b71aa6d825712a41e48806f0b235160bba7eba5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108082, "uuid": "dcec433d-9367-4450-95e4-017b82a513fe", "comment": "Malware payload (Dridex)", "value": "6e041ca5f2c793dbf4d59cb6b797bc678288dfeb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108082, "uuid": "2371b114-d657-4eb9-a133-7aaf72c64245", "comment": "Malware payload (Dridex)", "value": "1aa18db17632144fbf87d584a08d3f3678d05124bfa1c4dfe66ceb3d581f6044398788e1516decbaba1bda36d9106553", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108082, "uuid": "39efda91-ec58-44a2-aeaf-c748862e186b", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108082, "uuid": "5155ef6c-a644-454f-87a2-c015bdc332df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108082, "uuid": "ea7faab3-ee74-4504-befc-c381bec9c7eb", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108082, "uuid": "c05d9b66-1f89-4c47-9a5c-ec44eb2f017e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108082, "uuid": "d2d8917e-bcff-48b0-843a-aef829773c59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108082, "uuid": "b0b35d18-16a3-4576-b2e8-7da397ff7559", "value": "2dd12083_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2cbf4c-acd5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1620131793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131793, "uuid": "97b37068-d533-4851-bdf6-e47e675d4093", "comment": "Malware payload (AZORult)", "value": "fdef96d4d036ae3dd5a1d87b6d04481d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131793, "uuid": "ab24eb06-14b8-451a-aa42-48be5f1d31ff", "comment": "Malware payload (AZORult)", "value": "c0741e25484d3ed9ab786a852564500602186b59638397ffbe37eab9182a7512", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131793, "uuid": "dabf0ddb-c500-4963-a7ec-4eb033166144", "comment": "Malware payload (AZORult)", "value": "cc8dc1dc65acacc01f262490b9f1952d07cf3124", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620131793, "uuid": "8e3a88ce-bfcc-4620-b7ee-9cb52fcc8900", "comment": "Malware payload (AZORult)", "value": "df873d70a366baa23491534b48e602a9823a6d6b997321b4472547418701121daba755aba566563a9327e01583c2e606", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131793, "uuid": "1fbef7ba-eacd-4d45-9b19-ca0a576c04b9", "value": "23B32A6EFBC18277D02409BDCD45A1B9907975302E391822F7E64F6CD8F96C26A6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131793, "uuid": "2a90fc89-6581-4294-9e12-9f418613c114", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131793, "uuid": "c8b0baa9-a991-4442-b9c1-46326b3081fa", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiIq:faO1tme++wi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620131793, "uuid": "0b252d87-920d-463c-b4fc-e81ee6e51f03", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620131793, "uuid": "3c0dd90b-7938-4d41-ba25-0119fc309b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620131793, "uuid": "b33aba06-33af-4bd5-900c-e82111d65750", "value": "FDEF96D4D036AE3DD5A1D87B6D04481D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81836e33-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153331, "uuid": "8458f611-d38b-46eb-8059-41994668a41d", "comment": "Malware payload", "value": "b72d2d888dda9f5e61bd7922e717f56a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153331, "uuid": "15c3397f-af65-49db-9a94-69ac71472962", "comment": "Malware payload", "value": "c119778e68dcde503a121302033a34495ccec5dc9c6c7e85a8241bd061c82bd5", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153331, "uuid": "17deecb6-d2ac-4440-b9e6-08d45418aa36", "comment": "Malware payload", "value": "80cb58f1d8ff31a4762b40ae4ff1c195dcd71a56", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153331, "uuid": "b6b3f84b-faa7-4f0b-8693-fd107915cb36", "comment": "Malware payload", "value": "59f426cbd147b50d248bca22e89c9ea93966b085bb6f23ef3741395b2c9b1f893d372e7a46a06a554b423746c223af8b", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153331, "uuid": "e92ff30a-5bf8-4d4b-8602-ce16ec42818e", "value": "637533A1BA0760D6FDA41890EF08E27DA9408EF574C6CF35FAF04E4617B9E891F9D850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153331, "uuid": "f0949a19-1e33-4738-a095-6b3a75bf01bb", "value": "49152:l1UdkOgGKlJkHZrZ39xWgpsc9Ersdu9LxhS:l1akFnQrZ33WKCguRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153331, "uuid": "8da2a8ca-a26f-444d-a791-4cbdcdfa3414", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153331, "uuid": "86a8f511-75f5-4ea5-ac64-cd63a543a67e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153331, "uuid": "6928c3e2-fe05-4f50-8009-12888dcec558", "value": "c119778e68dcde503a121302033a34495ccec5dc9c6c7e85a8241bd061c82bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3aface-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115263, "uuid": "f6de24d4-bce1-4e02-b122-e4f086101f46", "comment": "Malware payload (Dridex)", "value": "77fa35f6456019775d3bbf5d95553fc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115263, "uuid": "0472c012-c103-4eed-a584-cd4d9b2736ae", "comment": "Malware payload (Dridex)", "value": "c1361ecae64c3dce171d4b137b3d07e9f78c2a6bf5feb92cf90512e107125b26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115263, "uuid": "38cdd290-eb8b-4154-837b-e8d380145840", "comment": "Malware payload (Dridex)", "value": "59511578a143c3608fed62cb819e16ae1aed796f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115263, "uuid": "57e0f750-968e-4b52-877a-565c03b094f2", "comment": "Malware payload (Dridex)", "value": "c919d195db490032b4033e68b0c605cfb0fbf9c635fa86b4703a1a01e2ee4f9f9698041738b6474a2238b260f4b464d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115263, "uuid": "8fc3dd78-c258-4bc4-8f9d-4d0c1e867e0e", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115263, "uuid": "3f3f320c-2074-4eed-88a8-85bd99648158", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115263, "uuid": "05868d51-f7e6-4208-9d88-96dd9b29bbcb", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115263, "uuid": "f7b85c1d-1443-42d1-abdf-c3b3c02e98c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115263, "uuid": "ea688d93-bbda-4d6f-84bb-43819350270b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115263, "uuid": "47c7cfc2-837d-47b9-92a0-cacb0b999a74", "value": "77fa35f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee9ef26-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090056, "uuid": "32018c0c-1fc7-4991-bb67-e43e362dde19", "comment": "Malware payload (Dridex)", "value": "75429682c8d7b5d47c3ddbf64ad70c43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090056, "uuid": "999b415b-17d1-46be-a1c4-e08ab9e751b1", "comment": "Malware payload (Dridex)", "value": "c189e9d242870543e74438e03fea47a4c9f2346e2c49a058ecb03c6e94ef32f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090056, "uuid": "037878cc-4d76-4323-96b1-897436d03b9b", "comment": "Malware payload (Dridex)", "value": "a0576c774c3667c601929ded99c0a3c06d58b59c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090056, "uuid": "66344bed-0891-4e61-9d68-9154ca55f611", "comment": "Malware payload (Dridex)", "value": "b23fc2af0cb0c867852ed8e1df667e4a664c637e692e0f6fce7fa1e20fa05a0449d62b58ec020b1f868bd50b9527d909", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090056, "uuid": "b2fb8e56-ad26-4f85-bcaa-53f68645094a", "value": "E8F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090056, "uuid": "7ad8be26-e79c-4317-a095-fc4bd9395199", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090056, "uuid": "285c13f3-2cd2-4e51-b2f1-427f897e6d8d", "value": "3072:1WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:142IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090056, "uuid": "21efc6e3-a870-4feb-acdd-1f0df3b1649b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090056, "uuid": "650e99da-5b91-4010-a2b4-21b1fa76db20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090056, "uuid": "17fd470e-cb80-4cca-b0f1-5a7911464b2a", "value": "75429682_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565a553f-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620142521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142521, "uuid": "77651a50-39e8-4e90-9ca7-f508ba5a6d96", "comment": "Malware payload (IcedID)", "value": "b20cef99d0534be1983b2e92cc3c788d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142521, "uuid": "5781c88a-1d85-4716-8b16-8d6a8d298771", "comment": "Malware payload (IcedID)", "value": "c1a21daae2e0d92ae00d58fcdef6729925a0d3ea2572eaca11f9181a3723cbbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142521, "uuid": "14496ac6-9c29-4b95-8ba5-fd61bdabc84b", "comment": "Malware payload (IcedID)", "value": "852da392a4f0820e6081d7cc67b3aeb2605708af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142521, "uuid": "5725e3d4-0df6-477a-9c10-5434ce64e3e3", "comment": "Malware payload (IcedID)", "value": "798d4a8b4925df7620dac98158a8337731bddafa2ab9c9384381267b92d188a53ee1627317fd9a1d8a6123221573917c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142521, "uuid": "80b970f9-3548-4b84-953f-8ca519d389cd", "value": "8DF362BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142521, "uuid": "e2868709-43a4-4fc9-89cd-f0fad6ebeb0c", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142521, "uuid": "11206fb4-79f4-40c6-aa61-4e0e7bfb205b", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142521, "uuid": "665594eb-7acd-4d00-8a98-95e9cd4bca78", "value": 171499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142521, "uuid": "d2e4c5db-bae6-453e-b34f-4e40e2d3a355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142521, "uuid": "feed8e8c-6e95-4378-a745-b07c153a6aa6", "value": "b20cef99d0534be1983b2e92cc3c788d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7ce61b-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095829, "uuid": "b8f4f649-ffae-468f-83ab-4e2c20063fa7", "comment": "Malware payload", "value": "52a8ae0ffdcf12db21db2b1500116b42", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095829, "uuid": "09c41339-2da2-4adc-8696-3a8197131f3a", "comment": "Malware payload", "value": "c211a21251ae3e49abb657c343686fb21a371a5df9d7ba9f51b00cad143f90d6", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095829, "uuid": "bc553846-4f26-45b7-8b92-8bcf53bf1c1e", "comment": "Malware payload", "value": "7f14dc286763956125289acbdb0ae523acdc8e76", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095829, "uuid": "655daec8-e904-4605-93f5-e14e14436c48", "comment": "Malware payload", "value": "42884d538c9cfc85630f48921ab869b8dd5f6481f4f9e879cb9a81c15564e2ceccddc8489030ce40b54bc59e93a7f88c", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095829, "uuid": "debb4651-ad02-42c7-a782-7519dc5577d1", "value": "FD953345F86892CCD15577ECF832F978FB5868F4E853219335266930473E99BACB2423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095829, "uuid": "1cacd251-dec4-49e5-bf7b-8f208415a6d2", "value": "49152:SXA+Zu5k2EF9UsXTL0FFQdXkIIqGibRSUSxZwNuGkasxDr:OINEfFTL0FFQd1bIFwYbasxDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095829, "uuid": "d6472093-a6f5-4bc5-8254-ab3a510452ea", "value": 2029381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095829, "uuid": "4ff568c2-f1d6-4fa0-afda-175973889170", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095829, "uuid": "ba87f6ee-c02b-4e70-b5b5-a95ee27ce226", "value": "AstarothSpammer.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bef25d-acb0-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620115834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115834, "uuid": "d39a35ea-bc6e-46f3-85fe-13a2565cfbe7", "comment": "Malware payload (NanoCore)", "value": "b89d3e7dd6ee20a09506365497f6cc3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115834, "uuid": "0adf61ed-4b11-4313-b75d-5d936511d940", "comment": "Malware payload (NanoCore)", "value": "c2af0dcf4558a32fde15405648d8dd6410c51d319812755fcb8e4f742723bad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115834, "uuid": "27097528-f59c-45a9-94a7-83020ce1d680", "comment": "Malware payload (NanoCore)", "value": "d5a40ae65560da802d5c5135d024d5fa8e840ff4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115834, "uuid": "bcf1ddde-b191-46eb-b8ba-31bbeeeef5c9", "comment": "Malware payload (NanoCore)", "value": "5f40be4a5cbc5464ab57876861955d12007dd81194806f28bc0819cdeb61f12eb17d018917b6a477780f1ea8261419a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115834, "uuid": "dff96994-d77c-4528-b2f8-0997e23e8a09", "value": "96F4CF2633D4AF6CF07E9B759115220093F0B947E722DA8DBDA514CE4CE1FC58362BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115834, "uuid": "4b7b0dd9-8b22-436b-951c-a02399b38605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115834, "uuid": "601e1f43-cb08-40ff-a836-9e65b76fec5f", "value": "12288:O2g1o0ezIROKMTSXHlIp8maopsxu05K6zAyLe6NPBmFBdWM/QXPZ:bg1o9mOKSA9bzhLnNgXv/QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115834, "uuid": "c0917d6f-ec93-4233-8da0-70863e973e36", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115834, "uuid": "75aa8506-c301-4370-8afd-b2e61f7e7e07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115834, "uuid": "308b2956-f78d-4951-b85a-f82d88704393", "value": "Shipping Documents Original BL, Invoice & Pa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7a591c-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153351, "uuid": "7aa53579-a1d1-417e-9c29-c3e5fb6e44c0", "comment": "Malware payload", "value": "3ecb6383b261880ed28ab9c4637ccbef", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153351, "uuid": "49a7f263-3a9e-451c-83a5-fcdb11865477", "comment": "Malware payload", "value": "c2c9b012dee7ed137f9ead72fb8ac70a07cb6cbf3a74a76026e6d3deac4710a7", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153351, "uuid": "af762efb-9a4b-4a6f-b723-b08912c10be7", "comment": "Malware payload", "value": "3a19fd755292b73313edf9416ef0fd6f0e596620", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153351, "uuid": "e9357f37-0453-49a9-a73e-21b6dc25f2e1", "comment": "Malware payload", "value": "3f1b6460150bf0b9bc4c9a8d25bc8c11cf2783c3c1c31769745628c9a0f25b5fa16d243ab507c83af4b7fed699997a01", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153351, "uuid": "d65be5d8-ceba-4764-9110-df7406e9a862", "value": "81A1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153351, "uuid": "057ebca4-231d-4d9e-87c9-7dbfdcbcdc96", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153351, "uuid": "9e03b0b7-ffb1-4fcb-97c8-25fb29dd9f4e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153351, "uuid": "1d86fbd0-ea12-476b-ad59-bc44e2a568b8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153351, "uuid": "0daebc31-9a95-4694-a49e-823fb5d97b07", "value": "c2c9b012dee7ed137f9ead72fb8ac70a07cb6cbf3a74a76026e6d3deac4710a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90555bef-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111695, "uuid": "c2055838-8611-4116-ae16-091c723abc81", "comment": "Malware payload (Dridex)", "value": "e7319a0f558e8a25d045020fe4f38c90", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111695, "uuid": "1a78e6ad-bf81-4297-abf7-076d0bc05098", "comment": "Malware payload (Dridex)", "value": "c2ef4905834b5db1f76f1637d11b5ab429ddb24a3b3644dcdac40d5e9a0b1513", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111695, "uuid": "cbf93c9f-72c0-4867-85a8-cc36a5fe5d8c", "comment": "Malware payload (Dridex)", "value": "81062faa7ef21481251c6dd845466e4b33c1b018", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111695, "uuid": "6c90cd6f-3b2b-4f14-8c83-550c471b9e4e", "comment": "Malware payload (Dridex)", "value": "01428f75b0fe6b359092e5c87f63db6d579d5782aadb2be11345950d424923ac160c573b1b94a394750094ec6885e755", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111695, "uuid": "c6148cb9-f517-4268-bbe5-54d494814025", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111695, "uuid": "9f932022-a16d-47c6-b89b-07e30f9da194", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111695, "uuid": "08394bbd-a287-4f07-b1df-ef928c763ce3", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111695, "uuid": "171b8263-8bd1-4228-8ada-224c1d14d192", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111695, "uuid": "5e1eafe7-fd8c-45f5-8ba1-0969e779e77a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111695, "uuid": "46f30aff-218e-488e-ad8a-eb7ff9db09f4", "value": "e7319a0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab4ddc7-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095821, "uuid": "ecd4424e-c0a7-4dd8-b5a4-c916a6c379e0", "comment": "Malware payload", "value": "25ac3ee433fed93e3621dc9f87839cd9", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095821, "uuid": "666d007f-1342-4970-860f-0f4facc156f2", "comment": "Malware payload", "value": "c335fc3edbc92785542a526e2fd96963a63d700f71b7ea5bd6b1f61e92db33d2", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095821, "uuid": "93425bc2-5398-4946-b8c2-dff659cd16ae", "comment": "Malware payload", "value": "7cad1b515c1029e27d997616ff9d9e8317e4d6c8", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095821, "uuid": "d8574090-ea6c-4b75-b119-d0d6329a618a", "comment": "Malware payload", "value": "ab2d9878c65884660c7d2f7ca86929c58b3a1a496181ee641ac26e2c91af264c91d9240380eb462dd8facf79d170a3d3", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095821, "uuid": "fa7a03eb-fca1-4cdf-94e2-55df4af83eb6", "value": "76D533587E101B82CB6E752A4CA1E216BDD1F6C7E1AF07BC25363FB86415D2AD162C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095821, "uuid": "523839a2-1b4a-461a-a3c6-c67a97fec23f", "value": "49152:+wkQsNusgJUIhnpHr3ikKbT4cLj54JB4xZSaz+u29N+nmdZeq4DSalXT0KH6Y:+wkrkU6pHr3ikKT1j54JmZLNkhdZed1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095821, "uuid": "b757e154-6cf7-409b-89a1-340034a7846a", "value": 2879898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095821, "uuid": "e3f8b234-0237-4860-9602-92e5dab4fd7e", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095821, "uuid": "b71cbb5f-9c7d-4e6d-a8d0-cad239676a59", "value": "AstarothSpammer (3).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95314a36-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160665, "uuid": "32f021a7-8885-4fa5-bb93-40150fc127ed", "comment": "Malware payload", "value": "40dbe73beac3924bfc6d051286795f4b", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160665, "uuid": "51303d0b-9ad3-4fff-8ec4-ed02502db2e0", "comment": "Malware payload", "value": "c3f5359234cf9a7c4993b33811554300ada6cef5f0cf8e0767e4c2757362d2f5", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160665, "uuid": "69399e9a-2e2a-49d0-be1f-3e8ae3bd5578", "comment": "Malware payload", "value": "88eb632628060fe1dc00ced50b6456dc60fd7f98", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160665, "uuid": "00a2b4a1-809e-4897-82f7-9ba7e0fc0bbd", "comment": "Malware payload", "value": "8f9ccf2c7b8394cbccd6b5018593f7ef3960ed8039a509cbca2fb4c224d7637bc95400d4dd94c2b6666ce7e3f0cdb25e", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160665, "uuid": "df9d5c94-7523-411e-af19-c135bd53c348", "value": "243196B32DC291260312E692B785483CE739900E8943240CA1EFC94DB1D0F932FDC2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160665, "uuid": "517a25bf-b6de-4ff6-ba11-c16846216fde", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE3fw:GEXfhexTvrtWQZUSePSiJVAyrLMf6pq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160665, "uuid": "45780a3c-4c0f-49cd-a32e-561f8fd257ea", "value": 1744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160665, "uuid": "29d642c4-5675-44c4-9597-114a5d59d750", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160665, "uuid": "049a2a26-ca1e-47cc-8ddf-ad0793a2abce", "value": "6R60QA6c.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec2c3c7-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153353, "uuid": "b10dcafe-4812-4b93-a7f9-595b4d20fcf6", "comment": "Malware payload", "value": "8a582e4f2d622489370343e25ae70451", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153353, "uuid": "3355d149-e74c-4a46-a427-6a161182e11e", "comment": "Malware payload", "value": "c4eae214c6c1289100fa0c227f685c886efc8c307b1af2de41d854c0f5975602", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153353, "uuid": "a897d22e-f459-491d-85a9-59465807110a", "comment": "Malware payload", "value": "84848cd4452ab0430027dc527568c142b44ed760", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153353, "uuid": "eec8c57e-4d05-4a7a-b676-22c337b5e507", "comment": "Malware payload", "value": "a441712e66db5041870642aa21a2337d99a724c13856d6ce4f76cbfa0390802864b294bb146bde38763b16392752c64e", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153353, "uuid": "d34a5933-8999-4a60-98fa-80e8f9a515b9", "value": "B9A1F850112C1AB0B246597AD26FFA52B40EC81B097B7B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153353, "uuid": "baf521b4-76ee-44bc-a9b9-b8684a3868ec", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153353, "uuid": "dfadaf3c-43cf-4615-880a-a34b8667de2b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153353, "uuid": "bf1a3277-5b0f-4e1d-9867-216166949857", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153353, "uuid": "ff8b663d-a0e9-4923-927f-9f3363e538e2", "value": "c4eae214c6c1289100fa0c227f685c886efc8c307b1af2de41d854c0f5975602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46b77ed-aca5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620111406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111406, "uuid": "7676a1d7-7300-4cfe-8670-d4c92a166b9f", "comment": "Malware payload (AgentTesla)", "value": "57e18aa92cd4d4c1dc830a4475af433a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111406, "uuid": "39a24bb7-826b-495f-b547-63def769017d", "comment": "Malware payload (AgentTesla)", "value": "c53a4390c9ba6953a6564058f4ec0c32ac62f5e8b715d4f31c0c4af4db17ebeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111406, "uuid": "0eb49255-b1ed-45d2-bb91-783427aa1d58", "comment": "Malware payload (AgentTesla)", "value": "9a32ebba54fa061b242c989662cc2e26249f1524", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111406, "uuid": "384799d8-07ec-4abf-b258-f3ee20a03ac4", "comment": "Malware payload (AgentTesla)", "value": "6dd036d09a2c6d1fc1ca613d82949385a595da744c28dc9abaddf892bce59bdd9a45ca1d63c2dcf5623272a8f322fc70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111406, "uuid": "06529e2f-cb05-4cc2-939e-d1fd629170a4", "value": "AA7118B513181EA1C22A41F5C29A7F3106D7F2EA47CA2884720EDF244BFFE149C29C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111406, "uuid": "45227002-639c-4d0d-a34e-68fb61fc26a6", "value": "96:iXhLTUWywvqE8sYqhx+ygnCef9fSd0wiT6l3yvk:iRByjE8s3SCA9fSd0wiTjvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111406, "uuid": "8a172060-fbeb-41ae-84cd-62af4d67fc6d", "value": 3567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111406, "uuid": "5370e046-ddb0-4218-9355-f316c4ce9183", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111406, "uuid": "58c332ba-b46a-4fcd-9f88-439888eb086c", "value": "PO KV18RE001-A5193.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912a3dee-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153357, "uuid": "c805455a-1ab1-4fc6-8320-4c292a6b2971", "comment": "Malware payload", "value": "60ecfbffebbde97c6c52be2859ebf348", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153357, "uuid": "5015db0e-ec76-41cd-b979-9bae67b3ca98", "comment": "Malware payload", "value": "c5768f0c26bd7bbeb1b5f6c056ed99a689e365d77350b1c87383f2937aa344fb", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153357, "uuid": "970e7855-a1c8-4c25-9660-f0de701da525", "comment": "Malware payload", "value": "a2ee4ae9273f6cce0882caabb01c8fcb31a597cc", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153357, "uuid": "635cbb1b-9b6c-43e3-b6b5-6d8ca3cd600b", "comment": "Malware payload", "value": "9db257f5bec203d4e5cb8591c8792b183fe39043f79b85de5d5af49378eab23735b58ce4b5a1f68ce1ac09a303467aca", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153357, "uuid": "1353a6dd-853d-4fa1-b201-edb89a04c3d3", "value": "D6A1E850112C1AB17246597AD26FFB52B50EC81B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153357, "uuid": "343bd695-534a-42b6-b9df-c5bc8e5681d5", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153357, "uuid": "864fa182-e880-4a2f-b059-2a1a0b28190d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153357, "uuid": "5a2e5967-9a8d-47ee-9f3e-7adf4dbbd8ba", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153357, "uuid": "20a5ae1b-267e-4d12-9ee4-3aa32d2fba00", "value": "c5768f0c26bd7bbeb1b5f6c056ed99a689e365d77350b1c87383f2937aa344fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efdf555-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152468, "uuid": "886bfe3a-4690-4482-8b28-7489997f88f8", "comment": "Malware payload (AgentTesla)", "value": "72d643819882baf6c48246024d4755d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152468, "uuid": "bf9203a1-6a31-4a3e-9935-7709ff213bd1", "comment": "Malware payload (AgentTesla)", "value": "c590c197137574e792a991b5c56791b8f7cccd4985d46b9f459fc6c39fdeb4ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152468, "uuid": "129fe16b-36c0-4955-be0b-3f724777337f", "comment": "Malware payload (AgentTesla)", "value": "edc461e732f56caa64c1ce4b02094fdd3d9af99f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152468, "uuid": "977b5bdb-6dc2-4e62-a17b-515c83742708", "comment": "Malware payload (AgentTesla)", "value": "d4b7c61db8316e5d3ee089a947f8a829ebded6656b548e8e80a75d6e029b9ac6bd87e50e5b0d51ac886b3150d0eb599a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152468, "uuid": "7bcf8ee2-b24e-4390-940f-e7c4a3fac963", "value": "AC253A6832641BE1F27B5FB663DA1C0183B92574693EE50D8F9113FE4963F032A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152468, "uuid": "aa5d4b7e-1eda-4d82-9c6f-9e6d21d86a7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152468, "uuid": "a7c4d7bf-268c-496b-a769-81cf03d1c42e", "value": "12288:aPbB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMajN2vZOmFb:afN2vsQ1oLAL+rdgUSzcr9Pr3fYM99U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152468, "uuid": "4b9e485f-a3ae-402c-8a1e-7abb36a663f6", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152468, "uuid": "06d5f704-ce3a-4676-9ccf-3514c96014d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152468, "uuid": "59d57c20-2785-4cfa-9b0b-2bdf9e521650", "value": "Sample Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9638d0c5-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153366, "uuid": "df59cf41-0d55-47d2-97cd-008f0b357258", "comment": "Malware payload", "value": "26774625fac1201a089f0fe707b309a5", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153366, "uuid": "853169ad-6be7-4499-b61b-c238b619206d", "comment": "Malware payload", "value": "c64f7127cce279095cc44b5f02caeb83d3cc2edb943bee922c1a417cf8914316", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153366, "uuid": "94ff8fdc-7d57-41a4-b941-74540a68a1ec", "comment": "Malware payload", "value": "404db277492853aa4175fba661a2aac9e585d9ea", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153366, "uuid": "0a206ec5-214a-4c2d-b13d-8330c9fdd480", "comment": "Malware payload", "value": "1efb1f73667a2a3c74550e93ad875b2bbe1b39b07ff0c0d1ad9b43e955cfed3f43493b9c46c396ddc0751be5bfa0e735", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153366, "uuid": "0b5ab3f2-4f69-433a-8ed9-12db721686c9", "value": "FD65330822FABCD4F9EB153937621C94C3A932F1C045B09536980CA656772FE539FEB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153366, "uuid": "fa3b98e1-9b3c-406d-8e67-96b8f9174c67", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflri+8:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153366, "uuid": "b5f43093-7db7-4e82-b427-69b8e677926e", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153366, "uuid": "96365985-b67b-454b-b129-8d21ae9ad7f9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153366, "uuid": "d2eba5b3-640d-460c-90f2-74366358e5c5", "value": "c64f7127cce279095cc44b5f02caeb83d3cc2edb943bee922c1a417cf8914316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7e4471-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620133651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133651, "uuid": "129d978d-a16f-4080-928e-23288767cdc0", "comment": "Malware payload (TrickBot)", "value": "eb70b6c24c0466954169882dbe5729a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133651, "uuid": "dd7dbfe1-2560-49ba-adaf-cbab81a7ba8b", "comment": "Malware payload (TrickBot)", "value": "c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133651, "uuid": "1c2ccf59-0a80-4752-b6c0-c71f974e9889", "comment": "Malware payload (TrickBot)", "value": "b81bcd8273854efb7d7b3fb5b982d75051a5d9a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133651, "uuid": "bf4c3216-bdfd-4fb7-9990-c5d913b14a6c", "comment": "Malware payload (TrickBot)", "value": "1a333cb232a8405435e96647957338ebf8b2c8c4f3cf4230a58f474003f4c97c2d4594425ca6c7efafb5a02447e4440a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133651, "uuid": "4cdcdcca-d34f-4680-9b9f-8bacbfb0c98c", "value": "74941243FC8B454DF1EACBB098702F4EE8321B11A75B1B2F44EA75A8D8163F63146679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133651, "uuid": "4c4ed2ad-fbea-41d0-b39e-af26ac166c62", "value": "a6618e9400ff529b6609348741f1312c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133651, "uuid": "e0dfd75c-634d-42ad-81a0-bd14cb56dbb0", "value": "12288:mLseU1D6L/hAsEYhbdf6YMvkm2kJYcxpGJ1:mLlS6L/G2f6jv7dJYYpGJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133651, "uuid": "2707911d-095b-4e4f-8a59-8b51c3ccdfe2", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133651, "uuid": "0a835e22-081a-4f6b-be3d-8ca535219bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133651, "uuid": "d603fc6e-03ad-482d-932b-3ccedc5dd00c", "value": "netmouser.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d779cce-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153378, "uuid": "ba6a888c-59d1-4355-bd41-e10df40d4549", "comment": "Malware payload", "value": "b9c0b804b231996097792a38adb4e26d", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153378, "uuid": "0bba7e3d-5b9c-48b6-aad9-f4633d81b7be", "comment": "Malware payload", "value": "c7856d11d009d0aed5f4a4563618d38a2790dc4fd375a429e7ad61c3c8feabeb", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153378, "uuid": "34a840f8-5260-4b9e-bc36-31a1df64be6d", "comment": "Malware payload", "value": "ee5b8dfea834bcaab2062c881fedb1fee19fa479", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153378, "uuid": "ce2a78e7-a6d5-435c-8100-d184caa66131", "comment": "Malware payload", "value": "1b0a3d3796f7301ed2962f08dd24c8c2861060a1b580b892b8b8a62d8a887980ee9e6ed716fcb4cf61231068090b1707", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153378, "uuid": "44aada04-4c90-46da-91ad-2e26a891cd78", "value": "44C53336F4BB39743641E7E24604D93A6BB7C35A3ABB37160FB89CCDA12450B756C098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153378, "uuid": "a2d407f5-7857-4f11-b71e-3b7509dd0e88", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1UEB:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153378, "uuid": "c6ef5701-a74b-42ef-aef5-18f7d4db29da", "value": 2670592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153378, "uuid": "2c20e49f-dd9d-4354-bb12-efe06907e889", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153378, "uuid": "c44ad1d9-c46f-4189-9ad3-3739a50d2052", "value": "c7856d11d009d0aed5f4a4563618d38a2790dc4fd375a429e7ad61c3c8feabeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee8cab3-acac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620114350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114350, "uuid": "e6cd94a6-3cf7-46e7-a3a1-538bd0d57878", "comment": "Malware payload (AsyncRAT)", "value": "0afcb9f210ad0fbae66276f583a0d04b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114350, "uuid": "25d55817-df0b-474c-b89e-2837546b3ab6", "comment": "Malware payload (AsyncRAT)", "value": "c7a647398282460a21fe3334a15d327c975c23cfdf4e08028c440b04b0404b73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114350, "uuid": "676a8698-b9b0-413d-bfe8-9532b4611190", "comment": "Malware payload (AsyncRAT)", "value": "d26d65ae6cad14cbdeb1edfdca9d3eba3dee1c5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620114350, "uuid": "2b2e7b45-4fe7-49a4-9aba-54b4e8d2292d", "comment": "Malware payload (AsyncRAT)", "value": "167614782c4d6dbe48cf548c72ce8819d7268bd8ed31a081cfc01d8d4cf19a842e7c2c74b42c2291186b212ba01afe8e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114350, "uuid": "5ca4368a-e5d5-448b-9d28-30ac0ae771c9", "value": "7745B517BC4C7D8DF9927AB62D89B2295810FC34F628079B34C1BD0AE578397A077369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114350, "uuid": "7ed20bca-0a1f-44cf-9ffe-f90992b9e257", "value": "eaf850221ebb92188ccb4c061d41387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114350, "uuid": "ad2e7cc9-f9bb-4bd2-81d4-6d43034660fd", "value": "12288:DMcf1rOmTgbOabObybOEcUFCw4z3Gzotx8wuVIeprv3:FN3WFJ4zduVIoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620114350, "uuid": "9b2027b9-1184-4544-85e0-530528d22c9f", "value": 1216237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620114350, "uuid": "dfd264c5-7965-4854-a0c3-6295d24c1538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620114350, "uuid": "4ebe0fd5-9858-4be3-ae37-a62b731fdab1", "value": "ORDER-210067.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f68e8f-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111647, "uuid": "db2a2e62-2bf4-4785-a855-f573449acde6", "comment": "Malware payload (Dridex)", "value": "9a76a326ebbbe0cc6f35b0fb4cae0348", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111647, "uuid": "5a1a8e1c-5583-4478-81c5-6cc745baa2bf", "comment": "Malware payload (Dridex)", "value": "c82e5060b368d8b45f5bfbcd84a0ef6ba3d5787e09134499688640f8d44019f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111647, "uuid": "a5e38adf-2701-45b8-a1f3-0d75d5e04004", "comment": "Malware payload (Dridex)", "value": "df51e6420aa545cc985d963cc95cf81d7e473de5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111647, "uuid": "6b73fc4d-f469-4157-9ab0-d3522e6199c6", "comment": "Malware payload (Dridex)", "value": "5d50536d1ecaf10f43ca4448cdc63e787d36fc4ed980f4092591ac888aeb1130f654883b392a7cf4fed9c1430c7254b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111647, "uuid": "24c26e0d-adcf-4e67-bfa7-de18c17e1a0f", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111647, "uuid": "7bd9c6ca-a63d-49a2-b27f-ad426a2172d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111647, "uuid": "2974d41b-0d50-4a8d-9c39-f8df79973191", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111647, "uuid": "9c5e6d9e-536c-4b8b-80c9-4f87f1045c6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111647, "uuid": "c056a72a-a7f4-4db8-a3b8-42fc1e1c13e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111647, "uuid": "705fbda9-e47d-42e7-9d3d-3f14066febcd", "value": "9a76a326_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea2cc19-acb9-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119825, "uuid": "bf328b04-ba80-4ee4-84b4-9bf25071a690", "comment": "Malware payload (HANTA)", "value": "38bc86ffa9f7a0758c54c9bea36a195d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119825, "uuid": "02ca5f61-28e0-4969-bf0d-bf607ced866f", "comment": "Malware payload (HANTA)", "value": "c8968ae1a491e810a8da8ebedf80a62a22753e0f25105834e3f39e1476829b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119825, "uuid": "05588df5-1a7f-4d7c-92e8-934b08661563", "comment": "Malware payload (HANTA)", "value": "8cfbf2e9bed5a160ddd7fb89eaeff92bbe8c28a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119825, "uuid": "461bd283-9f0a-4167-8e1b-7696921ff239", "comment": "Malware payload (HANTA)", "value": "0c2f4ed63c77bd37458bc2a742a505c579ac252926548c6442451c209c87ce0af0f0676c151794204fa1f177f724e431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119825, "uuid": "07ca5516-6349-4784-a774-8cd6a64314b4", "value": "860502B7413290B6C5996230F1B51F0B717CDA350584B989F04FE2EAEC4E6AD99F43B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119825, "uuid": "3962c2b0-db17-4ac5-8092-6bb79afe827b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119825, "uuid": "c9568a55-223b-418c-9457-06a5da0c7e07", "value": "12288:2dzrMCskQRzXM8BwOp0afCDGbm2VOoSFwK89rxY7p3VJQwTgdvPI4/7z/3lR2Ld1:2dfQB9cURm5FwgZQggdH17LnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119825, "uuid": "e9d57e0a-19be-48d3-9732-26ecbec4bdae", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119825, "uuid": "c61d158e-5475-466e-8372-9878af96aad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119825, "uuid": "1d5845b3-9f89-4d16-8af8-21c32ec057d0", "value": "h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4202b0-ace4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620138342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138342, "uuid": "26664c17-815b-4954-b8a8-6f974131b73e", "comment": "Malware payload (AsyncRAT)", "value": "dc48640ca8488d4c4e61b807ef19d11c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138342, "uuid": "026dcd02-833e-4190-adc1-b792b779d57c", "comment": "Malware payload (AsyncRAT)", "value": "c8f3d97c54386b86778a1d20917353583bcf706ffe0615d962683d55e449bcab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138342, "uuid": "3c5c9fb0-8cc2-45fc-a96a-82a36461fe75", "comment": "Malware payload (AsyncRAT)", "value": "e2cfbc565e62b269a7bfbdf2b3c060e52aaa6614", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620138342, "uuid": "c93a701c-5488-4378-a6f6-9a29e14f85fe", "comment": "Malware payload (AsyncRAT)", "value": "42eb8c367082a2ebe3efca68b8471758119abb8179d7131787cd3a412331657060e03fec4a529a812cfd9ccb50724bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138342, "uuid": "151d1ea5-535c-478e-aab5-231de2c758d8", "value": "23533746DD109B83E69987BDAE0B4EB61F4E2B4CA5C26ADE05334E4B7A057320D8F15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138342, "uuid": "661d9f44-bb56-4830-963e-f6f446362879", "value": "1536:zg+UkI3dpTyLSKIsPMh8y6W6Z4zt2vV3MNiP0:znUkI3AS05ycOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620138342, "uuid": "65a9a9f2-ba16-4b3b-b1ac-9be710a40415", "value": 65949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620138342, "uuid": "b0db5a23-44f4-4c81-9d78-0454d6288478", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620138342, "uuid": "3a787d09-ee98-4bfc-ae60-c935dc08e00b", "value": "Price list.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27a21b4-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153386, "uuid": "be049c3f-7997-43ee-9bf6-c23d54689c48", "comment": "Malware payload", "value": "3a379ae99d825827124aad94f39cda65", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153386, "uuid": "32ccb976-b752-4676-970d-28d5a4a426c0", "comment": "Malware payload", "value": "c96b7064055d97555852a0f30f310c5da1959bd28e7d4871e5e9689d608ff5ae", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153386, "uuid": "b672b8b0-96d1-44c7-9858-aca6e09934a1", "comment": "Malware payload", "value": "39872f1918dd55fa3b12effc3481e0b261f5b4df", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153386, "uuid": "08f666e2-9b39-40ce-a5b5-cedc1662abad", "comment": "Malware payload", "value": "ea9dd865e0aa5d80ba52ea68749e5409f929f69906e1c75effbabf7ccf188f5c92b3201cf3a0729bcc58f47cb85ae604", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153386, "uuid": "b38a32e6-fbb0-4ce4-8f94-d2933518a3c9", "value": "3EA53361B90A74A6FF9419609F08F67A6D40CFF174D2CB70E9B04F872378A892E6DC51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153386, "uuid": "12fe52ed-9965-485f-a167-4693444f4e5e", "value": "49152:l1UdkOgGKlJkHZrZ39xWgpsc9Ersdu9LxhM/uZd3cKLN0x2v:l1akFnQrZ33WKCguRM/u75xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153386, "uuid": "bfe4d1dc-4010-4ab2-bdd0-6ae8c8bc966c", "value": 2105344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153386, "uuid": "3f1292c1-7d01-4693-8a9b-8b9d24b695bc", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153386, "uuid": "e2ad0441-8bc0-488b-a0f5-35b2626982db", "value": "c96b7064055d97555852a0f30f310c5da1959bd28e7d4871e5e9689d608ff5ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d60b34-acef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142809, "uuid": "be7144ef-57b6-4e41-8718-ade8851afe1d", "comment": "Malware payload (Quakbot)", "value": "4131b71c0f1d082edb34c766188d10b1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142809, "uuid": "4eff16a8-f97d-4c31-b014-0b948399719d", "comment": "Malware payload (Quakbot)", "value": "c985fb8f434d7ed9d9844c8770e6c1b1d00d49de4dd6fcc4a8c4fc77be3080f7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142809, "uuid": "7148f60e-a341-432a-a35e-91228e3b9ebc", "comment": "Malware payload (Quakbot)", "value": "4d6afffcd7ba91815cc9d8e0427123aa63bd93a8", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142809, "uuid": "ff3a0368-2bf8-452e-83b2-9fa3bf78e8de", "comment": "Malware payload (Quakbot)", "value": "00765696cc5f6498b0ee297c7b8186fad9ce688905790b3c1c3d7b01899284278eb33fcea1aef3a781219969898dfae6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142809, "uuid": "3670ad42-88c0-488f-b064-c0ee546958ea", "value": "EDB3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142809, "uuid": "a1990699-d707-4b25-8df9-7f067cac1430", "value": "3072:VkYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:2AbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142809, "uuid": "b9ab15bc-91ab-4a38-9590-29ac54f5a315", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142809, "uuid": "90998f48-4ba6-4148-b334-23db3c86163c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142809, "uuid": "e8a4639c-faf1-48e9-89d1-e07eee242b48", "value": "Outstanding-Debt-439798376-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bcd54d-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "1a7055b8-dd78-46b0-9e61-d321905dc827", "comment": "Malware payload (Quakbot)", "value": "965c271faf86d03c634d62c30c54bbfe", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "dce9c354-8b48-4870-991e-aa09beedb441", "comment": "Malware payload (Quakbot)", "value": "ca4072e5c04688b42b9fb306dc7d051260aef6266575b5be8a93e39d075b9abf", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "3b1c47a0-d810-414a-9474-9798f3317a4f", "comment": "Malware payload (Quakbot)", "value": "541c52b418192627a3948a50ac3aeaf9441570f1", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142565, "uuid": "fc262906-c617-4b53-9cc4-78376f5eef21", "comment": "Malware payload (Quakbot)", "value": "a8deadcad45fab1a2020aa28afe04a60517a3534ff73dd8bc8d00b2bf4f3dd652bd8711231e4305f8eb7028f92233c35", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "9dfe71fe-5909-466d-8756-34e4321f172a", "value": "83B3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "9f4fed80-c8f1-4b29-86d3-874d2f0c4e3e", "value": "3072:3kYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:0AbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142565, "uuid": "09f6410a-ce88-4c7d-9137-45ee0732d94c", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142565, "uuid": "c15afc2a-ba3b-4618-9b1f-5acd19a929bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142565, "uuid": "e83b07e9-d1fd-4705-9962-66de1978079e", "value": "Outstanding-Debt-170373600-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708134b6-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620141706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141706, "uuid": "c7a5b31d-280b-4b41-9bed-a8530c42b538", "comment": "Malware payload (NanoCore)", "value": "ce4dcec84bfeba49404fa70f5d137645", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141706, "uuid": "5f80f50f-df08-4550-8a2f-45130ca7855a", "comment": "Malware payload (NanoCore)", "value": "ca85b069b028fc30a2af436344eae332ad6afe8a7e3904a48ee63948ab6c3133", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141706, "uuid": "4d00dcde-23d4-496c-a61b-e724835bd8f5", "comment": "Malware payload (NanoCore)", "value": "c31021953c59af126d0095bea70c26ca02a2d954", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141706, "uuid": "b91c7234-637a-4ef5-9e0e-f33d5649300c", "comment": "Malware payload (NanoCore)", "value": "0b2915bc1ef12b76123f21ada03df49d0cb2caa044b732b95c01c1dbb3876c3d6b6b6d54eabfa30ccf01d82cd8967474", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141706, "uuid": "c4b95a37-4f00-46ce-a1fd-75027d3f7852", "value": "54B4CF335226FCC91B7B2D84B60829560C6C389BA361526CFFC609ED69F6644DF5C4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141706, "uuid": "2b7804ff-4ff5-4a44-b537-4f1636e873c4", "value": "12288:hpwkVfVJwJJTtAm+7Jx1zCBEDiBsrvODJ2+oDhX+K2jid:/wkVfsJoz8srvOXoZdMid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141706, "uuid": "7d14bb73-63bd-4e76-aeb5-e91dba5aef32", "value": 498648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141706, "uuid": "38e7bb45-3649-4070-a273-d1a25e982143", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141706, "uuid": "542348b3-abe6-47e6-9ade-c163371d2137", "value": "Invoice No F1019855_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ad9c3b-ad19-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160851, "uuid": "d28294f2-5708-41f1-a177-94d06f846596", "comment": "Malware payload", "value": "e180d56a46981da47bfea9437d56d080", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160851, "uuid": "07c38557-009d-4165-9876-430c910ae0e6", "comment": "Malware payload", "value": "ca901997b0e5b3bbb60418887ce31c3761d45cd5bc4839d62b5fc46988cc13c9", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160851, "uuid": "d3d14656-0050-4785-a9d6-ba3891f71a36", "comment": "Malware payload", "value": "df79c83a92c454081a8af4c206251cbbe0cbb838", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160851, "uuid": "a2b609ce-75f6-4fbf-a6ea-81ef09feb66c", "comment": "Malware payload", "value": "3085658c74f7d3b6f03fb06d47f608c8970e2099fa67dd1d7f004e72ca279cf592b73ef548b75052c4e25a4a8c2fa804", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160851, "uuid": "6beaf904-a79b-42b4-91a1-744cc94ed4b0", "value": "483176B32DC291260312E6A2B745842CE728900E8943240C92DED54DB190F532FDC2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160851, "uuid": "44c13b5d-e3a8-4c2a-bc1b-4f480d50dc27", "value": "48:GEXfhexTvrtWQZUSePSiJVAyrLMf3qJqj:RhuTHZUSe7y2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160851, "uuid": "24e7cda5-8628-4df3-b5f0-d844e0a27ab2", "value": 1748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160851, "uuid": "740e2555-3fef-4256-9255-2f55b00a00cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160851, "uuid": "b4c1fa96-1819-4aa5-812d-805f2d58610e", "value": "w97es7Cw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95869e8-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093725, "uuid": "c69a4fee-7ca2-4258-8f16-7bcb0bcdbe51", "comment": "Malware payload", "value": "7340713700fc706739eca3e62b8650e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093725, "uuid": "80d4f873-ba1f-49a4-8418-b598fc011b0f", "comment": "Malware payload", "value": "ca991573b3c6495a89fa1f2745cf5b8fa6913a1a19c63ed54a9bc81cee611836", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093725, "uuid": "552aeb85-2cb3-4fde-bf9c-798eecbba672", "comment": "Malware payload", "value": "b8a9664f27f4818ed9d602df2193d06ab3dd1bd5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093725, "uuid": "1699cafb-aa21-4628-9d41-0bddcb21562a", "comment": "Malware payload", "value": "16a893d5fe81dc1ea9f1113abc1b16b018fdbdb06dedd8c748e123c8ab9a6c9a5c82bb4ef2cab247f01a49f8b63b0ac8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093725, "uuid": "50324075-eacd-4bea-b763-c7f797be9949", "value": "CA45227035E4D032E65358308EA8D775B879BC394472850EBBD01B7EAF62AA1D327B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093725, "uuid": "33c74f19-1599-42fe-a606-f490c7f07ea6", "value": "130312efe8892496180179ce46d20b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093725, "uuid": "8b5e64c7-3fca-4922-b0ec-873b1fd8bde9", "value": "24576:3TQuKl+kqs5Fr1NWd6lXgT6V6VAug+abNLAsZjSeN+UkgkTER/TXtE:1qT87GVnuLuN0sr+UknGTXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093725, "uuid": "60a84d92-2a4c-4865-902a-5d232a6cff22", "value": 1210933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093725, "uuid": "bd602218-cecf-412b-a688-d1c38405c125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093725, "uuid": "88630ee3-0df0-4299-98d5-aa62356b94f7", "value": "73407137_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93f01df-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153478, "uuid": "adbbf018-9875-4a31-afc7-e26d23b1c9bc", "comment": "Malware payload", "value": "4f5c17021bbc348202b9625f6dd6cfc9", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153478, "uuid": "4ec80914-a603-45c3-b3aa-f38cbbce730b", "comment": "Malware payload", "value": "cab5d25b9f17fcbd929837d265d3f55991fa34f03e896cfa298e1581d1898f6b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153478, "uuid": "284c80b8-5a0d-4f3b-af5d-63dfabed1cb1", "comment": "Malware payload", "value": "fd5170e34a555d2312cb3f63b4b91354635451fd", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153478, "uuid": "8852ab53-c823-498c-939e-a38531087b96", "comment": "Malware payload", "value": "af1a6fb5a901a95e59f7a99c486291022391dcc1cd04a93cf5c9008dc7b8870e72ae425d849c378de9a57a3613c346bf", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153478, "uuid": "bed37c9c-1315-4e79-8cb5-c1fcbf96ed26", "value": "8341B0C8315103F6ACA69A2B75B5D085B1C790D99CEA3E186EDE3CB489CCE193444AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153478, "uuid": "7c627d2e-b65a-4127-9ba3-6d15a34f3df3", "value": "12:q0Flxnkz0F+jc90FGijc0FVdrqB0FVkLr4ws0FVR8irRklH0FVQrhO0FAwz0F1pB:vlxkwgcWGGV/Og9Kwa5elzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153478, "uuid": "35931943-acc9-46dc-abfd-bf165f9d1eab", "value": 1885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153478, "uuid": "03b445fc-5069-4f24-bce5-d9061706fd37", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153478, "uuid": "81467b83-2946-497f-8e4a-cb23dd653059", "value": "cab5d25b9f17fcbd929837d265d3f55991fa34f03e896cfa298e1581d1898f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331d6e12-acc3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620123994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123994, "uuid": "a90032c3-7d68-4074-81af-dbd0b57a0066", "comment": "Malware payload", "value": "6c5e7908c3a06aafd6dcebc8a2dcb674", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123994, "uuid": "a6477227-b182-4c85-a1d5-a2b9d9e453b7", "comment": "Malware payload", "value": "cb8b20c28a0ac697b6f5bd430bd86762f6b9ef635428fe3fe77e174b172ac6f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123994, "uuid": "d245df6c-c027-43f3-99d4-ffb084806e57", "comment": "Malware payload", "value": "d094aef9d24e13ab70f2ef767242be554ed855ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620123994, "uuid": "83ab5558-85c1-414d-b9ce-540876be5fb6", "comment": "Malware payload", "value": "c1e4d613729e32f0e7255b1406c470441f10b167cec6f1dc83e6762d3e817ba5b9f9820ef5481de167b885014c0d721a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123994, "uuid": "7b5e2403-b87c-410c-b109-6193c80f9ce5", "value": "CAE19E3BBF166922C2E2DDBF861266C39CF687BD0041B7359200FD829A139C06B1746D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123994, "uuid": "eb00e38c-8b00-4665-9da5-679fe82b862b", "value": "192:kF+PVnWW4811rRBBTaikn27xcCQgcN0w7tLIdtZU1elD:kF+PV8811TBTaj27KCy0wmseD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620123994, "uuid": "60d203ee-6e61-49c0-8f19-1001a411ed08", "value": 6813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620123994, "uuid": "26bb45a2-a678-4464-a92d-c854c981d4e1", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620123994, "uuid": "883a5b87-eb7a-4262-979e-fbcd493fb528", "value": "presentation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80555f12-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111668, "uuid": "bd187c7d-32cf-4a8e-be1a-f706f35ada8f", "comment": "Malware payload (Dridex)", "value": "0cb194fd6690a3370065894888b3b582", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111668, "uuid": "f980df40-0a28-4616-9f05-12022eb8b88d", "comment": "Malware payload (Dridex)", "value": "cbf5a00e342e63fdbd619fdb54dc8d61f569d3749b52a9dfa47fb76ed3394d8d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111668, "uuid": "433c5754-1e39-4ac4-85d7-d72412e2edba", "comment": "Malware payload (Dridex)", "value": "5635adce1e17217761b0b392e9e7bab773d1b482", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111668, "uuid": "9cfbacd9-db96-4b28-85f8-ac5d22fe2603", "comment": "Malware payload (Dridex)", "value": "23db8b34a9fe0fcb89b7b34854a171e6d1cdedf623a8115bf2b6d6230486761025f1f6b7bbf9c8178077b6e365d2c707", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111668, "uuid": "0e137010-84d6-497c-948e-661bc67918f9", "value": "B4F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111668, "uuid": "77e5a0c9-c731-4493-a938-5e1dc0eb9241", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111668, "uuid": "5516a039-fc62-4741-9f4c-92feef78dae1", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111668, "uuid": "261241b5-6bcf-4d3c-992e-f6c76da214d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111668, "uuid": "484c362f-8c5d-436c-8619-6608e98ae167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111668, "uuid": "790b5ec8-f8aa-4957-81e6-c7bf38f59a7f", "value": "0cb194fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56c9ed8-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120400, "uuid": "bcf9d80d-b5ef-416e-8fa7-335e1067ce84", "comment": "Malware payload (Gozi)", "value": "b8c176dc8ab0d768031014f95b8816e8", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120400, "uuid": "eebe49ae-21dc-405c-822d-a549c7420eab", "comment": "Malware payload (Gozi)", "value": "cc79e66b24bfca1cd0ef27c63921737786dcdae02f871279800ea2c82939721a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120400, "uuid": "564b8dac-cdb6-44b6-b75a-7d7e4f89f29a", "comment": "Malware payload (Gozi)", "value": "97826adb6aac6340a74ca024a65065fa6fdb21ca", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120400, "uuid": "3dde4ecc-16b3-49c7-9e64-2d8ce421402b", "comment": "Malware payload (Gozi)", "value": "8a4a43cdcb414ecf0ac53f144b69301a4d910ac88c58ccbf3bf8a5d4e7eb8c5cadd2b14804b5d51a1ce4012e7d6ad362", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120400, "uuid": "c9039c9d-47d5-4622-9ce8-8bf9d49d907b", "value": "7B245B6AA2E40695EDBBDAB5C953C61BE7F334441B28D70F03B0CA656F57321F228352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120400, "uuid": "93031263-67e0-450d-9944-b9683619d568", "value": "3072:fWLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYPr9fGWg+Bm5kf7JDLm:4qO/rsPHN7Q6l7Bz9zhvNJYPrg1QNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120400, "uuid": "595b6e3b-5c01-48a1-acbf-fe02c4793b29", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120400, "uuid": "9a0da9fa-09c2-45ea-88c1-0821cb378965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120400, "uuid": "5a1cb781-b499-4494-9bea-5b710792e7a6", "value": "21a5f8d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745bbf49-ac95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620104346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104346, "uuid": "c280cdb3-b3da-420d-8124-bdddc7e4a181", "comment": "Malware payload (Formbook)", "value": "eee5f618718bc8237bb9c7a48154cf1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104346, "uuid": "e4de64ed-f908-484b-8611-f8c3cbcc36a1", "comment": "Malware payload (Formbook)", "value": "cc7b066e0fa912d406c27790458ad6feb171b27275b6e3fe46b7a7574da7bfce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104346, "uuid": "67adcb9d-d5a7-48ca-ade1-47477ae36223", "comment": "Malware payload (Formbook)", "value": "84dc873f65dc9e86978944d1adddb762efcf2631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104346, "uuid": "bdd48a1d-bbb1-4eac-a670-49fdddaddb64", "comment": "Malware payload (Formbook)", "value": "50f242e39f1f5a5dbe2c14870b68e380d54b0795a0b3263dc9888f137d2896ff05e91ad49e05192d4a0a8b1e2c43c8da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104346, "uuid": "f3fd5686-a939-46e5-a063-b5c957705c3c", "value": "95341276B3C0D8F7CB6205B109B36741EFD6E83120ADA74B67B49B5A753A3D48C0E291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104346, "uuid": "8a6560f2-42fb-4ad1-b4d5-beb50476b888", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104346, "uuid": "6389a12f-2ec2-4c3b-81c7-ff67c9406c52", "value": "6144:lPXIfOtwEmM2jSvr02vaoMrgkoHYltLEZZLMZU7J:aW2Ar0Esrbo4H0MZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104346, "uuid": "86d8cc1b-fe71-4214-b6ef-68c4e53affc7", "value": 235115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104346, "uuid": "13dff8e5-5294-4c7d-802b-cd8c4b2885b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104346, "uuid": "6dacce22-13c6-40cc-b850-387b7e0fde33", "value": "202139769574 Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c95f38-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133420, "uuid": "493c7c07-cf22-4150-8e39-7af09453e3d3", "comment": "Malware payload (AgentTesla)", "value": "04bc6764f8cdffb64457c5d2a4fb724e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133420, "uuid": "2895f5ec-0a92-47a6-b6ed-d5e52c0d797f", "comment": "Malware payload (AgentTesla)", "value": "cce20e15d25dff33fc03049e3fdfdf643eb50726e55e8c17994f64aa45bcd29e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133420, "uuid": "4b3b7971-bedc-48c5-9616-20e74d16443f", "comment": "Malware payload (AgentTesla)", "value": "0f07900befe2912a1539b02bf0897c858da65238", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133420, "uuid": "dd167209-e517-48bf-acbb-cee79587bf4b", "comment": "Malware payload (AgentTesla)", "value": "aba41fb0c74093f7039d17fdd2248d1d6d2b574e4ff739897fad0b125c090c834abc1312a7ea4f6076eec5a8da0f0f6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133420, "uuid": "de910ead-b13d-4015-9269-c83c0eaac01a", "value": "82253394FED98F57D47366B48F02D90E45598F483B0BF4AF7A30704A683A7B227C2925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133420, "uuid": "3cb3d45b-0d85-45ba-8781-8e05abea4024", "value": "24576:085JNhU/oGYxb+k0ZGcs/RX4qJvhHiaz9CzBIflqHg4i:08xoo9b+DGc+V4QvAaz9CzCflqHg4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133420, "uuid": "b65a364f-9e5c-4bff-8eb0-b90db0b31e48", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133420, "uuid": "655f5ba9-e6e1-4466-a567-9d77e62abb37", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133420, "uuid": "98abab13-df61-46b9-8b26-3cc2d1497f5e", "value": "Pending DHL Shipment Notification REF 04521.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d899aa93-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120406, "uuid": "33d8d895-9e28-4783-866b-717cb61ff517", "comment": "Malware payload (Gozi)", "value": "5e5f1596b33a674cfd76c6d2c05ad8a7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120406, "uuid": "6b195125-2aa5-41a4-a378-aabf9e4c5ce7", "comment": "Malware payload (Gozi)", "value": "cd2dd8bec4b30b7b7f69c1403c2fa19b1715e3e554c4fd595081e4f395c0d119", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120406, "uuid": "351adde2-3d8d-40b0-8360-44fa40b4b4a4", "comment": "Malware payload (Gozi)", "value": "4b2c6c39de4d362ef94e7fd306ce1b4e1eee1217", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120406, "uuid": "be80b2a6-b9ce-4b3f-a14e-6b1470cd8b66", "comment": "Malware payload (Gozi)", "value": "45d3698cf8e689440370462ef49dd4cf5ce25edb5f14e3183814a1ff9b53b8ad196a08992fa26295cc7bec555de0f070", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120406, "uuid": "2d9690b3-4c4a-47cb-952d-1a0c1a40447b", "value": "02245B6AA2E40695E9BBDAB5CD53C617E7F334441B28D70F03B0CA696F57321F228352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120406, "uuid": "f18c021d-45a3-403f-b4df-0562224a918b", "value": "3072:fWLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYPr9fGWg+Bm5kf+DLm:4qO/rsPHN7Q6l7Bz9zhvNJYPrg1nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120406, "uuid": "4938f4a9-13ad-4116-8895-5ab178123686", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120406, "uuid": "9e8cab16-9a6f-4a33-9d79-ea4b1db278ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120406, "uuid": "71e643fb-f258-4c8b-b1e0-bd60ffec458c", "value": "267f4280000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d58418-acb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620117282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117282, "uuid": "aa15c078-c509-47fb-8b41-ec79f2b8081b", "comment": "Malware payload (SnakeKeylogger)", "value": "ca39f4138335c0d5d1483ad8e2ba0cf3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117282, "uuid": "0f731b42-79a7-4260-aaf1-0e45732b2eb3", "comment": "Malware payload (SnakeKeylogger)", "value": "cd71e0f11db529a164eca42279020c06ae2d12fa0335b851a3c4043aa69e0896", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117282, "uuid": "2d90e2dc-662e-45d1-8713-050f94464f81", "comment": "Malware payload (SnakeKeylogger)", "value": "b96dbf7d795c4c915e445e4a75adb52a6ea5a23f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117282, "uuid": "988a67a0-13fc-4a70-be65-12a7a8bcf330", "comment": "Malware payload (SnakeKeylogger)", "value": "41585da49661474b9f33a859263cde910801691d3543985a5a425f252507ad17e252e04a136e4eb99c8eedf1716703d0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117282, "uuid": "c425fdc6-c02b-4e47-bb39-f2dc5d33a68b", "value": "26E4CF6233D4AF6CF07E8B7581255200A3F1B90BE722DB9DBDA514CD48E1FC583627A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117282, "uuid": "7ab0361c-897e-4e82-bfa2-3a669a3fd497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117282, "uuid": "2bc3977c-c217-4d91-888b-dc6d2ea4a8ce", "value": "12288:4CgZKkicIFOKML8ZZcbaDPzuHZxLmI2ahJU3DsIzcvvfFjmvJst8YtdMVyG9QaG5:1gZ3fmOKUNbaDiHZxCI2XzsI4vvf5mgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620117282, "uuid": "6a3cc58f-e4b4-439a-8a5c-8c787ffb1b8e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620117282, "uuid": "0e7eef62-9a64-41d7-bf7c-75b2cab806c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117282, "uuid": "6692ade0-8f8f-4f13-8bb9-7e4a42400884", "value": "Halkbank_Ekstre_20210504_080203_744632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e846ba-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097255, "uuid": "dac4a437-6492-4daa-b5cd-52ec978b0f58", "comment": "Malware payload (Dridex)", "value": "ae19f8d43c83cad99ae1209f6e3e147d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097255, "uuid": "cff5b761-cafe-448e-9af9-af4a3b2c21e7", "comment": "Malware payload (Dridex)", "value": "cdd4a2daacfb93cc17059ab06c017d0a513f95cf596dc6d12c0800d46380a338", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097255, "uuid": "d9660086-29d9-4abd-820e-ae92f02fd9d4", "comment": "Malware payload (Dridex)", "value": "031e4043c7f3817e0aa94c571fc37cc00e4662e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097255, "uuid": "fb41eaaf-2dc6-47c1-a528-e3df03737075", "comment": "Malware payload (Dridex)", "value": "1674e85ad8f1e70ca886856df7ef50b1d0e2ca225a7922fd4b059cdf204936dcfd898fd5223766dfd500aecce1de5337", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097255, "uuid": "dc86feea-2a8a-49eb-95eb-ec55799e9f1b", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097255, "uuid": "dbbacef6-519d-4cdb-9075-6002562047c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097255, "uuid": "7bc00d7a-0485-484e-aa4d-cc9078953633", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097255, "uuid": "fcf28971-2900-431f-8fea-91d1d81f3360", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097255, "uuid": "9ddd6ecb-39ab-4adb-b13f-8ac54ae19f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097255, "uuid": "fd02371b-494e-4a76-a70d-3a74408c69ba", "value": "ae19f8d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1195881d-acb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119213, "uuid": "21dcbb4a-c6f8-49c3-82cf-872e60878a63", "comment": "Malware payload (HANTA)", "value": "fd9f5a7e38910e73a3c2dd83b7f23e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119213, "uuid": "d6143a0d-3074-4236-9c88-aeecf61d268c", "comment": "Malware payload (HANTA)", "value": "ce339d27382e76c1a55fb2426513715de2acf675ce3aa72a46718baf1da3b9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119213, "uuid": "a10d2d86-e296-4c04-bd71-882ab3464793", "comment": "Malware payload (HANTA)", "value": "774dbd89fd80b8d26a3d0ac5bf384eb787164d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119213, "uuid": "1ebb3ef6-0ed2-490c-ba65-a715fd9f3b90", "comment": "Malware payload (HANTA)", "value": "e7f8fbe1e23d4ddd496df9010d46a4a45316d31f4d37f5a4080d87a5eccd627d7a15642383236ecc5c513f425d77e96e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119213, "uuid": "973e4ce8-399a-4116-bd4b-8d0ed2af323c", "value": "9405027B00B592AAC25D1330F1711F0B7ABCD6695A80B148F04FB2DBDD4D29D9AF47A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119213, "uuid": "db60328b-4bd7-4fac-9405-b62907f2832d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119213, "uuid": "fead5d9e-6b7e-43ed-81c2-7dc24af57070", "value": "12288:Itg0zo6UYhZQFCyQ/SXRwA3aeiuil74cb7AmEhI1zI0oJuwIZOnDLuG+GB8:IC3TYf8QKXRnKSi9DP8O1zZCFn7+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119213, "uuid": "e9816120-21b5-4ac4-9b09-d07b5cad0a25", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119213, "uuid": "ed9eec10-038e-4b3e-b449-644dd7e4742e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119213, "uuid": "bebedefa-63ba-43a6-9f21-a5e91a210a07", "value": "FD9F5A7E38910E73A3C2DD83B7F23E97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdd4830-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090058, "uuid": "19b553d4-fdb1-4a26-b882-017d06fa5af6", "comment": "Malware payload (Dridex)", "value": "ae3766c97ce7a9633d98ec606ea974ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090058, "uuid": "0a027e08-6fc6-4e3d-b5bb-b944a94a2d3f", "comment": "Malware payload (Dridex)", "value": "ce35dd652c85b8d386a09e85e5cd8622e604ac0692adcbc3cdfbdc45a067adf3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090058, "uuid": "a0e1fb1d-f555-48c3-9b98-b8eb85e22359", "comment": "Malware payload (Dridex)", "value": "e8a8af7943ad5fa98460b7a4076d7e88ec4a1f2b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090058, "uuid": "0710cf67-bd64-47c7-a786-aba9d887c45d", "comment": "Malware payload (Dridex)", "value": "b994898a21a7c12d79b9c448cc9c8bea60f515fb38809362e4bd18f6cba942f3fd948beaf74a84c133270dd061bc9a44", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090058, "uuid": "41f7e7ae-abb8-4371-a06a-afde3952c099", "value": "8FF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090058, "uuid": "17424219-8a03-4897-8e60-84caf01d2d5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090058, "uuid": "8f50ab80-33e2-40a4-8dba-583d021cef5a", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090058, "uuid": "00b356bf-fedf-4caa-88b3-d1e94a2e4b66", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090058, "uuid": "2ecb2685-6bbe-46e2-9941-1ce13814f1a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090058, "uuid": "8a2d359f-550e-4b5b-9f3f-cfbe6652f33a", "value": "ae3766c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03371ea-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620103990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103990, "uuid": "a8e12168-8a87-494c-a500-3b6c02db0dfb", "comment": "Malware payload", "value": "43760ebeddf863033266f30765671736", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103990, "uuid": "a80f942b-d37c-4ccd-a2b5-d9d6e001e9f0", "comment": "Malware payload", "value": "ce35f8d0d0bb90e8d2e42adef50074cc5b4cd0c7feb8d29e82c65eea93ee1ead", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103990, "uuid": "4bf4ffdc-5f28-486d-be89-fec860cb3e27", "comment": "Malware payload", "value": "9a570163637d92b14fe411e54498bff2f3bb6bef", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103990, "uuid": "7e279a44-68c5-4dea-89c7-2cb6e3326d77", "comment": "Malware payload", "value": "b9e279de80ce9f22df366c569b2e656fe864fb509132506b72a8d4a9df6a9e96e42638fe943d4be73fbf50f7b9dcf743", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103990, "uuid": "5983491b-ca35-468b-92d0-817d36fd3439", "value": "38A2D01EF1B1A63DD63BC43F968B06D1ED0D3446224A3E9218D53D6A5B8124F27CE2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103990, "uuid": "c4a70c34-23c9-40c7-91ef-7b1bf4d42734", "value": "384:KUBO3fWNr1kLzUlM9zP4GnWsfG9qYUC4HCRai:KUK42zxjhPO9vn4Hej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620103990, "uuid": "91073452-ce66-434e-934a-c71413401ea2", "value": 21541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620103990, "uuid": "196f0075-1efe-49da-9e99-776a46838faa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103990, "uuid": "b1412dea-a965-48a9-aa3e-41c0094342f9", "value": "cjm-CC 2021-2022 Membership Listing.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5b0350-acdf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620136168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136168, "uuid": "0d8d1dd5-a51e-415f-b685-61b60c61d802", "comment": "Malware payload", "value": "afe53bbae3461ca80d01283ff81a9622", "object_relation": "md5", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136168, "uuid": "ef56de61-e4b2-4108-a83b-1eeddf5776a4", "comment": "Malware payload", "value": "ce8284965a584e028e1c301a747acf3dfb472df4b06263b42634d00f7b40f77e", "object_relation": "sha256", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136168, "uuid": "6f5e6027-45ef-45ed-9a9a-62df3fa9eb8e", "comment": "Malware payload", "value": "c2d0b51cbfb61f5e17c65e7aa41fcf534ccd0038", "object_relation": "sha1", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136168, "uuid": "ab2f2247-2a02-4bad-999a-c46a065c2398", "comment": "Malware payload", "value": "bfd3e1e338824ebbcfb59bff3cc5fafb84dca23bb9b3581bf435406652f3c2719ef9d732adc7ab8c9bebe65b24b55453", "object_relation": "sha3-384", "Tag": [ { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136168, "uuid": "97ce53df-195a-4e69-bebf-7a2548f1f649", "value": "D555F21448BB860C769ADB931FAACE40C50FFC99943CF1857A083B3167221E6E767B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136168, "uuid": "accbd1c6-bdda-42b7-851b-cf9dcb2a7d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136168, "uuid": "40cf9553-5a89-4862-ba02-09e597a3356b", "value": "384:XsmHW7RPpNsszsVeMPCMyNie0JZzfW6+uUVVTzXjpvWRWtlV7I/NJm4LkGbDovTO:/jIKzhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620136168, "uuid": "68f11094-444b-421c-9fe5-874edb1cbdd9", "value": 1336472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620136168, "uuid": "b225b086-829c-41ae-88f1-aa0d3cb8cd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136168, "uuid": "be8cc3b4-4ac5-4aa4-8d92-5b5989962661", "value": "Our New Order May 04 2021 at 9.87_PVV550_TXT.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb309b51-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093728, "uuid": "275d5334-1674-49d1-8165-491042ad3315", "comment": "Malware payload (Dridex)", "value": "3b8f349cd95d1ff463bd8aa08d9cbde7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093728, "uuid": "fef25fb6-4e71-43da-b70c-09fd632bbf03", "comment": "Malware payload (Dridex)", "value": "ceb3fa5a56d5ae52b3e8a70a1d39d3000d98acb7f324baa4c14f3dcd7a2ce769", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093728, "uuid": "a716c718-971d-445a-8d60-bdaf298d5fdc", "comment": "Malware payload (Dridex)", "value": "cfcc4f2cda316038961296d74e3c9167810561aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093728, "uuid": "4836af02-5fee-4443-8b00-69f070960471", "comment": "Malware payload (Dridex)", "value": "3e5c5111da696fb9d1427d06991044f74f49e248ec9d3866158fbf59d19004625edea9d6875c965ce1d38e9c64b1a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093728, "uuid": "40e47497-d864-4c0c-88be-f6731c62f21a", "value": "69F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093728, "uuid": "adeb2028-786d-41f7-bf28-788c0c0b156a", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093728, "uuid": "46f3a08d-0116-4663-bcee-cde113e99053", "value": "3072:dA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:d3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093728, "uuid": "c1e08fa0-53f0-4e80-b936-ecae5b9056d0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093728, "uuid": "06379687-3e95-4085-8706-676e5012f198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093728, "uuid": "e154e3a8-5584-4a77-98b9-b548f01e9725", "value": "3b8f349c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7893a4-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153480, "uuid": "93feb4a9-6e64-494e-a5bb-85a4e5b74ac7", "comment": "Malware payload", "value": "7cd8629c587f071e5ce821d9a8e6b73c", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153480, "uuid": "cfce319e-5543-4d21-8b46-8357ea1f62e1", "comment": "Malware payload", "value": "cef2334e0f0ead27b66f98839e355c417b64e5e754b03dd961bedcb541ad6e44", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153480, "uuid": "e6cc9ce4-6179-4c1c-8853-98c3a4d52940", "comment": "Malware payload", "value": "4486a2a3a36e9910cc645b3b64b0de362d5359cb", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153480, "uuid": "104309ad-c65b-4d0f-9ec7-e3e5ea3a0f29", "comment": "Malware payload", "value": "430deca0d88558eee5b0ccb5a0b6c53e9bfdf17a94899a12fab89bd80940c98f83a5c313ab9782e6fb010229b0d82a70", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153480, "uuid": "6af6ad8a-a50f-4ba0-a036-7331a4094481", "value": "15A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153480, "uuid": "f5669df5-6650-4614-8aad-a3ba8644b311", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153480, "uuid": "b17a5f87-dcb1-4903-8ca4-6c036c1debfd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153480, "uuid": "248d9496-6be0-45de-94be-5c76e9c9f52b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153480, "uuid": "8ce2853a-6325-4c53-a0b6-9a53aa3514e3", "value": "cef2334e0f0ead27b66f98839e355c417b64e5e754b03dd961bedcb541ad6e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0095e225-acaf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620115319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115319, "uuid": "08fa3d49-59b1-44b2-a10e-89e0be5e3d12", "comment": "Malware payload (AgentTesla)", "value": "01c2e43a256fed047b2c4f4c6e6cf00f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115319, "uuid": "400bb49c-8b84-47e6-9b78-77882a26b278", "comment": "Malware payload (AgentTesla)", "value": "cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115319, "uuid": "2112f2ad-51d7-4f8f-94cf-9e29dcfa9261", "comment": "Malware payload (AgentTesla)", "value": "5b984d02ff6aa2dcc5722fc600e63eb9dc23bee9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115319, "uuid": "6567759c-f36d-4dfc-8f00-66474147673c", "comment": "Malware payload (AgentTesla)", "value": "dfc454330067d21e35e4b0a76b1afe7a86699257c5f71a843adf9b1e875d4ab7ccfdddb4efceee7c137ff73bad20260c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115319, "uuid": "2bfdb0a4-cbcc-4940-adb3-1e98deacb156", "value": "CDE4E03123989F65E47FEB799420001187F6F645EB22E75E7EE841CC5862F80D7B2B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115319, "uuid": "1f1713ec-0bd9-49d2-b310-d93e6f0bd08c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115319, "uuid": "067f50fb-3622-4620-aa05-a348a3895e82", "value": "12288:cCX7VRlglTCkOlu95CaLZ+MX/1GMS2u6Q2qFx0L1Yj+q0+b7aK03NdY:LRUTc+Iat+MX/1puP2WYeaK09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115319, "uuid": "0410309b-0a18-4802-97f5-13650cb0d0a2", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115319, "uuid": "7f0da94f-de2d-4854-854d-383e0f36adbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115319, "uuid": "ac0faaa9-013f-4aa1-adc2-7070e7da8121", "value": "01c2e43a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9b8185-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108038, "uuid": "4eccb04f-72df-44b7-b62e-6a6d41789ebd", "comment": "Malware payload (Dridex)", "value": "e4a7453bdf1889243694e3c373ec5125", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108038, "uuid": "95bcbebf-aee8-463e-986c-67c80b7925db", "comment": "Malware payload (Dridex)", "value": "cfbe32f4bbcff002602d590f3f6b29370d24659ea021bde01ea8aa9424a85b15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108038, "uuid": "124cec3d-45bd-4561-9f20-ed1e1e132313", "comment": "Malware payload (Dridex)", "value": "47444ed842c58e1826d7e87c9f7c2422babcfd46", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108038, "uuid": "8a0a2aa7-1abf-4835-b043-7ff03a46da85", "comment": "Malware payload (Dridex)", "value": "b472ff1b8164a7c27b7145c8273828af81aef1dade24f6c415eb5dd4ec2785d1a41067be060b1934919e14d40c10b511", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108038, "uuid": "a9bf4815-938a-45ed-aa04-c682624f6a33", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108038, "uuid": "8cc259cd-492d-4e86-a82d-03a1f6eac6ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108038, "uuid": "0910e26c-7647-42c8-8277-9adca420ac39", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108038, "uuid": "c783272b-8c29-4d60-bfb0-4d59419d54e1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108038, "uuid": "dac9b99e-dc27-4656-b624-3c6596a3ff93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108038, "uuid": "a607e186-dac0-46f3-9c1f-6a751bab0e24", "value": "e4a7453b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4239ee-aceb-11eb-abe1-42010a9c0039", "comment": "Malware payload (LegionLocker)", "timestamp": 1620141214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141214, "uuid": "64cbd8db-f789-4ea7-a36b-85ee09ae6cb0", "comment": "Malware payload (LegionLocker)", "value": "c72ffdba16d7bcb0425b5649c04a992d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141214, "uuid": "c1636a14-24f9-4fc2-ab32-4312fe54d599", "comment": "Malware payload (LegionLocker)", "value": "d07c227a7d73abe3eb7da6c7f23f5de256be3b1a610a7f620ca64e4f7410f04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141214, "uuid": "00541790-5926-4879-8c63-ff59dd9ead80", "comment": "Malware payload (LegionLocker)", "value": "f5fec549a29fab9adcd6016e7caf85962bca2218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141214, "uuid": "afbe2997-8320-448f-911b-6bc2dc80ab63", "comment": "Malware payload (LegionLocker)", "value": "5e53b41e3f20d113488dcd2e06e1b4649e110729029cf45f1327146d4b4a42a3340ecff68f8916c043802576cb352533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141214, "uuid": "492ebd72-92cc-458c-8afe-30ee4649d736", "value": "38E2B2D8FBE88139C254AAF458D309095230D663BA46926728C852B9CA737DF74CF793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141214, "uuid": "8e0b26a8-a841-4191-aa15-c8bd4ddfb63c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141214, "uuid": "7974f54b-395b-4d9c-96e0-e1d0e9ad2228", "value": "384:F97pwzzYoZ492dJRFdp1wXTlyG9IwIwOhq9sr5NcpNWx0pmgLESp+aqcOR9FKRQ3:FtPoZRJRFhwjPIwm2Q51E+bcO3IRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141214, "uuid": "29a8f559-a1a2-468d-9a61-760f30ffce1a", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141214, "uuid": "a908ce43-c978-4d5a-acbc-ecf5f76b8293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141214, "uuid": "762ac0cd-dfd4-4a8f-bab3-19dd9912a2d1", "value": "222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd71cf7-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118856, "uuid": "2d8bc656-9d93-44e4-ad11-56ba6cc4610a", "comment": "Malware payload (Dridex)", "value": "24e8a2de807f31655292d91bdb70852d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118856, "uuid": "c7c2e0a5-3dc4-4d37-86f5-f7f2a1bca57f", "comment": "Malware payload (Dridex)", "value": "d09fbd8136102299e4bfd87965a8d9b26b5bbfd1248114b573b759e6cfda9377", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118856, "uuid": "23ef777a-1d63-48de-af5f-f87dea4fc169", "comment": "Malware payload (Dridex)", "value": "083a6f96f0e31969810a206cb1b5f621a1c2c7f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118856, "uuid": "1ad1d4db-c800-4e5c-9398-f17983d04642", "comment": "Malware payload (Dridex)", "value": "139eec5112aefb23d77ce9ca025d05d232f74487749fda11da88768c2746fc0bcdc70dc54a4eb8d4f400cb2875994ba9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118856, "uuid": "68d5886c-ad02-426f-aac6-dc2198678bdf", "value": "C4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118856, "uuid": "a7a4026b-dd63-4cf4-b3fc-c67cf459f2c2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118856, "uuid": "4a45bd04-f12b-4ea8-be29-374db90cf3b4", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118856, "uuid": "85c50698-f60a-4dc5-ae17-b4fa11f41a15", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118856, "uuid": "e8aae5ea-b218-4f36-b7c5-32e349340f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118856, "uuid": "134479c3-43d0-4444-9f5e-8e1d485fc07a", "value": "24e8a2de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d79e83-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153399, "uuid": "29bbe16a-6acd-4ab8-a7f0-c23a46a093e2", "comment": "Malware payload", "value": "ca1f4d1dba57fdd6b2a1209796731902", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153399, "uuid": "66e5012f-6c31-4c30-88f3-c47e235f7c4d", "comment": "Malware payload", "value": "d11338dcdeef5f30e4b4a0cab022554d5a4baaeeae062733bc8f5d36498fa127", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153399, "uuid": "d996c1c5-e6ff-4e39-bb96-8ca597efa869", "comment": "Malware payload", "value": "5cba30ecc1d917c319ec5846bc76a9bbd2e09167", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153399, "uuid": "2343fd3a-015e-4d64-8dcb-d288a3c20b6d", "comment": "Malware payload", "value": "98e709b671740871dba8bc6518ab61e43166453ef4e6e856f79b35f35014d14d0ca2f59f305c954829dd2293db950c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153399, "uuid": "64729d7b-2d64-4212-a7f8-86c49965dff5", "value": "B5E5339CB1EC29BE82D4A633B2EFEA343026A6DDB06143915CF7948D0C17271D4DAE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153399, "uuid": "4c66c2f5-69ff-4aa7-8fc2-f2a42fa95abc", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hP:tos909Qg6ecEZHyEexmLaI9MY7bx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153399, "uuid": "c028b636-d53b-41f3-8746-73325cf659a7", "value": 3301376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153399, "uuid": "1baafabe-83b4-45a1-a781-ffc19b3d9b33", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153399, "uuid": "60198f8b-4413-4977-99ea-e1f9c153f431", "value": "d11338dcdeef5f30e4b4a0cab022554d5a4baaeeae062733bc8f5d36498fa127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fff88f-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100864, "uuid": "4d16d8a2-699d-4516-a27f-558187ca55f6", "comment": "Malware payload (Dridex)", "value": "5eee409d7c4d676297234dfebb8ccdd5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100864, "uuid": "97e2024e-25f6-4fe4-b7ca-ee83bb072888", "comment": "Malware payload (Dridex)", "value": "d1a0db92a37b1c36e51f5406f3a3f46754ad4c952bab7421db7e17bc62f9ec47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100864, "uuid": "cc7b9f19-ca6e-40e8-93dd-c7acd3796d91", "comment": "Malware payload (Dridex)", "value": "a4ca142489e8456a8fce7c45bfda865a8e1997ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100864, "uuid": "9706b1f4-acc2-4e6c-bf13-26515c321693", "comment": "Malware payload (Dridex)", "value": "1bfdd50077d1c6e0dee0b8ef8fcf58f92f0c3e8ae3915b1dd041eba707a86ce36722c36af230c04d2cec4bb8497bf3c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100864, "uuid": "fea313fc-7bb2-4960-b37e-fdcf11c69494", "value": "3DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100864, "uuid": "890770be-55cf-4bb7-8c52-aacc4b0a0a8e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100864, "uuid": "e031e612-b590-4f7a-924a-6f27da714769", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100864, "uuid": "2b15ec9d-160a-4d4d-85e5-985f073f9fee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100864, "uuid": "e25f53b6-c8d7-440a-846c-88ddfeaf0791", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100864, "uuid": "ab83241d-9fee-4796-9a26-f146fcd1474d", "value": "5eee409d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f18a319-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620103935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103935, "uuid": "fafbe481-ec26-40b5-9449-59ad4b3154ef", "comment": "Malware payload", "value": "4eafc4b9b63a50ca372d613a786dc184", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103935, "uuid": "5bb129b2-809e-48e8-864f-8f4d7f899108", "comment": "Malware payload", "value": "d1c59fe93a0a287020a912fff39188b7ab071656845b2046e834d11adfb2bed8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103935, "uuid": "3da3f330-297b-4197-a04b-d03b6d385132", "comment": "Malware payload", "value": "fb3fa41e72a0d77ed06ad1deed27391e623ae3dd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620103935, "uuid": "879a277d-3428-4392-892c-69650999d009", "comment": "Malware payload", "value": "d8adb2167e8a9baa9b2f66dd5794945fd2730c0cbd0ef17974735697a91c775478d783fc1ff5c8e3b8cb08ecff3438f2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103935, "uuid": "fcafe172-888a-4d25-9b2c-0b3c7f5bbc04", "value": "D1E433E1F102B8DB504A4633CB7332E7150BD8881D6167D7DA24CF9105A7A63E8EEEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103935, "uuid": "844093f3-e096-45c1-b556-b15b7f449d18", "value": "12288:TXYEOj+MsEkPn0BxSKb2GKm1YtwoCOznogB8SFx8DYIv1xA1KSKZH0i+7R9nd8Aq:TXYEOj80BNSGYSQogB8YAYmxA1KHg3n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620103935, "uuid": "d2dea4c8-28b3-4317-a783-9343543543f0", "value": 711005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620103935, "uuid": "4747d055-ad3a-4a70-8bff-d01191e9af9a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620103935, "uuid": "6ff6c698-c154-4421-b5fa-513af28829a4", "value": "Company Letter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d8a442-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100866, "uuid": "e9b84687-57ad-436a-a40e-3be3abfd417c", "comment": "Malware payload (Dridex)", "value": "6c16bef68b44841ea8285cd476ec0673", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100866, "uuid": "f9c9b6ae-84bf-416e-8938-ae42bb8bfcb0", "comment": "Malware payload (Dridex)", "value": "d23799d802152eec9f28e1439dbf35d31d6ace7d3694ddd3b789678ab6ba9cc0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100866, "uuid": "9c871158-bd38-4990-99e3-343c2d2187d5", "comment": "Malware payload (Dridex)", "value": "711cfbbf597d906adf1d7d96aee51af1fe227a64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100866, "uuid": "6de8a8c7-bd0b-4de9-a2c6-113370ce987a", "comment": "Malware payload (Dridex)", "value": "82f0403dfe4fe5a07fed9479f78fa4c64b5f0f8aff1a609ac607bacb4e4b5d1879543ea126991625e2d7c3581e680dcb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100866, "uuid": "019f84ce-6339-4b72-90f3-90b7a38299cf", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100866, "uuid": "a86f4cba-f439-41e7-a40e-b76bbe16e6f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100866, "uuid": "6b92082c-fcfa-4948-8c19-d1bd84c21201", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100866, "uuid": "a32ba8d1-52e0-46ab-8c0f-706e1d151f26", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100866, "uuid": "5b7b765c-3df3-4ade-b815-40545f82e2b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100866, "uuid": "6d76472a-6a11-4872-98ac-2223a2803655", "value": "6c16bef6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe432df-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126136, "uuid": "88af741e-a2cd-4d68-9a62-ab28c9580858", "comment": "Malware payload (IcedID)", "value": "e594ea809c24d81cacae25761ae68a4d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126136, "uuid": "bc845140-31b3-4af8-97fe-da82bce0259b", "comment": "Malware payload (IcedID)", "value": "d328633005bb0fd39826107193a26f4d6d933fb4f2dfb6f8e4eb48c6eab81df3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126136, "uuid": "7a4c551b-7fe6-4374-b763-35a97f032914", "comment": "Malware payload (IcedID)", "value": "c402e78a57d801ee6220aa1e8532e444db22f911", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126136, "uuid": "4f388ac9-75ff-4a9e-b630-8eb2817a27fb", "comment": "Malware payload (IcedID)", "value": "ff0d53b5070b9b9006930b4acce27457560b9cf0aa140ed4b8eb297edcb5474295b93206407904b8254f9696c71171fa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126136, "uuid": "85295e48-0ffa-482e-9bdb-27e09c2eadb3", "value": "77B3CFBDD502E4E2CB69DC3DD1167412AD5B91877F0FE61F208621AB0803DA76E352AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126136, "uuid": "4092f5ba-a5d0-4979-8d67-5ab3511863d7", "value": "1536:cutuov3BiTr4GDgM+nG92hjPcQpWUot9E8cNcrAOJOerwzkFBHhr6vQnf+zy7fc:ckuocrZDKGopH8x+8HdoLqp6vif+zUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126136, "uuid": "cfa6c8ec-258e-4d7f-b916-c6c39c3f758a", "value": 109084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126136, "uuid": "73644833-9115-4fff-bb28-321c0242bf34", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126136, "uuid": "057c436f-c40a-4ca3-9558-e953856e9f61", "value": "statistic-2069354685.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78afa37f-acfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620149451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149451, "uuid": "750684c5-c177-49b3-b470-52a575629024", "comment": "Malware payload (OskiStealer)", "value": "5753388fbfcde9e08d00ac9e2be5d881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149451, "uuid": "6bcceea2-95ce-4875-80e8-15351a885a16", "comment": "Malware payload (OskiStealer)", "value": "d346665dc0a3c37256f313f6e9e41c254acf70c599d007f1391128c4b3771ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149451, "uuid": "37d0cbcd-156e-4590-b4d5-3897dea8be16", "comment": "Malware payload (OskiStealer)", "value": "48e8a88ca75782489db9b5da0dff11f050a7a4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149451, "uuid": "d1f63b70-a3f7-42d9-af2f-0fc421f55245", "comment": "Malware payload (OskiStealer)", "value": "52accb253085770bee6dc4ec339b38e02ef85977737200899dcbf42b81b0b9348524d16475e63cdb34a704d58e00f5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149451, "uuid": "d29a1dd4-8438-4651-a79e-ffcd7eb7aaaa", "value": "B43401806ED8A30ACD755D79AEA2C178B7706F116C10E6CB5C23F3494BB4BE16460E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149451, "uuid": "aaa6987a-4013-44ac-9298-f356af0b35e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149451, "uuid": "c5534ccf-d4e2-4222-bbc9-ebe65d5f83d7", "value": "3072:voiswQNk+vZJKZ0Hx7hA0qstfzoeAWRfS8ypYAxBWA3VcuVdxtWL1ySDMIeKppKe:gRV4QpZvtfUeAIQHuA36cdHj2O6K0Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149451, "uuid": "03b8ec70-0ffb-465f-93a0-15737a7c781c", "value": 251192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149451, "uuid": "c92e8f54-9629-43e6-9013-8465e53708c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149451, "uuid": "e5cf10b7-9543-40df-85d3-52b9caecd17c", "value": "5753388fbfcde9e08d00ac9e2be5d881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aa044f-acb4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620117774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117774, "uuid": "6deaff65-c887-4598-9541-b4cdaf251e24", "comment": "Malware payload", "value": "986db1fe16ff3dad22700ded853e1469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117774, "uuid": "29d093f5-dc9e-47ec-8564-ef83f933a325", "comment": "Malware payload", "value": "d3b8d065f0ca36f76542d4f2d3f6a541d0b9c3bf20420f1714f64d27061c8885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117774, "uuid": "4ef8c534-52dc-4ef6-8e8e-a896291fc863", "comment": "Malware payload", "value": "697e234290099c34f6f2277c58faa317ceb895a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620117774, "uuid": "07974733-2377-4a78-9cd3-02d435b7a62c", "comment": "Malware payload", "value": "59f2bd7447881dfbecc89daf073a920d4ee8bc2347d336b04f8b53b42aeb764362e559c6803b60a7e831aba0894d5959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117774, "uuid": "0505e18c-5a13-4336-ab7b-8af3a20d362c", "value": "A503DEC56A405563F21C12FEB8BFC6AD456EAC4BE941824EFD0835C9EF6520C6AF3643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117774, "uuid": "7c78b5d0-7bbd-4a53-8ce3-18e08e188c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117774, "uuid": "03b92e39-b306-47a2-a8cf-41812eefbc5b", "value": "384:XCJlQa8A864oQVxcifdvQ5kmpsvIirANbqffncX/JbkzYcE+8G8PZ:XCJlQa2YltQIirANbmncX/xwYcE+85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620117774, "uuid": "c7abc3a7-fd1a-47ad-87ca-1075ab267820", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620117774, "uuid": "27576238-56ab-4ec8-a276-d06884711168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620117774, "uuid": "bd3953f9-116d-4e0d-905a-f3d9886bc49e", "value": "PowerPoint.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1548577-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093684, "uuid": "28d99234-9af8-4aa9-8522-3edf8eabfa19", "comment": "Malware payload (Dridex)", "value": "97fd2fd3a4efa6d53d5a5b41f941f353", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093684, "uuid": "24322a28-4d9a-4140-abeb-254744dd4e7d", "comment": "Malware payload (Dridex)", "value": "d44591dcc8b58a59e286c8601f7f4b11906aa5cc52f9e8a6eb99bc4e3594b14b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093684, "uuid": "d58fe663-bac0-423b-a602-892571001e45", "comment": "Malware payload (Dridex)", "value": "723ff90040c5b9cc4c637f167b63f2fcb5089e64", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093684, "uuid": "8dc8e01f-e008-405f-b11c-df4b22de5e0b", "comment": "Malware payload (Dridex)", "value": "90d33bbb13dc8a0cfbb6a7e2c194b2dc3b14b466c06c80f0aea8ce8bfcd5748b529d445030374d593239bec28b13f822", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093684, "uuid": "3f01c5b8-4d04-407f-a647-8f3e4bc4b376", "value": "86F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093684, "uuid": "47d1f744-e2d8-4aed-82cf-266e8ed72af0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093684, "uuid": "3430cfe1-6614-48cf-a0a7-0ea180ad1003", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093684, "uuid": "0ee19d36-80d7-40f2-8a7f-151f434fe69a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093684, "uuid": "a6f4dcb4-98fe-4310-a867-550f05b1e5b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093684, "uuid": "67904eda-6cb3-477f-aa39-fd8fb51dbc12", "value": "97fd2fd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8150f3cd-ad00-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620150324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150324, "uuid": "ac732dc3-ac10-4601-ad30-cac777af8be0", "comment": "Malware payload", "value": "59df63df48d34fc9d3d9be42e76f6794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150324, "uuid": "245f817f-538f-4301-8a6a-0b50d04b7568", "comment": "Malware payload", "value": "d44d20adff5359504bb9aeeca5fc1ac855aa374eea0921b0990a41b8d0d777da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150324, "uuid": "2cf03912-ff42-4b75-875e-6e94e857a0ea", "comment": "Malware payload", "value": "853952f4a4bfdc0ea2885c766e544370489e683a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620150324, "uuid": "cbf23f0a-8f7d-42a7-a292-31920bd01d67", "comment": "Malware payload", "value": "01965d1d60963fad3022fa373ace84422d8ba3d955cdedf07be3afdea15f80dddede4b47adcb1175cfca576a33b9a627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150324, "uuid": "152c7eb3-3cd2-4018-b1be-21c0e2764b45", "value": "C885A3F5BEFF85128798FA528B7571A10D3F7B89853E328D88445D26C217D468838F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150324, "uuid": "e58bfa38-8ee0-4daa-a74c-bcc2fd76ed46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150324, "uuid": "3528fb08-cbbb-4c31-8bc8-bbf73f2d28c0", "value": "768:CituxG4U6iAubfmjDbFIY9jhXpkp7hJOuCFl/idlCLF+J3xBDrzxTDe3ufeAl1/2:Ruk4UQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620150324, "uuid": "e33b9501-971a-4e0e-90aa-9de9cb1294be", "value": 1853952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620150324, "uuid": "e9f4f707-54cb-4ac7-b735-da90195cfeb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620150324, "uuid": "f2e5d41f-cd1f-4184-915b-4bffeb8919f4", "value": "59df63df48d34fc9d3d9be42e76f6794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6787ef26-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142550, "uuid": "fae52a2a-6497-4609-89c4-0a292fe26baf", "comment": "Malware payload (Quakbot)", "value": "a10947afc655468b830fc095aa2778f4", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142550, "uuid": "0d09c07a-9e3c-4d0d-bf73-fffb049af8b2", "comment": "Malware payload (Quakbot)", "value": "d47c6c23f98e3eb6b9c8516c04957bd964e18970df8a3ae4978aa1b4eae68f6f", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142550, "uuid": "6835ad3f-db8e-49b4-bdc6-f933fb1921e7", "comment": "Malware payload (Quakbot)", "value": "21ede0701106edc700120e79289c3eec73399266", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142550, "uuid": "e9b679a4-0ee7-4260-9e19-21a79e8b8cd7", "comment": "Malware payload (Quakbot)", "value": "983e09b3c460a10045c31fae520515fb234ec4ffb20343da60d039248bc92138ec42af44fa8dcd7c9f9340edc06dec4e", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142550, "uuid": "8e1a6f56-73da-467e-9ed0-ee9fea39a486", "value": "69B3AC0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142550, "uuid": "657825c9-6f17-451f-ae83-a094002699d4", "value": "3072:JkYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:SAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142550, "uuid": "eb1d208a-62ac-4099-93c6-264278553b06", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142550, "uuid": "fb50f812-d75f-48ce-8239-d257200020d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142550, "uuid": "e18fab7f-91a5-4613-a820-79a9256cd502", "value": "Outstanding-Debt-996801315-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9c6928-acf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620143741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143741, "uuid": "57e395f7-a3d2-4450-907a-878c2d06a5ac", "comment": "Malware payload (Loki)", "value": "391d99bfd6e00d82a8cf1c195f0f1c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143741, "uuid": "11356dbb-9c61-4b52-a3ec-568a6d59be62", "comment": "Malware payload (Loki)", "value": "d49e81b866a31f5ff08ad550f6e6cc7a2fadead9858abdbc289538d18825d87a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143741, "uuid": "68402585-d941-4a3e-8da6-8b3101bbef98", "comment": "Malware payload (Loki)", "value": "f4c8976e69d5eabde0cd911470a8d50beb78c9c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620143741, "uuid": "89235803-2166-4349-8169-e15d0581366a", "comment": "Malware payload (Loki)", "value": "b6f08fe7576a5cadf94a258460d9d8acd596666a76648c8d9216c1068c2e05264c82abf4996a5b0ccfdf31d7eac78c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143741, "uuid": "862ca75b-8829-4a10-a880-57e8ad7ac552", "value": "9D35279B7B50729EC857CD7289781F64ABA0E46A830B9307A01711ADEDCD8DBCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143741, "uuid": "bd4b6350-a2cd-49ef-9e04-2bc5ce46bbe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143741, "uuid": "8095a67c-b34e-4ebd-b73c-54c97deaa642", "value": "24576:VYyLszx35dWWj+QO+UTUcD7ufeE4y0U0Vi:VY/935MGRNc8e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620143741, "uuid": "b92a3b52-7367-487d-b8e7-dbd870090187", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620143741, "uuid": "67bfa2d5-dd5c-424c-b0ad-2e69d728d671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620143741, "uuid": "3e8b57e0-9569-49ba-bb67-0c1ec2a97160", "value": "informe bancario.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9feb6d-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152460, "uuid": "6862003c-d1c1-426c-b014-57fd293e16ce", "comment": "Malware payload (AgentTesla)", "value": "cf4fbd7fa545026f738a9b49730010e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152460, "uuid": "a453e76e-1523-44cb-9007-e8d05dc614d9", "comment": "Malware payload (AgentTesla)", "value": "d4a486d6eb6ff402162a440e49cb53777c2a3a0e98abb04016e189cd445676a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152460, "uuid": "a6e4a9eb-8faa-427a-91ef-daee10c12f11", "comment": "Malware payload (AgentTesla)", "value": "93aaa89acdda9b49c501d901e29b17e8e8d56c75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152460, "uuid": "dc63890d-4edb-4abf-9a81-ffe0040da15d", "comment": "Malware payload (AgentTesla)", "value": "eff061309626c349ea18fe07d26d4a86a74601de15ee07cf498a11fc56baa01fc01517bfd4da75ac5086363f5b51027f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152460, "uuid": "dac4a807-2a3d-409e-b8fc-738595c4f03a", "value": "BB45F66631FC1AE3E2765BB563D618068F653E34293AD90D4FA037FA1672F031A35A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152460, "uuid": "512e4c65-726b-4ff2-bd3e-3a6017172c09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152460, "uuid": "f75d0df7-30dd-4442-8bfc-4823df156340", "value": "24576:XD9wLdQoLAHcLeYS0pbstFk0LIGfncM+eg:XD9wLd4L10ds3kRGfn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152460, "uuid": "d9c204d4-78d2-4d45-af2f-7fe07f6f69b0", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152460, "uuid": "53cf01d5-6676-4806-95cb-767591ce15b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152460, "uuid": "cd456ef0-bb9a-48f2-ae7b-76ace131e1c6", "value": "ENQUIRY 050420217274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1225b8-ac80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095209, "uuid": "0db32942-bed4-49e9-8ccd-8b49be02ded5", "comment": "Malware payload", "value": "e9b92c611b7e56d2327e1fc623405949", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095209, "uuid": "9d578e6d-da89-42fd-9876-13678cdeb37b", "comment": "Malware payload", "value": "d50627e2265cb98c31de63080e96a5e8182ef85998cd18c8801d38db6bf4f578", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095209, "uuid": "da6ebbf9-a880-423a-b6dd-43039facd5dc", "comment": "Malware payload", "value": "eb691d34c4da070eaa4c32d1b036b579159233b0", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095209, "uuid": "0bd2b751-ed27-45b9-aea6-e179587cfc98", "comment": "Malware payload", "value": "f886275fbddf17ac2090d0102a7a5a820e16fa5bf77022e0ce5a4b21852555952bde6c42a7593f947079ae80dfa05838", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095209, "uuid": "ea4c2632-6338-4a91-9c09-0e96aaada157", "value": "0E84012372085D26CC782AB5AAB7CED63278BF505C940A5235E9393E9F3BE05CD1315B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095209, "uuid": "1584b522-c691-4d9f-9090-69d83def0f86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095209, "uuid": "f007e4e1-d9c9-40d1-b46e-e07c36a905ba", "value": "6144:3xvJgUpL8SNFDu/O63hGSb/DB5pr0+UTsWkef1XwxQ1evov0F:3zp5bu9TlLfUTdwq1Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095209, "uuid": "5425606d-81eb-4fdf-ad2d-2552a6efbd1d", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095209, "uuid": "3120911e-5957-4069-8924-b167384f2560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095209, "uuid": "a23a1d91-ef40-432e-880c-3ad8b29824f6", "value": "AstarothSpammer Cracked By zFxbixn & Nichaen (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c548c-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153403, "uuid": "e037671d-371e-45c8-be1e-34d683fbeb0d", "comment": "Malware payload", "value": "39d963e8526d9569e453f8a0e38fb424", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153403, "uuid": "4a09cd49-feb0-4273-b978-4baf23b6d4da", "comment": "Malware payload", "value": "d5ad8069773fb3bde82a839a1d8573fcce480fb1a88c391669ab6db3469bf58d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153403, "uuid": "519a562b-e6e9-40e6-8e8e-0e2e053e7d45", "comment": "Malware payload", "value": "63785fa8075de22492dc1d57c63d4a8cc30f2269", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153403, "uuid": "3b6190c3-a439-47ea-87ec-be1294ee37c7", "comment": "Malware payload", "value": "01965b400d102d5a849335a7defc0e11cb01d183e4210fe3fb1794fdd1181705baaf5fb06290e0eb07a74e1c8f940f5a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153403, "uuid": "84aa081c-29d9-48a0-a15d-680be0f0f46a", "value": "76319BCB22A206756CA1E97B326A8424F1D4F5C75BCF9F58BCDC78F9828DD047010A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153403, "uuid": "b506bc1b-2fe7-4085-a7f3-3b906df2c97d", "value": "12:q0Fc4V0Fci0FcABc43fX0Fc7eekX0Fc0+k0FcKX0Fcle1FZ0Fc1EX0FcS0FcAV84:vd+4Dc4koasjM3sse+KEs4uJwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153403, "uuid": "d43acd48-71a4-48c9-a9ec-242d8ba223fa", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153403, "uuid": "a5356dab-3976-4aa6-9464-a23f3245e518", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153403, "uuid": "c5d33e8b-7855-4744-887e-4f7fd39b38a4", "value": "d5ad8069773fb3bde82a839a1d8573fcce480fb1a88c391669ab6db3469bf58d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c03df4-acf6-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620145852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145852, "uuid": "90b53d31-e640-47b1-a51b-30d0db85ec3b", "comment": "Malware payload (BitRAT)", "value": "cc05001463cbd7b4bd5949147c773988", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145852, "uuid": "08d4b3c9-6e6f-4cb5-8805-d8af836a7244", "comment": "Malware payload (BitRAT)", "value": "d5b80d52df526be1a519fa5962702503f22eb24417e65041e91be881f73b36ff", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145852, "uuid": "04c772e9-956d-407d-8909-268a413e2041", "comment": "Malware payload (BitRAT)", "value": "132adb880c7768317e3213178611fb05d33dce93", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145852, "uuid": "c25c84dd-057d-480e-943c-bf7098f1d29d", "comment": "Malware payload (BitRAT)", "value": "e5ad6972f5350d74c7822d665ced78254a04b5f930bdc093dc0fd2ecd660a54b3e8be23b90f743a5dd06127117020261", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145852, "uuid": "9a42ef39-34ab-4297-80af-36db170cc62f", "value": "50F5222B3F68436AD1BD4F740430071067F1F55AD325C32F6A9464AEDEC2AC58E66BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145852, "uuid": "c65327fb-dc56-414f-9688-386e170940d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145852, "uuid": "c656bc06-f2c6-4b76-9e9b-0cae7ea445ba", "value": "98304:dRZGkF9XpEvVrIMWNsygX4uDJPzyBxZ3zCk:RGM9XpAVwiVNOxZ3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620145852, "uuid": "0286009a-17bc-4476-ab0f-7525a3723fb1", "value": 3631104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620145852, "uuid": "b3c3d67d-a010-4aeb-9caa-190e31de985d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145852, "uuid": "77f8bdf9-a885-4947-9278-a06a314dde56", "value": "Transcation03232016646pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af64e3f0-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153408, "uuid": "974cfa67-72bf-4e0f-9879-b3037886c57a", "comment": "Malware payload", "value": "058ddb56eeac234daa151d2e19357c62", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153408, "uuid": "6a267d77-ca2c-4736-8770-1996af5eabab", "comment": "Malware payload", "value": "d6c31fff45dd53754b3d7064ee9b0b92f158b22866bda8efb627a5eb2e2dcaef", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153408, "uuid": "538663c7-a0e9-4045-b212-426a02cec282", "comment": "Malware payload", "value": "5a795e71703d34c4a729e7934e0125e2ed868eef", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153408, "uuid": "39ee6b3b-1ebb-47bb-88f0-91dc27ebfb8f", "comment": "Malware payload", "value": "9bebe634bc314db3e7b4d3367d351b25359a6443b7ff3286609c2ffb91a5fec93a31b81b9db359236e88e34a63b63d0b", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153408, "uuid": "15f72a10-2c23-4ad9-9692-2b687e6874ff", "value": "B275330822BA7CD4F5EF022937624CD4C2AD31F1E441B49676985CA62A672FD039FDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153408, "uuid": "f3ac28ea-6a46-4045-a174-b2b780ecb0fb", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8X:IDSTOhnXSI0Wk5jG2nfBtkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153408, "uuid": "5ab4e237-4e10-41fb-8788-be34fda5ae18", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153408, "uuid": "1beb9e75-f341-4bb6-87b9-7ed1981402e3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153408, "uuid": "bfdbd051-62fb-4971-aa69-b5820b28658a", "value": "d6c31fff45dd53754b3d7064ee9b0b92f158b22866bda8efb627a5eb2e2dcaef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc4137-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108065, "uuid": "d7e86ae6-edd0-469d-b3b4-d0139e4e12b5", "comment": "Malware payload (Dridex)", "value": "75dacfd304c06f7a6e52b9b1e7b97e9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108065, "uuid": "9b32c12f-46db-4ff3-a95d-fe1941335c63", "comment": "Malware payload (Dridex)", "value": "d6fda9402ba84477cd9d66be768fa748f497017e40e8bf24753bf27ed2e61a38", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108065, "uuid": "9d4af468-cc92-4672-8156-7ad5b9bc4867", "comment": "Malware payload (Dridex)", "value": "8ebde1f6ecd8ac756803a2ca530f8d66480cf149", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108065, "uuid": "24eb212a-b789-49bb-a41f-69702d133d94", "comment": "Malware payload (Dridex)", "value": "a139b4c5328e06362d762245d4ab876e3984767efefb26d9b2e4507d75dd699f6802a50ac1d0d41931c03799b4f7c11a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108065, "uuid": "30bb4038-ef3b-4368-b4ed-6279b8615a13", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108065, "uuid": "7dcd10be-0512-47af-be2f-ccbbd1220f40", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108065, "uuid": "946ecb25-b2ef-445f-a66c-67dd7a5224a7", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108065, "uuid": "3d1639cc-e016-422c-9795-cae07ee47a06", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108065, "uuid": "ffed52c1-4891-4ea6-a3d9-196be9af978e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108065, "uuid": "5fd2d417-95b5-45c8-9a94-d013599c5779", "value": "75dacfd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c51c1a-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115272, "uuid": "899faaaa-d48f-4ee6-a94b-4aa00738c95e", "comment": "Malware payload (Dridex)", "value": "a2e62e43b0732482540a46aa7555e492", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115272, "uuid": "95b69968-a164-45f7-b8bc-527a13933ba3", "comment": "Malware payload (Dridex)", "value": "d72b4a75060aed66d0c3727eac2b431db61f8d949b1e72544dd3ba5208c953a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115272, "uuid": "c0f09716-bc12-4a16-ad58-ab6d7ca032b6", "comment": "Malware payload (Dridex)", "value": "e031eac63de6f70f398544b0da9c1ecdc245a5fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115272, "uuid": "90a3b06c-5faf-4860-a80b-573a607c4e65", "comment": "Malware payload (Dridex)", "value": "3715ad90ff522e5e037ac71c4466799711c8059d95056e3c84cc6413a080fc7e7a79093670f57232dbefd7072ce2869b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115272, "uuid": "ef6c2465-3574-49e6-8697-6b3589a3376e", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115272, "uuid": "3ff55ff4-0a42-4702-a532-7c486b6b3261", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115272, "uuid": "9aedf34f-a88c-4afa-9c40-4e6185558ce2", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115272, "uuid": "1491d254-07ca-442d-bcc8-bd4f95babba8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115272, "uuid": "cb2fe721-0496-4b13-b8df-7586981a3a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115272, "uuid": "76193cd1-36a0-4429-88d2-80062a87a908", "value": "a2e62e43_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a637d38-ac9f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620108598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108598, "uuid": "d93ea09c-148e-4e47-9a72-5dedb135bdcc", "comment": "Malware payload", "value": "308de8340d361aab35f1828655849723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108598, "uuid": "a858091e-afc0-4dab-a742-3230c226d891", "comment": "Malware payload", "value": "d7b59654644c399eaf13d7460b928ebf8f94bfd9e97e4a135ef005719e4eb18b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108598, "uuid": "18d45b80-922c-4c32-9ae8-29e5a0bab18d", "comment": "Malware payload", "value": "ba86b54e102d93530585aff6d1b1b32f48a779da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108598, "uuid": "66e8e486-2ae2-483e-a93f-dfa7ed180793", "comment": "Malware payload", "value": "bd42e912c71c41a97c19690cea0a3c1beaf775c1474d7c5a9d6a3ca3e1405a33ad944e2720037b91b570ef0e74bb4ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108598, "uuid": "db047f88-08cb-48d8-8cae-662a0ec7cde7", "value": "3753400DE1E45138F5EB8FBDCFE391E50A4CF7F0AA320179212A5F19BE41E968952271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108598, "uuid": "dadff714-ac8a-476b-acbb-fb101edbb96e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108598, "uuid": "5192edb7-8d01-41dd-a397-dd7fc44086f9", "value": "768:YaIrJiEPZ5myd6Ol+3rQ/wD0AIh8L2KfPtZEKzF3x:YaIrt5myd9+Y7hqHPHzJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108598, "uuid": "1ab38f62-5bf2-455a-8dfa-5ed6886828b3", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108598, "uuid": "88244063-19bd-4258-bda5-97b2566eb946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108598, "uuid": "af6cee2d-7a83-4874-a1b7-ff4e9e5597c6", "value": "Payment Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64419e0-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153419, "uuid": "d1311e7b-ecf0-4bd5-97c4-d9c767a5786b", "comment": "Malware payload", "value": "9f6bfc56a8b7329f0ebf3cd0abe45c4b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153419, "uuid": "480b1bc5-f998-418e-88f3-8f96edd95eaf", "comment": "Malware payload", "value": "d7e461d922d0a08fd55f3ccdc334b8ae7df592da6da4de0279745b9be6206b40", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153419, "uuid": "0f878706-9157-4595-9ad2-074bf770eb6a", "comment": "Malware payload", "value": "80efd70e831415e645d7d25c03d0bced1d3ea6af", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153419, "uuid": "76dd047f-a871-4d9b-9cf5-212aefa6dab8", "comment": "Malware payload", "value": "5032c81471a788587125a09aad6265e7436095616072e3032e7ff694d001f9dce09af057099f8f28e2775a2102490528", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153419, "uuid": "b62058c5-d453-4c6b-a58e-14d649881463", "value": "0E16333AB0B734B82A02DAE257189D3137F2D74A3E1537261FF9A8DF922441BB778544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153419, "uuid": "7f42307e-b8ec-42e7-b11c-e5abd791708f", "value": "98304:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HVCjzrbXbe8gGjAuvc:KnD4Yqqvc7hvLFOMojzrbLVfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153419, "uuid": "002dd9e1-988c-42e4-abce-6913a888a357", "value": 4050944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153419, "uuid": "e4ded686-9633-4abd-90d7-01312cc8ef0a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153419, "uuid": "f7682fe0-a413-42cf-aa9a-9098988d9a58", "value": "d7e461d922d0a08fd55f3ccdc334b8ae7df592da6da4de0279745b9be6206b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ad223f-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086519, "uuid": "f5c8736c-2274-4291-a99e-6cbaacba18c6", "comment": "Malware payload (Dridex)", "value": "04afdfaccdace8f8eb9b2eb437b6fe59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086519, "uuid": "59778495-d3ce-4d98-adfd-cd016da49cc7", "comment": "Malware payload (Dridex)", "value": "d80ab032c85189bb148f5c5423fb700967e2bbe84b81bb39139a4f17f9c38225", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086519, "uuid": "eba8e487-ecdb-401a-b90f-8ede9b73fd69", "comment": "Malware payload (Dridex)", "value": "d7ff116e3fa72da8d235f30fa3cb51e81fd5576a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086519, "uuid": "0a88ca33-6436-4bf3-abc3-f2bad1c64ddf", "comment": "Malware payload (Dridex)", "value": "752d93da7a7bf0657e3cbd47fd17f27fd52d15975cbdbf5ba8e1a62c8f2c7d6d689d0ca3c106e7a4fb923a312347f95c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086519, "uuid": "531ad441-cb09-4ea3-9c79-c885d6d0bf2c", "value": "9EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086519, "uuid": "52960abb-f18c-46af-93b9-389e15112bc4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086519, "uuid": "8262b511-a6ee-4840-860e-a0fc54248cd6", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086519, "uuid": "9e7ece0a-94de-464a-aafe-c06ad70f5f1d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086519, "uuid": "131f148d-de7d-452f-8bbc-159f0dcaf260", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086519, "uuid": "6bbcd109-05f0-4da4-8ab1-56466ac8b7c8", "value": "04afdfac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78ad7b0-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153422, "uuid": "14d30bf8-b311-449d-84bd-ae4a3609d220", "comment": "Malware payload", "value": "97e48610f8110ba0e309acbbac822e85", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153422, "uuid": "37b02890-7c42-49bf-a5ec-347e50e8d398", "comment": "Malware payload", "value": "d842d5e57fd5ae273bab5015a636e3d68915a4fc67d123da1721fcf93a0e4c77", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153422, "uuid": "ade1ee67-3990-4774-91be-e26920445649", "comment": "Malware payload", "value": "07c1bb2418cfd91e0fdcc90c91e827bdf0f3310c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153422, "uuid": "312d363f-2ede-4823-815f-06a7e5055c6f", "comment": "Malware payload", "value": "5ae227cf4e6bbe34116346ac1a82c72a0ff2caf6f268e786ceeb89dc8f14f325e5f55e47fcf524ef18544f2964bf6046", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153422, "uuid": "f40de886-0072-4472-93bf-b0535541cfe7", "value": "3E41A2E53345207A2891586276B8CD08699CE971B4D8AF3D5BCEB8F4C9ACD11B1C1F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153422, "uuid": "863460c7-f276-4fe8-8876-101c9768f8b1", "value": "24:vsBEohr45QkOlh5BUQH5hkhR5rCCD2xru:vsyohkXGhbkpD2Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153422, "uuid": "35ad9516-ec89-48e7-b523-4c6492a86205", "value": 1993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153422, "uuid": "03a297a9-17d6-4bcc-96da-b73478fb0231", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153422, "uuid": "6646ddfd-001c-44ff-b175-b8b883ce030d", "value": "d842d5e57fd5ae273bab5015a636e3d68915a4fc67d123da1721fcf93a0e4c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9945abe9-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620142204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142204, "uuid": "b517c390-2e66-490a-a74f-7a6f6180d7e6", "comment": "Malware payload (Gozi)", "value": "759e055bf47a9ce1a7fce3e3276120f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142204, "uuid": "bec16cbd-40ae-4736-9187-b0332c1f981c", "comment": "Malware payload (Gozi)", "value": "d8bcf8beebb5ab690b52094df6317f023f62f044e8107508d84d06d4700fe81a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142204, "uuid": "9f26b5b4-7528-4302-b1d0-1047b4dd5c80", "comment": "Malware payload (Gozi)", "value": "d6de742f6caf13d4a9aa75287d041596fbcea73a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142204, "uuid": "3e25df99-3d07-425d-b273-42b8be94ffe0", "comment": "Malware payload (Gozi)", "value": "e27459ee22b8c451fe6b00ea9e8575d05c9a1517d988b58adc61458255a6f3249ac294c5c4460bd090bcabca392c882a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142204, "uuid": "3f2b0a3a-da3b-42ba-9303-b053eb97e227", "value": "99D3BE0CF7E950C1C5DA3AB750B19E287228EE128DB4243616F62E797FF71A37C29485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142204, "uuid": "024f989f-08dc-4fba-853d-950b96da0ac8", "value": "3f728412058b62c418b1091768b74d7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142204, "uuid": "ebb6e31f-94c3-4de9-9397-7f71dfa94c93", "value": "1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142204, "uuid": "b8c99d16-f3cc-4e2a-8fec-749e24d47e30", "value": 133529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142204, "uuid": "fe341f37-e4ce-4e6e-b777-ffa8727e7031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142204, "uuid": "7c750979-70fc-4957-9a67-dab314aab6f4", "value": "759e055bf47a9ce1a7fce3e3276120f3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f095d4a9-ac94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620104125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104125, "uuid": "24d887f4-911c-4ffd-89cb-221c0284aa1a", "comment": "Malware payload (AgentTesla)", "value": "5f46d5673862d680325027b17231cbf8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104125, "uuid": "2130e351-107c-4b75-81a2-3a165d297936", "comment": "Malware payload (AgentTesla)", "value": "d8c0c72ad21c7254fab0b797434500aece61caadb763d9479a0ae00c2a7e817d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104125, "uuid": "a6775087-5864-4dd5-ab4c-d790cea08e3e", "comment": "Malware payload (AgentTesla)", "value": "23e35282deebd4a66d2bffbde33d65e5e686c28d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620104125, "uuid": "b41093e5-fdf3-42fe-b8b4-c1cdf7cd3e6a", "comment": "Malware payload (AgentTesla)", "value": "1911116c9d6c8c4e767d402a5719c1720b04bc7bb8ac4f92fa99b5aca453a409477ff3e9d6c5d0b25a1e38b0bb38b73b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104125, "uuid": "bdddd57c-43d9-4d77-bb21-890ff1505155", "value": "9EF4231347B979DE394C63EF3A97AB3F285E355DA291809B054C538C14AE25C623FE83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104125, "uuid": "9426f747-a984-4848-bd01-497040dd54a1", "value": "12288:toWgqfDxsxjeERq7YS5A6F4WwKTVizWHP6jiOxd8lL+QmC3rLLkjjGuxk5D0T+IX:tx/kagA9F4momZOxd853rLLojGuSIT+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620104125, "uuid": "5c6fb572-f761-4e2a-93ef-b1cdbea7fa1e", "value": 764951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620104125, "uuid": "3519aaf3-3013-4444-abb8-11c81e534292", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620104125, "uuid": "806d0db5-edca-4f90-8e94-d7d7b926a741", "value": "REQUEST FOR PRICE QUOTE - URGENT.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7946657b-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620152458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "b5f345b7-056d-4626-9aaa-7ac279aebab4", "comment": "Malware payload (IcedID)", "value": "5a6333cf53801a3de2ba5eaf1bce1db0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "a0841f0d-2b13-4c6b-91bd-cb2f5bde58a6", "comment": "Malware payload (IcedID)", "value": "d8e335d45c358a3382e1705e9b2eabc9a3207746ca85b2b1ce4000a41cf92b83", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "49b0b595-2188-4cc1-a29b-77e68ad8532c", "comment": "Malware payload (IcedID)", "value": "703aefe35d378c854c4562e59d61ff64e6c9c9aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152458, "uuid": "6aadc2bc-71bf-46e1-9ad2-be7391053174", "comment": "Malware payload (IcedID)", "value": "7628aee495cc8fc977bfc5628be47f82431cc0a29b14566f18c3077db2f5180c42e4bf0399376452c4cd4b2b164c0c3d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "a46186c6-71d9-4acf-baca-dd5bf8c496ee", "value": "D873F6E1A50093B2FEA95AFF1035C719D4B073F95AFE271BE378A6304D225861EC354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "716f583a-3131-4f05-aa6f-fa7422adae44", "value": "cfa8dd488fd4044f7dbcc5838881a33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "b98ad4fc-56d3-4b4a-a623-76e21724309c", "value": "768:bS/3Opl2ZtshraeIXwB8zH7kRYPIct4/fdvgb4dU334C3NUZ7Ndf/gDWTt54Qv2i:gQf1BVjg9Gr/tvHyi6n/0ZoVOgTjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152458, "uuid": "379c38e4-4c0f-4c3d-83a1-76477c63dcf7", "value": 77835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152458, "uuid": "8018e8f5-dfd2-40d0-86ed-704c0a846547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152458, "uuid": "aa8cf41e-4c8b-4291-98e2-0a794ccd7761", "value": "5a6333cf53801a3de2ba5eaf1bce1db0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d252d44-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142559, "uuid": "4462562c-f5ac-41b8-9ea6-b4daf223f6b8", "comment": "Malware payload (Quakbot)", "value": "4bb9a0b3083ea187a4720719202acd0b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142559, "uuid": "6ab16c28-1c58-4f1c-b698-6a2cd574dcea", "comment": "Malware payload (Quakbot)", "value": "d905e18284f96852f43a3e0c5ce0ec8d732a5edb571e59fffba9ec2a47f73dcc", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142559, "uuid": "340f917d-cb14-4836-9c9f-17c2251bba93", "comment": "Malware payload (Quakbot)", "value": "68e57e29e7608e7bbaa4e32c0c896ccb208dc351", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142559, "uuid": "ec69d48a-3182-459f-837b-6347641362ba", "comment": "Malware payload (Quakbot)", "value": "42e0258fd22de257d14fc912c80bfe69418136608702ad60f7624fbd5ddfa18b893907c048d696af6d5b9d094489765f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142559, "uuid": "dc344949-3358-4021-a358-65d422a73e86", "value": "77B3AC0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142559, "uuid": "963b9a08-f46c-40a2-9606-86de17580c80", "value": "3072:5kYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:iAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142559, "uuid": "cb8b102d-2b2c-44a4-9363-c765f935bc9b", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142559, "uuid": "637ae77a-71ac-4090-b482-2ac16ae81e68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142559, "uuid": "c383d85c-1de9-4ecc-a341-99ab3e383df5", "value": "Outstanding-Debt-1684546119-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bd167d-acb8-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620119465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119465, "uuid": "913273aa-0f89-4594-83a0-97c0931d21f5", "comment": "Malware payload (NanoCore)", "value": "597332734fde92068c7b354d33920040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119465, "uuid": "b3586390-3971-4d74-acee-a0a9a0218206", "comment": "Malware payload (NanoCore)", "value": "d9510122ef15d475c69ca539c949d4b8c8002b8f617411854098091106c37119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119465, "uuid": "c72dd3c4-b10f-41da-9248-c38d83b3accc", "comment": "Malware payload (NanoCore)", "value": "01454e8c59644ab0dd54d2326a93965a1f52b91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119465, "uuid": "11c19419-b8ea-4ee5-8270-8fc2932cebb8", "comment": "Malware payload (NanoCore)", "value": "316e1212821750dbeb32ae605b8953d25a5c3d28ae25bd159c28ec710567c4f05bae5dcc86ec544a58162af86e8cf7a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119465, "uuid": "8a2e6033-372a-46bb-99d2-1a7b4cc54675", "value": "31F4CF2673E4AF58F17F9BB59025420093F1B50BE721DA8DBDA500CE4CE5EC5C3A27A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119465, "uuid": "d4d08be0-9873-472d-9077-3505cc159a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119465, "uuid": "bb8e7f5d-80c4-4ded-8708-5825570e3ee4", "value": "12288:FygEfhLfIEOKMN4bAapo4O6vTZ/rGm1ohM7/7lv92L97rK:UgExffOK9Uau4TTpGmd7/N8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119465, "uuid": "5348a089-2f45-421e-a2e8-b7b6311f1ca7", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119465, "uuid": "5d4c5799-49c0-4080-97ec-09fed4163068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119465, "uuid": "066252f9-c247-4f1c-a5c4-6470c230f7a5", "value": "Shipping Documents Original BL, Invoice & Pa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93b0b4f-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1620153424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153424, "uuid": "e0279a65-1e34-4ac9-a2b8-139b30be5986", "comment": "Malware payload (Mirai)", "value": "a1a5fbc1f888de553631668ba516ba76", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153424, "uuid": "2e13118d-7873-4bac-9d2b-80e0eb3ead66", "comment": "Malware payload (Mirai)", "value": "d967f32f5c01e540e34641bd36201024f4b1198b273877d315fa00077ba88670", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153424, "uuid": "a906a234-2e03-42c0-b8f1-8071023a6e4e", "comment": "Malware payload (Mirai)", "value": "cf3bb1e08445e56ff63432aceaf2a0917be59bdd", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153424, "uuid": "8d326007-aa7a-4b9d-87d4-04fb8bdf95f5", "comment": "Malware payload (Mirai)", "value": "d6afaae3417539dc2f665093f8ed753f2b97932f08bbcaf3454394585177e3ff267cff13b9f27818f4ab6950d98d4a31", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153424, "uuid": "9526ee07-55f0-4cfd-9207-cd805abcb0b4", "value": "9CB308C4B143E9F4DC4505743026FB375E36B1BA222FED97D3F89A636D92A42C805A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153424, "uuid": "a36c88ff-b6bb-4312-ba6f-25fdc44a66e1", "value": "3072:kjwROj6+18a7qJ/lAO1/i5FKCQLG1xOFR9BXlMclq513xDFCH2svXG0DP:wuOjN+cq9Aq/i/KCQL2xOFR9BXIX3xp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153424, "uuid": "aa6341b4-f4ee-4e2a-8665-73c097b7f132", "value": 115600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153424, "uuid": "445e957b-d00d-4710-80ef-76d4ad8d6e22", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153424, "uuid": "a39dd2b3-3ab6-4fe6-a2fd-e7efe3716f1c", "value": "d967f32f5c01e540e34641bd36201024f4b1198b273877d315fa00077ba88670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7637fda7-acca-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620127113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127113, "uuid": "597f2ae7-576c-4869-86e8-a1af229c624f", "comment": "Malware payload", "value": "9afb84acc1cbecc4d70e30ebbc9bb9ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127113, "uuid": "fbc6de37-cc26-4ed5-a4d6-d4ec26907325", "comment": "Malware payload", "value": "d970639946fd688735a558bea81262e1763fed2697238ff166b5592c85b088e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127113, "uuid": "59fc12a9-f1c2-4803-b5b4-c14cb2418dca", "comment": "Malware payload", "value": "ac1b10dbd2f237475510d0d86c78bcc983a5559b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620127113, "uuid": "7599cebb-2c9b-483c-821d-942fa0907841", "comment": "Malware payload", "value": "c431acfb49e4b4d3f856d096795cbee1a6b8f69b7dc88fadc4e4237d66cc020459ae3c9c99a41c31442bf86b2c0f8aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127113, "uuid": "d58294d6-eb49-467c-a4e1-df8d2fba089c", "value": "6AB36F79AE455CA1F0404AF587C336FA01EBCD1266F6DED6ECDC7931A539AE830CA061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127113, "uuid": "cbb627e6-e600-4a87-bca0-9c755966223b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127113, "uuid": "8a4c65cd-71ea-40f0-a01c-cf20bd3b221d", "value": "1536:vdypNpJyCNalo0AiWxVj9qYlE6Ym1Ovy6aeYyacbmFW:vgpNpcyZNj9HO6AK6apTcbmFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620127113, "uuid": "801f4058-e454-49e5-b32c-d575197bc8b5", "value": 112768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620127113, "uuid": "efdb9a46-8247-4410-b735-781aa60ce907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620127113, "uuid": "1b010286-7cc4-4098-8f8e-ae46104cc102", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad6f97-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126090, "uuid": "e864d3a5-2a82-44ff-8632-f625d3a99d00", "comment": "Malware payload (Dridex)", "value": "a856bf89c4cb528027d43ac2331f6f87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126090, "uuid": "55ac57a3-9002-4bbe-9160-f1414ca98e9c", "comment": "Malware payload (Dridex)", "value": "da267157b707f5449db095bb2f2d8ce9259b02a57858847049a67f0c07614344", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126090, "uuid": "18c38901-3eb7-465e-be49-edddd920b63d", "comment": "Malware payload (Dridex)", "value": "f5e5153222e40a00ee1ffd69b3d5f9cbeb6b6fc4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126090, "uuid": "18c68386-e9a7-4ebb-83d6-15fb0cd479e3", "comment": "Malware payload (Dridex)", "value": "cedcd6d7d55542b8e3150a256db7d7163277eb4ee03fa914e5a55f78ed59ceaef8414aa1d657a408828af76f5290677a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126090, "uuid": "f14ad888-89c1-41e7-85b1-901811c1f724", "value": "D9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126090, "uuid": "10a066d0-2cae-46be-b89b-5493183628de", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126090, "uuid": "87ec06c2-db86-4a03-bc7b-3647626bfb68", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126090, "uuid": "089547e2-11d8-4ebd-b4f2-1f7b080d55eb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126090, "uuid": "13051989-40cf-4693-b5dc-c67984081f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126090, "uuid": "18aa28a7-1ea0-4996-bb06-97d572042bc8", "value": "a856bf89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75843b4-ac9c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620107546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107546, "uuid": "a142b596-edc0-4c3e-878f-741fa0c72db0", "comment": "Malware payload", "value": "ef086d7ff851087192da4875633309a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107546, "uuid": "b60b247f-0a1c-488b-a282-0fc0cc8ceaa0", "comment": "Malware payload", "value": "da738fd264ce783b168d1085f9cb95550f46a5eb3f103cf982e01dbe9bb565f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107546, "uuid": "fbe29494-da4b-4412-b023-3b1eabbc5670", "comment": "Malware payload", "value": "09f14e9ae202cd3125f5357db7aabcde61ada7f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620107546, "uuid": "4223d045-567d-43ab-b2d1-a8d62458b7c3", "comment": "Malware payload", "value": "372b8c6969cf3cc6bc7d56faca543ec1e14fc827b8a3b0ea6094f1ae046fb3d8b4e792cf5396bd0700e93a6fe3c0f1c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107546, "uuid": "f7e8fb49-1b85-42fb-9d2b-6ccb3c6aef25", "value": "14226C3CC511F827C262417EE07506B9F75D1456A5C2AA2E7094F18D8BF13C78B9E1E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107546, "uuid": "fe940d64-1d7f-408b-b830-a3e4f397d8ad", "value": "96:kHcIMm57P6PcUdmGJa6T/n/jNTarFU4VIIAE+UXoJT0z09p1wJCWxlPFbsFWbsgK:ScIMmtP3G/bMUK8vg09sHP6QX0ec3Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620107546, "uuid": "2110d00f-0db9-4e75-b8c5-38228a99c4b1", "value": 10311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620107546, "uuid": "b123627f-cef6-49a2-bcc8-5ddd65f4f239", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620107546, "uuid": "a6f6ccba-618c-4202-be42-90b4e864c2bf", "value": "MV RED SEA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3524e54-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153441, "uuid": "babfd494-978c-40f4-bcca-5987928d647a", "comment": "Malware payload", "value": "4de9e35140a3778386bb7b5e3e80381d", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153441, "uuid": "a0694670-7f85-42c1-85fe-5f08b4f2a6fa", "comment": "Malware payload", "value": "da7e800cf56c39bacea7ce542344ae154c77c7b44c0eb72c387d63d61222b4ee", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153441, "uuid": "5fa2aee0-be50-4b1d-93d8-b0098c6af01a", "comment": "Malware payload", "value": "48bee9e13086550931dfb3157f2aa10140efdc4d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153441, "uuid": "8f9a601d-c0cf-47b7-99e7-acd247c34d09", "comment": "Malware payload", "value": "05653bef2e60be938b4be513ee1ca9a6cb221bb53a1c1e354c79aad341fc456209514158367dae45a2f957f5be34638f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153441, "uuid": "7d330f6e-d294-46ea-9361-e3c2a031cc8a", "value": "B9953375F6DE30BD9AA4A173A7EFCD24303BA2CCA0558BE06DA911CE0406531DED4B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153441, "uuid": "d8837db9-8fea-4a9c-af58-ed76e988a323", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKU:tos909Qg6ecEZHyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153441, "uuid": "bffd104e-467b-4c1e-9487-1a8b6951134f", "value": 2007040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153441, "uuid": "fa17ba64-9fd0-4465-87e3-a5d148ce074a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153441, "uuid": "3a28ab45-40c7-4ed4-8122-943b39b292fe", "value": "da7e800cf56c39bacea7ce542344ae154c77c7b44c0eb72c387d63d61222b4ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503557a2-acc0-11eb-abe1-42010a9c0039", "comment": "Malware payload (OzoneRAT)", "timestamp": 1620122754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122754, "uuid": "b83748cd-b98e-4baf-a5b3-775df2792b9f", "comment": "Malware payload (OzoneRAT)", "value": "ed7251fadeb9bd2a8836828f2e1b6f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122754, "uuid": "c0b54f0b-2bf7-4bdb-9911-2d23b3ed804c", "comment": "Malware payload (OzoneRAT)", "value": "dab16f86762edfad407ad17ff640eeaf0b92ef8da877d81e07c90690d142df88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122754, "uuid": "7988df48-6cc8-4b7f-ba0e-c539f05258bc", "comment": "Malware payload (OzoneRAT)", "value": "ab41a68d76147bfdb3d5ff36ae0e992e4e5b7c84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122754, "uuid": "9e88b806-d239-4804-aa9a-281e7a06864c", "comment": "Malware payload (OzoneRAT)", "value": "ed28fe45cdbe084d2fa406c022eb95787560c3ee5c4676f124e5e7275f09d533d211af39be24d645357734f8c6b2e4e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OzoneRAT", "colour": "#691468", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122754, "uuid": "76daf646-7454-4260-8027-3fb2324baf7f", "value": "4D2523049BEFDE3FE59CC4B651FF8E111BB84DA2D854E088836BD75762A43C02617A2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122754, "uuid": "90b6dd4d-9b00-4ecb-8074-9f7e50b70f79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122754, "uuid": "ee853352-cd84-420a-9863-1fb61e7789d2", "value": "24576:TwhVYmWGP13bZSo3p4DAY0ye4GLv4UHh4bAxHwbqI:TqHNKe9LxSbCQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122754, "uuid": "5c1d291e-7b12-4da3-9038-2774dbd664fc", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122754, "uuid": "dd0318a0-9378-4fe9-ba9a-b038c3cdc522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122754, "uuid": "0e30570a-52b4-46f7-af62-cf9de2c9037f", "value": "ED7251FADEB9BD2A8836828F2E1B6F83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cbc45e-ac84-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097259, "uuid": "747abc66-37af-4455-983f-b8c815d0b108", "comment": "Malware payload (Dridex)", "value": "83cbf565c198a45dd38e8954349624a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097259, "uuid": "4f414679-1e1e-4bc8-aeb7-21fed681e686", "comment": "Malware payload (Dridex)", "value": "db16bd88cbe9255164ed518f993e423ac7759da0e1961684e6185305c0f76911", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097259, "uuid": "dc2d7144-4886-4a17-a778-eb7b3509fa03", "comment": "Malware payload (Dridex)", "value": "d904cc09a1c188a58ab2b9a3ab62bf3a2561742a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097259, "uuid": "6934ab4f-0465-4509-b88a-c61250ca2d05", "comment": "Malware payload (Dridex)", "value": "99f5ba8172562e2dab771910fa1e95ee2ebf7a73def3d700af7e423b104be168cc5abf9269dee02f0c7c1ab804c776b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097259, "uuid": "62baaec8-a87f-4211-9a09-7aafdf9c8b0f", "value": "DEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097259, "uuid": "55121031-1d2f-4704-84c0-477d84e59cb2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097259, "uuid": "b6772322-a597-4e7f-8360-1886b5ee6c97", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097259, "uuid": "77dee44c-46c6-40dc-a3ba-74ddedb42bbf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097259, "uuid": "0cdce321-7a9d-48d0-822e-c34e5065e7be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097259, "uuid": "3e7ae211-83f3-4478-a185-3cd82c4e9fbc", "value": "83cbf565_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bee2a9-ad17-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160259, "uuid": "2fb20b97-e76c-4962-ab68-a28e03acfbcd", "comment": "Malware payload", "value": "31d75f308a65d1dbde534fdf65b2f9bd", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160259, "uuid": "49278157-668d-44a5-a8a7-506f408bab25", "comment": "Malware payload", "value": "db3d7d4fe061f9a3153ac1ff78c2508e30cb5025aed6aefadba96cedf1cd3381", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160259, "uuid": "67729ab7-7e77-4af6-8e06-a10d13450ab1", "comment": "Malware payload", "value": "af355b7febd7445f2531776e54159629674c826a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160259, "uuid": "ed520489-819c-4499-966a-42ab81071669", "comment": "Malware payload", "value": "099b3af57f96837e544f32987b387fe85ed1b7bcbedc00f790f9d3f111fbdea76f8f52b4616465547825f8f186fc6314", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160259, "uuid": "5aa833d1-c819-482e-b2ca-ead7d625554d", "value": "6451960AF947D15C9BB9236BED978626FF1B801B9DA2104C71DCC2495F2080DA66CF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160259, "uuid": "7aca49fd-ef4d-4767-929a-a9d566a824bf", "value": "48:AxK48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:hGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160259, "uuid": "7838afc1-255f-4247-af01-42e66be88c67", "value": 3137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160259, "uuid": "1a30e812-8806-42ef-9b52-fdbb0e7b6d3f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160259, "uuid": "2d3bcff7-340e-4a5c-aa6d-a5a99d1578fb", "value": "0yi0t9Fz.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19459a55-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620133399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133399, "uuid": "cc6264d6-157d-4b34-be31-f5ed0dc67da5", "comment": "Malware payload (Formbook)", "value": "a6ea0794f2791f9f2bdfcdb467122e6b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133399, "uuid": "b7e19a35-6e1e-4e67-8ce6-e5b9f60182dd", "comment": "Malware payload (Formbook)", "value": "db692f9512b08149089a9d7295a04633f22944d87f2bfe53ae00d2c55f7502ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133399, "uuid": "8eaf02b6-5065-4388-972e-97ef7fbb873c", "comment": "Malware payload (Formbook)", "value": "83815a1977485c3fabdd49c91926d0482e3b78e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133399, "uuid": "352c1359-8518-4ecb-8d2f-91adde755349", "comment": "Malware payload (Formbook)", "value": "908dac32bcca339d196698014b573565f7ea80f77538f4a1814e2443a7ed5f49cec67334e39a6465df8bdd7aa3d6eb55", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133399, "uuid": "14b4bdaa-0834-493c-9d07-a35cd8ba0217", "value": "DB641312747143A3E3A368BF5CA731B5B0E2CE620924BD49704D7B3A5E36D9F8D4AC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133399, "uuid": "7b3e8ba8-f4f8-4e78-ace2-49405c16d5ee", "value": "6144:Nc2M/OhbVZxxJBrH0z4IeLiR2sWxIyEazPO8ZH88w5a5GCvVWoiNa6LwnxTaM4sL:6PAVhJd07eLgiK0PO8588wDCh+aPxWcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133399, "uuid": "13f6650e-5daa-467f-a18a-0d24013ef009", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133399, "uuid": "4fe89425-5f7f-4019-8b75-b0d75498f140", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133399, "uuid": "8ebd101e-6f49-4c67-9b78-fe86e55bd9a3", "value": "Refno.191938.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92a9091-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111736, "uuid": "e3eb318b-b412-4771-986f-385905579c52", "comment": "Malware payload (Dridex)", "value": "7b03d465980aa20f400461cb9640e9b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111736, "uuid": "3f701b50-a2dd-4eba-a773-991609c0d81a", "comment": "Malware payload (Dridex)", "value": "dc03c2b6b36ad8dde8e4ba7b90b9e48e20fca318f9b5f009c083e4fd57e1a8dc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111736, "uuid": "2939cb72-b09d-4ef3-b057-bb3982e54485", "comment": "Malware payload (Dridex)", "value": "c43cce04c9bfb0e196a8fee5e11abceacf4f5b0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111736, "uuid": "0b0c4c78-6727-4a74-918e-f0fb8b2ad050", "comment": "Malware payload (Dridex)", "value": "76195b9e6b10aa49319afcede80743eca9d487a8f45e9d25d346abd988f29df23326e56a51cc823bfce65ce546350d8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111736, "uuid": "cbe7762d-81a2-48ed-8abc-fbbf709a5e31", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111736, "uuid": "eacaf6ed-6b35-453e-b28c-79214a1f055e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111736, "uuid": "0c17b2f5-ac9a-42ab-ae3a-9a2c3022008c", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111736, "uuid": "37ad2023-2e55-433e-8043-e87a46809f1e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111736, "uuid": "62c9e18b-640e-4ae9-ac26-dcba82774e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111736, "uuid": "2aec6d30-c509-4353-b434-dc8a4a989b41", "value": "7b03d465_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56765827-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100860, "uuid": "34c70c7a-4eaf-4ee2-8be8-588e25d7c091", "comment": "Malware payload (Dridex)", "value": "0cd0eeb2f76e717a613b6e627f5910f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100860, "uuid": "366ac719-572d-4ff3-bf60-a59df20eb184", "comment": "Malware payload (Dridex)", "value": "dc5d651c0a950bd7a1a267706b5e9451d1b884865457b5b2ca928814269e219e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100860, "uuid": "b94051e5-1b40-4d55-9304-45f19de4bdc0", "comment": "Malware payload (Dridex)", "value": "811e29c638a27d5302a9114d238907788149ac3c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100860, "uuid": "6ed4974a-d88d-4aef-959c-5f4c00a9d358", "comment": "Malware payload (Dridex)", "value": "1f8062f05b977e60403aff00129c9415c33c6e5ce52ebc788ebffc90b4119be1464a855d716600b9e500e7e30c41b4c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100860, "uuid": "a5d7f219-40d9-4703-abb8-eaa2352da1a6", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100860, "uuid": "9294ef66-716f-46cb-9a48-496a5d9fc9bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100860, "uuid": "68781637-582f-401c-ac37-791c7af67381", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100860, "uuid": "d8b12301-4dbb-4ff4-94ae-867f06282a8d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100860, "uuid": "444d5a2d-1f71-41d1-822e-8652622f8ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100860, "uuid": "6aeba0f6-021e-497b-b8d5-fedfc48a370b", "value": "0cd0eeb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e569d812-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120427, "uuid": "4e3a3f60-80cb-45d2-8605-0fb41975473d", "comment": "Malware payload (Gozi)", "value": "d14f637d91f3d813b1d8cf9020932dc1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120427, "uuid": "396bf9a7-0f30-483a-b235-9d43222c628f", "comment": "Malware payload (Gozi)", "value": "dcae9172e9f499c5aad43fd5fe129b863bb42d630620e161bdd7b2cc02cd7c31", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120427, "uuid": "2bf9fed4-15f8-466a-8798-225c0364a807", "comment": "Malware payload (Gozi)", "value": "ba5cd2988ae66a6968eab7d0c80437f0a870b568", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120427, "uuid": "ff04d937-6591-41be-98d9-5d5f7734d7ff", "comment": "Malware payload (Gozi)", "value": "214b31ea6828872d3690841b83a3a110d56fd712bc5e9cb4af0e6f50636cad9b7aa40ed585bd066a7ec1f303ffa0f347", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120427, "uuid": "7c568b8b-69de-4305-a06c-21897f3bf4bf", "value": "22438E8172E008B5C392153025C4F7E7BAED477062B8A05197730BDB6E929A7EE7D30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120427, "uuid": "688f3886-c814-4bc2-8455-ed9626a01105", "value": "1536:I/7Qc1PqlalX4nmohJKwWTZ5xWNhHIbMRLJmFO9W0LB:o7nPqlalhozGZ5xszRNmFO4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120427, "uuid": "c4f06f58-0038-4d14-8a63-f7fe8ff8caf2", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120427, "uuid": "261ff073-3bee-4042-98d5-e7d0068187a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120427, "uuid": "25f96b94-cab0-4e40-a91d-88a0f8bb46eb", "value": "4ae0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ce5665-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1620142599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142599, "uuid": "66dc390c-5e31-41e1-b4f7-7161fb5158a0", "comment": "Malware payload (Matiex)", "value": "500058421aa06690154fa7ba57312f1e", "object_relation": "md5", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142599, "uuid": "c53beacd-420d-4100-860c-89723a8d644a", "comment": "Malware payload (Matiex)", "value": "dd501ae96aa533ca30d5f317a5f579c5d554681fcf131a0443e618a7e5711a01", "object_relation": "sha256", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142599, "uuid": "40da4cad-2ed7-4e0f-b847-5f3e9e51bec3", "comment": "Malware payload (Matiex)", "value": "02a30bc38e14e8289d411e85712e0468a82dad97", "object_relation": "sha1", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142599, "uuid": "906cd2c9-b616-451b-b69a-d1ec52a1fdfc", "comment": "Malware payload (Matiex)", "value": "0c6154d145245f91c6d782a9ae7cd182a34868601a9be4b5fdf7b6f6d0f41244542cec51e7da66d8b388e1a100eea23e", "object_relation": "sha3-384", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142599, "uuid": "b438a966-276d-4f2f-bec7-278856e4d596", "value": "CCE4BD277F689656E1BA5F381835030067F5F11AE725C30F2D6460ACEDE2AC18E677E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142599, "uuid": "a1858be8-9208-4373-b65a-7cf19145c900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142599, "uuid": "ecfec07c-4ad7-4423-9ba1-dde2a85b61bd", "value": "12288:TOwfn//X6KM5nc2pOALLZRrxM45PTlYpR7J3LSEVP33DjxqTW/en:TmRrxRPxYpJVuEVP33d/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142599, "uuid": "2a8986a8-9df2-418b-ac1c-ada6434eab97", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142599, "uuid": "369e1a23-f01b-46f0-84e6-50d71e58ddf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142599, "uuid": "83801b55-75f1-44f3-b3a9-2c4cca2b77fb", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb1adcd-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153482, "uuid": "f24858c9-5ae8-449f-af1a-8b3c2de44b24", "comment": "Malware payload", "value": "a102004771c5117800930c2fb8ec8dd7", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153482, "uuid": "531dbca5-d04f-4db6-90d5-c6b7e063d2b8", "comment": "Malware payload", "value": "dddd2afb8647a9074fce6ef3981a07540a650e0a6cca2447fb3ca9222afc1651", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153482, "uuid": "47faa46b-6bdb-4d58-a432-85d0c67fe878", "comment": "Malware payload", "value": "0d234a8fc11a4a707072ceac53d25962790d28eb", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153482, "uuid": "50ba2310-aa83-4013-8f46-82ca704dd709", "comment": "Malware payload", "value": "0b415c3131d60f9acbd9614a8639218fc248bc5ad16c7926ab931716fd8b41ddcbd492aea6d5e0d51a842b35ca315fa6", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153482, "uuid": "78db63b8-5ad2-496d-9e1d-3dbbc68f1b36", "value": "DDA1E750112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153482, "uuid": "f20b95eb-43ab-4bfe-a563-0295fba373eb", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153482, "uuid": "3a1335b8-faf3-496e-9ff3-2d7880585ed8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153482, "uuid": "1fc102aa-7bd3-4784-9b77-e6f850f6f66a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153482, "uuid": "4fea705b-c6f2-4f72-a0f0-25544acaab2f", "value": "dddd2afb8647a9074fce6ef3981a07540a650e0a6cca2447fb3ca9222afc1651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55261e73-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100858, "uuid": "0a6c8d59-91c6-44fa-b315-98c6bb83c469", "comment": "Malware payload (Dridex)", "value": "445c95f521d7aa278525f536bfbbc06d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100858, "uuid": "432c0b83-fd36-4eed-a6ad-81558085d7bc", "comment": "Malware payload (Dridex)", "value": "de1d310fc8c13c5d59198df48a827bec5a35e45916691782984b1ce41fd5f552", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100858, "uuid": "51d4cd3d-f1f7-49ba-a19e-1068125c0f7f", "comment": "Malware payload (Dridex)", "value": "1b0c58811242c69b6fd880a84f4043971c242647", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100858, "uuid": "ea690bfa-a7bb-495e-bc4f-13da4e0fbb49", "comment": "Malware payload (Dridex)", "value": "045d64ef6bd8e646c1e68d1391c124224b9b5340294f0733d9bd363990ad99745905e1c979f61a1e35180b9a60b92d75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100858, "uuid": "b38840ca-77f5-4332-b7d8-419365b12686", "value": "DCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100858, "uuid": "a7004e1a-18d2-413d-afbf-67c823c2532c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100858, "uuid": "c540b5d6-6fe4-441e-a429-fcf1bfab81e2", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100858, "uuid": "abbf6688-870d-4020-aea9-f29bd188765b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100858, "uuid": "8aa9b52c-e794-4f95-8920-b5a28c1f1ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100858, "uuid": "7f3d9b43-e3e1-4939-97de-37b26cc19da5", "value": "445c95f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6c412d-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111690, "uuid": "188681d2-cd6f-49b2-9aea-f531e4ee5efb", "comment": "Malware payload (Dridex)", "value": "048b9f2b778c858481a1cb8fcc6ecbe5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111690, "uuid": "03e3b92b-601f-45ed-bed2-88ad62911a43", "comment": "Malware payload (Dridex)", "value": "e0ba8cd32287d3e49cda1a97527275798527102cb976475f983ac8f24ef80ff4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111690, "uuid": "f3d2fac7-ac83-467f-be99-815e5b19f163", "comment": "Malware payload (Dridex)", "value": "fa18faf9c4612847bc7f16c5357426766c2e5b40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111690, "uuid": "dad522ac-41f9-4b65-a7b3-ad4332ffff3b", "comment": "Malware payload (Dridex)", "value": "c757487db2178610d07e1fbe82c824a057bdc5c79ce9947078e1374da37451f993ec74db45d6a94274fc9b22905d345e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111690, "uuid": "dff6a904-bb63-4cdf-ac77-60a0b38289fd", "value": "1EF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111690, "uuid": "f025b232-8836-4109-b481-258bdbb3879f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111690, "uuid": "be83e51d-9bc8-4494-8d38-c78683ba1a30", "value": "3072:XIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111690, "uuid": "ce253ae1-185d-4190-97d3-307b9da3e78c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111690, "uuid": "272c8011-6d4b-4ee1-be9c-e052700536f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111690, "uuid": "570dee4c-0fed-436e-a38b-35dd352826e8", "value": "048b9f2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026b2927-acaf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115322, "uuid": "ec3ad352-8629-473e-a587-3766c6101e8f", "comment": "Malware payload (Dridex)", "value": "d3320f5a630d6866851d1298a971cfc5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115322, "uuid": "82bd4ca0-4e7c-40ca-8dce-230bb0877334", "comment": "Malware payload (Dridex)", "value": "e0cccfb3084d41c78493d296bc00d8b692a34a6bbab8d8a7e1f046ac88a861f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115322, "uuid": "759c02f2-ce11-4256-ba75-c26ba638b907", "comment": "Malware payload (Dridex)", "value": "8a9a82710ed5a9f9b87a3e854611c3450e02f2a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115322, "uuid": "114aa4d0-bcff-4d17-9088-609114affa7c", "comment": "Malware payload (Dridex)", "value": "a944ce6c571ba2a98b49cda826f0f7e69b113da11827c199aaadf619088aec0b84ad1c8e8d337e59d0449aad1ff6f26d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115322, "uuid": "43359f6e-d9cc-4cef-9fb2-a2f051e48b96", "value": "ABF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115322, "uuid": "5a1136f5-cf3f-4e1e-9c19-6e67d54de515", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115322, "uuid": "c88d30be-758f-410c-9085-488cdbb0e781", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115322, "uuid": "033c7694-e29b-47ba-b428-ec9faa229a5f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115322, "uuid": "bbbf2eb5-5a43-49ca-9307-c0700c392f25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115322, "uuid": "19de5d27-4e0a-4521-8b1d-99e273e3359d", "value": "d3320f5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40074a3-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122465, "uuid": "0d084f19-408d-44cb-be5c-447d1566a969", "comment": "Malware payload (Dridex)", "value": "bdbf0780be5765bb5b3c3d0d82377918", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122465, "uuid": "9ccd2049-a262-496a-b7e4-975ff8755dbb", "comment": "Malware payload (Dridex)", "value": "e12ba2c3601299537f06f191f0bf4af28e6bff07ab0298bb5e27804f94c63f0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122465, "uuid": "83a5ec3a-b54d-4eaf-af4d-a82f41c79fb7", "comment": "Malware payload (Dridex)", "value": "067893b8a4c57f20aaf12ffdfac8c061fb5e04ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122465, "uuid": "b879abb5-10b9-443c-8852-ba6265c0c3c7", "comment": "Malware payload (Dridex)", "value": "86a8db78fbde4d579bec75b253ece99f78d8c303430402583d520c6150e18f31056da021d18e7e3f63c40042cf79f2e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122465, "uuid": "d65f403b-3566-447f-83de-d6e375d911a3", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122465, "uuid": "ebbf3183-ceeb-4bb6-9b67-5d19addfde3d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122465, "uuid": "155e8d84-ff92-40e2-b5a3-82c73b358bd9", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122465, "uuid": "b5e3b796-30a1-4578-9aac-9fd97878080d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122465, "uuid": "421037bc-3a49-47bc-ae1e-7f0d6d25a0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122465, "uuid": "4b8b9cb1-aeab-4e84-959f-33c622a2cdfe", "value": "bdbf0780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866476ea-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111678, "uuid": "f3644c2f-b474-4b8f-987b-89c160ce3cd9", "comment": "Malware payload (Dridex)", "value": "21252f4b3648e898eda537c6f7ae8b2c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111678, "uuid": "cda3e015-558a-4eb4-b445-cd44ef4b99c4", "comment": "Malware payload (Dridex)", "value": "e16bbafd147684d72e8faac71212436dde5bef99aa56c0c9031f491dd710206b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111678, "uuid": "daac5d2c-cf7a-4270-970a-ba55e44b3957", "comment": "Malware payload (Dridex)", "value": "710d280224707b38ecee9582bfdf91bec11cef40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111678, "uuid": "98b31568-d5b0-4653-bdb9-d15938def2f6", "comment": "Malware payload (Dridex)", "value": "f59d317992a6f29e4057e405afe9ea68ce37592a1da059f1e6d99c09011085ed87334c455f128f35974176d8380538e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111678, "uuid": "debf89d0-3d59-4dbd-bfa0-744fb3c0903b", "value": "15F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111678, "uuid": "f682cb2d-8205-40b7-a294-e8025494ba3b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111678, "uuid": "4d9dff87-7dee-4c1c-b9f4-145876978b63", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111678, "uuid": "a67af30c-ba59-4396-87d8-1dd50c794347", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111678, "uuid": "43bc3b6e-ae47-46a8-8b35-a719b62ce5a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111678, "uuid": "0d358e64-0faa-4f19-83b0-f846a1b83f15", "value": "21252f4b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93160792-ac81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620095808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095808, "uuid": "8b1d65e4-c8c8-4a36-b9db-9ae14237db99", "comment": "Malware payload", "value": "a07cac8ad2b211a9d9538bca4f4a49d1", "object_relation": "md5", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095808, "uuid": "496c5fd0-7331-4915-bf30-cae043e954e9", "comment": "Malware payload", "value": "e26047ba468b635a4a8f68288dc936a93ccfe34dfc4a87c3162aed69dfd83f86", "object_relation": "sha256", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095808, "uuid": "39dc4f6c-7733-4252-8faa-44457dbeacfd", "comment": "Malware payload", "value": "1991daa41eb129513809fbf67df672797f679206", "object_relation": "sha1", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620095808, "uuid": "5ac8b67d-fe13-47a4-94ee-12d42c208680", "comment": "Malware payload", "value": "273486e3235f827ae382ad8fc47a37a49201e8557cd7184635e3fba7933d4e49157ea5f55d640d17eb817d6d00a3a264", "object_relation": "sha3-384", "Tag": [ { "name": "AstarothSpammer", "colour": "#63005B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095808, "uuid": "c71471e9-7161-4e74-815f-14119d56c5e0", "value": "358533C76028C920BC1FE5D7610FD1E5F358CBBAD4E1CE9958843D35A5AAAEB0CC185E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095808, "uuid": "186fa8bc-92d3-4d61-9540-a99c4f40678f", "value": "24576:2mac9IqL/o6hg8hCBDp768+NHsgG5SFed9qkaAk6TgAGc92R1FAPMTYm0Mvgv:t9Iq7Thqld+CgQSsXlTgz6u1nTc8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620095808, "uuid": "b755fc80-e01b-40c2-8d84-a90fc6efe8b0", "value": 1729086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620095808, "uuid": "2a881d2f-46cb-46b8-a303-373431efbb1d", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620095808, "uuid": "78195225-9018-4914-84e9-11ffa7b3208e", "value": "AstarothSpammer (6).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dceef340-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153484, "uuid": "5662f4e7-a7df-4084-94f5-7b5bc6468e2c", "comment": "Malware payload", "value": "877516203bdf276204f40ed386fadf34", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153484, "uuid": "7a8cbf1c-7ae9-4cea-9d0d-f9ca87bc4770", "comment": "Malware payload", "value": "e27adf8e180b31ce97ab4d14c61e18f16bec6526d68c8b3bfe3bab0141c50809", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153484, "uuid": "3cfd2eeb-6eb0-47cb-a241-b679fb5fbff8", "comment": "Malware payload", "value": "faf2c7f86735244824ae89673c65b85cc76fccd0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153484, "uuid": "68cd2c9f-60d7-4a05-8ed4-1ed93b878714", "comment": "Malware payload", "value": "979ce1c91db7268aa6e4423d64c40dddf8ff61b5de1ca53892abc2655c88e9be201fd52af30ef467460de015b1093e5b", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153484, "uuid": "637c9713-8156-40b3-aa3a-8fdf4639f41a", "value": "73A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153484, "uuid": "2093388d-7edf-45ec-98e2-da5a420e9ca8", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153484, "uuid": "d67d680e-7c27-4102-b2d9-605faeffa04e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153484, "uuid": "839e03f7-0c7b-410f-884a-694cff0433b3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153484, "uuid": "ab747a6f-a9f0-4e3a-bdb9-301a8036ba1e", "value": "e27adf8e180b31ce97ab4d14c61e18f16bec6526d68c8b3bfe3bab0141c50809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0095ef4c-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141948, "uuid": "eb63d047-3a52-4c73-916b-34c7542beff8", "comment": "Malware payload (AgentTesla)", "value": "ec217acdf26636dd01ccba3dc7df5066", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141948, "uuid": "30b06edc-6944-41f0-93d7-cefe3f1717c5", "comment": "Malware payload (AgentTesla)", "value": "e27c7feb3112b0f8d3aa4195962fc2c430074179cbf6811874b49691c486e26f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141948, "uuid": "f510b56a-1a83-4495-b66e-3a3242c67caf", "comment": "Malware payload (AgentTesla)", "value": "768c321ffe79e38f92682477a2b9b0e6122721ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141948, "uuid": "f9e7be85-b5cc-4d71-bbf9-30a8bbeb734f", "comment": "Malware payload (AgentTesla)", "value": "aad7e30cba28dddcfcf95932adfbbfa830dd2786d5356c3a4e0311dade96f0b042221e021245467d0273c656469f43ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141948, "uuid": "c1fda22b-9489-4acf-a606-f38daa28aa64", "value": "29E4CF6233D4AFA8F17E9BB581241200A3F1B50BE721DA9DBDA500CD4DE5FC5C3627A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141948, "uuid": "7facee0c-a3dd-422a-a913-75982b1e4d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141948, "uuid": "76821930-2e10-4d35-93d3-8fd4f9b52681", "value": "12288:Bngn6+vI0OKMw48B82j5RNDmCR6k1G9Dvv5eNvesqFYGjD+GtZV:Rgn/jOK348XTNR6kQ9qq3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141948, "uuid": "67d1b2c5-2a3f-4456-8a82-df37c01ebed8", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141948, "uuid": "a2329927-e62f-49f5-8740-6aa3f8119d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141948, "uuid": "7ac8c8cc-9275-4e1e-b5a3-40605268c80e", "value": "ATuRNgegI7kl7Ua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261d534a-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620108080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108080, "uuid": "57c54d7f-44f3-4741-a8ba-80422a4d831f", "comment": "Malware payload (AgentTesla)", "value": "8cd641fab012f4f066d29dbb4a594704", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108080, "uuid": "716b3bfd-ef05-4ce4-bf04-415b353aff83", "comment": "Malware payload (AgentTesla)", "value": "e2d92dd0533af813efd89ee34df68fecc5100ce88600733507fa70e40d2d486e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108080, "uuid": "cb0af818-61b8-44cd-998d-a48b5a5c28b9", "comment": "Malware payload (AgentTesla)", "value": "148afadbc96bc434dd29c8073e0c077f422d61ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108080, "uuid": "e8329b8f-1492-43b7-9911-fd9736971404", "comment": "Malware payload (AgentTesla)", "value": "67a2f629c6a2ae91fcdc8d9136a8ba91eb70e5e320ecbbb547ecc3a3d65791af74d95d49968c99956e94ca4fbeab5b6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108080, "uuid": "16a4e2b6-cd87-487c-9a5e-7f8e85b59ea7", "value": "0CB53A5222A86E05F93E57B49730441D47F6BC17DB72DB9EA884B09D1FB37C08B1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108080, "uuid": "8c854535-fce1-4b98-ab41-ae169e36c1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108080, "uuid": "40759d10-04f4-4058-a990-5170f5ec8447", "value": "24576:9VU/Aa/zb5ZE1XcUwATO/pm/BAz5YJmz6PBDmIt:9u/AaLNauUwATJ/BAziJU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108080, "uuid": "9f441e21-c886-436c-80bc-406acbc69804", "value": 2312704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108080, "uuid": "e8a8774b-bb96-47a2-bcbd-e5af2dd26e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108080, "uuid": "dd1e60c3-00d6-4d30-ac5d-5a6802ce7b42", "value": "8cd641fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b482ef1-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620108170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108170, "uuid": "2bc0dc2d-4b41-4871-93cd-023de0ccf228", "comment": "Malware payload (AgentTesla)", "value": "7359297d925a4ad254b2a6b221229e51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108170, "uuid": "fecf9f09-3a90-4bcd-aa89-1ba857215336", "comment": "Malware payload (AgentTesla)", "value": "e3034bf8e50bc953c8be781a0e950e2c00402cb265f871e82343accb45562fa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108170, "uuid": "c0c77782-995c-44c0-ade5-a7fcea162cf9", "comment": "Malware payload (AgentTesla)", "value": "8d975b9adbdbbdc95d365432d8125bcbe251088d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108170, "uuid": "d05b13ec-4165-4d1a-9016-27f06d2d7231", "comment": "Malware payload (AgentTesla)", "value": "6258f49c456fc79a339a8ef5c8c3c9126e24379f5af213812161f8bc56f3ef0a4885fa86032d7e000f6657195d603845", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108170, "uuid": "1934675b-bada-498e-9acc-e1a56b5b9610", "value": "6AC54B9272A45D45F83E4BF05B35442807F7BD1BDBB1CA4DA884B15A2FB33C18A1EB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108170, "uuid": "1f1c5bf8-eace-4917-a9a8-4429a8782616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108170, "uuid": "8a369c20-7099-41e0-b1cf-e65e19a83d1a", "value": "24576:BjEboWZE1XcdWXvETkutQg7LFxAI6PBDmI:BjGaucvEFtQPFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108170, "uuid": "00834742-f718-4e74-a797-10dce001d65f", "value": 2589696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108170, "uuid": "af64fe86-e044-45fc-a34f-8cb657c7d613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108170, "uuid": "cce7d269-219a-4a4d-ba1b-9fd747475398", "value": "PO_287104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9e1775-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160706, "uuid": "4fcbb9e9-7ce7-4ef1-93df-9b59d318fe85", "comment": "Malware payload", "value": "4a7270577ec8553c67109b285efcc7b5", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160706, "uuid": "9a09f2a6-96ab-4645-bb79-e8b0ddaa4d50", "comment": "Malware payload", "value": "e31b21bd5546bdb983fa117dc4d6f11cc53bb350c0474dde5096247c6d72c252", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160706, "uuid": "4067df91-6253-4636-b3c0-07a76eb37884", "comment": "Malware payload", "value": "ab0969847be15fee6ba4ae2ca1e844dfe00a17e2", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160706, "uuid": "c58dd615-1b1b-4c52-ae0a-c3dd196fa469", "comment": "Malware payload", "value": "2deb265d048e7cf940153501bd6d52b89f49a0f2ec9bc9cd59a1ec7d0e345fc95d6970b758b71218dd70ed8c765d25a6", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160706, "uuid": "de9ad126-c9d6-4b85-9590-5c4572e7b406", "value": "BE31A8B31DC291260312EA92F785582CE729940E9943344CA5EEC94DB1E0F933FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160706, "uuid": "4b65e75c-f44a-4f7c-be0f-ecd52cb1a612", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWSRGQUnSvGPSqBJhZbxIzCyyD++ETTTQ/TvLE39Y:GEXfhexTvrtWQZUSePSiJVAyrLM9z7qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160706, "uuid": "8b44635e-e016-41ce-9793-741ba26bd3c8", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160706, "uuid": "6c4664e7-3bf1-4a74-b8b1-43647f548201", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160706, "uuid": "eef7a680-4bde-4843-8a1e-d61a0ec56606", "value": "CT99TgLf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a3e253-ad05-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620152454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152454, "uuid": "dead9997-cc77-44b6-8ee8-c05cd46f4e64", "comment": "Malware payload (AgentTesla)", "value": "09a25586d2eaf5e8c3a5df5557bad218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152454, "uuid": "d20d240e-98ca-4713-ba59-ec90010a30c0", "comment": "Malware payload (AgentTesla)", "value": "e34725603d4f0177a6fbb66cff9f073a90cd74e6a65c05f1a704ab390906474f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152454, "uuid": "24c02341-60da-466b-a145-eb5083ec6e7c", "comment": "Malware payload (AgentTesla)", "value": "33acc64a84386fc9b14c9b389f7fc7f4fad089e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620152454, "uuid": "9c286a99-14ed-4dd3-8e66-488b36c55bd6", "comment": "Malware payload (AgentTesla)", "value": "b0bb7d118dde531c99d3220a5d3d3f289212def0584fdb01332986336fb9b0f893a1936d7ae54780e82558bd472dccb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152454, "uuid": "66812fc1-d7c5-494e-859a-7438498326db", "value": "8B253B6832681BD1F27B5FB663DA1C0183B92574693EE51D8FA013FE0963F131A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152454, "uuid": "1a7e3f77-fb12-44a0-b955-4bd13f63ef8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152454, "uuid": "702be6b6-40dc-4590-9db7-76e3d6bcf37d", "value": "12288:WTbB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMa46ZSLmFbD:WI6ZS8toLAOAYKOVGNkulYP0tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620152454, "uuid": "d89d2084-9ef8-4914-9fc8-125768abd41c", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620152454, "uuid": "3ea5ef30-22d9-4d43-9284-f0b8ca7bee8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620152454, "uuid": "68de34f9-8dbe-41e2-839a-b1d262debd14", "value": "7XCBqj5HLqHcRlU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad447eb-acab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620113752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620113752, "uuid": "d339e75f-4372-4ace-97cb-d41c394a4608", "comment": "Malware payload (Loki)", "value": "62c0acfc18a80a6132a3e8d8baacc90a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620113752, "uuid": "b7b8b7e3-56c1-4e52-b803-0e45fb493b20", "comment": "Malware payload (Loki)", "value": "e371264367bd07e03b5ccb18c60859ded59c7ec201adc8d3eecc07f6afa0eb0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620113752, "uuid": "fb76c599-3bb6-449d-a02c-928d769b48ea", "comment": "Malware payload (Loki)", "value": "ef70f214c90145dd7d831e6319950410d7273d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620113752, "uuid": "86516e1d-1b92-4500-a34a-c38b394e93df", "comment": "Malware payload (Loki)", "value": "77c5f620c30d0440d89b23d91d6edebe7d2981230cd6b0681fa06ee4fb2bbf119529cfc716dcffd26a60734b3429e459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620113752, "uuid": "e4ae9faa-7098-40db-a9a5-8154774b2c1b", "value": "BE746DB1E3D59CE6D812137C5477AD331227AEAD68B1450E12DE3D397FB738210AAA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620113752, "uuid": "320daa3c-845b-4983-b505-af77d3b8fcb1", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620113752, "uuid": "0f624d03-3d4b-4a5c-9614-3d90c7f1f662", "value": "6144:1PXUDKRpBfseCNcSi0U0rgQAwhtrRLsdv2MXiXEqZx:mDKRDEeCnpUkgtwXryJLSUqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620113752, "uuid": "281bfd6e-f198-4a31-af62-7396966b90cf", "value": 343513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620113752, "uuid": "999f5a9d-2465-4d80-9965-2afb14c62d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620113752, "uuid": "e76b6174-c82d-4675-8b31-9bb53d29a55e", "value": "62c0acfc18a80a6132a3e8d8baacc90a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1112d3b9-acc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620126513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126513, "uuid": "bea6ab62-6660-4674-a19d-4736c65751c1", "comment": "Malware payload (AgentTesla)", "value": "51bd76b0340ea0286f81b1839b52076e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126513, "uuid": "39ab0291-8d0b-404f-96be-9ea4a3ee4f5d", "comment": "Malware payload (AgentTesla)", "value": "e3b64a79c1e0d387898d625a190d782c2ec2c144d6420a3ceba2ffb640c40046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126513, "uuid": "f669a4dd-a7a3-48e0-adca-70b40a6a004b", "comment": "Malware payload (AgentTesla)", "value": "4016ecbec8e165a9ad85e3f50975131e4c81b150", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126513, "uuid": "9b825bbe-fc52-43f9-8fc5-248c37362de4", "comment": "Malware payload (AgentTesla)", "value": "3ce2925585812151bdb3bd5535ac950e58bf4148659fac0577119a9d7cde96935b9860a9811b2f365c8fe65d09147b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126513, "uuid": "aff6b81a-6b4c-462f-868d-ce58ec7c4109", "value": "9405AE52B2C09B58FC7E9B7980351A1093F2BD17FB31DA4CBD5830D949F3AC28262796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126513, "uuid": "a1510330-dc38-4cf0-9173-d0c8adfd2d1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126513, "uuid": "910057dc-253b-4446-8a57-e348f116b588", "value": "12288:INgv/ZmeIIkFOKMtl7CAQj8JqlhFW7wHU0kQIjBGxXYgmqFi:OgvgTPFOKowj04hJU0kv4xog3Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126513, "uuid": "612b21a6-df56-4703-96b6-4acc1fd06417", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126513, "uuid": "f27f06b3-538e-4c05-a371-107c26dece35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126513, "uuid": "4daa0383-77c3-4d76-a5a2-382d37bfe42e", "value": "INDIA ORDERD CH2323ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61061556-ac8d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620100878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100878, "uuid": "2191c98d-2dca-464d-8cf7-51f20a8df5c2", "comment": "Malware payload (Dridex)", "value": "9cd550b440d8180836942fc5cc0f1211", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100878, "uuid": "ea1ec1f6-3193-4e92-bce3-3f4c4b0d14f2", "comment": "Malware payload (Dridex)", "value": "e3b8580c331a1da937a229f7eab7d2e94a0654bd429b934b62578cfa64c793e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100878, "uuid": "454614d7-bf34-470a-a395-96cbfb59c999", "comment": "Malware payload (Dridex)", "value": "65d786e262ef414596a80d4ff54a74e232a0ca59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100878, "uuid": "edc036a4-24ad-432d-99df-09cf25569239", "comment": "Malware payload (Dridex)", "value": "09a123652b535b091beb7612545f0e4b1c59ca44b3b852b3db45cb679b8e43e7c0883f81c50a55196f73c2e91dc59aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100878, "uuid": "25afcac4-defe-4cd1-bdf2-cedcab5737fc", "value": "84F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100878, "uuid": "05b4a889-85c6-45c6-9105-c9b601941c2e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100878, "uuid": "04a84615-6ef9-4edd-b42e-459d6d826af3", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100878, "uuid": "cc0c2da7-bf0c-4bb7-bfd0-c1293e5091a9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100878, "uuid": "8db48383-8480-4250-b39f-42d8b820f98e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100878, "uuid": "70665b47-ba45-4f3c-a2b5-f1eb8e43137a", "value": "9cd550b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5c53ee-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620115260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115260, "uuid": "ec892411-d745-4d36-8597-dcdbdad47ad8", "comment": "Malware payload", "value": "3262e8fe3f51222859d517546aa20d83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115260, "uuid": "25f74dd9-a3f6-432b-9941-d7cfe31cb5da", "comment": "Malware payload", "value": "e3e738aff246098c72814f000210b2b131ac3b1b4c9720205d5175fbd98393ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115260, "uuid": "fc8d5fdd-973d-4c9b-a2ad-37ba0955511c", "comment": "Malware payload", "value": "1c62336a2641eb7b718fc3094787d3f560eb7117", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115260, "uuid": "6b13e888-61f0-4ee0-99ec-b6aae9914f07", "comment": "Malware payload", "value": "0998c5b4aa91c77a558a5c696fe8cf76907472befbfede752e27cdc67b787dd57e17261099e96f6754d2e3fe6660f9ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115260, "uuid": "0e85dd42-7b94-4c58-b2c5-e0d05fbbb17e", "value": "E9E2DB42AC2D2A23C132F8210E1D5D519764FE06395712E39AA63E6AD77DEF10B7DF20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115260, "uuid": "cf5dfcf2-75c8-469a-9831-c17e28ba0e38", "value": "384:sk+MhH+OJJcOrd50f3o+qDcBFUQu0c+hskDVugkO:s5nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115260, "uuid": "b44ba410-0863-4c5c-994f-e482f30ffed4", "value": 33217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115260, "uuid": "96757601-70a2-4661-947a-2b9b2ad03a02", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115260, "uuid": "768bbaa8-d84f-4e55-b462-2c2f530cb9af", "value": "3262e8fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4800dd78-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118875, "uuid": "08061fd6-e66f-401b-b16a-2a9a2f494a29", "comment": "Malware payload (Dridex)", "value": "62f995b2c9f119840dfc37327cd0aca1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118875, "uuid": "822acdfc-f52d-45d7-9430-0cfd9c215f7a", "comment": "Malware payload (Dridex)", "value": "e48d8d205edeefbde4f254d78b3f2c1b9ac9c6c7688ca0d20501a7ab52ef56b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118875, "uuid": "1148c1db-a696-462f-b229-bc3ec46aa199", "comment": "Malware payload (Dridex)", "value": "43a8e13c514df17551f6840cecef7cdfe2c5e87d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118875, "uuid": "48586082-3b1e-4206-abad-f7fa1b163b3b", "comment": "Malware payload (Dridex)", "value": "8427cc82d15e25dde1bcdcc4d1a68e3255a25641d22befe3c646fbe2117f7433eba605311916f042d9d85d20128854c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118875, "uuid": "265b8bba-27f7-46fc-8272-24ef28cd6cd3", "value": "32F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118875, "uuid": "f4bd2cbb-ff35-49c3-a46b-80130fa38596", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118875, "uuid": "4549c517-8d91-4786-9d34-1b56322a21e7", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118875, "uuid": "83fb9ffa-cb38-4d35-aa92-1e9350416201", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118875, "uuid": "ae310f49-36d3-4bac-8c87-72543d556573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118875, "uuid": "ab04a644-30e1-417c-9b03-f798aca480ad", "value": "62f995b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95d4992-acf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620145721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145721, "uuid": "a1a3d7a5-5527-4ef6-8b2c-26d09b7de88e", "comment": "Malware payload", "value": "264c2ede235dc7232d673d4748437969", "object_relation": "md5", "Tag": [ { "name": "#Backdoor", "colour": "#1233B6", "exportable": true, "hide_tag": false }, { "name": "#ICMP", "colour": "#95845B", "exportable": true, "hide_tag": false }, { "name": "#Pingback", "colour": "#932F03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145721, "uuid": "f8cd7cf8-9f00-4d89-9d0b-bc91f182ade4", "comment": "Malware payload", "value": "e50943d9f361830502dcfdb00971cbee76877aa73665245427d817047523667f", "object_relation": "sha256", "Tag": [ { "name": "#Backdoor", "colour": "#1233B6", "exportable": true, "hide_tag": false }, { "name": "#ICMP", "colour": "#95845B", "exportable": true, "hide_tag": false }, { "name": "#Pingback", "colour": "#932F03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145721, "uuid": "1d0fd8ea-8e96-4bb8-bc5f-f7f4a089dad4", "comment": "Malware payload", "value": "0190495d0c3be6c0edbab0d4dbd5a7e122efbb3f", "object_relation": "sha1", "Tag": [ { "name": "#Backdoor", "colour": "#1233B6", "exportable": true, "hide_tag": false }, { "name": "#ICMP", "colour": "#95845B", "exportable": true, "hide_tag": false }, { "name": "#Pingback", "colour": "#932F03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620145721, "uuid": "472b23b4-499b-4c68-999c-2657102ba204", "comment": "Malware payload", "value": "6ad48eece1b426a7c2b49c07df34d7cd5e36cd976ae466868c6488c04d69e49132e43ae9311c752c2c41fee175ce0d90", "object_relation": "sha3-384", "Tag": [ { "name": "#Backdoor", "colour": "#1233B6", "exportable": true, "hide_tag": false }, { "name": "#ICMP", "colour": "#95845B", "exportable": true, "hide_tag": false }, { "name": "#Pingback", "colour": "#932F03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145721, "uuid": "3b0a6bd3-4018-423b-a519-1e3916ae5c26", "value": "0C634C4A67A140F9D803C175C9E3AF72E632B81A17B9934F5B24CB6B5F23790953E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145721, "uuid": "bdf22770-1fa3-449c-85c1-56b16a1d056a", "value": "69a080eb62533e53f1abde958e9fb49d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145721, "uuid": "cabe4f8b-a337-4533-9b05-f5c4e0c8601d", "value": "1536:b8TTUkboM8m64G95k3TdvdNs5Dpqi1d52cI:b8TTLbT36x9AY5r1d53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620145721, "uuid": "45a8dcd1-8808-4959-a895-3c585e102d24", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620145721, "uuid": "13fc5c26-0b29-4990-a884-dde55f344c61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620145721, "uuid": "57f07c1e-863f-4234-a675-26524b400bdc", "value": "#Pingback #Backdoor.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65a8eac-aca0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sazoora)", "timestamp": 1620109262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109262, "uuid": "5639306c-7cbb-441f-8f6e-bcf75ed4f32f", "comment": "Malware payload (Sazoora)", "value": "bb7831b05e13694dc04f60af29a8da21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109262, "uuid": "e1bfaad9-b994-4673-a74e-71c72be7d8bc", "comment": "Malware payload (Sazoora)", "value": "e655b06ea5b0dad25ad463a66bff53789b15763a87ddd17336aab9ebd5b2eb87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109262, "uuid": "dca11a7c-3a37-43db-88c9-713940640deb", "comment": "Malware payload (Sazoora)", "value": "8c9a80c2003075b731139d18a18bf308a62e0210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109262, "uuid": "42d59b43-0c1d-4b8c-9b10-a5616e52d531", "comment": "Malware payload (Sazoora)", "value": "03abf57b7c3dc2230c591d5999de1abad4f8fc3ce18762381b8e73d2cc19a0845d5de3621671af755262585fac5f79b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sazoora", "colour": "#E9BA4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109262, "uuid": "fb4d7f8b-9e05-4fd4-8100-1fd792886fa2", "value": "166533F742229127FA1CC77C67177F3921258653A27DB3923C9E952B2E38216BD02C76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109262, "uuid": "d5c9882a-24bb-46bf-ad35-9c67c9b779ca", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109262, "uuid": "91cd71e3-9609-4419-b797-3fefef31c922", "value": "24576:hJmQ3QWWrDXNmFyC2SadnEHgeJhDIZyHvoUdEdNH4Nh564YI63PJQixes:hqrD9TC2SVACoUe91JxQLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620109262, "uuid": "21fd4863-8256-4527-bc58-28605f28554f", "value": 1510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620109262, "uuid": "36101774-35e3-4cc9-aff3-ff74af739dbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109262, "uuid": "10bab34f-75d8-47db-91d0-6283775476bd", "value": "BB7831B05E13694DC04F60AF29A8DA21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd109f2-ad04-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620151981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151981, "uuid": "04d52408-c630-4a5e-b4e5-d15b0ec89fc6", "comment": "Malware payload", "value": "d3323cf0a9a60af00d2a6e146a569f05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151981, "uuid": "3f656fd3-0e39-4ec1-84fb-bfbd40466b9e", "comment": "Malware payload", "value": "e674a6000143d4a91f4a5b7c5ff1f375fed234951461244e1e9e2dfa6d48d84e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151981, "uuid": "7fc493ec-6cb6-48ce-b3bf-8e20c2ebabab", "comment": "Malware payload", "value": "ef18bf04bca90c10b77898663177ae62619f28d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620151981, "uuid": "735b855c-bb3f-4be4-90ac-a38cfa7cdad1", "comment": "Malware payload", "value": "f0f464096e7f62248997e15cf0ff2ff49eb9430da7dc2fc1c8327791d1b16cbdbe3ca1ea06a0c0a4acd5249784179264", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151981, "uuid": "49f38e1b-3130-431c-b416-ad4591f48f18", "value": "5C83D017D8089612C4B912B89C434EFCAF447D28E9826FDF42664E97B9F56B34C1F19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151981, "uuid": "65d759d3-42e0-477f-81d6-f6b415f6a97a", "value": "1536:OEakAwkVLqfsSTqysABp0dkZqoDZGaQf8hlrXKVy/QPpJeRFroZvuW6xYJBGz6:PPk8ESTX085DRLXKVyYPYromGJBGz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620151981, "uuid": "2cd0b29f-e63f-4830-928f-11b56ca7f9b6", "value": 81949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620151981, "uuid": "f924a9ad-64c7-4b92-8919-fce05c4c7fc7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620151981, "uuid": "dfb6292a-06b6-452d-ac78-7d8d8f200b53", "value": "report_04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be572de-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118881, "uuid": "6b63fc37-6844-449d-924f-c864bbd0a6db", "comment": "Malware payload (Dridex)", "value": "580fc597d8f11bc8899d36f12a6cb14c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118881, "uuid": "9461b794-9037-4b3e-8d57-9843bf2f664d", "comment": "Malware payload (Dridex)", "value": "e6814fbf45b15c26fabd7b62f468f051adeb8d8a47d60cde1331f32eb2a0d6ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118881, "uuid": "f7ed18e8-6348-4599-bdc3-c08de5b661f8", "comment": "Malware payload (Dridex)", "value": "4c29f2c94e194bb05079bbaf7f6c81f2a1044627", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118881, "uuid": "a63cd2fc-358b-497a-b6fc-4f16628512f8", "comment": "Malware payload (Dridex)", "value": "df181f67c29813fc970ce7956c3ed0c42661b94f90a8a8f8d128c1cfe937dcb8c830558b40b07fcf32a3a60f5457af42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118881, "uuid": "62ed67d0-05d6-4a0e-861a-da0599fd5521", "value": "C4F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118881, "uuid": "1dcfd8b3-adbe-4da7-8233-2896d96d1e2d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118881, "uuid": "1308a9b5-d828-4ddc-aa0c-332e840a7d7e", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118881, "uuid": "7dd6ddf5-c4c9-444a-8537-8eb7d6cd33bc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118881, "uuid": "9c1d12d5-6827-401d-bab7-870047aa205f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118881, "uuid": "7e32e18f-1318-45ea-a7c3-2e2683034fc5", "value": "580fc597_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3894a9-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153486, "uuid": "81f38910-ae92-423e-94f5-e9cd3c200bd4", "comment": "Malware payload", "value": "c692ff5047cf101d750e0b013c2bcd9f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153486, "uuid": "1b120f66-7e52-4e53-be0e-4acbff38d487", "comment": "Malware payload", "value": "e72f593689c04b587a8e4eddab6325f7879750d711a8ff1bc4fd7240cddd1619", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153486, "uuid": "54a29417-3955-4a77-b856-793da4fb49d2", "comment": "Malware payload", "value": "730a6625dfc1792c0c72e9eb9190c7efb344e89e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153486, "uuid": "29ba1bde-c3aa-4fe7-ae2d-07ffe6bfabab", "comment": "Malware payload", "value": "f237641be7c0eeb9c60557c384c5be4b7081ca31d8b2097f69dda92fbf9e84e49cc36fbac659e2147aeae1e81537d777", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153486, "uuid": "ed7318e7-e8a5-484e-a544-c5af0bd64ad5", "value": "19A1E850112C1AB17346597AD26FFA52B50ECC1B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153486, "uuid": "ff1fd50d-fcde-4bce-ac66-5be0dae981d2", "value": "96:JHRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JHRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153486, "uuid": "bdb0532c-6b48-41b3-932b-6199e8fcbff2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153486, "uuid": "88c9e65f-b94f-437c-8707-f9b73408548c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153486, "uuid": "bd1c686b-6929-4ff5-9d64-81542fd6e2f0", "value": "e72f593689c04b587a8e4eddab6325f7879750d711a8ff1bc4fd7240cddd1619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc8fafa-ad18-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160785, "uuid": "cd3ec640-624f-42f5-994a-9e1b0cd37b98", "comment": "Malware payload", "value": "5eeddb4731bf3261b5e5267a3b7b10b6", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160785, "uuid": "1820473c-2297-4fa3-a47b-0630cde3c691", "comment": "Malware payload", "value": "e7fe875b568b447cbeec1bbcc2ba119078f8ea90d3251a40ed1f42e17b1876be", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160785, "uuid": "c3713487-2d0f-45a5-9a90-9adad2a81cb5", "comment": "Malware payload", "value": "435f9ca6485c95c6a3c281229dd116a6556ad77a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160785, "uuid": "23c925d1-2dae-45db-88a5-2e48ea176892", "comment": "Malware payload", "value": "a2c19aca914ddc6d05b9e598a509688d16733d0134cf330b490b26379574540e741738ba727448ffff68236d52139d0d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160785, "uuid": "27453931-5f8b-4f6d-9256-94c1128e42b3", "value": "8631A8B31DC281260312E692F745482CE729940E9943344CA1DEC54DB1E0F933FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160785, "uuid": "6e0c7399-1017-4ae3-bda7-46ae0a4a75ad", "value": "48:GEXfhexTvrtWQZUSePSiJVAyrLMjal7qj:RhuTHZUSe7DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160785, "uuid": "399b6076-3035-4534-8a4a-22962f5e3f84", "value": 1702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160785, "uuid": "256109ad-1270-4d8a-95fb-4cbc1168c271", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160785, "uuid": "f5418de5-b64e-447e-b489-027be5775f1a", "value": "RT8yJwnk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e018f7-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620108083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108083, "uuid": "c1755973-7d7d-4fab-8074-8738d26d6933", "comment": "Malware payload (Dridex)", "value": "371ad0eca2962e4c3cf74831e68ab4d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108083, "uuid": "39b80b00-8cff-4d7f-bca8-3d4a2826767e", "comment": "Malware payload (Dridex)", "value": "e8491b6f356dbcdab9df8dd9e1d8475ec90395f12042232b53df8b71f1da516b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108083, "uuid": "61861097-89a4-44f0-a638-1f62b33fb969", "comment": "Malware payload (Dridex)", "value": "c64638010b956e554319ff17cea5c1e521f1dd03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108083, "uuid": "43c3869a-6ef5-4736-8500-501a45369bd3", "comment": "Malware payload (Dridex)", "value": "440c06b75a4d289b9ea52fa1acb8a89a2a0d22b1bc28849c48c1f9112f0c464a76728498700b47317da0618c8166a3da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108083, "uuid": "3b265262-8dc8-43e9-ac6b-b7a2064c5c42", "value": "03F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108083, "uuid": "57d4bd94-a390-4bca-81d9-e62a7f38757c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108083, "uuid": "c18e2d77-44ed-4e27-b227-cddb0b3b7bae", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108083, "uuid": "81157c60-8397-4591-bf1f-2a3f2dca6194", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108083, "uuid": "5a6cc6a6-fd06-4554-916e-be7ef24c3d30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108083, "uuid": "b4256bbf-fb7d-452e-91c0-c322d3ea5b61", "value": "371ad0ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec483114-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115285, "uuid": "0338cf09-9e01-4820-b1c5-9a77b177aba1", "comment": "Malware payload (Dridex)", "value": "28e194455b15e9ccf772ea36febba144", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115285, "uuid": "47b6079d-1aa3-4cea-aaf6-d082cdcfe672", "comment": "Malware payload (Dridex)", "value": "e84ddf5a4b74c95687e8226342f31a45e798a9172699e51d8ff4240dcbd46d4f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115285, "uuid": "59ce2af3-534b-4b59-b522-676938e1d6f0", "comment": "Malware payload (Dridex)", "value": "2b49035ddd2d253233c8af241fee84b208b69ec9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115285, "uuid": "0568f058-b1df-4b12-b2a6-6593664af942", "comment": "Malware payload (Dridex)", "value": "20c68b8230fdda105086c84702e8ba7afbc0b6279395195eea63115597ec7ff7f9db237deb84f19a88d5bfc54844622f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115285, "uuid": "83c95437-ae75-492c-9e94-3d376bfaa204", "value": "5AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115285, "uuid": "60281370-8f1d-4db1-8df5-86b47c9a42fd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115285, "uuid": "98a80409-bb47-4206-b4b2-c252f853dabd", "value": "3072:IWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:I42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115285, "uuid": "ce4cf2b7-a800-4dd5-8b8d-537aa7626b0f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115285, "uuid": "95a64b42-b279-4d26-b143-758eb132b814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115285, "uuid": "caca54e8-8729-4bc0-ad16-258908f28d4e", "value": "28e19445_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da361eca-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620108383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108383, "uuid": "5e6b2f11-d582-4fcc-9ca9-378158278e70", "comment": "Malware payload (AgentTesla)", "value": "f2c76e01130aae8cf5a60f704a298142", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108383, "uuid": "85ad7871-6f0e-47d1-91ff-d228f2b7c86a", "comment": "Malware payload (AgentTesla)", "value": "e8785ac783e08fc75a9ff9874af699975bbb161b54d24b51cc72bdac57a8179d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108383, "uuid": "73e7643d-07f5-47cd-b74e-26796e9afa45", "comment": "Malware payload (AgentTesla)", "value": "9c8c3a71caf5f48a6a4e2b0587c3dfa1ab9f1977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108383, "uuid": "fa34ea92-eb27-4147-bfec-1a1ee8f1ee2d", "comment": "Malware payload (AgentTesla)", "value": "eea191700110ce830e1eebda9002845bf721ae62b6d1dac096c1708dd754e1d0b2f28ef0198b9d81158930a0b87e004d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108383, "uuid": "227a7130-3b28-4892-9341-2da2042299a3", "value": "4CB53A5222A86E45E93E57B44730442C47F6BD17DB72DB9EAC84B4990FB37C08F1A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108383, "uuid": "c92cadd1-a67a-480e-a4c8-a1be005e7f5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108383, "uuid": "a65b4626-9ce3-4d0d-858b-2a4c1c898f3d", "value": "24576:95LL/zK/CZE1XcaFIk+S6GaTitLpVDLRPBDmIK:95LL/uKauuIa8TWLpJHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108383, "uuid": "3e807d54-0b93-4487-b373-6cb1118421b4", "value": 2284544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108383, "uuid": "8f7911fc-a2e0-4cd5-ba6f-0f348e0008be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108383, "uuid": "09e5262d-4eee-4427-b00a-dc2542984c67", "value": "ZO27SUDOV5JjZFy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e40aa6-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620118866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118866, "uuid": "9d4b01a9-f4c2-4406-af46-84eeb740e578", "comment": "Malware payload (AgentTesla)", "value": "6fbb325e733601c4047943ab88e73044", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118866, "uuid": "a2a18010-8cf8-4a9f-8b59-ba631f8c3421", "comment": "Malware payload (AgentTesla)", "value": "e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118866, "uuid": "87524684-3684-49c2-9d77-554c49a25b6f", "comment": "Malware payload (AgentTesla)", "value": "53fc02f829b6e2136b787d3a16d5ec69d58da7bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118866, "uuid": "fcdf141b-5a3e-4b75-b2b5-a86d78f9cbce", "comment": "Malware payload (AgentTesla)", "value": "58a787c7da187f13db8e5ed6256428c493ea028aaa072a77c2bb6a4f49bd3cf39953911c1feddad398fbee3690046263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118866, "uuid": "0a8d96e8-31a8-4e13-a848-e3720e8c5017", "value": "2E15E00877E57BA6D6150E36DA2340C0C3F5E067B232F7DF69E858E59922386875F813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118866, "uuid": "d40515b1-3872-4879-a068-44a4349f622f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118866, "uuid": "bd6a1455-dcc4-461a-9652-9f94d1b4f4ec", "value": "12288:ATpj4IWo86HiBADJuSxRvi1W8rLZ24VUGdXO276OZlcW8f4/K90jnkNTJ5om2lOx:Av72VIZn27FbPjnkdJ2a/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118866, "uuid": "58756be3-766c-4fab-a641-e537ca472895", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118866, "uuid": "bb87fb09-1eca-43a5-a2e3-f6ebb1d3b899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118866, "uuid": "d0230f8d-949f-4925-8bd1-476bde51b8f2", "value": "6fbb325e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beff4aef-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086433, "uuid": "2af8cee1-18eb-4c15-92bb-7d98585c56a7", "comment": "Malware payload (Dridex)", "value": "a670d04dc627778314c79337b600a61f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086433, "uuid": "dff4563b-b5a3-4986-85e8-219503295719", "comment": "Malware payload (Dridex)", "value": "e98b1b9363a2a3c32a25f0b75ec00db1bfcb03c13b21e98d7ffd03d89f1f0e2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086433, "uuid": "1c976391-b851-4c30-8cf6-ea74b4c341f2", "comment": "Malware payload (Dridex)", "value": "9f8236947faf20bba71d6d22996c16f8271de024", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086433, "uuid": "331dfb03-21b9-4814-a6c3-566d87f7aa90", "comment": "Malware payload (Dridex)", "value": "bf1c5edcf0fcc315a27cedd3c450d53b9ec55f029b5fb4c9b2eba61c698bd84cb0b15ceb5875c80352daa7b919bc3a0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086433, "uuid": "62f47b76-0185-43b5-9d62-612f9eedebd3", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086433, "uuid": "7116cb2c-61d3-4e85-b4b9-84ee317d54c8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086433, "uuid": "316883c6-e408-44fa-94d1-40919d910243", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086433, "uuid": "68edfc37-7df4-4171-a081-ee89f43dc49e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086433, "uuid": "dd82f768-a928-4328-bfb0-bc96e4168d66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086433, "uuid": "3f8c320f-bde4-4c78-af16-9f832599e961", "value": "a670d04d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9159dc9d-ac8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620100100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100100, "uuid": "b03c2630-c5d6-4c6d-b7f4-d473efa06278", "comment": "Malware payload", "value": "3874ba5a2e4e803b953be9100aac273a", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100100, "uuid": "532764e9-ac14-49d7-ab04-2e2233b795eb", "comment": "Malware payload", "value": "e98c1efb772a4cd7d691b89beb463eefedf568e8767f4c6153c86b6df343dd99", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100100, "uuid": "d37b29ef-a695-4eb2-b1bb-15369f6f4a64", "comment": "Malware payload", "value": "99b2dd2c4764467192a58e1cf6861cf19699614f", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100100, "uuid": "02c33207-3751-47fa-9764-0d2ccab0ed65", "comment": "Malware payload", "value": "c81189568bb7a178beaccef00b881794eb2889a96a2758b6e725517c99f96dec0bfed92909aeeab2af0544e9659b4b3e", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100100, "uuid": "dc530652-0306-416c-8e8b-6f138f369404", "value": "66527E3C2A6D07ACCF1DB3789B3DD90800DEB65CE39465FA39BC62436F25A179725058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100100, "uuid": "08699302-448d-459a-95be-dcb2d2767ccf", "value": "384:nhS7Rb7GhIBF4PsnQvcZh77lrckzAUuReM3FAyGKz:nhS7R6IBFg/vc37xtzARRRFAEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100100, "uuid": "89b4fb7e-57d7-42b7-91e6-45b1b44e0a6c", "value": 14372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100100, "uuid": "e8ba93b4-ff87-4497-87a3-a4748ff14dec", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100100, "uuid": "549f4f71-4961-49e2-afef-f4833986cb04", "value": "d.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e1cf9c-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620122550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122550, "uuid": "8685f499-12ef-4fa2-970a-7c2d5eec339f", "comment": "Malware payload (TrickBot)", "value": "5f0e0f1511af373e889e1b5d479aa3e7", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122550, "uuid": "9749d85e-324a-4242-8438-1179baaf3aec", "comment": "Malware payload (TrickBot)", "value": "e9c98bff81ba5138f040cef7acbcb56f0f80abcf41ecf4893d4700e308f6427a", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122550, "uuid": "af69d126-39de-4628-9946-1f6d03181b0c", "comment": "Malware payload (TrickBot)", "value": "abd62078830a775b96d2818678284636c4541370", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122550, "uuid": "1da326d4-b1fc-4546-a71f-4503f71d7c99", "comment": "Malware payload (TrickBot)", "value": "24df995fd7427617952d8d569c3bff3169d0b5602d774cd0b9059fe53c78375e7b20ee3d7193e1f6b06f24193e190c29", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122550, "uuid": "a693af6e-c601-4ff5-910e-218ef77da8b5", "value": "A6B4E02A37E1C877C1A754B90EE2DBAA72F6FD204F724A8723943B0D4E316D25935316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122550, "uuid": "1a8ddd9b-4a2e-41cb-8df8-0ad922e0797c", "value": "ea97e91275f65096e0769ec8f21f572b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122550, "uuid": "5bdf9884-5615-4237-b6b6-8674daa626ee", "value": "12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttYwejNh8rGJcx+:ZXQUIsQpMsequrmGw8Nh8if", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122550, "uuid": "124440a4-8082-4611-bdec-271a99850b3e", "value": 533177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122550, "uuid": "b94fee8a-aedc-42a8-b10e-3c203055423d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122550, "uuid": "a23192a3-f4f0-4cca-aac5-ccf9472ab100", "value": "5f0e0f15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9377de1b-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121578, "uuid": "78f39ecf-e484-4f8e-b3f8-03298e598655", "comment": "Malware payload (AgentTesla)", "value": "09f267541d8a72d279aedf972588191b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121578, "uuid": "319a304f-5020-4a12-84e6-46ac1704a313", "comment": "Malware payload (AgentTesla)", "value": "ea10e70c721a8337ab46d0833b7d82447f3c334815ad2ba71618f7cc1c9d9b30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121578, "uuid": "b5044c41-7eca-4b5f-b707-5ee1a5361595", "comment": "Malware payload (AgentTesla)", "value": "696717c34abfd7502707a04901dcf4d2f4eb1c55", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121578, "uuid": "038e83c7-22e3-43f5-bf11-69e348a210af", "comment": "Malware payload (AgentTesla)", "value": "4dce6b366b7bdaab574a7bc94e6f61e70318310d2b856599a68c39d1562ef1e9dae703fd2e268c3a4f841771a9d008df", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121578, "uuid": "594cd3bd-347a-4874-917a-c46f5e05b7be", "value": "F445334FB3445FA61F2B1B65EC2C104E14E84687CC745ECF6610872409AE37DAAEDDA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121578, "uuid": "190d2863-c678-47f6-9456-1c5a639b4df2", "value": "24576:mxWY3X67jrvbSXZ20gR0zp2tMh2m+rSw0d7rukfPcUgqlPX5NpUsbk:VHvE20gqzotMhD/dz0Uhlv5TN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121578, "uuid": "11556a2f-1140-4fc8-b5b5-604260ad1856", "value": 1253796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121578, "uuid": "66bf82c6-7bcf-4462-bae9-a58f220008a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121578, "uuid": "43043d34-7bc3-45ba-86d3-efbd75375b1f", "value": "attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df72352d-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153489, "uuid": "09509df3-314a-4935-b046-c28f5a558d87", "comment": "Malware payload", "value": "023682e12b9387944e187666446f5707", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153489, "uuid": "43ffdffb-b43b-4ff0-bcd8-1458396c63f3", "comment": "Malware payload", "value": "ea2cd16e0e3ee13b84b57d4d92d22bd744bd99f17d1bcdb85f233bce2d8a855d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153489, "uuid": "0fbc197b-e08c-4c7a-bd17-0c0a373f971a", "comment": "Malware payload", "value": "8bc9d3bdc3058728959365c4a226d274fa2ac96c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153489, "uuid": "056ae2cf-2500-41d2-bba5-aedcaea16241", "comment": "Malware payload", "value": "1a3bba69e12a60c3ee55419f94ee9f5981cad8a3fb9da64a964b47e49cba1dd15875156c70ed05e54ac70459404de703", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153489, "uuid": "8438dadc-83ce-44c5-9513-0202424a83b8", "value": "FAA1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153489, "uuid": "04c3fded-1a79-40a3-863e-d82de9366080", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153489, "uuid": "7572184c-a53d-412c-aa31-15a30b1a8cfa", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153489, "uuid": "ab35ce44-3b1d-4df2-bd67-f38d2b1dd32f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153489, "uuid": "f7721356-8cc3-4ecb-abb5-72e661e1739d", "value": "ea2cd16e0e3ee13b84b57d4d92d22bd744bd99f17d1bcdb85f233bce2d8a855d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38457fe-ac9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620108425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108425, "uuid": "f080da84-e152-40c7-8fe3-ad69ec22cc0f", "comment": "Malware payload (TrickBot)", "value": "d202217ae5758e4acda1b7a2d89241ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108425, "uuid": "1052c06e-03c8-4683-9444-64d727ef061a", "comment": "Malware payload (TrickBot)", "value": "ea334250dda64c740a8e06ca7c1717e972a0d524011880c7ff05b1e35a881215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108425, "uuid": "8e792b6a-8a46-40c5-b33a-b78a48d135f2", "comment": "Malware payload (TrickBot)", "value": "8d3d3b0ba95dbf4c794949cd04d34a139ab75e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108425, "uuid": "cc2bfcff-b465-4d44-b6a0-7d0954b23742", "comment": "Malware payload (TrickBot)", "value": "7501875c31e33baba42f7a890dcb71d337dd833249ee4bd68f47010c9d36e7b78be2cef4451f87d52d746a55aabff93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108425, "uuid": "91105d56-94ab-4456-8461-8fd6243c0adc", "value": "B405C01636F0C276C6B391304FB6BB29A2F9E9914F354EC72390864D1D325F15F3A26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108425, "uuid": "69a9b548-5965-49f4-aa5c-e8f7fdc0f36d", "value": "7ed6c4038f63ccaac5c9ff583b7cffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108425, "uuid": "f7f7043a-9ffd-4a51-b78b-5e188bdf0833", "value": "12288:WODzE+jyMiCwdorN0PWpgl0Bdlr4CiZlC7xOhAUNQJ:yUiDdy0CFuAuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108425, "uuid": "1423122d-1742-4e59-9fc1-80513b6e1d86", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108425, "uuid": "ff4b6075-0931-4647-9d90-17913d2a152e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108425, "uuid": "b9a081ff-947e-476e-bfce-c3c3f7dde747", "value": "d202217ae5758e4acda1b7a2d89241ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b06f89-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086437, "uuid": "54f6cff6-bf3a-4e14-be2f-cf1f97f00cae", "comment": "Malware payload (Dridex)", "value": "d65093ed9571d64022e6176347675807", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086437, "uuid": "93445b63-01cc-499b-a57a-089ad4e07e25", "comment": "Malware payload (Dridex)", "value": "eb0621352aa49333b9ce4c4a552dc2bf6697cd76883d567e63b0dd58db36970c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086437, "uuid": "f8fe6169-0e41-4ad1-9e06-3489454957dc", "comment": "Malware payload (Dridex)", "value": "7459a433bd9fa2701bf24053f1e5d76cb369c9a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086437, "uuid": "d5a290d8-b567-4314-830c-c06ba5bcdfd8", "comment": "Malware payload (Dridex)", "value": "5f1dc87e2b05cd8fde0806566f2879340be525164eeac0f08fe5c37b649f378c1bc31163ac895ab418031418c985c99a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086437, "uuid": "80410b76-a71b-4c9a-b67e-d73651045a29", "value": "C2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086437, "uuid": "ffc1034a-0357-449f-9ec3-3fa4d00c693d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086437, "uuid": "f16d75a5-a438-4deb-bfbf-e18e44b2b067", "value": "3072:llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086437, "uuid": "2c767e08-fc7b-4bf0-b802-6766c7393255", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086437, "uuid": "c2bde3f9-84d1-4f86-9aae-0ce015cc52fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086437, "uuid": "59dae143-6d48-4c9c-8001-a7508708c357", "value": "d65093ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4f7582-acf8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620146824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620146824, "uuid": "064cef8a-f1d2-42ca-b46b-b8e1e6e98240", "comment": "Malware payload (Gozi)", "value": "e8eae1a820426a722c7cae54ed5bacd8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620146824, "uuid": "25fbf1e0-11fe-4069-87af-608b0196db30", "comment": "Malware payload (Gozi)", "value": "eb498648d17ad5250ab1f38b190dd2da8bfa8db3ee86054db991db79d15ad5cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620146824, "uuid": "df0f5dfd-c0ca-4328-8cc0-bba6a9d9954e", "comment": "Malware payload (Gozi)", "value": "4d8368f112e0c56e7caccb89724bfdad1999e706", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620146824, "uuid": "c803778b-0c09-4134-9edb-b632712f99c7", "comment": "Malware payload (Gozi)", "value": "3700008ee37c8fb46b0d32fe663292bb4f7dd7d87d9331d451a44c2a761ce31bb9f5ebd9b431d94f3253b1a63359f374", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620146824, "uuid": "97f6cc71-7d72-4a78-a280-2915ed0b9b89", "value": "27B4CE1131D2C135D16247BE482BEAC147FDBE654F351A9B3AC87B8F2E36092A739712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620146824, "uuid": "a48ca59f-ad7b-4ff4-a01c-02692bcad4aa", "value": "61abfa6d76443dd7d018df0c9cf8b0a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620146824, "uuid": "966f61c5-3127-4c9b-9deb-e87c5404b7ea", "value": "12288:CdXaT8lLVrp6I7MsfHqWxSWlNTjGoLYTbgOJpXLH:CdXhp1YCMuFx/jGo0XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620146824, "uuid": "2a473e9a-f071-4cb8-bdbb-fa946b2a0a6d", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620146824, "uuid": "4f7f70cd-5ff9-4387-a044-19ca594c6e1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620146824, "uuid": "a7437116-568f-43b5-86eb-6ae45f833c94", "value": "e8eae1a820426a722c7cae54ed5bacd8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcd95e1-ac85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620097299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097299, "uuid": "cbcdc697-f290-40dd-a360-d96ed8fa2899", "comment": "Malware payload (Dridex)", "value": "1fb298f7062525ef43543f1a34b6b5c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097299, "uuid": "ae035d91-3f3b-4cdb-af81-84a12129b97d", "comment": "Malware payload (Dridex)", "value": "eb9c6a24831eaca033fc7da2c83cb98309bdf21a2149d03713836f82129ed28c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097299, "uuid": "82c6fdf7-e568-4644-a8e3-631439284b94", "comment": "Malware payload (Dridex)", "value": "5feec210339db2962d75ab9b8bf43bf38c6065cf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620097299, "uuid": "f10eb06e-a273-414b-b7ee-4bd4ae989397", "comment": "Malware payload (Dridex)", "value": "0a16fb65ccf96c9a8ad89961a6e0730254dcbd54eefe2e89f8c2056eb64a4a6047161dee91aea72e843a93527da50993", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097299, "uuid": "3bb43602-e99c-4b5b-80b0-34caad9bb922", "value": "2AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097299, "uuid": "46656a15-fc74-433c-9f33-ee1cd3133a3a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097299, "uuid": "aeef81f8-15e4-492b-a129-f9c628f2764d", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620097299, "uuid": "919c1bb6-b162-47fb-b20f-b800306ef463", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620097299, "uuid": "f5db5da8-dbe8-42de-bfe3-81b9c6290f89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620097299, "uuid": "97393cd0-0fd8-443d-93fa-6bd617725a7c", "value": "1fb298f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d03581-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111650, "uuid": "3bd6da8d-33bd-42a0-9a3d-68ad34cc8812", "comment": "Malware payload (Dridex)", "value": "529948e3fe2ebbaa9088ea249802c874", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111650, "uuid": "f3d5e5a3-45f9-4b94-ba01-272da7c74649", "comment": "Malware payload (Dridex)", "value": "ebf93c1dd52a29d28a94adb57ad466a1c0d5e123b69c251fce5ecc7d5b16fb32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111650, "uuid": "c26de998-c847-402f-9a67-100d18507a2f", "comment": "Malware payload (Dridex)", "value": "549afe4dd49300c89544ace670f6c81d2af7a269", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111650, "uuid": "8d92089c-b43f-4a1c-9699-c49587643c55", "comment": "Malware payload (Dridex)", "value": "6ba117f827ce43b39b2c1d2558d3b2967e37b171b16219b4abd1d3ad0ab6d36de450ea246ca48cf06e9b0da51f7997de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111650, "uuid": "ccf642ed-cbff-4300-a099-69a2f2cdc17d", "value": "9AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111650, "uuid": "3df52423-9428-4012-8fa3-e9b52fd0a926", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111650, "uuid": "e94fce96-6e8e-45c4-8282-cdfd6cf837f5", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111650, "uuid": "9006b4e2-c50f-444d-88a6-bd042291d9c4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111650, "uuid": "142cd48c-df30-470f-a894-24bcfedfea7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111650, "uuid": "4f20026c-7483-4a16-9ea7-72d8ffb5e499", "value": "529948e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8738e8b5-aca6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620111679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111679, "uuid": "896f209c-3895-4c3e-a31e-146723b559b4", "comment": "Malware payload (Dridex)", "value": "765d074c3edaef0271ec8f0b17f55d94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111679, "uuid": "b9252961-af48-4582-bd07-0de1842ca71e", "comment": "Malware payload (Dridex)", "value": "ec2e6a1c354f5d9d71567388e313fa8c11659c473c92bd53c4a0fd191889acb2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111679, "uuid": "7893fab3-f57c-4d95-a24c-3f77461c171d", "comment": "Malware payload (Dridex)", "value": "b21cad7905e3dc5eba993724461c633fc84accbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620111679, "uuid": "f427d086-7aa0-45fc-945d-569da78fbe29", "comment": "Malware payload (Dridex)", "value": "9c6653844e54dd0a1d0da99e753cd6f4e902814daac402f3b5c09b9213f605801d7e469f40ee08902ef0d4dff1278cbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111679, "uuid": "c6f49d35-f7c1-49b0-ac5c-bfc0cecba493", "value": "B8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111679, "uuid": "0ab663ce-dc92-42f8-91ea-8c3d58582d09", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111679, "uuid": "6cd60f94-a9ad-4677-88dd-435eeefba2e9", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620111679, "uuid": "d12f9f08-fa71-4d55-8e40-40423c60f34a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620111679, "uuid": "e68d7429-02bb-445b-9e70-6b487d07ad2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620111679, "uuid": "1fdf90f7-e455-47ec-b949-e6480972d808", "value": "765d074c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8744bd5-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (HANTA)", "timestamp": 1620119171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119171, "uuid": "d03983d3-4b97-489d-be53-afc9ab2680af", "comment": "Malware payload (HANTA)", "value": "c40d81f68d8bf39d35f405c579afb018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119171, "uuid": "7bf7072c-036e-4000-bcae-5f3dbf1db8e7", "comment": "Malware payload (HANTA)", "value": "ec63467827962443c26aaf7c00ee709de81b964f98866d6d49cec346572ca84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119171, "uuid": "f59e2325-75c5-48d0-94c3-304b0bf567b2", "comment": "Malware payload (HANTA)", "value": "c20bec2cab3c32404d38e1f7f1c25466ea493ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119171, "uuid": "8bdba1a9-a720-4198-bc9f-4e5c4802e5b4", "comment": "Malware payload (HANTA)", "value": "d909899d9eacab58f9cc910961cc3f82ec38336472c970428bb720e3b422f840b57673ce8d940ae2a01dc385bb19fbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HANTA", "colour": "#E59B6A", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119171, "uuid": "1825531c-26d2-44d7-8c57-576f6b5eba5d", "value": "B305023B516692B2C6982730F4B40F4B766DD2291580726CF04FF2A9DD4E68C5EF87B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119171, "uuid": "49d6a4e9-b890-4fbc-b352-7f95e7c3008c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119171, "uuid": "c7219ce0-34d6-417a-9204-a1ad47d66609", "value": "24576:mD6UweV0clgsVSWwFEN9B+wFrbt3apSIKhr:mmUweyclguIFM7HM89r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119171, "uuid": "dcdd9de3-b02e-445c-8f04-c66f4c7ee6dc", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119171, "uuid": "740d833b-1f86-4142-80cf-58e02bfd482c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119171, "uuid": "85b53ddb-3865-4ea6-8dfd-2ae48cb8c84c", "value": "C40D81F68D8BF39D35F405C579AFB018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9556cf-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118884, "uuid": "ba2343ff-551e-4c84-a72a-8f661df07cf5", "comment": "Malware payload (Dridex)", "value": "a7640ca7b4a48c8a291820e04fc81a9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118884, "uuid": "236f9f1d-bba7-4ced-ad54-bcba2d515923", "comment": "Malware payload (Dridex)", "value": "edf4dc19e4d3df063b1e0fe90b338aee7966d000392bb906a53006acb174900e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118884, "uuid": "d993daf3-1ff2-4e5e-80cc-30ec9093adab", "comment": "Malware payload (Dridex)", "value": "72f8638f3d56dbed9b6d281303b1c52ff2f0449a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118884, "uuid": "ade30c1a-2c2e-411c-b2d8-fc66a22d2c05", "comment": "Malware payload (Dridex)", "value": "634e14c27be2cda347dfa764cfa7ab58a16d4604c8bb0120c988f68009b5468477473c4decc1b1f53f4ec131c3c12e10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118884, "uuid": "f152de33-0b74-4e64-b16d-91f182f0ebd9", "value": "5DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118884, "uuid": "ff88e81e-2b15-4fad-991c-c157d6e019a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118884, "uuid": "b677bba4-b5f3-457e-b432-7572f3b2d030", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118884, "uuid": "0bed5c95-9fcf-4d77-99fe-4c051af2af7f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118884, "uuid": "1f40217b-ed18-491a-8f3c-a50a7b40fb20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118884, "uuid": "d8fa8703-0f62-496d-99cd-ef4044d388d9", "value": "a7640ca7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a89494-ad17-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620160282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160282, "uuid": "a4fe0b80-c4c4-4903-a266-03a75c6f23d3", "comment": "Malware payload", "value": "93e5d84cda3ae2e7c31af986614c1f10", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160282, "uuid": "a064874d-d8c6-46d1-a199-f98d91a5a52b", "comment": "Malware payload", "value": "ef8e06979d6b1ffad61748506908598348d43eb4bac16c325743f490a5fc4ed3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160282, "uuid": "ec8c0bf7-8db2-46c6-b004-71980ccc0816", "comment": "Malware payload", "value": "9947b0dfd3ac9a0f51d5d933084595aed740df2c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620160282, "uuid": "206f5765-17b9-4cca-856a-ea23f43757ab", "comment": "Malware payload", "value": "bff760ccd6d14f316fe5b3756ce7c3c65243d2cca8ee25992a4e79c10318d81824b528fd8a8c9dd9ba4f67000e70ef63", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160282, "uuid": "50f35f55-00fe-477f-a72e-af087da6e257", "value": "4A518409F807D14C99B9236BED978A26FF1B801B95A0100C71EDD3495F3080DA66CF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160282, "uuid": "3ebd6ecf-f566-4d62-8f12-b6dd69466ee3", "value": "48:kxK4jeLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoTX:QShrffvIypvK0elkEYZ857", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620160282, "uuid": "98930c48-73d6-4239-a1e9-f96ca965a9b3", "value": 2963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620160282, "uuid": "7fe7f522-24ec-47a3-8668-85e36737ffa7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620160282, "uuid": "788cec2c-bf7b-4dc4-bc4d-1be6f95107cd", "value": "PTW7N57Y.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9ae40e-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115312, "uuid": "6a58bf47-65eb-4c05-b64f-33c3b06a3f91", "comment": "Malware payload (Dridex)", "value": "9de4df6bd5294d1f7770f8f1754b36a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115312, "uuid": "8f72cb5c-b535-4b1c-950f-970b8d5f74e5", "comment": "Malware payload (Dridex)", "value": "f1128b9146c0ce9c1401feaf1476e52320713d14d02186d8f2b4aff68313707c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115312, "uuid": "89e80b7a-2d8f-438a-9546-528e8f3f453c", "comment": "Malware payload (Dridex)", "value": "aa2ffc277ab627ac8f9987e49432509dc7355fff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115312, "uuid": "10595da7-d92a-4f9e-91d2-f037c2218aa5", "comment": "Malware payload (Dridex)", "value": "b020ca504132e35f137810eabd61d51ecb537aa6df8a1bfbf4e0dc6a23651b0b5cd43b72d5d70229a58d879ee24a5113", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115312, "uuid": "0dbee9db-e13e-42bc-9fd5-1835785a8b8c", "value": "05F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115312, "uuid": "3c5ea306-c494-4d95-a58c-7e06e54d7082", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115312, "uuid": "c6ee9067-46f2-4246-b980-ae01b5058dc9", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115312, "uuid": "2284bf11-236d-4ee8-9723-7fef4d5bc60a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115312, "uuid": "6b087f06-c567-4ac7-a704-57bbd1328473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115312, "uuid": "83d01129-2e31-48c7-b77d-6b0bf1454307", "value": "9de4df6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a173b4-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620093495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093495, "uuid": "6822d8bd-bf67-4e50-95b3-5b3a3dfd1082", "comment": "Malware payload (Formbook)", "value": "01914c12d145f25ecd92eb346ea13c15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093495, "uuid": "d69c69f7-dbc8-41c0-aec7-2e855aa0885b", "comment": "Malware payload (Formbook)", "value": "f13a70ac5752be9d6cd680dce689311d13693d1d71df977729ff61aca27896ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093495, "uuid": "fe06610e-b818-49ac-b8ed-4d1918ef835e", "comment": "Malware payload (Formbook)", "value": "9054f4bfa04d897d8d7686bde3d67e3f9afe9d7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093495, "uuid": "94c6f286-a2e2-4dcc-83b3-4eec215cbd01", "comment": "Malware payload (Formbook)", "value": "70b4330878f30b7d8727aec072a21f0efe62a04cfb994c41420d2b46c45cbd23fc2c5b7cacdc850f1fbf7e13e0de6622", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093495, "uuid": "2063b87c-43e8-4ec2-bcec-08586c1826d1", "value": "4724235BEA2DB554F58FB71D260A58BA2EA702AA3D454D8C1C73C07C180D95FAA1CF2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093495, "uuid": "9721e003-8ad3-4800-9e85-0fb976f67794", "value": "3072:4K2NCLExFG4643wpzdwMXwScfkArKR7FI6AFQRhKo+t6jPBfjQtWdgqAWUyrkiJl:4KTOW6OR5WAhKo+MjPBstVq1rlJOXrzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093495, "uuid": "bf7cc941-19c3-459e-88f7-fdb4e5809f61", "value": 224831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093495, "uuid": "fe581362-124a-45b5-8b0f-e7fd1ff7db5c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093495, "uuid": "1e4a2e05-9390-4e09-bd7a-560b754680c1", "value": "BANK RECEIPT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5f2e31-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122503, "uuid": "cf6f799f-78c2-4976-9f9d-f5d0163df744", "comment": "Malware payload (Dridex)", "value": "1d046e0c812ea1ebeeb6f2cadb486e17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122503, "uuid": "45fcf5c2-efd8-4aa9-8b52-03ea22b8b1a2", "comment": "Malware payload (Dridex)", "value": "f19b4e323f09405dd7f8fb59559e02c57e268baebe87b5a04e3dae3b960d9b87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122503, "uuid": "ca285511-8bd6-4265-bbe3-cf4e964337b5", "comment": "Malware payload (Dridex)", "value": "f5a712889f6d3fd5e42d5e6085e667e820b8633c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122503, "uuid": "eb2657ed-5683-41a7-b3cc-6b2da7d26cc0", "comment": "Malware payload (Dridex)", "value": "98f1942e88ec0af2cb81faa0f2bbb0ae9c75629c8fa18d36aa4a31c2fa963cc91aab26b2391b5efc0ab60994426a134c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122503, "uuid": "6d9ffd86-779e-4323-9838-04c4429d58e6", "value": "A5F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122503, "uuid": "d9e2d816-73c9-4bee-9780-3723e14c6e69", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122503, "uuid": "6219a663-2636-44d6-b83e-c92b1712e77e", "value": "3072:oIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Bc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122503, "uuid": "9564686f-555d-442c-942e-24fc58ad34f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122503, "uuid": "322ebf6e-4038-4d71-9c02-8aefa454d372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122503, "uuid": "deabc8bc-a19f-4c35-b543-5f0a2f0224fb", "value": "1d046e0c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54808542-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620133499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133499, "uuid": "6c39d790-5016-43a7-bf92-c25675a60de9", "comment": "Malware payload (TrickBot)", "value": "dbf959510d307852805901b7e0dd6c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot92", "colour": "#7BC191", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133499, "uuid": "a9a3f1c6-fdf9-40c0-9f17-061cd7cdab76", "comment": "Malware payload (TrickBot)", "value": "f19f135e7f8785f2aa1a6351dcc420194d99b2f69e5323c99b24dcbf6a7ba632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot92", "colour": "#7BC191", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133499, "uuid": "2c75a0c6-b1b1-4d85-a59c-d4db7ce21a26", "comment": "Malware payload (TrickBot)", "value": "2b23fad35eddc44df7eca6ddcc7a904b7e317fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot92", "colour": "#7BC191", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133499, "uuid": "9634db0b-666b-42ed-b8f5-1a0ddf2007c9", "comment": "Malware payload (TrickBot)", "value": "142bdbb4d5b3e887dd21c8ddf4c0eccf7fe24a1492060bc97d538301952d490e96193632d54c40e48a9a5f456b2d05d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot92", "colour": "#7BC191", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133499, "uuid": "b149c1b4-f4c4-49ec-88a0-708ea8d07243", "value": "1F05C01636F0C276C6B391304FB6BB29A2F9E9914F354EC72390864D1D325F15F3A26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133499, "uuid": "ced80088-1bc3-44b8-80db-284e7030a863", "value": "7ed6c4038f63ccaac5c9ff583b7cffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133499, "uuid": "5fe67cea-bce9-4500-83f5-fac2adefe1db", "value": "12288:WODzE+jyMiCwdorN0PWpgl0BWlr4CiZlC7xOhAUNQJ:yUiDdy03FuAuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133499, "uuid": "2dc69d0a-5576-4343-ac09-a5fa18d79624", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133499, "uuid": "855b8c90-c9ea-4aae-929f-c956560df4dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133499, "uuid": "5a77949b-07f8-4bcf-8288-54a7faf73ba1", "value": "dbf959510d307852805901b7e0dd6c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60aa3fa-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620122495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122495, "uuid": "9c2b2d2b-39cc-4f7d-a36f-dd21aad24dc7", "comment": "Malware payload", "value": "f7cb21fce47ead1e21003168d264747f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122495, "uuid": "cea95903-f93a-42c3-b176-327d5596e906", "comment": "Malware payload", "value": "f1fcdebe84f0c5ef9dd341ccdc2ba25cb64ecc868394e1420db64173edd049fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122495, "uuid": "5fb07019-198d-492c-9c77-e0da8b3c75a3", "comment": "Malware payload", "value": "15a62d2ac5db8aebc35e2cc93d118591ad9d8397", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122495, "uuid": "b049a86f-a5ab-4915-a290-a6c3878de424", "comment": "Malware payload", "value": "953d67b820029f34513ce8704249d7cd3dc27111b4d7924da6a9927bb83daa815b337efd01449aa4a7a4e70ad9feeee6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122495, "uuid": "8d8bac67-33c7-4186-b94e-aa068d513454", "value": "75F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122495, "uuid": "4b0daa75-70b5-4e32-8438-65e91bda2a0d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122495, "uuid": "fc8bd393-f77d-4fb9-9bfb-566ddce7e69d", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122495, "uuid": "25b10a31-afd0-4cf6-aba4-8586bc2c4380", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122495, "uuid": "3dd14a63-67d9-42a3-8fbe-497bdd9390e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122495, "uuid": "5f3bb287-54fd-4c7e-8214-979e1054f76e", "value": "f7cb21fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f464051a-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142357, "uuid": "dd1249dc-04c0-481b-9eae-6013a162d85a", "comment": "Malware payload (AgentTesla)", "value": "4e1c019a4ba0f853a071d93bfad3ffaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142357, "uuid": "5c60ba77-3d9e-4ab8-833c-773571cff7d2", "comment": "Malware payload (AgentTesla)", "value": "f22e2e9b137f32fa90dbb3469be393b7bae7d8c5746ba6ec28c1c6bd94005ada", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142357, "uuid": "5e214649-6ce2-4300-9792-9c299043ee3d", "comment": "Malware payload (AgentTesla)", "value": "2113790eb87033ba23136550a16349773237b315", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142357, "uuid": "53b0af83-e57d-4bde-94ff-74bd1d7d7ef0", "comment": "Malware payload (AgentTesla)", "value": "9fd73414aedf4b6e391ffddfe0e61d25cbd5364c8150b5fbb88fe692586742d5a75b780ae25852f56a3046b998b328d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142357, "uuid": "aca57e95-0217-4ebe-8ac6-f5d47c7976ab", "value": "E72549AC325430EDD627CA36A7DE1C1592603175A62B960B872303BD8E1FE53AF349D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142357, "uuid": "0b43841c-912c-441c-af53-dd790cae3133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142357, "uuid": "f6f4c679-f5e7-42cc-a073-6988b097e3a6", "value": "12288:nLoLLoS60/K7yh0/+w8sLCKWZs5TRO6FwoL4IXcUH2TETnmFrVwvmZdP6GM0IRAc:LoLA/+pShRO6F74smVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142357, "uuid": "fa6abdff-f362-452b-b05b-aafa9eaf54ed", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142357, "uuid": "8e4fb575-8bd2-49eb-b766-714c0942c10d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142357, "uuid": "6bf977d0-e027-49c0-ae4f-92634790125a", "value": "4e1c019a4ba0f853a071d93bfad3ffaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13a317d-acba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620120393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120393, "uuid": "d099d277-4450-4201-b6f2-a0c42efb8da0", "comment": "Malware payload (Gozi)", "value": "34f21bceaca8327c54d59c0fa103540d", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120393, "uuid": "ea51ff10-8ada-4411-ba79-adbe65608a8c", "comment": "Malware payload (Gozi)", "value": "f2b3f79ade40513d7a6c736864b524c885eeb24934b3fd1ee71c38e666b45f18", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120393, "uuid": "0a284ef2-79b8-4c0f-84ae-c555df6ee3f9", "comment": "Malware payload (Gozi)", "value": "c2d38256cd16f2d6a2f9fdd4128d14378fd125ac", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120393, "uuid": "1640e27e-bfb7-4ee4-99e1-58b463ed62c9", "comment": "Malware payload (Gozi)", "value": "732da36a1ab9a1eb4ce666851705281f5f4c951a7141b477774a21a95f0bd7d8e6ab94cc96da51721b9c9366a4d8f9ff", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120393, "uuid": "f5c69150-268e-4aee-b8d4-81d67e1f33e1", "value": "D3245B6AA2E40695E9BBDAB5CD53C61BE7F334441B28D70F03B0CA656F57321F228352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120393, "uuid": "8514e11e-0797-431b-bd66-7286d70bc1bf", "value": "3072:fWLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYPr9fGWg+Bm5kf7DLm:4qO/rsPHN7Q6l7Bz9zhvNJYPrg1+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120393, "uuid": "4a4c7878-6f8b-4f5f-92da-ee1acb61fd5f", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120393, "uuid": "0fa93a1d-628f-4e0b-9c45-6f1b65a6cafa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120393, "uuid": "b363fcc0-472c-47ec-b7da-852ceeb31599", "value": "206bfb50000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e4fc43-aced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141963, "uuid": "9479d190-431d-4f8f-b240-79aafb5b6d96", "comment": "Malware payload (AgentTesla)", "value": "37bdeb7dd32f6bf7ef310ca575f4236d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141963, "uuid": "f9956950-f6c1-44ab-8d64-93cab1056e68", "comment": "Malware payload (AgentTesla)", "value": "f3299da1eb5ad076c503fa440ba15e4bb418fa17b5cf0315620eaecf3b618de5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141963, "uuid": "35f8d388-aca3-4015-833c-cd17f4c21081", "comment": "Malware payload (AgentTesla)", "value": "fbd39cda4384a9bef901bb74afe2e42240fde4b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141963, "uuid": "bddf1432-6538-48a3-937c-2b90a6dc5cf3", "comment": "Malware payload (AgentTesla)", "value": "509606a9dfbcd27cea262b459e1920134e0c655f3a8d67cc44442f1affe61a0a23a7c230bd3f27b61e7b5d2821771abb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141963, "uuid": "183ebb36-8edd-466d-8afd-3d572c5446de", "value": "6EE4BD277F689652E4BE5F381835031067F1F159E321C32F696860ADDDE2AC18E637E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141963, "uuid": "2c343fc9-eaa8-4c76-822e-a059a1c2a4a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141963, "uuid": "305aa907-2f77-4bd7-86f6-7faf54620654", "value": "12288:+rWDxn/yDKMrnc2nOAXLW80lxMk5UJrVn5YUQUJZ6miBu40BcbxKVnd0i18z/uJn:+tl0lxwVn5YUfomIbx+nd0iW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141963, "uuid": "1f37adab-a1eb-418a-88a1-d8ff0030ac4c", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141963, "uuid": "35e56cd1-8eb7-4094-8a79-c8b0cb172c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141963, "uuid": "7d5c6a11-54d9-485f-9b6b-2109eb770bc1", "value": "Ei76uYS4ahe752B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd13cd1-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Ponmocup)", "timestamp": 1620090080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090080, "uuid": "0369cbee-e84d-49f4-88f3-d744ab509295", "comment": "Malware payload (Ponmocup)", "value": "f1a1da0986c1226dc965ecfde27dabd1", "object_relation": "md5", "Tag": [ { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090080, "uuid": "fb65143d-7de1-494d-8c6b-e8a4f0f48a29", "comment": "Malware payload (Ponmocup)", "value": "f32e0d2237690d60e860c3116e43d3057b6243d4f67468f01c0fddd6b513678e", "object_relation": "sha256", "Tag": [ { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090080, "uuid": "c93237c9-e39e-4913-9209-0e4ada297325", "comment": "Malware payload (Ponmocup)", "value": "97f3b7f5a6c6639ee2e38e116afa0078dc08b026", "object_relation": "sha1", "Tag": [ { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090080, "uuid": "50d00d4f-5a5c-4db5-af00-e3f9cb4a43d0", "comment": "Malware payload (Ponmocup)", "value": "e42061ee1d0a15401a486bd393cead20d498f6ec902239cbf3bbf05b6d2822c622600662a3af4282cde5022a845eebf6", "object_relation": "sha3-384", "Tag": [ { "name": "Ponmocup", "colour": "#4CDDBE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090080, "uuid": "3870298c-1ccf-4205-88dd-efbbf65f8517", "value": "E9A302A5A215494CE25B393418A79BC126309FD2E3B366CEF2285B7614B9D3E6817F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090080, "uuid": "aa3170a7-4463-44dc-bb76-e7a8e2adc332", "value": "4cacad1da8b3e4a083875a2f70cf172a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090080, "uuid": "4fdb902f-070f-4b7f-a7cf-c24bc73605db", "value": "1536:2IP/gR0GYNrv3FQLc6erCVzcSbi6tEeS4uuTSiPuxu4dtUK:RPIOGKrv3FQL9madblnuuGy+u4LUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090080, "uuid": "28d5040f-98f4-40a3-bc88-7e571cf676eb", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090080, "uuid": "61a84e85-5a92-4730-876b-5889d55c3d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090080, "uuid": "0286654a-e73e-4fce-881c-0114cea9d8cf", "value": "f1a1da09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2c7d0c-ac8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620100061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100061, "uuid": "9b70e222-24a5-4506-99bb-0c0a03ccabe1", "comment": "Malware payload", "value": "64dd92f97bf7b9752f124ed0b75762c5", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100061, "uuid": "ced54324-12db-4699-b332-14c56a871a69", "comment": "Malware payload", "value": "f3be6c1152adb1403f3109682e4a8654a5743d22f40defb031d49217035b9b7e", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100061, "uuid": "286d5f23-0de5-443e-8294-dea62c5149b2", "comment": "Malware payload", "value": "1994362c0efa588665790293df52119fee1a56a4", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620100061, "uuid": "ee256438-1292-4487-a5fd-30b6c42fa611", "comment": "Malware payload", "value": "9aee8cf7efc48c7823bc1704653302b841774c65c178fb21c5399ecf4c8064801d186fbc67487812a7f653b1af9921e0", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100061, "uuid": "03fcc9a1-4a7c-47bc-a8e6-1aa4160b98f2", "value": "58327DAC8BA50E7DDF59F2B4C376BE2C02CD7A7073916276B92C62735B1623B1B05421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100061, "uuid": "d07c536d-7710-45c3-82ce-4d69409ca8ea", "value": "192:Ku2U7LOB0ER9BeiKhdj4qoC7892fLmCcyY4sbmwv6Hqk5x7AVEBJCY2x89:oU7LOB0ER9shdj4q1o4fLmCcyL6vi7G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620100061, "uuid": "d9251aa4-a6ad-4367-9bfa-9ba404b7f486", "value": 11307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620100061, "uuid": "804b1d67-d433-47bd-9663-add80ba3e374", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620100061, "uuid": "71de1ea3-dcb9-4ce7-954a-318095923093", "value": "ew.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7074117-acb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620119598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119598, "uuid": "b1bc5a79-bfe0-402b-98ba-96a5adb645a0", "comment": "Malware payload", "value": "ed2cca37dd060c89cdcb9823e0b7be02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119598, "uuid": "f0739f77-926b-4d75-b031-44ae02328f7a", "comment": "Malware payload", "value": "f3d5013578835436d8cc1f82b7dcfd44e18737535f54fadcb4ea5ad18d8aee0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119598, "uuid": "bbd8319e-e673-4e78-8424-bd8c60349d90", "comment": "Malware payload", "value": "a779843a8f713e34c5be29fe4246e56b1d6b40c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620119598, "uuid": "9de75248-e84c-48b9-aefb-77b569d7980d", "comment": "Malware payload", "value": "7b3a9b76cd9a4a145a2219a73725f72818d2c32fffd298962697acc7879218e094ad4f966225981e7cc7a875152598bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119598, "uuid": "ed67435f-1923-41de-bcda-0c0ab9a40211", "value": "84063362B3F6D1B1D8171030ECB9D6319679FD310B915E8AFFE05A6E7EB4092832A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119598, "uuid": "4efff767-3282-4147-971f-b0a58dae6a30", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119598, "uuid": "5681f9e8-3b7f-45ed-8498-0d32b5637ab8", "value": "98304:EF+WVtifrnekQTYTBT5t+md9cC1dbTT21TX0CYWwSdY:fKASUlT5t+md+i1TT6TkCYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620119598, "uuid": "45224e87-25ed-457c-a521-cd9e442ef2f9", "value": 3722950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620119598, "uuid": "687f2f1b-4c38-488f-aa2a-072068486745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620119598, "uuid": "098f35f7-3c3f-431b-b143-b91ca87af5af", "value": "sms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed8f2cd-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093653, "uuid": "41541467-dabe-4725-87fc-c52ab8668b7d", "comment": "Malware payload (Dridex)", "value": "48d341e6a2d1b4dab8d293eb932d6002", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093653, "uuid": "651e1ca9-7e74-4a61-9677-0e8011d65aa7", "comment": "Malware payload (Dridex)", "value": "f3f33641b72ec44821d9d8ad0a23cf72241f7614552be774e6d5988e4b378fcc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093653, "uuid": "6d033274-de1c-45eb-9291-acb92f84513e", "comment": "Malware payload (Dridex)", "value": "2c5f8a5af4951e80e2d9628421d09f6e4b4cd459", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093653, "uuid": "6b1a2091-a232-4106-b75b-5760ba5ce837", "comment": "Malware payload (Dridex)", "value": "847648bff9feda76b1be4221a9cf1c570f72b9c63aa64f963b560a2d5877aa77d376ad01a5a8df47dc0d57265c96915e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093653, "uuid": "72799948-28db-4d5d-8213-c44be31a424a", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093653, "uuid": "0edf8959-efa0-42de-bb1a-a3aa7c3ba0ad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093653, "uuid": "24afe13c-604b-4805-b070-5199f2a46d4a", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093653, "uuid": "40bc521a-0992-451c-8428-62917a1e482e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093653, "uuid": "f482184b-a61e-42a6-a6ab-23a19ef8d19c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093653, "uuid": "cd2ec00b-81ee-4a54-8baf-f06fb3656302", "value": "48d341e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1c8fd4-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620093647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093647, "uuid": "ff48a5df-5c09-4d26-808f-e304646a3355", "comment": "Malware payload (Dridex)", "value": "d0f70695b8d02288264bb428aab3b23c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093647, "uuid": "31f0da16-0717-409b-9f15-5aaf1dc30359", "comment": "Malware payload (Dridex)", "value": "f44af0b364f060da7201e14c9f51dff2912ab61e1204591ad7fcb15bae14ff40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093647, "uuid": "af701fe0-4760-40c8-b5cc-80f04abcdb7f", "comment": "Malware payload (Dridex)", "value": "96121303c8500cb0fbe1a22949c8dd8eb0a1f5a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093647, "uuid": "02099f07-8f69-4553-a6a2-314de6fa1b87", "comment": "Malware payload (Dridex)", "value": "7de1906cf39022003fb0bddefdb546a1175a63fa1ede3b133158ae383a49aa75d9f9618f14603f1f7250145cf2b71169", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093647, "uuid": "306872cf-bf6e-4e47-906e-4b42dd832ca0", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093647, "uuid": "0411320e-4c1d-4052-a401-2dec8b3586c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093647, "uuid": "a9266206-6d3f-4c44-a086-065e992d79ce", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093647, "uuid": "067ea1b0-c430-4d21-a02a-2d2754b2c29f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093647, "uuid": "80f2126e-4332-47bc-b3d8-3e33251e0e18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093647, "uuid": "9d5f99df-7228-4264-a1b4-9b1f0f8b5cef", "value": "d0f70695_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b726bf58-acc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620124645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124645, "uuid": "3b0d2df3-465c-492e-90a2-22e4d3c07c6b", "comment": "Malware payload (AgentTesla)", "value": "7971e41f55f726e968de7da1fb7d8522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124645, "uuid": "f99a2cc4-0342-407c-b34f-b324be7cdfea", "comment": "Malware payload (AgentTesla)", "value": "f532dc9acc4acaa1d47406b8149d9092470ed263b168b3a911887fc71eac0317", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124645, "uuid": "f1739760-ef93-4d85-bbae-b364757b6b08", "comment": "Malware payload (AgentTesla)", "value": "6a439a6b92669b89dd399987b8c987620c7ef91d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620124645, "uuid": "162f4b44-db35-4abf-a406-1613eb14d808", "comment": "Malware payload (AgentTesla)", "value": "e5ed474080d6d1be88b25d6e3eff6d2b0647dc5c14010b4c207e78b6982314099e4d14c2732e95a8253ad8731601b78b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124645, "uuid": "cb341946-203d-4cb1-9727-66a634ff42e3", "value": "9CE4D0322244CA6FD77D20F8C032F74142F5C5493725E7893DA220E96EC5BE9A761B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124645, "uuid": "250a22a6-1388-4371-9704-869dead270ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124645, "uuid": "aa009a0d-88ab-4eb4-bb8d-e9570772cb8e", "value": "12288:zlqp8jcBFaKMsfpFp/bW3W3zKn7pnuvl4LHt8qh34BMCJlFzBy:zlqunKLfZ/Knn7puvlkHj37z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620124645, "uuid": "3ef12196-e2a5-4f14-a031-551528bf5d1f", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620124645, "uuid": "f87ebba0-fe8d-4c9f-adbe-4ba9a88e6f4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620124645, "uuid": "a797ca25-201e-4522-8bda-0961deb8ae7c", "value": "F\u0130YAT TEKL\u0130F\u0130 VE TEKL\u0130F \u0130STE_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3aa342-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115286, "uuid": "5b0e7c93-6849-410f-818b-8fc53ab658d2", "comment": "Malware payload (Dridex)", "value": "1bf8613a5f8db6cd5850125453ca5296", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115286, "uuid": "9a28474c-9721-4d5f-a43f-06564d8823e9", "comment": "Malware payload (Dridex)", "value": "f5ba0e2ad2d9679928d4f660817bdbce4d5bf045bf03f296357ee12f038d849c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115286, "uuid": "63058050-3495-4d3e-b78b-f64169a10a10", "comment": "Malware payload (Dridex)", "value": "72878c24543ee22d4fe3927774a22cc5a231641c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115286, "uuid": "aba5a419-b01f-4033-a054-e8ed37dc695b", "comment": "Malware payload (Dridex)", "value": "04e459033f5d7342b5748c84794a8dca78bc478d110c9dd9532d56d5602b7f13a9e61319726268de1b7c87ed6bbaa34a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115286, "uuid": "60ea04b4-a96e-4417-bfd1-e0792ecdd71a", "value": "5BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115286, "uuid": "2df792d2-460a-4a19-8a0f-f4de20d38c7f", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115286, "uuid": "c80e95e2-2611-4693-bc89-0158c0a6b49f", "value": "3072:YA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Y3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115286, "uuid": "1f9a45f9-5b16-49bb-9dd2-44c1d4dc0758", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115286, "uuid": "204104b9-5b03-49d3-bd16-4cfd2d97adbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115286, "uuid": "8eccaf2b-76ae-43b0-9d32-f0d13461782a", "value": "1bf8613a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04410480-acaf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115325, "uuid": "265b551c-e818-4a3d-be43-139e4bf6f699", "comment": "Malware payload (Dridex)", "value": "14b6282e3105632ead35127989471a1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115325, "uuid": "ce2cb428-b833-4894-940b-85c834056e8c", "comment": "Malware payload (Dridex)", "value": "f67d29966da46c8c5593dda4a4e2df956f520e5fb240f924f2aa2c24fd628ca9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115325, "uuid": "bc4e0553-c5d8-4d99-8202-4ffa07d35dff", "comment": "Malware payload (Dridex)", "value": "b20e21bfa1591ec451c128ac0c8b4a75e507d1a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115325, "uuid": "00aa27f8-3652-429a-af0b-74135b3c8161", "comment": "Malware payload (Dridex)", "value": "ec2b782815e72afa9ab126926cdc5a8271a3754a8c802a3d47565b764907b0c939edd83a0a618c382e37f792328c9445", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115325, "uuid": "748e5a99-11a7-4e2b-94ef-66e6fc1d7f4d", "value": "E8F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115325, "uuid": "59c93871-4811-439e-bdb2-f6662fd5964c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115325, "uuid": "637556ab-21a5-426e-9717-900a697f3811", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115325, "uuid": "19201b42-31f3-4e03-92ae-b89ddfbf9f25", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115325, "uuid": "f3ad74b5-1a60-4dd5-87a3-2b4dbb181977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115325, "uuid": "5a06c917-5b09-42f4-951b-746a222c0c17", "value": "14b6282e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aba2d1-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126056, "uuid": "50a08fd8-acad-4e66-a71e-d07c1c1ef467", "comment": "Malware payload (Dridex)", "value": "ef2ccb56d5bea3a4df6bc0c0b587d05a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126056, "uuid": "54075852-1e6c-4e6a-80bf-42ff2ed3c95e", "comment": "Malware payload (Dridex)", "value": "f6dda85d9904639f395aff555476201a711642fe84851665175878e517e23b3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126056, "uuid": "c8f3edc6-8437-4d83-a500-60a9be68c454", "comment": "Malware payload (Dridex)", "value": "60ef7ad4263102bfa7c148bc4058746332df4ebe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126056, "uuid": "b52563ab-78e2-452d-98fc-f2b29de6a7f5", "comment": "Malware payload (Dridex)", "value": "6fc9f50b60c899200d36a03d80b0bae69ac02afb71091c90533e32ff489b8fd4e850cafa68d0fea183344e1c28994fe4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126056, "uuid": "58bf75a9-beaa-401c-829c-bab9b35a182e", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126056, "uuid": "7a9b49ff-c7e5-4569-a762-0f540bcc5fab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126056, "uuid": "3e4f0793-1101-4537-8d7f-f6dafd538455", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126056, "uuid": "7f3d1580-d0ed-49b7-aa3b-597407852133", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126056, "uuid": "ca53d60a-70fa-41f3-bce1-765d10f95bc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126056, "uuid": "8e45b7ef-4288-4784-a79f-04a7b1a223c7", "value": "ef2ccb56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facacfe6-acc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126047, "uuid": "07878d5c-916f-4a07-90f2-1432d7abfbf3", "comment": "Malware payload (Dridex)", "value": "33075048e282cabb3d333b0382664477", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126047, "uuid": "bf72f460-7d75-43fe-b860-cb07dcdac9d2", "comment": "Malware payload (Dridex)", "value": "f6f2dfa8faf147349af8e2e3f4e51537143922d6e2e61226a5d3f35235352d72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126047, "uuid": "988a4528-0f10-48b7-b873-04e96c8b7191", "comment": "Malware payload (Dridex)", "value": "db09152b336365e7596b9ee72733abb1c796d346", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126047, "uuid": "7be2e161-3e3f-41a0-8a9c-425fc53f8d77", "comment": "Malware payload (Dridex)", "value": "669389b3328c03da2bbe9d4dc88a76a049a79a2c1e7d5f2e54f217d68f22c9cca147bf3e5599c9080f7b0a939383592a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126047, "uuid": "5a8fa751-dbbf-4b90-acd4-635e198222ba", "value": "04F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126047, "uuid": "3bb4b969-640e-4ad4-b340-84fc9e0c49e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126047, "uuid": "94c5a3a4-c111-4149-ab41-8b6a27dcb0b0", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126047, "uuid": "03170e4c-a64d-4224-ae3f-8273143f74c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126047, "uuid": "81f274f6-db7e-4489-9ad6-43522a28df56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126047, "uuid": "d142d953-0e64-4bfe-ac95-5b558a2df9e8", "value": "33075048_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c14e73-aca0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620109268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109268, "uuid": "1c5ab417-2277-44a8-ae30-1f27af206a35", "comment": "Malware payload (Loki)", "value": "57a122e7744772b6b3c8c4d153882eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109268, "uuid": "3bbf5f5f-fc5d-48c3-8869-6892dc14aa80", "comment": "Malware payload (Loki)", "value": "f7b3e95c6a5da0562c321e46442d654d2caec7ab506cc7cf440356f235aed9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109268, "uuid": "fdc445b8-9f2e-4528-accb-d749174e69ec", "comment": "Malware payload (Loki)", "value": "d0e4102d5f05983e11c81787a81f051c906b4fbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620109268, "uuid": "8bca5596-a4a3-43eb-813c-e2bdbf86211c", "comment": "Malware payload (Loki)", "value": "49745fdcf5ba02ad6873bcf2b7b94f503a60c465c1027b0af1235879bbcf553d5a1b23677e60b9c0205f8fcb4d5b221c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109268, "uuid": "a5d916d6-4c07-4aeb-ab98-77fca3965817", "value": "66D54A12A654AE24FA7D1733CBB5482087FAFC01DFB2D55E58D478DD1EB37A08A1A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109268, "uuid": "c7fb1e27-932e-4f96-acee-70c52d8697d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109268, "uuid": "008fbbd3-ff5b-445c-b130-e55c129f5998", "value": "49152:mTrv+27Op9IGlYCrWYxSK00BO/dGaaeqR:mTrv+zp9vlvKYxS538eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620109268, "uuid": "5bf8996b-8ea2-41a3-a772-a3f9635533da", "value": 2886656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620109268, "uuid": "21c67c15-91c0-45ef-8590-8188e476faad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620109268, "uuid": "32e1607b-9d12-4e30-81b6-35329b716124", "value": "B3ljmKLkcGN9GRZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cce605-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620142493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142493, "uuid": "ddfaca7e-caf8-417e-b2b5-628824673691", "comment": "Malware payload (Quakbot)", "value": "19ad92f20025aa19a6947fa78fd142c1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142493, "uuid": "e0e9f479-9d11-4a34-bfa4-f2408abb4b0d", "comment": "Malware payload (Quakbot)", "value": "f7bb7538509e6652197d8877aceac43f6370b763a323cb3990ab5991124b1941", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142493, "uuid": "e67600c9-7ab5-43ca-9d74-2d25b353e6ee", "comment": "Malware payload (Quakbot)", "value": "70b88be09827de5d40a03bca4ac49e2a7de69ea9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142493, "uuid": "2c492daa-c1b0-4a87-a620-6c090fe832ad", "comment": "Malware payload (Quakbot)", "value": "8ba72f84c1cc7a8078da5fad0e4f5b766f3effa7e011c87c6a6e33bd32dcb50c24e1887feafd451eee4af8772a58152c", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142493, "uuid": "08f40e04-0146-4d70-a818-8978d32a5de1", "value": "39B3AD0B8C088AC3C12DA2FE7D0B4DF96E0E5718D8966FEF05211F897A561631E4F46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142493, "uuid": "fcd90a70-890d-4936-9e3a-31764ce5361f", "value": "3072:bkYvKINbjvw548LMb/oqKO8NnS8+60Kc+ECx:gAbT648LM7D98Np+EdECx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142493, "uuid": "ccd7c3ba-dc43-4f1a-92f7-cb369fb78c0f", "value": 116934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142493, "uuid": "301e3817-a739-4718-aef6-45b06b6a6911", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142493, "uuid": "d8f08c82-66ee-4f28-a2d5-17db894672e2", "value": "Outstanding-Debt-71778964-05042021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3fd2e7-acb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620118887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118887, "uuid": "bc0e6eee-76f4-445b-8507-2ea66b28e084", "comment": "Malware payload (Dridex)", "value": "699cb9372bfd32e2120be48067a8208e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118887, "uuid": "6f813624-f6d7-4def-acc4-7396574e1454", "comment": "Malware payload (Dridex)", "value": "f8d8f30b52631fa4521d502f0f57a6bf921a908769d8a577afbf9284bb0f1c67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118887, "uuid": "f709876f-ca1d-4957-a4d4-e6064b3d350b", "comment": "Malware payload (Dridex)", "value": "c4ed411e20ccb6cc5265e8040b3ec2c8bf0cb551", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620118887, "uuid": "9a7bdd4b-29fc-4139-bc59-59893bb6d55e", "comment": "Malware payload (Dridex)", "value": "b00d08fcfa9620bdd4d7a323c4757d6a9f4a1fa8917fa61b50852d3454bcbff1deb54d97c4c8820a776005122951e1e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118887, "uuid": "30157e1a-bc1c-4a62-b8fb-9295b5c82723", "value": "A9F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118887, "uuid": "86029ad3-e1b1-43d6-b37a-d2a00f5fa99d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118887, "uuid": "6e580212-590b-4f89-8e3f-5c2ee57e7dfe", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620118887, "uuid": "fafb5d34-e91d-4c90-ae55-4db06a2711ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620118887, "uuid": "61cd6ce5-d057-443b-94ee-ed1d0be71661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620118887, "uuid": "b5572463-0447-4815-806e-7c4808897863", "value": "699cb937_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d939f00c-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620115253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115253, "uuid": "1e77720f-fd88-4745-a33e-26eca70464d1", "comment": "Malware payload", "value": "bec9e1c85fa2b1c1f1cd2ea909cb443e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115253, "uuid": "015fdbef-a4dd-4d80-a0c8-c9cd09b64820", "comment": "Malware payload", "value": "f92d9046e82bc946e20b5f43acbb8456e4a34d60be94ced4d26485f70ce3f8ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115253, "uuid": "b6d4960f-68eb-41ce-a584-dced0ef4ff16", "comment": "Malware payload", "value": "c71e6359521f12ecd2293f989a9bde296df7afdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115253, "uuid": "e8f66557-98da-410d-b859-dd9e800960f0", "comment": "Malware payload", "value": "2fb97b32dcac5b4200c324251e11391b20ee8ae9bd9776685c7f1cebfb2ef055806368f17c05f2e04c48398a039331bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115253, "uuid": "c2fa12b5-df73-490e-b4af-cb638f5b45d7", "value": "C192E05B006ECF4745441FE6971841EE3F48476C843628E9AEABF0772A6FD3E421AB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115253, "uuid": "ce5cdb54-c068-4719-9af4-bc965feff2bc", "value": "384:x2KqXtczvrCwpaXqVED+WEld9JBHRI1GaPDE1qdjXaiHwNk8yD:gJ9IvrtweE/KBHsW1qNaiik8yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115253, "uuid": "4ddba3f4-8230-4407-a0d2-497915043f61", "value": 19991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115253, "uuid": "a9795d56-a587-4c25-b6e3-dd1c7984eca1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115253, "uuid": "5063ee53-a523-481a-acf8-d5b99b6056cc", "value": "bec9e1c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3352f10-ace7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620139644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620139644, "uuid": "a037c3ba-674b-4ec9-a14e-ea65eff1cba4", "comment": "Malware payload", "value": "b5e5b774f5228a39349ce7562d885f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620139644, "uuid": "f6ac12d1-2e7d-410b-80ff-0ce54affc7de", "comment": "Malware payload", "value": "fa1462d4e6fce1dbb5c4813cd596555e3a583face9932e173af9913a421fb428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620139644, "uuid": "77b9c825-148b-4ef8-906d-ff068a844d96", "comment": "Malware payload", "value": "cb4525243f5489c17bd010445efc80a1e38afc76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620139644, "uuid": "d4e13478-95f6-45e0-8d06-fecb58dbdcba", "comment": "Malware payload", "value": "d1f9080c52ab1ff0aa937e28cd4713f269cd4431533d2e50ab8541c49a589369454f967c2a94a5f6994ffad7bd36ddea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620139644, "uuid": "2eb51fc7-c43c-439b-a630-fe712acd3869", "value": "A7460202F782C4B2E11705704976573EEA31DE765B218E83B7A4FE696D333E1522B21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620139644, "uuid": "11a64532-a29c-4706-8923-bc9775ca491a", "value": "9306ecff6336b7eb91842185ceec62b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620139644, "uuid": "264b08e3-97fa-4398-9afc-6571c12be7c1", "value": "98304:SilGHlG4hCogJBAUZLGa6gayGklp45Qktpfu0eT+cXJwF5FLILc3zugm:ClDgJVR9lRUVy9JmdbjuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620139644, "uuid": "d6cb48a4-7706-4ae2-b8de-3a88a4cd3419", "value": 5725232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620139644, "uuid": "99ebe04a-3ac1-4d65-b7ab-eef1aee6b19f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620139644, "uuid": "0d2c0fdc-a4a5-4e7b-8408-51d3c037023a", "value": "XMToolBox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e36c58-ad0e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620156323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156323, "uuid": "c2971bcb-a1f8-4720-ba60-9f8ee786a0d9", "comment": "Malware payload", "value": "10e969b8d0ac42929d449da10278a02b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156323, "uuid": "3a69dc04-1e0a-462b-8e6f-de5c454e161c", "comment": "Malware payload", "value": "fa2409a2e10db4a64bc6b90c0620709ec79f4f83082e27beedc7d801dbdff2a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156323, "uuid": "fc2c20a0-8da2-4668-b51d-ad75b5f5ad36", "comment": "Malware payload", "value": "4d3f264b38d0af6b11cd75bae88ab267d2dd0c3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620156323, "uuid": "08811d11-6e57-4449-98ab-83b66a39db79", "comment": "Malware payload", "value": "2217a6940080756dd40d222b4ea69db13aaef628f2ba293ac3f238a104cffe184ba668f83be6a0986029ab16daea91cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156323, "uuid": "801e3b49-4c46-45c8-bbba-e131e864cbfc", "value": "38D2C081B050BAB3C45686322D86C561F9129C601AAAD2C7B764BF7FFDF17854A0CD2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156323, "uuid": "ea2c8265-f2e1-4948-bb8d-961d43d2997c", "value": "384:XvxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNcxM/:Jv8IRRdsxq1DjJcqf5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620156323, "uuid": "096f5610-9368-47cf-9845-0ef4a16970ef", "value": 28992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620156323, "uuid": "33020037-0963-4eed-9d73-efd1b69d8970", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620156323, "uuid": "1ce90f1d-6e3f-450a-8423-556ab233ce88", "value": "instruction.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1140b5b-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620093711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093711, "uuid": "1947a2f6-6d4f-417c-9bf1-bf7f448fe13a", "comment": "Malware payload (AgentTesla)", "value": "b61fa321f22d56553ab37916d973cf4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093711, "uuid": "961ab39e-aa18-427a-81cb-9e8bd6c82a69", "comment": "Malware payload (AgentTesla)", "value": "fa6c016af805ab3cff129cdc2e57ea74e70502e0c7519c7f6b4c29ab2f6981a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093711, "uuid": "79ef88b7-3b24-4020-bc56-109f72a3b371", "comment": "Malware payload (AgentTesla)", "value": "5c17d448c342005b848ce18bbae99d7827176503", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093711, "uuid": "2e9e07b2-d0eb-44fb-959d-91533550f60f", "comment": "Malware payload (AgentTesla)", "value": "885f90593161a3360feb5a37b40cb619e68943da596236d287dd0e90a95c4233d369512e6668ae5c98696441e7a1c9cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093711, "uuid": "77b145b2-f8c6-462d-b754-c0509259c493", "value": "A7F5DA7139FF72A129FEB89C49156AA58B3B77D1C478CB0D1340630EDB120466DADB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093711, "uuid": "3cf05f8a-c68e-453e-a8a0-d4cc025d644d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093711, "uuid": "e9349e85-4de3-498a-a1ce-eb35deb7b6f2", "value": "1536:HFBUiIcxW5XW2hJV3rvAXUL/HWtV+WXWVbsWDrWce+GeERDvNnpWA2x/6BY/neWx:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093711, "uuid": "c94cfc8c-366e-4903-b1da-25ea3fb616fc", "value": 3502592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093711, "uuid": "a4733c7b-502a-4770-bcf1-8a2bdae78340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093711, "uuid": "e3682012-376b-429e-b8f9-44c08f64d85e", "value": "b61fa321_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25c0d6f-acdf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620136287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136287, "uuid": "c1229da3-73dc-4822-a21e-a2160c139382", "comment": "Malware payload (IcedID)", "value": "6ee6fcde80cbf4967885454cfcdf22a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136287, "uuid": "912e4c1e-fa80-4144-a0de-08fcb4f6648a", "comment": "Malware payload (IcedID)", "value": "fa914c9914a9a663613c62467009adb9a283275863e0fd4a39b5e5e4f3a0f376", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136287, "uuid": "fdd8f44f-8b9b-420b-84fa-6a7273c4afa7", "comment": "Malware payload (IcedID)", "value": "c3b771ed998a4363e9eb00996c651bc560138503", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620136287, "uuid": "e61b40f1-86b3-4336-88a0-ab56c3fdb276", "comment": "Malware payload (IcedID)", "value": "db6d08bb9b6d578d1ddf4f83bcc618d7c9bf433070740e3075a75063a3786dd53d417d268e725792e9988397f11140c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136287, "uuid": "41a8074b-d50a-46eb-ae1a-00bbe6f37c1f", "value": "07749367829AD2BDF14768B1A03DAF4EC2546E902962CCC7B4D694126F239F523133DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136287, "uuid": "ca95d386-f33f-4460-8ff0-e51ded43a461", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136287, "uuid": "0c9a475e-1f9f-4f6e-b6c2-3a7743ba54f5", "value": "6144:oHObBm3F9Y4IiLlKKJApI8A5UWNuKKHDTgul3ta+DaON2:ok4IElKKJApI8A5UWNuKKHDTDl3Q+uO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620136287, "uuid": "fc463681-70cc-4041-94ad-e6724a283ff4", "value": 345688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620136287, "uuid": "1fcf2aa7-8866-4b11-9cdd-ada3f9ee77b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620136287, "uuid": "4c1bb6f1-2cc2-4cd8-a727-892b4a4a0433", "value": "pasteBorder.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4efe0d3-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122520, "uuid": "065c4b50-4823-4b7d-b69a-05d1d538b5a5", "comment": "Malware payload (Dridex)", "value": "e7dff9650378ab4fa9842a9ebebd7afb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122520, "uuid": "83f2ec31-d791-49c6-9285-71f042f4f460", "comment": "Malware payload (Dridex)", "value": "fb3997399ec360775800ed513ecfb17fba81d60486deaea4e190aafbb5d08fc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122520, "uuid": "8759bd40-6c37-430b-af1f-1ef2afa720ba", "comment": "Malware payload (Dridex)", "value": "63d8762c130517904456e237733ed62a73b77897", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122520, "uuid": "53a0f579-ebef-455d-9354-16665ff3ec90", "comment": "Malware payload (Dridex)", "value": "5c8b5ba177c23bf65d6350b3617e7e08fe350c516989cf402195b344f67fafe3e3e2c3b4791ee858ac5b9a3d96af75d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122520, "uuid": "623c6b51-a4a3-4c8f-b991-4d87504f5721", "value": "B8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122520, "uuid": "bc44de0c-b519-4604-ac11-91795a389a8f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122520, "uuid": "f2d2aeb9-2992-4e7b-9ff6-7c35f8a2b643", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122520, "uuid": "029bf0ed-dc8c-468e-aba5-938513d60712", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122520, "uuid": "d223039c-2a64-471f-8e67-92135b38a15a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122520, "uuid": "1afbeb1c-b648-41d4-8a31-c5cef0cb2d80", "value": "e7dff965_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31d4c54-acbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620122517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122517, "uuid": "a7119a3e-4ea1-4daa-b5cb-9b419a4ade69", "comment": "Malware payload (Dridex)", "value": "fb9ee3b215081a51a42ab38543d24953", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122517, "uuid": "257dbff9-b2ec-4ef0-bb12-102a18969e8e", "comment": "Malware payload (Dridex)", "value": "fba4c726ec48450bc0db804db4bce2b59c5bea80a530c3a290f9759bdc1eaea9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122517, "uuid": "72cf18f4-0627-4f38-82af-a30034620f62", "comment": "Malware payload (Dridex)", "value": "034a60af5508da814abb7b2d70a5271989926270", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620122517, "uuid": "7c644275-751d-4d87-a33e-c760789dccbe", "comment": "Malware payload (Dridex)", "value": "b8da61308ef3898b437a99220e1a5351d9e24857af62a25af1f36a1ddcf7d5cbc788513af42f89e352cb9d0009e8b807", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122517, "uuid": "8cc018f6-c56b-42a8-a205-f982e224aac1", "value": "F6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122517, "uuid": "b063fbed-93a7-4e02-8e66-42f86b2a220d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122517, "uuid": "0baff89f-0d12-49e4-8d4c-3b37656c48d5", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620122517, "uuid": "e7b12653-535b-408f-abc8-2733d69400d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620122517, "uuid": "890bf553-440d-4190-b021-5585f6e20e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620122517, "uuid": "5cce307c-b4aa-4172-afdf-689647f0344b", "value": "fb9ee3b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605e5446-acff-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620149839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149839, "uuid": "0bd8a9c2-2683-43cf-985c-a5c3b6eb8048", "comment": "Malware payload (AgentTesla)", "value": "5a0c6dd1f7bbc5272f2ced270e2d4d8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149839, "uuid": "94367757-5677-4330-ad53-8906f2dfcf2f", "comment": "Malware payload (AgentTesla)", "value": "fbc12470553e748b10dd0e1a15c6e28a1e777b626757349e46031f7e0608b8e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149839, "uuid": "3dd6f4a7-bf0f-4898-9dd5-e99e759b170d", "comment": "Malware payload (AgentTesla)", "value": "9f553e08793745277db8a0d3aa82a63b7526a28b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620149839, "uuid": "2e3e6284-5a25-467c-a99a-ee7a0288c2ed", "comment": "Malware payload (AgentTesla)", "value": "a523bde29c059fe2463ffdefc16d7d42ea011b32f424a7bc8f599ac87cf9fcc63a98c392748516277e4f2e3a701d31ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149839, "uuid": "4a33bd00-d160-40b9-9060-b3605acaf2c4", "value": "7ED5BFF875047DE6266F576BDA96ACDD03B626239ACBA4CC8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149839, "uuid": "21e36d95-627e-47de-ba09-6fc7e6164e04", "value": "24576:bs3sSY8fk9mx1nmyuWKNYEDgjfCHw/AMCTIujdqIcfQTWLgmQxKnZpqsmEuyF2w9:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620149839, "uuid": "f8441a09-a6b1-4b82-92b5-8b78f8f1729a", "value": 2960089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620149839, "uuid": "8bd66b37-db42-459b-ae88-2e8facea0fb6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620149839, "uuid": "f5741fa7-ba7d-44d0-872a-e10721cea94f", "value": "Allignright_companyprofile.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0530f0f1-ad13-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620158276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158276, "uuid": "dd1e7825-bc84-4c3e-92f0-38457a36d5d9", "comment": "Malware payload", "value": "8832e0557e1b144bad206ed6d14d5c34", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158276, "uuid": "126c6e01-07ba-461c-833b-8fd598aa0f71", "comment": "Malware payload", "value": "fbd1b454da7fecb92c40b9b2f74fc8fecae79340afdc011e7c0d6339fabdcfde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158276, "uuid": "d2e8aed9-1ad3-4518-af44-418acb02e154", "comment": "Malware payload", "value": "4b729d3262362a2ab3edab09ac1f625af8f5e0c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620158276, "uuid": "a501d3c1-e5da-4141-92c4-472610c93ca2", "comment": "Malware payload", "value": "c5dd1c278c748dd7640fcb93519dee94351a346f973ce1cdab5d9670a5edefe9d4eb6774351bc71b20443bf2218ab6d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158276, "uuid": "c60c95a0-aada-4b3a-b846-8ab3a8804383", "value": "8C9302932C5400F497D767EAF8A0612C9DF62D6E2667601AF36193DB9A720D02C8F739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158276, "uuid": "4e58a52f-6607-42ab-89be-b8f0631e16df", "value": "1536:zf0WCyPs/c63J2lk4Gjh3mkGaWIpOJcJ8BsjTxfNbQxds7WQGBJeDSD:zfpCyPMtIlkdjh2kJWgjpfmb/eDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620158276, "uuid": "751cd1fe-0b4a-45f4-92d0-b63f6af5d6d8", "value": 96379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620158276, "uuid": "ecdda3f7-d8d4-494d-b8e9-8b7773347660", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620158276, "uuid": "2b81add6-3c82-4182-9423-86f7d98d1aa7", "value": "IMG_05412_868_21.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99852da-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141936, "uuid": "fa9b621f-198f-45a7-9b53-b78f398c7f8f", "comment": "Malware payload (AgentTesla)", "value": "5133cbc9db4989d6fbb350e0829911c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141936, "uuid": "0945f6c9-3f7a-489b-aba6-8a7308b9e4ac", "comment": "Malware payload (AgentTesla)", "value": "fbdc2f9c6e970ae88ff30847c4d63472a0f0aa9b8e008e5b5c37f62ac526a963", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141936, "uuid": "b61658ab-5879-462e-9f54-addccc15dc2e", "comment": "Malware payload (AgentTesla)", "value": "72052feec6f9f94fe0831a77bdf8c3493d268e37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141936, "uuid": "57049649-3dd6-4495-984c-42ab0fbbc2c7", "comment": "Malware payload (AgentTesla)", "value": "d7a83d94f2657cbc7bf7ede0bdb00bbe4e696157004f0c36654f60a0215f4e3f9c141f7abd9c5c3a79bf31a141c762c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141936, "uuid": "5ea76016-0189-4986-8ff0-7dc8fffcac3b", "value": "3D253A6832681BE1F27B5FB663DA1C0183B92574693EE51D4FA113FF0962F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141936, "uuid": "378fa127-406a-4a73-9da6-89b82985daa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141936, "uuid": "da657beb-8584-45bc-a0fd-cbb1692a9769", "value": "24576:Zv0t4KctioLA/9NjMjEjqRUj+hRZJr+F/:Zv0t4KEyYoOWaJr+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141936, "uuid": "053f81b2-2e45-426a-a46f-d6c380e127e1", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141936, "uuid": "6bc0e442-5aea-4348-ab49-92cb2af10c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141936, "uuid": "98d4ba04-e2a9-4dc9-a340-ac15d31a2257", "value": "New Order Request_0232147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f06593-acee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620142381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142381, "uuid": "b492edd9-1576-4836-a270-5d19389ef007", "comment": "Malware payload (AgentTesla)", "value": "d96f52fc8733d2f4a127bdc44d4ceb25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142381, "uuid": "8cf37071-da01-4a06-80cf-82d07cd4a80e", "comment": "Malware payload (AgentTesla)", "value": "fbf9ad4434424d18319916f523899a50c21535012a50d531ed30040f0b66970b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142381, "uuid": "efcf3db8-dbfc-468f-ba9f-1c40ab225742", "comment": "Malware payload (AgentTesla)", "value": "e6a708ba1ec4bb5e0335d111c25a660e8d2e3059", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620142381, "uuid": "1001eeb1-5abe-4efc-948a-0cda04e483d6", "comment": "Malware payload (AgentTesla)", "value": "3069cf27a79183eaa4cfad5c268571c0444bdea70e4b173b3f3f380d9157ade16eaf6d283a3a34af2feb2df5c8ad3e30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142381, "uuid": "71600f08-ead7-46f3-9f13-ad24022c3340", "value": "8FF5E810D759DC2DF6B38DD5008CBA9F1B97EBBB4D3E88A1418852531B82A4CCFA1B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142381, "uuid": "79997544-0fa7-41f6-a3ef-393fb79dfc93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142381, "uuid": "f56e0446-ba5e-437d-9298-1c1112d8e4ba", "value": "6144:w8e+U7MvlCLjsAhi8QMtmeC2C2gffQSXmVEb2BQsP87Q/GQDRT8haxZICH4qxvtz:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620142381, "uuid": "55344879-3456-4d5c-bc58-9ad54c4bbb27", "value": 3367424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620142381, "uuid": "8c9951cd-7018-413a-bdc0-dcc2ad49f780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620142381, "uuid": "405d86b2-3192-4f35-ad53-0c2e30b407f3", "value": "d96f52fc8733d2f4a127bdc44d4ceb25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9e4512-ac6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620086486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086486, "uuid": "fc09fc5d-b63d-4251-b790-fc4799556849", "comment": "Malware payload (Dridex)", "value": "94b66916edf554d3ce220d3a13cbbdf9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086486, "uuid": "9a8f470e-9048-4203-95aa-6990f21de31a", "comment": "Malware payload (Dridex)", "value": "fc646dd6a8d4fd69236c9cc5ab87e1634a0c935c4def31cc491ec6951c100294", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086486, "uuid": "1b7d1127-82f1-4e72-ac67-265b4fb9cd17", "comment": "Malware payload (Dridex)", "value": "a760149681473811d4f251149a05df625576070c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620086486, "uuid": "8bd4b150-a804-4402-9826-9a4bde4c807e", "comment": "Malware payload (Dridex)", "value": "c3abe6c3fd6532817a5de138e14b2b27d43f51e0a252c430e93d21e7c014d640c331118320e76c2ea18e6172c05edaaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086486, "uuid": "7d26ce60-4876-4a91-8da8-98e38833b03c", "value": "4CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086486, "uuid": "59400142-fe54-408b-9ece-25045330bf10", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086486, "uuid": "03e3e748-9508-4529-bd6b-332b73357a2b", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620086486, "uuid": "cb56b88b-39db-468e-832c-d4a0ecc415de", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620086486, "uuid": "cef6cbda-00fc-47c0-b94c-94c170b4c6be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620086486, "uuid": "d696138d-b7d6-4e05-88fd-e7037e6d50d6", "value": "94b66916_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf779f6-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620126075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126075, "uuid": "a08ba9de-1952-4e8e-99d5-ac997a9a5201", "comment": "Malware payload (Dridex)", "value": "49aa838c6a5425a153f7b437233b7e85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126075, "uuid": "a37db209-1235-48b8-ab58-cd71ea87c50b", "comment": "Malware payload (Dridex)", "value": "fc9a718e7660e39348ac3261b45f2a3effada22c9a982f6fcc8d27205aa49cbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126075, "uuid": "fbc922ff-6221-4213-8b15-b31960711990", "comment": "Malware payload (Dridex)", "value": "32b93f4fe24cab4b3db9f87dc1d3d874f274eb85", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126075, "uuid": "85f7d758-d2d0-4f35-9864-fb8f7d4769af", "comment": "Malware payload (Dridex)", "value": "3ce93296ee452180b8ba219733199c36ad279c7a22e3dd004728807859a3cbe6302cebb5a21c4ff386c2214a9fcea76e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126075, "uuid": "daf257ff-00af-4f39-86c9-3d2400240d50", "value": "D2F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126075, "uuid": "6b388bd2-05d3-4b48-963f-0ca61eeac49e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126075, "uuid": "9eec92f6-0cd6-4d06-801d-61040fa2c785", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126075, "uuid": "f59d2b4e-ca03-4579-b34f-e7c408c23f54", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126075, "uuid": "49e87490-36d6-4a5a-9fce-87d06efb5e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126075, "uuid": "eb483b69-04be-4818-a47d-a0ff09aa92ff", "value": "49aa838c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83eebb5-acec-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620141826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141826, "uuid": "43e2177f-eeca-43ba-8cb9-9880d84e6bbc", "comment": "Malware payload (AgentTesla)", "value": "7c928f4a06e66c661940922388466707", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141826, "uuid": "68f38e81-e5e1-488c-84f7-11cb21250b90", "comment": "Malware payload (AgentTesla)", "value": "fca759c8d9bf03262a2d43097bdbdc89d0a233e81cc9e90d4bfd557cf780f744", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141826, "uuid": "ae95ffe0-96c7-4763-af23-b4782af89064", "comment": "Malware payload (AgentTesla)", "value": "e90c9a70885ef022a5b7d86339ce1c8817fe5972", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620141826, "uuid": "037c7eb7-52de-4887-a9a7-5b56e358f039", "comment": "Malware payload (AgentTesla)", "value": "557c7f0992db09314f98cbfe705545a201a4c778ad513a55408255a396e569afea5431f55d1332886941a6c654be0904", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141826, "uuid": "7a7b7932-5842-43ed-86e6-e6fc472bfa37", "value": "1D15069B7710729EC457CD729A781F24EBA0E46A830B9307A02715ADEECD9D7CF141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141826, "uuid": "5bab4044-c520-4fb6-92ab-b1e39697f2eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141826, "uuid": "57cf84fd-9445-46df-b799-a3c603bc17ad", "value": "12288:TjBili96IPqKKxMByj+1ehulvy/bcl8DsSB59s52tIaaZEWbEW8YzdglLxYXJDLK:BDjCKKx8oi+Al+so3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620141826, "uuid": "731bf84f-57cc-48c1-adf0-9253970f67ce", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620141826, "uuid": "ea52ac66-6919-405f-a8e7-c356ba89b52f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620141826, "uuid": "2d6dcf98-bf55-4c19-8cfd-c6796ab46394", "value": "MAY_JUNE#920288 COMBINED ORDER 0029101 Reinnoire RCA CT06UAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae7f0f0-acbb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620120598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120598, "uuid": "d83c3aee-c08e-4347-aa9a-32c9101c03ee", "comment": "Malware payload", "value": "e68fb8ee8306faaf6fd952333d4c1a4d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120598, "uuid": "a15a104a-2e75-47d4-8bac-43f61821bc4b", "comment": "Malware payload", "value": "fcf06f3ba301946d82b2bbb7da59af21216535f7dddf2109aab1ed3d3fd3b049", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120598, "uuid": "001ae034-7a6e-4063-81fb-fc619c461475", "comment": "Malware payload", "value": "dae7975fe9dd29908d1ac4db5824d7036f46b533", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620120598, "uuid": "256fce84-e15f-46df-967c-ae291cb48e6d", "comment": "Malware payload", "value": "8684e38851d9d09fd545dcb02d860d55192750b241d0b276400fd3f897a05d1522bc1c1084f1fc851dd6932baba0bb59", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120598, "uuid": "45d6aa1e-99d0-4dd2-aca4-32eb6e2a0830", "value": "4616018BF745A86EC8F782325276561A66474D198B83EB874A64723C0DB7DC04B4BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120598, "uuid": "f5f64759-7a4d-4d54-94e1-eda70cc225f8", "value": "98304:G0Q6QjB9z7DF7RrQisN4k7NrWd1VMacpQAuP:G0Q6Qj+id1VMacVuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620120598, "uuid": "83a87cd7-e097-4de5-a166-1c4c50d6fe05", "value": 4166710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620120598, "uuid": "91f8110f-a0fd-46b2-b4d2-dec903a80068", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620120598, "uuid": "e6fa79ef-32bf-44ad-9042-fd4f89bfd2b1", "value": "UPS320.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95b8ce0-acbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620121642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121642, "uuid": "b54699d4-28a4-4729-82b2-ec4c90657bff", "comment": "Malware payload (AgentTesla)", "value": "c10a23237f03cdb38952921f0abe572f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121642, "uuid": "d95d7315-4f63-4049-b302-0715145886da", "comment": "Malware payload (AgentTesla)", "value": "fd7472363bdcd092b7fc8c1134b2a20001948c24a9ea43638beeb0dc772362d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121642, "uuid": "ccfb2e63-189e-4c79-bad0-3b85267bc98a", "comment": "Malware payload (AgentTesla)", "value": "cf0aff11d0dfb294c4e273cf78a43bf7e15f29c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620121642, "uuid": "26a4885e-2e44-4c4f-94df-fce47ea05038", "comment": "Malware payload (AgentTesla)", "value": "f53350fd8f818a9cbc17fe5a996d6d1d33f4c27ece59f76aff1bd440d8761922a575ec1b0ef1d5409ae15002b0091a0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121642, "uuid": "872a24df-54fb-4758-97f3-09e390d92a60", "value": "B82549AC325431EDD627CE26A7DE1C0592203175A62BD60B872303BD8E1EE57AF349D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121642, "uuid": "29b4419b-3473-499b-9125-5646e3edf2e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121642, "uuid": "dee0c259-eadb-4c01-ae64-ffbf40e15d08", "value": "12288:tmoLLoS60/K7yh07h2I2mn+E8hurskq8Q4OpUyPb95UCpYFsjB2StwNeTPJ7IShO:EoLAVNvn+Cq8Q4Mx2uwStw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620121642, "uuid": "24c283e2-f01e-44ff-b0b6-7c99ed73f4ee", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620121642, "uuid": "8514c22d-62c9-476b-8d4d-f5e058bc702c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620121642, "uuid": "73772ba3-34bf-4a34-9b8f-7dc02a44cdd9", "value": "stow plan and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1ae18e-ac9f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620108651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108651, "uuid": "3d02be7b-38e8-44b3-8dc1-49d937fee9b7", "comment": "Malware payload (RedLineStealer)", "value": "9901d90330c9d140262d6741a7ba3de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108651, "uuid": "ef093f34-2906-4e83-9961-05b504d40ad3", "comment": "Malware payload (RedLineStealer)", "value": "fe28808f8b07b484ff987a1ccc2f187857139e84d58dfbbb8004ce29f21bf1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108651, "uuid": "e5d0ecab-c1b0-41bb-bb0b-3facac51cb19", "comment": "Malware payload (RedLineStealer)", "value": "c68de5eaaf9e9e34acaac51b83c9ddc36798dbd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620108651, "uuid": "47281cb9-55cc-4845-b48f-7a1dfd1d7ea6", "comment": "Malware payload (RedLineStealer)", "value": "9aa9e6fa27a3b822efa707def7504956d0ef8005b71c7f81e5c3d8a447b8ae61a07b6852078edd93b4cd67cbb641e5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108651, "uuid": "bd07e9d1-c535-45f8-aa8d-554b9625de42", "value": "3CE4D9715801C992EB342832D0E6F514616DEDCA9C5C9AABBFAFB3D909F0F0E3B59504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108651, "uuid": "748b052b-5fcc-448c-9c24-1bbf5ac0a47b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108651, "uuid": "98acb4af-85b4-4974-9652-db4011b1e540", "value": "6144:k0u8rlxfznqqryuOS6sskQxGm0bwq4nDs/Jb2GKqsGaOylXG3+BX39jzEy:O8XG2ylsHA4kQZHZE4gn9HEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620108651, "uuid": "face571c-b39a-4453-abad-7cc52d6a8cba", "value": 687440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620108651, "uuid": "55742c42-4088-4940-a7e6-d894980a4629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620108651, "uuid": "5033f8f5-4b0d-42f9-b4ce-d05b94d5f716", "value": "9901d90330c9d140262d6741a7ba3de7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4810ead-ac7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620093690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093690, "uuid": "47916764-7b46-4de5-ab6e-f7c98186a91a", "comment": "Malware payload", "value": "b02c31d84eedcfe31c800d569f3b7ccf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093690, "uuid": "20f6baf2-e72d-4a1c-8b63-2da30f698561", "comment": "Malware payload", "value": "fe7436fbaf907d1285b590bfe1fe75c53fc6fcdf45dd0a0d4e986adddeec77ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093690, "uuid": "12d90eef-1e32-437d-8b98-60fb15e4309b", "comment": "Malware payload", "value": "d8473e71e43ba4565cf406c8d84ed2e13119e37d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620093690, "uuid": "a00cfea5-4cb1-492c-971c-b4a3ef8cefd9", "comment": "Malware payload", "value": "e37d5fcd25674caf3a31d49031230357db8e4e04af63f4ec0ded69b0a7a5878ecaab4088fcbc2f3de07c2401740ca56e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093690, "uuid": "cc4d308d-d1bf-4fd3-b8f4-f9ddac8a2ae0", "value": "C82612833FF84C67D16AC73488A195A1C2F2B862D53DC75FAB80269E1E27384B52175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093690, "uuid": "a0ccc9cb-8a7c-4d49-995e-b8d640d6a07e", "value": "75ef29dcb2a4e0348c86afe2844d0a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093690, "uuid": "f3c01d82-b099-4ba7-af65-995118941f7f", "value": "98304:XAcjm/9xL8vWtej51Q9qheX5wTNEyM7KGx43yQxSF9ocdkz:2L8P91kyTNXMek4CGSvoCkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620093690, "uuid": "52e33328-c43c-4927-a9d0-82803e20adc7", "value": 4790096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620093690, "uuid": "8d8f030c-eecc-4b6f-9d6c-b8a6d07f8dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620093690, "uuid": "7f8c9db7-aaad-4aa0-8488-f50db50dba1b", "value": "b02c31d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a5a2f2-acae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620115280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115280, "uuid": "93e14063-ba81-4879-96fd-8c3b45241f74", "comment": "Malware payload (Dridex)", "value": "4b12cb698762bd194b1f609b4a98cdc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115280, "uuid": "f9b42f36-f25d-4ed0-830d-68d1cbaf13a8", "comment": "Malware payload (Dridex)", "value": "fe99539b78b3ffa3efd46ac197886dcec375a4bc6c5a72d657e1d8f57abafe6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115280, "uuid": "dbb53904-294a-4fbb-83f5-093c79b39e27", "comment": "Malware payload (Dridex)", "value": "c4829f8119d5d6f2ca549410ac90f104467ee6e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620115280, "uuid": "491e506d-7203-41c6-8f83-c77b0ee70625", "comment": "Malware payload (Dridex)", "value": "3a25cb8550b9567659acf897fa7cb98d6d8cf8487db631d666b145c584a9e63cbbc4b42399c57006048f9a281b69fd16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115280, "uuid": "0bd4d93a-2ac6-4eab-b50b-1adb04ca2036", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115280, "uuid": "e7648516-a912-4c56-8853-91da62c45774", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115280, "uuid": "7b8ddfac-3256-4408-a577-8f8e2db8adfc", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620115280, "uuid": "881b00f5-ee26-46cc-9b19-736bd92eb79c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620115280, "uuid": "2c86508f-8300-47c7-b538-1e16d9ca4ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620115280, "uuid": "74c49624-a3f8-45f8-9c9e-2a41002a20fc", "value": "4b12cb69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cbdc60-acc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620126141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126141, "uuid": "1f25415d-7e96-4fe7-8b1d-7f62f8a4557e", "comment": "Malware payload (IcedID)", "value": "a633264676827acce29fcf5a7d5f3975", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126141, "uuid": "3aa4adab-e855-486b-9019-a0b1dce3cd54", "comment": "Malware payload (IcedID)", "value": "feb038a0920f3517f06656a3ff5ce2914923adbd3eaa5cbb3c40385de11ad19e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126141, "uuid": "12e389c0-a27d-4b17-8bd0-ec8562a80aa3", "comment": "Malware payload (IcedID)", "value": "fd69e2804193b643b5d28e70e95e8f3c46429200", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620126141, "uuid": "16e55f33-f33a-4c75-a204-575fc1965162", "comment": "Malware payload (IcedID)", "value": "8e2e4122da5aeaf2eb2293c3e14e4b35a781e675dfb7d82832ec1a6d5758b22f9f1ffb25be3926f1525d40f929c874b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126141, "uuid": "40156771-6ab5-408d-ad0d-71a1931171c4", "value": "6C8302643968009CC35A5256B918731C3BCAAEE9A0B3E53C8E1FBDD005E665536D4F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126141, "uuid": "59f3846c-800c-4c6d-8ad8-d1bcc3bdfc67", "value": "1536:q24GbYaYt/Pfu2VJptQN73OIzi2IR57yv06iJAyehNR2EBYH/+sKDTUxJmq6g:q24lho4IzsJyv0DlENRDBGWLExJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620126141, "uuid": "e3651a35-500c-4712-9602-2ad4ec8db8f3", "value": 83764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620126141, "uuid": "85daf82c-b5f9-4bd7-aba7-694313af7cf5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620126141, "uuid": "9ff97bbb-3110-44e4-b755-0150241d9a7e", "value": "xx_xx-77.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cf50a4-acd9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620133412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133412, "uuid": "7bee1aab-9de4-4fdd-b405-202a2faaae4b", "comment": "Malware payload (AgentTesla)", "value": "ad7c902b259476d340eb66125aa4846c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133412, "uuid": "ebfb761c-7c40-4ae0-a9d6-55987646a4f5", "comment": "Malware payload (AgentTesla)", "value": "febdbb2078e5f14e3f534dac4dcf387097c8168f8e803ff98f642b9a99517865", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133412, "uuid": "1e96f979-63a6-4a36-9c62-0b670355780e", "comment": "Malware payload (AgentTesla)", "value": "96b5a7b3dbc729d794d9ff1af2701dfc8a82ee24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620133412, "uuid": "458cd774-f29e-499c-9004-2e00fc7816c1", "comment": "Malware payload (AgentTesla)", "value": "6cd71dcbaf473a6983da412c1070f83d9077e772e45fe3dc2be68bc7d56c1ed2f861bd353d7b7a1840dd3c7d098ddc47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133412, "uuid": "a11767a4-4462-4638-a536-83f9454bc21e", "value": "8F35238AFBC22B47D6770D31A2AFCEA446EDCD50D613805393397A85343E936BA1718D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133412, "uuid": "fddd5bc5-967b-4777-b793-40b7c182e54c", "value": "24576:vOF597+bM4Bd0wr8/3sbCN382iHyLaGShbN2piTUqyInvEdtegld9vhE:vOF597wBSwr8/sU3nxLaGShbNBoqr8d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620133412, "uuid": "81daed74-ff04-4892-a371-d062720dbcd8", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620133412, "uuid": "9a3f87d2-c320-4c68-84d3-323a039f6832", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620133412, "uuid": "0895bda6-96a9-4ca0-893b-d707a75919b8", "value": "sample04052021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ab8ced-ad07-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620153491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153491, "uuid": "031be01b-c67c-41f5-acac-07ec526fc1dc", "comment": "Malware payload", "value": "7187e0d3a54a52d8a92f6f009b932379", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153491, "uuid": "dcaab2f1-2187-418d-8ff0-805f9b1c44d2", "comment": "Malware payload", "value": "ff0fc31d1c02e8d5cb61ae4ba1d5135c8f52d10a0288acf971593dfd147af4e9", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153491, "uuid": "0fca80a9-e19c-4ce6-9c25-7fa894cff2fe", "comment": "Malware payload", "value": "83f6d84dae0242898f84ba9d1bda113a2e31bdff", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620153491, "uuid": "0511823a-d021-403e-928c-d0201b4fb486", "comment": "Malware payload", "value": "8ccac85c04c7145b0881e67d58a2db4f85aff98345bad945d6d007380e1f43115b9f96e168c3bf6366fe8a45ac26cceb", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153491, "uuid": "74148344-669f-4fd5-9877-08fa105168f4", "value": "9431EACA3022A35142FFEDEA33679958440DB2F2593B3F15CCFC0B28D4AA514B1B1B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153491, "uuid": "80ccc35b-7a3d-4b19-91be-895f5f94a584", "value": "48:SmdG0jomX8a6mUlHBmRWRzR9+OlmRHRsR9Q+YZYHmRARpRj+yd5mR1ReR4z+8Yml:SmdGwomX89mUlhmRWRzRgOlmRHRsR/Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620153491, "uuid": "a508b66e-2fc6-4baf-aaa1-4e1769b07e4d", "value": 1565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620153491, "uuid": "23a9aada-9db3-4a76-b660-53fb214270ca", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620153491, "uuid": "5e8dd421-8b27-479e-8085-d8b4633b63d8", "value": "ff0fc31d1c02e8d5cb61ae4ba1d5135c8f52d10a0288acf971593dfd147af4e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318ac751-ac74-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620090061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090061, "uuid": "10848063-5f22-4a53-b11d-e60d016519d5", "comment": "Malware payload (Dridex)", "value": "59084a2c18a546ca70f609649fd1b06b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090061, "uuid": "d5be72ba-1d8c-4756-a792-4a97cf7ddee0", "comment": "Malware payload (Dridex)", "value": "ff61b8bf03cbe9890bf2937179e1c61e79eefd120096bc8f68f34b493105e331", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090061, "uuid": "345a5d91-7903-4568-b374-9110ac4a9766", "comment": "Malware payload (Dridex)", "value": "c717c11ecb3ac409165a8cd389a0ed0f77bcaaeb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620090061, "uuid": "9f393e0d-d448-4b50-85db-7bb290e65927", "comment": "Malware payload (Dridex)", "value": "6309e0f8faad0f9bf35f852d3e4b7efd85f9ed78cc75323a0dd21b7bec9e4f974b2663a1b0d6b783f4857217dc1daed6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090061, "uuid": "6ed103ab-f4db-4304-8bc4-bfb43bfbb934", "value": "62F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090061, "uuid": "9d328d32-1d78-4ce8-9e92-b8e9d08e5aac", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090061, "uuid": "9ca490c5-ad23-488e-9918-32e2e32bd5e7", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620090061, "uuid": "a11d6573-086f-4ef7-bd9f-f3114ed2d3ef", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620090061, "uuid": "451bbfb0-7155-4ee5-a4d1-2127b585b642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620090061, "uuid": "0048d1f1-6206-4245-9432-c1fa8169451e", "value": "59084a2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }