{ "Event": { "published": true, "date": "2021-05-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-21", "timestamp": 1621641781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2a38a0f9-52e4-438c-9722-97daba6c0a9a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1122db-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609661, "uuid": "eea7c324-f68c-499e-a922-4f9bb66e56c2", "comment": "Malware payload (Dridex)", "value": "7c17706d8b3366ec0a627c34c0bdf392", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609661, "uuid": "899f19d6-c3fa-4a17-9433-bf2e2598187a", "comment": "Malware payload (Dridex)", "value": "002ab23d06c840817697a883245dca014be67cb6841b9689231da84b5519bad7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609661, "uuid": "cfcf0abf-353c-401c-9322-400aaae5081d", "comment": "Malware payload (Dridex)", "value": "365a211b192c5861cf800389ab3e4ed0c52381f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609661, "uuid": "b0bb6907-57eb-49fb-882f-a8377012b4ed", "comment": "Malware payload (Dridex)", "value": "0027db6be774a15c4c73bd90459648de3ff785ab2d19152e751d5970780b31a03a8dbc98aaa1bbffe26ffc172d545ca1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609661, "uuid": "2474a228-fde4-4f54-ac4e-0a84b117a76c", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609661, "uuid": "a837116a-071d-4afb-938f-8cac0023207b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609661, "uuid": "75dea3d9-dc8d-4452-a146-144edc86d309", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609661, "uuid": "7932ba73-2f33-4e4c-a52e-02f0b89e8e92", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609661, "uuid": "35b5351a-a7ae-4847-bbb3-e255a168dbcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609661, "uuid": "221dcd44-b535-4503-89ed-9b6cb20c0d18", "value": "7c17706d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd19388-ba3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606477, "uuid": "bdbbeb10-524e-4f44-a7e4-dac5491b0196", "comment": "Malware payload (Dridex)", "value": "15b04ae3a57c16bc6c6f918ee654df6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606477, "uuid": "20287fa7-ff91-42f3-9ec5-f8c1d6a58676", "comment": "Malware payload (Dridex)", "value": "0031c670f9200f92cd28275f25af87b2a305bee72ae528e5d9691c0ac895633b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606477, "uuid": "d1cc9f1a-30e6-46e4-81d6-bc36b6b0f223", "comment": "Malware payload (Dridex)", "value": "8c5564c9adfa5216248d9cfe49754facaecdc8ea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606477, "uuid": "fc710e2a-b9f0-4d40-9f0b-b89fc0101679", "comment": "Malware payload (Dridex)", "value": "76ebcdb295c074b5ae043179fa37a7ad66a79e981782ab9d4463683537a8dc5bf9048b63c939184cf01ea24e9ca8c331", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606477, "uuid": "befccf29-617d-492b-9288-4fcfedd070d2", "value": "0AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606477, "uuid": "7ab8af57-8c00-4b94-8304-fd41a2ca06ea", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606477, "uuid": "3031c55f-0f79-4d92-a684-ecb3ae9c67a2", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606477, "uuid": "31ca4834-491c-4b75-97fa-99c07f5f3c43", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606477, "uuid": "62d36d84-23ef-496c-bd0d-87af81708525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606477, "uuid": "f7ccc744-5b5a-4f93-a8ce-f6b122893018", "value": "15b04ae3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bb5c37-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621576026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576026, "uuid": "ab979ef6-4ce7-4871-ade2-d3b4dd65224b", "comment": "Malware payload (Dridex)", "value": "e252c1021af8c96d6ef7d9e2e6222e37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576026, "uuid": "28416f84-5126-40c7-a47a-cc9b796b8f6e", "comment": "Malware payload (Dridex)", "value": "003a55364c1f06f8d295e3ebe641b90361b01a00084f7af5e5f29fcfa5064534", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576026, "uuid": "7ae4dee2-d5c6-4f5d-91c5-4b8a2192b55c", "comment": "Malware payload (Dridex)", "value": "9f48356ecb94fce37e8726eb5d6569e17ff6947f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576026, "uuid": "f2d720c7-8cdf-4174-b3fb-c19b37bf72b3", "comment": "Malware payload (Dridex)", "value": "b32e8da91d34218c4ea49ecb0bce95fcb235fac6e6a9f890a40084bba7554d6abd1240350ee03eea430af2921364d956", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576026, "uuid": "7170fba3-bd53-4ba1-bde0-58929d070e73", "value": "EF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576026, "uuid": "2a090378-2f9e-47cd-a8d3-7cac2fc249aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576026, "uuid": "3ee6c93d-3eba-4964-b122-6eba427b0d4a", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576026, "uuid": "4165cea0-ad48-4a17-adcd-3b43588cb603", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576026, "uuid": "3feb744f-5e2e-42c2-bea2-bb0fc9ed2737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576026, "uuid": "3ee7de15-0e9e-4dac-8c64-ba97f4456c1b", "value": "e252c102_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c5fb1f-ba4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612870, "uuid": "1f745c35-5028-4d4b-9cdd-f4b71771afcd", "comment": "Malware payload (Dridex)", "value": "63eea8cf0e0c1c899956fa9275fc9fc4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612870, "uuid": "59cd3f1a-6306-4c18-9e33-534996d5aa7b", "comment": "Malware payload (Dridex)", "value": "0062a4deca10b269e8878b267e75621a4b543e9e0bc4eeab5b9c89bc39782b26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612870, "uuid": "c3bb9d5d-3f8d-48e0-81e2-fbfd2c1b0fdb", "comment": "Malware payload (Dridex)", "value": "d0322fedc6c1c1193c15f2bc1daf6a0188fb5a9c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612870, "uuid": "49dc6d94-8889-4e71-8c14-d581db9c7828", "comment": "Malware payload (Dridex)", "value": "250a44cd357b9cf2ed919282261df12350728517b465cc71918aabec2af063d4284146297fac3d6152a10cbfa75126a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612870, "uuid": "e3dcf2ce-53c2-4b67-8ff4-ce9cb115572f", "value": "D504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612870, "uuid": "148d9c5e-2410-4850-b838-9c656f836be1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612870, "uuid": "d2bd71a4-6c8f-460e-97dc-893d8c4871db", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612870, "uuid": "8fcb803d-fcae-4af1-b05d-ad15ae6de471", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612870, "uuid": "1aefce78-66db-4b7c-81f0-1b661018b062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612870, "uuid": "1d7f61bc-0381-42f8-8e39-24637aae126c", "value": "63eea8cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c109751f-ba5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621620598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620598, "uuid": "a69db83d-be97-4327-8f1f-d1dfccfd6df2", "comment": "Malware payload (Dridex)", "value": "739c4bab47d05a2c83070251fa3832ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620598, "uuid": "81797b4e-3933-42b2-b0a5-60cecbd05c6b", "comment": "Malware payload (Dridex)", "value": "006b00a7b3aed5839d9e3886303d9c86196e7606fa4a3d32bcb0c304e4f356a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620598, "uuid": "b8f9aafb-b754-44d5-999c-6716e37175ca", "comment": "Malware payload (Dridex)", "value": "c2e48b6eb80e637b8566e9e66702e06d475ff224", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620598, "uuid": "ad43c7e3-aa8d-4f29-bde4-fecd3f370f2f", "comment": "Malware payload (Dridex)", "value": "cf84294f0043afb45b248e1f32a03f6b871e60c7b29c32e6134d644ef53b0bae58e91c2d67b9ed308b05587cfbb5770f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620598, "uuid": "203eef9b-e6d4-40aa-b7b7-178f4d0d43fa", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620598, "uuid": "0eca8f33-284b-4468-927f-b9d789e49d00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620598, "uuid": "ef36e6de-4b56-40dd-967b-b60b48dc30c4", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620598, "uuid": "3431f1e4-ab7a-44a3-a983-785b343fa208", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620598, "uuid": "fab0408b-6ac3-4da1-8f89-c428d1d786eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620598, "uuid": "6116e745-5ec8-48c7-bc28-1dc7f2e41da8", "value": "739c4bab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfda2575-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578532, "uuid": "893330a0-c4ba-4558-8529-f9eeff3eee5b", "comment": "Malware payload (Dridex)", "value": "b2edc49ebfc016a90b8d0dd4b41690cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578532, "uuid": "9e612b98-66fa-461e-b603-97e02d58db84", "comment": "Malware payload (Dridex)", "value": "0076572a62a756781aeccc3a5a413d95b9dfe54084c76c12a9f3587b382269f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578532, "uuid": "90c50699-0676-4db8-86bf-fe6e727b2d1d", "comment": "Malware payload (Dridex)", "value": "c4d9864ec627feae9b03c993d4665a5912a7fc1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578532, "uuid": "685fa4d7-229c-4ed9-8855-5d5977c10a44", "comment": "Malware payload (Dridex)", "value": "c28c8b2329cb19b66785a710e361e97cffed90b526faf62766281a4defe00bbbcccb46d59b87013e80f75ee382bf71e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578532, "uuid": "5ec8c01b-8992-4374-8a6e-4cdd583847ab", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578532, "uuid": "55a44faf-b332-4d5a-8be8-4a4423ddc7e9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578532, "uuid": "29d178c7-1c5c-477e-8360-e4526a7a0c64", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578532, "uuid": "ac17c118-e927-4d34-9435-ad2b22ad6ca6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578532, "uuid": "39ab15eb-445d-4d44-a0a4-1306d2a51269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578532, "uuid": "264571a3-2b23-4b40-b846-ef1946663853", "value": "b2edc49e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7217af0f-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634639, "uuid": "e3e43491-974d-4d9a-b782-ecdd7a87b227", "comment": "Malware payload (Dridex)", "value": "ac461d4071a9202e50447f528bbd6a98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634639, "uuid": "270b2811-9487-44f4-bcf4-f678cf98eb7b", "comment": "Malware payload (Dridex)", "value": "00c1ce26b2644b836a401e752666128e290e16ef0351f0bec4ae9190ab5d4eb2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634639, "uuid": "b9d7f326-b2e4-4389-9586-74354842c9fb", "comment": "Malware payload (Dridex)", "value": "2c49852aed55eaae106ef80400c8ac6f8df3ea63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634639, "uuid": "5304b0af-1db8-442a-bd82-be2bf96b77c0", "comment": "Malware payload (Dridex)", "value": "2cf5540e63e2d8053286c9ca1720e1b5dcfc6a6e8cf2556db88a7ec7628ce15e704856bf09ed13b08557047ebaa30717", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634639, "uuid": "87976345-1a9d-4340-9904-788844f4b045", "value": "05F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634639, "uuid": "d7d2888a-6203-4f53-8286-400c10b82d57", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634639, "uuid": "576d0e45-7fc0-4ed3-839a-5fc022667473", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634639, "uuid": "5bacdc74-855e-40bc-aef2-254fe36d4b45", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634639, "uuid": "494de773-91cd-46dd-b371-c9cc0dd80c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634639, "uuid": "6578925e-2875-4ed6-8301-cf6755ade86b", "value": "ac461d40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c92c329-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612377, "uuid": "50daff38-0adb-4bd8-b552-6e74d21aa96e", "comment": "Malware payload (GuLoader)", "value": "3704c3c0b75a42b90288776130e2164a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612377, "uuid": "9bb38362-4ba3-4178-8f0f-0350620dbba1", "comment": "Malware payload (GuLoader)", "value": "01006d50a9052ffee3ea3dc6429aeb86e4d361d1ffe69a455bb00a1e03962166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612377, "uuid": "5b37d40c-afb1-49af-b727-d1ba7f3ec406", "comment": "Malware payload (GuLoader)", "value": "4b7f1633eb1722377c9602df70a93d9d8d4e8f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612377, "uuid": "4d74fa8f-c90e-4048-bafd-7bb327f536eb", "comment": "Malware payload (GuLoader)", "value": "2c13babbc569d770b76214b22d69b28b64e679adc9fea2913a1af476232d5bf4e51b1f6f853ed83f2a764dc91136782f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612377, "uuid": "8711bae3-7b3a-4121-8ae5-16a7ee0a6a88", "value": "CE34C799B952E069F8CA81B4F026CA1F18A53C7371854E17BF836F67B0340475EF992B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612377, "uuid": "73134c22-4552-4b7a-a903-06dbadcb33e4", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612377, "uuid": "9242acd5-b3f5-4435-bc29-6679e47a0bf2", "value": "3072:c+IFtkYHZfaJhmCeK+bMGiLVLPQwWEYPrNNX:c3ZC7mhKyilPcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612377, "uuid": "32b8ace2-5126-40a5-836b-6a9996a86eee", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612377, "uuid": "1e3e5aed-bb9a-48f0-98b2-262ce8e71c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612377, "uuid": "97e2b0cc-5653-4e8b-92a0-180aa3116379", "value": "zam\u00f3wienie 2001135249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fae020f-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555635, "uuid": "dba01c45-f1d4-4033-87aa-3692ce006a80", "comment": "Malware payload (Dridex)", "value": "30ad229dae9312871dbef376a838e622", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555635, "uuid": "2a384ac5-0b2e-49bf-9962-07b9819b17a0", "comment": "Malware payload (Dridex)", "value": "013c15959b2da0bc16fb81ba9300df00af6532c45eedfd588494d7f8c26d9a2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555635, "uuid": "76b1f68e-0143-4b09-88ee-737609778539", "comment": "Malware payload (Dridex)", "value": "0f651ee69ab7502f2ce7a8df4af6bc2936d84695", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555635, "uuid": "8179acc1-10bc-4e73-a389-180f61cfbbde", "comment": "Malware payload (Dridex)", "value": "e31be04c05b2f1ba71c68e224b83802fe4451380acd110ad557cb8fcbb364c03055ce47c02edaceee89f728221fca6da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555635, "uuid": "e621a2e5-9905-41a1-a968-20734d51ee80", "value": "3604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555635, "uuid": "cfb9bf0d-3bc7-4eb9-bf11-1a6b699bd925", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555635, "uuid": "53edc19c-372f-4ddc-bfd0-f2dfbaaf18b1", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555635, "uuid": "8613497b-77bf-4d10-a039-f5e78c113fbe", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555635, "uuid": "72dcc33c-f32b-417e-8ac9-e966b52dbcba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555635, "uuid": "4e35d59a-b41a-4cbb-8060-7263ee7005c2", "value": "30ad229d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea909a4-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623977, "uuid": "dacab6ea-d7ec-4a24-8b91-4ee4187d04f7", "comment": "Malware payload (Dridex)", "value": "2c22d4515f86867982444f74f5618e74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623977, "uuid": "18fc2212-dd46-4163-a7fd-836b37acf99d", "comment": "Malware payload (Dridex)", "value": "014d14903a45ced72d7a6346f44846e9fe8779bcaf5320c1c29a6f28e52dc166", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623977, "uuid": "db787ac9-5757-4254-83a0-1f51a7e7eb64", "comment": "Malware payload (Dridex)", "value": "310096f40768a08e8a81c89f76f30e3d390967a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623977, "uuid": "de8d6b96-c627-4814-b003-765b91be6243", "comment": "Malware payload (Dridex)", "value": "43abf0397ba6b6394fd1842de36879df113a29ffbabe8e7b6b3ecde4c9db3fdfc0e151f7f332a2de1301f0352988684b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623977, "uuid": "db99678f-ab40-4d1f-aaed-ec5513e6da14", "value": "7DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623977, "uuid": "8e6cb809-21c8-472a-a643-efdce3a77d47", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623977, "uuid": "7c1ea36a-6393-4ae5-8c71-24d459252f3b", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623977, "uuid": "cad0f327-3cc2-4a2c-9a03-7554469b5006", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623977, "uuid": "1fd145cd-8245-4ff3-9d8b-accbf674c2eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623977, "uuid": "914335b3-62c6-4101-a8fa-445309c13b23", "value": "2c22d451_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de32c00a-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584570, "uuid": "8e916080-9c24-42cb-8f44-564c269a2571", "comment": "Malware payload (Dridex)", "value": "22db1c626514a4969dfab91b70dba406", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584570, "uuid": "f330a19f-2397-40d6-b3e4-23e791279b5a", "comment": "Malware payload (Dridex)", "value": "0168f62f5e6c53614dce89a602e154b78d96e586c175aed0e8bb2b58fc1fe4e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584570, "uuid": "696626f4-ab6b-4863-9597-3eef6a4aa4ba", "comment": "Malware payload (Dridex)", "value": "81db91c30f014737e07f13e850dd8d9d869d2664", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584570, "uuid": "533a47b6-7441-4bed-94e8-b7c77dffc6d4", "comment": "Malware payload (Dridex)", "value": "8f161c7ce0403aad69c479ef1c08f7e52e38484b2361e6e73ed6faf6f1f226e2a212d799a7e33c9c44d57eeb5eb7c8f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584570, "uuid": "d41bbb77-d3d7-4e73-ba2d-3ab53ddb6c99", "value": "5604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584570, "uuid": "aa1d71c4-ef50-42e9-b070-3b8c47ae0835", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584570, "uuid": "20673f97-3d9d-4107-9b5e-c20013bf334a", "value": "3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584570, "uuid": "28b59ae5-5092-4acb-8432-5c418d4efecc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584570, "uuid": "19916a8a-9631-4b6e-a3e8-078c81896f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584570, "uuid": "79315118-a21f-47c8-ba83-81c5257d563b", "value": "22db1c62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3177e3-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581964, "uuid": "693d195c-ff7f-4062-a225-6af120d92798", "comment": "Malware payload (Dridex)", "value": "ece951afd058bbad92be067f4d11548a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581964, "uuid": "5a83dc1a-72c9-4d53-ac71-233e79698b5f", "comment": "Malware payload (Dridex)", "value": "01aecd24a4f18d4882a9c39b8e89b62baf4666f3e9df0a5ea15c666ad6599d2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581964, "uuid": "47f86100-f48c-461c-ba05-da5dbe66ea8a", "comment": "Malware payload (Dridex)", "value": "dc98c09c8704109ea8da249a333491c32b2e4ed4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581964, "uuid": "0f7dfff3-e2ff-4468-b0b9-6d2be8f2fd99", "comment": "Malware payload (Dridex)", "value": "43911191836a67ca2ef73a020c00715ede2a05ce264d22eeab3e08a38622f24865a02f51d93fdc5ab58d514bfce303cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581964, "uuid": "f62260c6-4545-4054-a01d-3153e92df240", "value": "55F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581964, "uuid": "b2d2451e-fa96-4182-b79f-234fca76c5b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581964, "uuid": "865f6787-52e8-40d1-af47-9335f6e97855", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581964, "uuid": "58795394-ac68-42e2-adae-fdfe829a8ec6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581964, "uuid": "57b674f7-4a82-42a2-9577-217c33b43ee4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581964, "uuid": "d35e7bb3-c05c-409e-ae0c-a3642d7a87ec", "value": "ece951af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e1848f-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613062, "uuid": "4908ebf9-80a1-4499-88cf-201716910c86", "comment": "Malware payload (Dridex)", "value": "5db3c1abab1488449c19160d15c45c14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613062, "uuid": "f69af97b-e014-45c0-847d-e694082a97f2", "comment": "Malware payload (Dridex)", "value": "01b6858f956b7aa326670db08569670bebb2cfb8fa392a1e12d701179f9b8b16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613062, "uuid": "b679485c-6989-4f9f-ba50-8cfe76ef47ff", "comment": "Malware payload (Dridex)", "value": "11af1ae2766fe548dc6475255e818011692da9f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613062, "uuid": "4da2eb4e-fca2-4624-842d-eb67d05c3ec7", "comment": "Malware payload (Dridex)", "value": "64f35b671cb64c16f27484e8c9ecf981bef93f4c5a0026fe72cfdfb54c32faf54281e48310d40479333a7e8bb8a19638", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613062, "uuid": "5d3b96e7-197f-4cac-a209-d1c782a1c732", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613062, "uuid": "696a43de-0489-4184-a8ac-18048a3705a4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613062, "uuid": "107b571e-6cb7-4cfe-a711-a2c085a258ad", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613062, "uuid": "09a65df4-b152-4416-80cc-d142e119d310", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613062, "uuid": "8b6f98d8-7c27-4a80-82e3-b9cc35abef6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613062, "uuid": "ea804111-8bb0-4220-ad67-b6af37617643", "value": "5db3c1ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41afd230-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611795, "uuid": "4276e131-4838-4c68-9b80-476d3c09c47b", "comment": "Malware payload (Dridex)", "value": "aa948fef684f9034481e8ce91d318448", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611795, "uuid": "9aa2df05-d9ba-4c2e-a23b-7c389cfa96c1", "comment": "Malware payload (Dridex)", "value": "01d281983cb3cced2a75a3ec89e3e37241e9ea19f64e8fa322f07fba57fb7312", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611795, "uuid": "6da82ea5-5401-4b78-aea1-10e70394643d", "comment": "Malware payload (Dridex)", "value": "321a4bc4bac825809236648c3403ad05c938166b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611795, "uuid": "02ffc96e-2f52-4891-b80b-457c661dd9fb", "comment": "Malware payload (Dridex)", "value": "b08e7b999b5d56ed95ad6c1395e1c685e0992e08601f6c11b4df6347f60058578b2e4558a77da8a23dccdcf57b74117b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611795, "uuid": "07a28ccb-a04b-4685-8bad-0fd4e4535468", "value": "7604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611795, "uuid": "8a91b949-b175-4e93-b724-f7ac980bdbde", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611795, "uuid": "5cef9772-c6eb-4998-8891-2ae548984a89", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611795, "uuid": "8e3e9dac-6f0e-40ad-b0f5-1e59d47f30ef", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611795, "uuid": "171fd692-63bd-47e9-9d57-316af4d7b40d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611795, "uuid": "25532e4e-d1c5-409a-b407-1cf683fdd4f6", "value": "aa948fef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cb7e84-ba24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621595019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595019, "uuid": "8d035731-0f02-4748-bbeb-3d892eae8b1c", "comment": "Malware payload (Dridex)", "value": "c94e95a848d05ee404523e28f5f7483e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595019, "uuid": "19ac0e8e-4d07-442b-8a3c-2f033dbfafea", "comment": "Malware payload (Dridex)", "value": "0226605705e3c27d67b869cc6b44ecce2170dac62a8c9aab8be2971da79d0370", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595019, "uuid": "f6b369e5-3cc5-4815-91c4-35e3b84f053c", "comment": "Malware payload (Dridex)", "value": "0cb26f0f518258c7f9f5c332dcd51a2643ef8ae6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595019, "uuid": "2bfe0073-04cc-4721-ab87-23b64569fe96", "comment": "Malware payload (Dridex)", "value": "e7ea2d9470d51948cb174ad59a86db85ecfe274c76116f1f70e4d45e6e6dc0aaa4a91584c3906c50225306a6af3f9329", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595019, "uuid": "150b0471-1752-4993-9980-127d8cec385e", "value": "5104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595019, "uuid": "d3ab34d4-2654-4f6b-81a0-80ee94cc07c0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595019, "uuid": "d0c108ef-84cb-4830-ad72-9cf6fd4ee7d0", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621595019, "uuid": "48d87f58-a646-40b7-b7a7-108de7d86d34", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621595019, "uuid": "971df618-9de7-47be-8aa0-0290edc6869c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595019, "uuid": "b65452ec-0547-4d50-8b5f-fcd17ed5ed6f", "value": "c94e95a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e97b3ba-ba59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621617749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617749, "uuid": "5a2015c2-777c-4246-9e35-efa44b6df25b", "comment": "Malware payload (Dridex)", "value": "d6516fc0b3d1d927997a2b7e4cd81ee2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617749, "uuid": "e6f5845b-d375-41ba-9e41-397cd750df93", "comment": "Malware payload (Dridex)", "value": "0230ad0200bcd6b53c788a06698b5050247fff69409298c9576c44d37442a0cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617749, "uuid": "781c2566-ddad-4bbb-a140-b5c1fc8a1e83", "comment": "Malware payload (Dridex)", "value": "d19885f84e0919199b690e0e8025f53093851a22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617749, "uuid": "a66c090e-1a51-42bd-a623-4760d7b0a476", "comment": "Malware payload (Dridex)", "value": "f9c835f53d44de011ce647e9a807539496f866bbff90c2a8607f5f06ad21247affc0e0848e7bb97676a8b4a794cb216b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617749, "uuid": "cfd7110f-90a0-4904-89e0-e120673323d3", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617749, "uuid": "8c4c7417-31d1-4cf1-90c3-b09d0bf06535", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617749, "uuid": "4e20f3a2-b2bf-4834-a07c-a60ed81a58b9", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617749, "uuid": "911a009c-3f43-4928-bfe5-e622dbc9dd47", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617749, "uuid": "f8a9b3ca-322d-4512-84c2-cfe42fdcc97e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617749, "uuid": "794f4703-2d8b-4e61-bb21-a5bb207ae6c4", "value": "d6516fc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab10785-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573101, "uuid": "01758490-d041-43eb-9608-68dc55cf545c", "comment": "Malware payload (Dridex)", "value": "761f47468e1f05b4e9279929218a0da7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573101, "uuid": "4199b635-c0ea-41c4-9513-59433a754947", "comment": "Malware payload (Dridex)", "value": "02cdfdb8b676da1a389c8d7860462190778ff41e2184b62a143a13ac7cdc997b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573101, "uuid": "dc4f70ed-9adc-41a8-9495-d772e11d2974", "comment": "Malware payload (Dridex)", "value": "9e8373743ccf571f69acde83cd7dc0e8453fb173", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573101, "uuid": "1d90422c-ad6a-4887-ba7f-3095ff81d67e", "comment": "Malware payload (Dridex)", "value": "4012aacde40b18a8260f3febd327d89ebb26a3c863e8c31c7181e886e65833383ede131930ec732199a4fce2cd0dabbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573101, "uuid": "c10da17f-7430-47b0-bfc0-93ae710139c5", "value": "CE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573101, "uuid": "d90b1a8e-d2ee-40b7-883e-9fc3979c2d75", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573101, "uuid": "56fd5856-5cf7-4213-80a5-8145e0a59b6d", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573101, "uuid": "5fc3e328-eeb7-45ac-b6ea-ef51f7e3015a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573101, "uuid": "191f8abb-a35a-442e-a855-04cd205799f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573101, "uuid": "f0d714f1-e1fb-4c6b-bbc8-18868b40a5c0", "value": "761f4746_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273f5cff-ba44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608744, "uuid": "0a1c74fb-c618-4143-8d89-8d8d439ce2be", "comment": "Malware payload (Dridex)", "value": "1ce531f3ee34ec24e0a413581c16435a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608744, "uuid": "893e51b2-f15f-4a41-abb3-fefdd70c8cef", "comment": "Malware payload (Dridex)", "value": "030f53eb0492f025ae81ee173242ab13360f033ec562feab03a4adafe6616649", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608744, "uuid": "1e32a727-066d-4811-a417-99e4f31be34f", "comment": "Malware payload (Dridex)", "value": "15b3af33f36f5917065069b85c777d023c0836f4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608744, "uuid": "17bea686-9db5-45d6-a964-f71c6220bb9d", "comment": "Malware payload (Dridex)", "value": "252c3ddfe4c8ab8323bb8cad9d04bc6d2fff3911b725b391ad8e771e23ddc222cadd11342193397b8b8f3a76e2e8bae3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608744, "uuid": "ed8a3ea2-f9ce-4ffe-80b8-da121236f7d2", "value": "D304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608744, "uuid": "29d34554-bb95-4044-b684-4236941887f0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608744, "uuid": "d129b6af-9b87-4ce0-91c7-657d217b2dd3", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608744, "uuid": "e3e720be-c15e-481e-943c-5d0a3640b476", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608744, "uuid": "dcace87b-ba74-4d78-ba77-2ebf0fc87e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608744, "uuid": "f3a637bd-548f-4810-a913-da4d7ef45a4d", "value": "1ce531f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e6a6f9-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563215, "uuid": "275d921d-eda8-4429-93ba-4a75e1241293", "comment": "Malware payload (Dridex)", "value": "62e8c36ce1051b76494678df12115c20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563215, "uuid": "30ee535d-897c-42a8-b9ef-73666e3a667b", "comment": "Malware payload (Dridex)", "value": "031b858dc90f3e7f96fec1051f3d9d65667632ff6670c29aa811f3e69d687c6e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563215, "uuid": "7ae1e638-cf97-4d7a-bf4f-1504ffe0d5a1", "comment": "Malware payload (Dridex)", "value": "a764e08c9dccc62611a3f1ca62f04417614cd801", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563215, "uuid": "f69cefaa-d988-47e7-94fe-bfd4e43d7641", "comment": "Malware payload (Dridex)", "value": "87cbcbcf4bb0ffaf8f91e79314a9bc61cc6051249506cb42037c5c2c9d86d6c2e56d8cd7e53424ccf4113ae523300b6f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563215, "uuid": "7330b7d2-82ee-49df-a150-53dbe8cc6bef", "value": "DD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563215, "uuid": "6af160f6-d1fc-42f8-b5cb-1b373ebd422c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563215, "uuid": "835b062d-1509-4b1f-9389-37562bf3d90e", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563215, "uuid": "4b02976d-5d47-48fc-a141-c2901aa70781", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563215, "uuid": "17a5b5d2-1e62-48ab-8a4f-f54461d1d102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563215, "uuid": "d02c61f0-94d4-479c-b2de-667a45ab37c6", "value": "62e8c36c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899ae4a5-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610197, "uuid": "aa736934-bc4d-43de-94b1-a93a979cae0d", "comment": "Malware payload (Dridex)", "value": "98cb70b5f50fca7e40d3e859cab49666", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610197, "uuid": "c72ea600-f063-496d-b188-2fc8decdfffa", "comment": "Malware payload (Dridex)", "value": "033fde3167b4ce5b177eb26c0320d8a61786383afdd9888eb79f2f2ddd1ee52b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610197, "uuid": "22e7c8f1-d311-4e77-b29f-bcec67c86bcb", "comment": "Malware payload (Dridex)", "value": "c8e017a121d813467189bf010257c0a7702d2dde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610197, "uuid": "b4baac22-bdc8-488f-8d19-21dee5af799c", "comment": "Malware payload (Dridex)", "value": "da0cfdc16a82cf6d0a783b3a0abc515ffc40e100b3ba5db41045fff96637a51fec3d3270b49378c268689dcea9fb9650", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610197, "uuid": "a8624d90-4924-4463-89ae-7aa88113ba99", "value": "B704B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610197, "uuid": "ce7e1688-c217-4805-8062-aab713d3b7b9", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610197, "uuid": "258707c9-818b-4576-9774-b2d3d31138d8", "value": "3072:cWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:cWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610197, "uuid": "3627c435-8582-45ce-84f0-297a5ff77c86", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610197, "uuid": "417badec-d647-4011-ab82-989283063854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610197, "uuid": "304b3ad4-3d64-4c74-8a83-bf6e7082370f", "value": "98cb70b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b36c7df-ba06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582149, "uuid": "25099a25-ad81-4db0-8c79-d28d80759261", "comment": "Malware payload (Dridex)", "value": "c4dc13576d9a34d1d91bdf757a5a3d0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582149, "uuid": "f8b585ce-d109-4691-aca2-e81c3742dd4f", "comment": "Malware payload (Dridex)", "value": "04089b8cbfc047e4b559f9092fc045dd3e1af7f7d69fb9574ff4d7259061320b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582149, "uuid": "b5cd2632-37d4-4b4e-b123-7d949c734312", "comment": "Malware payload (Dridex)", "value": "d868f97ddd44dc3f94ea81bf65a5f87e72bbd0c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582149, "uuid": "f43813ec-5d1f-49e8-b5f8-f1955492ffd9", "comment": "Malware payload (Dridex)", "value": "e0f80550cec913fad4fdefadd558d6468a5a94aa97f489ec195bb07b7069d495af98a2297836b99bc7eedfcb75bd4bc3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582149, "uuid": "3ffe453a-8b0d-40fe-8772-2b793bc254c3", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582149, "uuid": "6778beda-e4f9-465a-a5a8-b68899ae8943", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582149, "uuid": "f30b2f12-15eb-4d73-baa1-24d0c9d48506", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582149, "uuid": "7909672c-38db-4021-85b2-6ab0aa1071e8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582149, "uuid": "d68deb19-a486-42a0-86b7-196f628c609c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582149, "uuid": "5807873c-c659-48d3-a7c6-357d7e1f72ca", "value": "c4dc1357_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0732667f-ba5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621618569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618569, "uuid": "f2579c8b-dc12-438b-9069-3e86dc0042dc", "comment": "Malware payload (Loki)", "value": "0dbcdedc374c1be61233c8866f9cd1f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618569, "uuid": "aa69cccb-b9a0-45df-a2c1-55e522a1e1ef", "comment": "Malware payload (Loki)", "value": "04155be0258982ae7bde2684de0f28e6344b8efd2d5c9189af8e1fb522d7900a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618569, "uuid": "8a00e22b-240e-4062-bb46-4b656d2a787c", "comment": "Malware payload (Loki)", "value": "d09b60dc7c88483a01a02bf96cb7f79dc71f7b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618569, "uuid": "15e0b10a-9594-4751-97b8-7cd21b9d1cc5", "comment": "Malware payload (Loki)", "value": "915d24aae11cc7ec506d857b73a2f967a5bc347c61fe89c7afafa0e902b9f5ed58378e28a2791c94527b3d9d5d879cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618569, "uuid": "981c5287-3e0d-4ae2-90fc-7247c31fc1f8", "value": "DEE4122333DC972BC27D2A3404A1369082F5E9992AA2D75E2DC9B1DC6BFB345C751393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618569, "uuid": "43696b45-9112-401a-bb82-bf7a902017bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618569, "uuid": "b043165f-69ff-4766-a056-f9697dcd6272", "value": "12288:o0BZvZqcTnAKzcx27K1aowna2CDAjQ/nViTZ011MP2oITs3qEOUu7Fpj:oEzcx2oaownarDAkI011NoSEkZpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618569, "uuid": "7fc3f901-b9a1-4510-b4b8-41db2308aff9", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618569, "uuid": "00444305-dffd-488e-bccf-0c89a5f7048b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618569, "uuid": "91c4d5af-08a0-4be2-a1bf-a039d345285c", "value": "QUOTATION-FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27cd0c6-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621613702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613702, "uuid": "4abda832-12e7-4b23-bbc1-a2f769b27198", "comment": "Malware payload (RedLineStealer)", "value": "fecae53b388e5dad7298833f8f72ef8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613702, "uuid": "f5c76d37-d1ec-4320-ae18-578f782c321b", "comment": "Malware payload (RedLineStealer)", "value": "0437bb741978927c6c8f391116bab698dfd80e58deab1bba8dd8cfdcccd24e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613702, "uuid": "33888e3e-c48c-4e33-b2c3-8fd477f7f89d", "comment": "Malware payload (RedLineStealer)", "value": "e6fdd0171ecb11d70ca048705ea531acaae85feb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613702, "uuid": "052c685b-feff-4ce9-9b57-f5bf425a1ed6", "comment": "Malware payload (RedLineStealer)", "value": "a89e4561481291cd36ef395e8bca42720fedeee6c0d7e5de2d5d476e110f0d2f5c4321c621a6c2610aeab4f8423e5732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613702, "uuid": "49e80737-4bbd-42be-ab1d-9a1c59d66689", "value": "D64559503054CC08D72AB639DD9990F403FCDE85D560C22B78AC7F9937F2B26A52BE99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613702, "uuid": "44725038-76b2-45b0-8cc3-266d9dec9d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613702, "uuid": "1ee6b94e-6a3e-49a2-be3a-69d7f842c9f2", "value": "12288:XXQc6MW79sPwHXaLnQaeDGoZu83Wl4KNpXgcAzqWGs4G6JGj8kh:HQcpWJsPwHXaUz/ZX9KPwVzLGtkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613702, "uuid": "e9a260ab-4a52-4315-ab59-7c928338b50b", "value": 1221976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613702, "uuid": "9149a044-3c0c-4078-938f-196bd594d954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613702, "uuid": "db248ebf-5d48-48c6-90ab-7b3e748fe196", "value": "fecae53b388e5dad7298833f8f72ef8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d96ace-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571006, "uuid": "ec2e1ab2-13f7-4535-bd47-e8cede72e3c2", "comment": "Malware payload (Dridex)", "value": "9d7d928747beda14d597d0abbab41a40", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571006, "uuid": "11a4241e-69c8-412c-97eb-8b8e037fcc83", "comment": "Malware payload (Dridex)", "value": "049dd9ee196639a479af1d72d6197f98847547fff6f85afba10d8ecdc9f4e0a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571006, "uuid": "a7d97d89-40f2-45b0-9232-58e725b9bc5d", "comment": "Malware payload (Dridex)", "value": "8da65ab48b1e66f3933a2afeff03ee916a6cb3fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571006, "uuid": "b2a61fa1-2812-491f-b45d-9b2d4c760b0c", "comment": "Malware payload (Dridex)", "value": "080a851ae6c0197bae7b8bc58b7fab01198db63cdf2eac9b8bd0bd7028c40e00cace101725a6395527ca2228083748f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571006, "uuid": "c29e3be8-7a3c-4067-b535-326100c200aa", "value": "6604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571006, "uuid": "8e078709-5add-4e8c-8e50-96ab351adf23", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571006, "uuid": "50d9afd4-36f7-403f-a5ec-db7aefe562ed", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571006, "uuid": "883997d3-87c2-4bb8-a733-34728bab3a78", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571006, "uuid": "e0141051-88a8-4fb4-b5e8-05affd9f3c51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571006, "uuid": "77dd4cdf-d088-44af-947f-26b995e04545", "value": "9d7d9287_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b23268-ba2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621598917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598917, "uuid": "4e93917c-9ae6-406b-a679-d62ad2ef94b0", "comment": "Malware payload (Dridex)", "value": "18590e05678fdc8cab4c49a29bb4a9c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598917, "uuid": "09eee9cc-3279-4ac2-857c-a083bf3ec6f3", "comment": "Malware payload (Dridex)", "value": "054b82f45be2a7a267219d11cbd15a535e9f5e855a4757668a4dc7b3a0a43a92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598917, "uuid": "5fd08762-062a-4e49-80c5-bf072b03ab84", "comment": "Malware payload (Dridex)", "value": "61178be106891c4ce435cafd50c02de79c0412e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598917, "uuid": "93ab878c-2636-4819-afdb-85b1f7d49b9b", "comment": "Malware payload (Dridex)", "value": "fc228a73f1c06b3994e97755aa2faf0cfeef58dacf5812600ddc4a9b492991ffbc97c731ce9577b76b35934bbff8ff39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598917, "uuid": "e7e769c1-5f54-4c80-ba9c-a32a25a3960d", "value": "2F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598917, "uuid": "9517e8b6-8146-491e-ae0e-9881edbbfb44", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598917, "uuid": "a454961f-3e24-4a73-8956-56dcb90b5d86", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621598917, "uuid": "5d7eed6f-c745-45ad-97c3-8d69062ff708", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621598917, "uuid": "c050672f-8f0c-4629-af1a-e6dd9e158d32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598917, "uuid": "b6469a21-f7fe-409e-a17c-a916f1d4ff27", "value": "18590e05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9179036f-ba01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580146, "uuid": "1ff66f69-8e45-4d20-bfcb-6b0fb23611a1", "comment": "Malware payload (Dridex)", "value": "240df86cc2aa0fdf0f83d1d09a63ec98", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580146, "uuid": "7cd8df66-519b-4e74-a8bd-367e594290dc", "comment": "Malware payload (Dridex)", "value": "05ecdf35d1018af9da4aa9cbb25a5b3c3759629b7e3c9672f6ac1ea81402a9d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580146, "uuid": "7b779330-fed5-47b3-84a7-77074cb20bad", "comment": "Malware payload (Dridex)", "value": "2548d1f2e8ebcb63421b2269443a38907dc6c372", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580146, "uuid": "e35bef8f-6a62-41fb-b238-58eec8e82654", "comment": "Malware payload (Dridex)", "value": "aa169888deb464442a2a317681c2a8c5a108a8327a753ed6e833ee530d2c92bb9305b61aa3990e7294ef7eebcac2d71a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580146, "uuid": "53e29dae-e087-4b90-b34f-ac1bf3acff68", "value": "BF04E0D0C6C62687E4A7DA729CC17D2A57356809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580146, "uuid": "c6254668-46a7-48f5-b46c-b7a685b9560f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580146, "uuid": "bf91b08e-877e-41f1-a697-f57c456d2535", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580146, "uuid": "d8dc442e-ce9d-49dc-910c-e377d6b8337f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580146, "uuid": "393e575a-807b-482b-9bc2-cecb833c3dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580146, "uuid": "fb352b2c-5f85-4fb8-8d5c-79ae99018067", "value": "240df86c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae66447-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588027, "uuid": "9c6c6152-1c46-457b-b39f-8201dbf122a5", "comment": "Malware payload (Dridex)", "value": "17ed9517809e5d0241bd028f9b5c9692", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588027, "uuid": "6c902185-1b64-4ed8-be8a-c0e3e6f204ba", "comment": "Malware payload (Dridex)", "value": "05fec54f0baccb32f519fec2392e7a0163fdb9caf359b7d57f2c9d71ebeb35fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588027, "uuid": "3544b321-d2c3-4a3e-a88e-a15b4441e445", "comment": "Malware payload (Dridex)", "value": "479bf5058e09b3d60f16dac235083a2ea94ec149", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588027, "uuid": "228f31ef-afd5-4a6d-8509-92f704e64de0", "comment": "Malware payload (Dridex)", "value": "2dcfc152784e995792e3b5ec1169b98d33736657cbce1e6ede8267e450783b79894afd3ede57a2a9a478520e50c87c63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588027, "uuid": "f9438cdd-d7fc-46c4-97f0-2ac48850efb2", "value": "B404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588027, "uuid": "b5f64939-4379-409f-b258-24a199a12cb7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588027, "uuid": "ed9223aa-f4da-4c5a-b724-9ac520c8d406", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588027, "uuid": "51bcd9c6-dff7-4260-947c-78518058645d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588027, "uuid": "4a34361c-185a-47d0-a99a-128e7156984d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588027, "uuid": "27bad3e0-5621-45bb-877a-118c7e65f5a9", "value": "17ed9517_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36889c2-b9ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571613, "uuid": "840c429e-b4ec-4b0c-a021-20ed4b886aee", "comment": "Malware payload (Dridex)", "value": "630f8d08ffc1399892ed07231d798201", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571613, "uuid": "b6acfb4e-61d5-48df-bcd6-1521425feec9", "comment": "Malware payload (Dridex)", "value": "064a9a356550eda8365b572a357c7b779ffae1e360c795cdda2a00bf5baf70fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571613, "uuid": "2799faa8-a58e-4f14-b667-66ecc269c67c", "comment": "Malware payload (Dridex)", "value": "cc0b4d1cb83b0b682bffb8c1b2087fb7bb99a709", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571613, "uuid": "07d53955-e01b-49c4-9b69-cb4f9f069fe6", "comment": "Malware payload (Dridex)", "value": "12b3a40db98ca54ac9651ff5a0b0189286a75e933b19db261cd2a3a1b55ee1d16b1eb8100c63f2f8ac0580ccc8c0ad3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571613, "uuid": "3b5ca19d-90c8-41ba-95fa-480004a7f179", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571613, "uuid": "5876103b-9315-43bf-b27d-14e264a12c74", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571613, "uuid": "baada23d-5a45-466d-9747-f93afca76f97", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571613, "uuid": "086beec4-2e13-43eb-a93e-bef6a69a26e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571613, "uuid": "dd2b6ae0-b75c-4c79-b220-5baad5019921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571613, "uuid": "4c1f64e1-3059-4300-8d55-c0dcee0d6736", "value": "630f8d08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba64909-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610255, "uuid": "940a6039-24cf-4a6c-99e1-88199fe775e5", "comment": "Malware payload (Dridex)", "value": "c769bc355d5930620bfdd614d5a6bb69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610255, "uuid": "83b1ae39-9752-48b0-bf5a-104c349742c4", "comment": "Malware payload (Dridex)", "value": "064e780bb29b97d5eb40b90955ee8e74ea016a06f9d0b10702d57695590b79f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610255, "uuid": "d620a747-82d4-4212-9966-4c09531ec598", "comment": "Malware payload (Dridex)", "value": "243472201f8ca9d3719e1cc46ccf6afebb55ce67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610255, "uuid": "b2409d9e-9b0e-47c1-aef4-54b9d604d0d1", "comment": "Malware payload (Dridex)", "value": "bfb86b0be0eb4cd55b5e90434695cd59b9dfbaf0f353e2cead84f3dd9ce2f4e3b077740bcd8b75d3b5a066b91328b888", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610255, "uuid": "3ff66d1c-2d3d-43cc-b428-4006265af52d", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610255, "uuid": "512df75c-e448-41e3-9d6b-3d37f6e08863", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610255, "uuid": "ff01f278-736b-49ab-865b-15be89425ff4", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610255, "uuid": "40aeaf63-927e-4f51-a2e5-8bedff0e01c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610255, "uuid": "aee44fad-fd8c-4972-8d31-0dcec7ff38b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610255, "uuid": "a5a15341-84fc-4826-bf08-728932cf47da", "value": "c769bc35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0c055b-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577026, "uuid": "dcb4ad0d-2c2f-41f2-9713-315eb9b3f16f", "comment": "Malware payload (Dridex)", "value": "9c6827a95fa99400757830f50f19fcbd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577026, "uuid": "eda0d53a-c880-4414-805f-a219f8b9df72", "comment": "Malware payload (Dridex)", "value": "06ae8284ab8eee3728b7743630df0f7434a2cb1f2f3955c9afda15a7f08eeaee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577026, "uuid": "89583585-84b5-4c9b-a5a2-d82df46baffd", "comment": "Malware payload (Dridex)", "value": "294f206d91cd187c6ae179f81e57793692d8fd89", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577026, "uuid": "57f5a4d5-7fb7-40dc-8057-66ed7c5c479b", "comment": "Malware payload (Dridex)", "value": "023648d23da2cfa0d33b43b24ad4d9e75f62a7133666339ffb42cfee3781f44eb84cb27a69cfacbe3dcded8664da85d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577026, "uuid": "120d9e6b-e61a-43e2-840a-1736355df05a", "value": "B504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577026, "uuid": "c4b14080-10c1-4b42-8eca-7bec103dce80", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577026, "uuid": "814c4def-64ac-4144-88bc-1072b83bbd7c", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577026, "uuid": "3cc71fb2-2224-4c88-8e85-cd89a52929de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577026, "uuid": "82a9c9f1-a84f-46a9-a565-8a5202c99f25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577026, "uuid": "20cb3bcb-b9c5-4d30-b758-7d69ad10aceb", "value": "9c6827a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2d6c4d-ba2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599414, "uuid": "6b705b09-6ec6-41b8-99c7-527b51ade506", "comment": "Malware payload (Dridex)", "value": "048aeecbfa010ef617e1e7b0cf3c5b12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599414, "uuid": "e6b18de0-3f92-4632-acc1-12bf035804b6", "comment": "Malware payload (Dridex)", "value": "06f1fadc6f514de77a8259dbce4ec1b4199bc064b5ec94174aefaf8451a193ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599414, "uuid": "c812fa80-8944-47b6-b47d-9cd4d51d90b1", "comment": "Malware payload (Dridex)", "value": "f03c3d1f3e2fb3d15a55c0428604db4f520e64ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599414, "uuid": "436c0f82-f154-43fc-985a-b6e0a599f659", "comment": "Malware payload (Dridex)", "value": "8324a23ffe1720bd6a0c036613890ec78f42c8c0c2d2552db15d2c7f35e5ac4952fd70e437cc1d36cdf7edfadf1e54c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599414, "uuid": "4d45b182-a89a-4058-90d5-a0504e678cc6", "value": "5404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599414, "uuid": "1ae5f127-2ad3-40ab-b3e5-dcfed812a7e7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599414, "uuid": "d6f69142-d58c-4683-a7ea-a1f4420614e6", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599414, "uuid": "372a774a-2bf4-451c-80fd-4ce8fd03ded8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599414, "uuid": "4efab4b4-6700-435b-b193-391ce2bf032d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599414, "uuid": "0e36f361-620c-4c59-8192-854661a7d117", "value": "048aeecb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4cba01-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565826, "uuid": "80279a8f-8436-4681-8abb-a96f53eedac2", "comment": "Malware payload (Dridex)", "value": "7448a3081dfa2e36eb0b4ec1a414a872", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565826, "uuid": "08f86c76-dcde-4018-a204-7cd65f90519e", "comment": "Malware payload (Dridex)", "value": "070864b53a73e23b286cf0ece8c48b30674093dcca223169df957080bc3a0a2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565826, "uuid": "4be0b1e0-3fe4-4b64-9839-68cf7f19bea4", "comment": "Malware payload (Dridex)", "value": "47441393c991485032471d5501c285fcbea3dc90", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565826, "uuid": "46e2d075-e93d-42b4-8927-eb06c5eeb43a", "comment": "Malware payload (Dridex)", "value": "aced82366f0ec36ffff2babbaf4d43aa1fba3cbe2e7ecf54a9b75351a16a47f884de56b00cdf160a06943fbec0392f3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565826, "uuid": "813a83aa-fb7e-41da-af98-559ad06b141d", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565826, "uuid": "aab41e5f-ef4a-41cb-9a2c-da1879d1a983", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565826, "uuid": "eafdbac4-9673-4085-9590-e3d607323020", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565826, "uuid": "c8f858d7-b573-4695-9ad2-8b42f721876e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565826, "uuid": "5982c4a1-d6d9-499b-9914-d033ccea00e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565826, "uuid": "96d88dc3-1d7c-429c-a550-8b87e4a808fb", "value": "7448a308_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5476480e-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634590, "uuid": "691f7083-1bc0-49dc-b522-df06935da7c7", "comment": "Malware payload (Dridex)", "value": "ceea553b6e817c8ea18fd6c17e4845fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634590, "uuid": "5dbc8a35-2fb0-480a-9130-80c3ed2a6c7e", "comment": "Malware payload (Dridex)", "value": "0877c46666f8568385dd4bc1bed2827bb133834c93291c59746dfe3cb0f962fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634590, "uuid": "8112fc9b-e539-4801-aba1-d1402eb4820e", "comment": "Malware payload (Dridex)", "value": "b565e4f4ee6dea66a56db8cd4bbba634b487d808", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634590, "uuid": "7aafd2a8-cba0-465e-a640-c5c0f4e44db2", "comment": "Malware payload (Dridex)", "value": "83c1c84563a87b0c7b7f1d8c3f2dbf883f306e5a0e53c25ab19799288a0eb23b5a3cb0fdde0e9f7f70f349d9e2d540e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634590, "uuid": "e74851f0-6372-4dcb-bff8-5d3b74811759", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634590, "uuid": "6be9e6f5-7586-4319-bd0d-573db37fbadd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634590, "uuid": "06eda571-a52f-4e0e-aa4c-d93872cd8d12", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634590, "uuid": "51572b12-6b2e-4639-b96e-129af34cf31d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634590, "uuid": "89ee3fcd-d736-421f-8752-d9044152bf73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634590, "uuid": "9237371b-6521-4818-9000-fa9be95b23f6", "value": "ceea553b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7d463f-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563097, "uuid": "1f31c164-8bf5-4068-a12d-69c046ea2e4c", "comment": "Malware payload (Dridex)", "value": "2f7037c6af6b08ab84e0e5b63ce65c64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563097, "uuid": "d581d054-6c3c-42ed-b8f6-e4a026a35a1f", "comment": "Malware payload (Dridex)", "value": "088a75da3561290fc31e5afe085e749b755509a9f33335cf7f3e888be7a446e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563097, "uuid": "96d53df4-f7b9-44da-a2ae-535fd94927bd", "comment": "Malware payload (Dridex)", "value": "4b459da33e733b5b430327ddefdef2ec6fd601c1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563097, "uuid": "59b4743a-0a07-4def-8d41-7084061863b1", "comment": "Malware payload (Dridex)", "value": "4fb7e21a1551e5bf9b857f522c546a79349880782b3c38002de259ef14da5ffce8e4628a180bff8e3df13f3d4bb2fc18", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563097, "uuid": "d2bb33d1-83b9-467c-ae78-8aab04709e4d", "value": "48F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563097, "uuid": "6c790134-419f-4072-9f3f-bf16f48b251c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563097, "uuid": "6961bd98-2d6e-4e28-b5fd-22f0e276a215", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563097, "uuid": "6b397f52-b0fb-4030-9de5-304c1272723d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563097, "uuid": "84c53228-44df-4484-a60d-bf4c3ad9f963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563097, "uuid": "548c7e4b-a2bd-49c6-ab5e-7b29aaffa428", "value": "2f7037c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799b6211-ba3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621605876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605876, "uuid": "ba154aa0-dd46-4138-b6a5-119f017fd324", "comment": "Malware payload (Dridex)", "value": "b610cbb5426bb25e5f29ea5b311f149f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605876, "uuid": "8c3e2d57-efc2-4201-830b-a5708209d150", "comment": "Malware payload (Dridex)", "value": "089ee1325c40ffeba3ba16b48892f31f10f1e23c7f6874fa407b7b95bb1ab982", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605876, "uuid": "1914d311-9e93-4db0-89d2-0510834e5e0e", "comment": "Malware payload (Dridex)", "value": "1874b9245a08b36a36f652b352c65732864339a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605876, "uuid": "e3eecc8c-6a57-419c-a1fb-c4c948c86526", "comment": "Malware payload (Dridex)", "value": "1ec8ba7137f23dfdf1db9103b6a61f61729f2af777a2acdb83d2c4c8affe32fedc73e7d378123a4d2e73d5f238266b34", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605876, "uuid": "ff8741bb-0c34-4627-a3c8-f7f45b81fae1", "value": "76F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605876, "uuid": "24f74dc4-eb53-4102-8fcb-40f3c890096b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605876, "uuid": "31714708-aaef-438a-92b7-60b068980739", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621605876, "uuid": "3c47713e-4a0d-437b-a68c-cf4d01567517", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621605876, "uuid": "963fd113-7753-4aa3-ad35-1473ebc1f352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605876, "uuid": "99e4c1ea-9348-47f6-9ca8-7a13d4fe5d7f", "value": "b610cbb5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6258b3-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584298, "uuid": "786aa08d-6e4e-4081-993e-6fd0d7a0d362", "comment": "Malware payload (Dridex)", "value": "4aeda44072a8d204d43679b15ca52c43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584298, "uuid": "5944150e-4759-48d8-85f5-9cf50b2aaf87", "comment": "Malware payload (Dridex)", "value": "08b88451da605ce2816dbf14da5aa023e2b9b4930b24e6efca311958fd1cea05", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584298, "uuid": "a3ed1e9a-1c9a-41e1-be20-bbf66f2e29a2", "comment": "Malware payload (Dridex)", "value": "663f28d57b21197473ac3743b4a2bf24b4bffd25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584298, "uuid": "83ad2aaa-310d-4077-bab1-d3b39563ac0a", "comment": "Malware payload (Dridex)", "value": "ba9d9161cec9e769fb840df29a4e2199b5a19f07e62850c202ea6d4617a0d18dd5f8d1efbddb4461094217d8fea41bf3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584298, "uuid": "4c18422d-bf66-4a26-9bc5-ca5dc227dfd5", "value": "DF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584298, "uuid": "1b908cba-6f23-4c9d-8d2a-4e8f46de4c59", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584298, "uuid": "1b9aea2a-9b86-4967-8a47-5fa5657f33fd", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584298, "uuid": "ef687bab-564f-4efc-9410-8c8b520212a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584298, "uuid": "06929e56-ae0e-43d1-9d03-ccfb4fe0947c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584298, "uuid": "a7c71940-ddba-405e-9d9b-8efae6f1af52", "value": "4aeda440_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2bcfa1-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621616540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616540, "uuid": "7b6e67d9-2cce-449e-92a3-836f6c90ddde", "comment": "Malware payload (Quakbot)", "value": "8c3cb97c96930e259e3f01b525a15fab", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616540, "uuid": "e5fd253e-0113-40cf-bd9d-6fb808f66cf1", "comment": "Malware payload (Quakbot)", "value": "0970047184fffb5c2d100a43ab90579c687366bbde30ef84cba649d7343fcf53", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616540, "uuid": "07ef0999-e579-4be6-b07c-d57ec3c79332", "comment": "Malware payload (Quakbot)", "value": "20823304d3fb8eb28360630577c3061a4fce29f8", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616540, "uuid": "c660a501-6abd-49ac-bab1-c5e46f5cb52c", "comment": "Malware payload (Quakbot)", "value": "b5c69eeb8177c393faf8cf14d09eb4711cede4a194d474075f4fc8df20ef9e513a66d6855948137c9e2f72df450e6f1d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616540, "uuid": "1497ff73-096f-4d7f-af5b-7605409d6af1", "value": "A2D4AF27F7A0883BC173377D9C5B96949C29BE813D2468462FE81E486F7D3813E16297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616540, "uuid": "1282434c-fc08-4081-abbf-c272ec36a494", "value": "a7aba6adb1ae5b75efafc0349b38a1d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616540, "uuid": "9653a7e4-b29b-4122-a396-e1bfd0b901c0", "value": "12288:kX8ImE3HOu+F0vZuPxdqQUrVQIKrX1U95RcYPXjS:kXZXXOQxmvUr+XrX2ZLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616540, "uuid": "705afa86-507d-4e98-b642-194faff36f22", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616540, "uuid": "5d7112aa-67ea-48af-b1e0-2db1f1389f60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616540, "uuid": "388e35b6-32c3-4e49-be3a-6286b419861c", "value": "8c3cb97c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eae3fae-ba2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599442, "uuid": "c40507ff-becb-40bd-9c4c-9d81d141f97f", "comment": "Malware payload (Dridex)", "value": "ab5f02df3ae6886bec5e53db07261365", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599442, "uuid": "7da304b5-4d79-493b-a9f7-8323434579c5", "comment": "Malware payload (Dridex)", "value": "098d6a0562092963c13f8eba0cec2d7b3b3ca565779c535c6d04b9da7e907d29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599442, "uuid": "305b6e93-1e47-4e2a-874f-95a5a98f36dc", "comment": "Malware payload (Dridex)", "value": "e3363499aad0dd50d4b51982a0ab70e16011c54a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599442, "uuid": "28eb0122-7f64-4504-8531-5895e4cf849d", "comment": "Malware payload (Dridex)", "value": "9415c22000c94eaa418c16b3560548e2f3487995287cf7741ec5ff6d6c05c745065e465958755d00556acd7d287fdb0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599442, "uuid": "747401d4-8cb3-411a-93fe-c86f5c2115ee", "value": "2304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599442, "uuid": "d3c5475b-2071-4ee2-bbf7-e5081166f34c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599442, "uuid": "54af8994-bda1-438d-8ec2-ce61f010d931", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599442, "uuid": "5783dd25-efb1-4f25-98b4-2705f7d42ccf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599442, "uuid": "d797312a-07ec-4bbe-8608-e19854629b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599442, "uuid": "da50bc8f-7f99-4381-a517-9a8ca3a5d189", "value": "ab5f02df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca32cb79-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580670, "uuid": "fe75b62e-1dc0-4048-a2fc-e58e29a0f80b", "comment": "Malware payload (Dridex)", "value": "31f37f2061654fa311d0c38b44448e87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580670, "uuid": "1e64abef-75e3-420d-9fcf-f170b3779904", "comment": "Malware payload (Dridex)", "value": "09b2cab11cc5bea6eec9fc41fd6a6a33d805307006e33f0a3018d9178651ea64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580670, "uuid": "5ed7471c-9d19-4013-b42b-367be34f601e", "comment": "Malware payload (Dridex)", "value": "e3ccf295f91e80b8a7f551239d1760512734c183", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580670, "uuid": "a57f1a28-0d56-486c-9edb-dbb6fb997653", "comment": "Malware payload (Dridex)", "value": "4e215561a44f6a758897356e6f12a04ef917e94cda60f6256553493d5622ba40a2570c03f85e842baa9b211e7bc1c75a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580670, "uuid": "30db1de8-02fd-4620-bc4c-436727bd10b3", "value": "9EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580670, "uuid": "55f10995-d6a1-422b-b82d-a20a21958b08", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580670, "uuid": "1b7e9ff9-95cc-4120-b79b-9da5bc768b88", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580670, "uuid": "ad3532c2-667b-4779-ae98-0baa44dd7daa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580670, "uuid": "96aa4cf0-a12f-460f-ac53-43be9ca4a072", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580670, "uuid": "e78cd90e-dca3-4dfc-85bd-c7c42916d412", "value": "31f37f20_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49caacb3-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622116, "uuid": "d217eed1-9b7f-424b-b04d-337a40be62c5", "comment": "Malware payload (Dridex)", "value": "268c6607af735f0aaafa67af962e0f19", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622116, "uuid": "7f299669-5489-43d5-9a9e-dc288d5a2738", "comment": "Malware payload (Dridex)", "value": "0a31052407c4651bf66160d07e0c3dcfb9687a67ae51da85cf2045386dd6c291", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622116, "uuid": "1a4ba291-2823-4068-abae-28440c75559f", "comment": "Malware payload (Dridex)", "value": "170981eb6a2e6f58db41ae98e4a22eb8d4e43dba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622116, "uuid": "8c645812-efef-4220-a6c8-147bd125d0c4", "comment": "Malware payload (Dridex)", "value": "fb103ccb28e20c22d6918a1a2842345059d14639ef268c3f7ea9417035706dd3b2af8e395e4c5d1dcb44548f292b8a05", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622116, "uuid": "d46747c5-ed5f-4ac9-9038-80649a5aa28c", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622116, "uuid": "645573fa-ebdc-42c1-9d3c-8a96d61ebc57", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622116, "uuid": "ca63b4b0-b9a5-499d-9cbd-2075c0b79b27", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622116, "uuid": "e14bcc2b-532d-44aa-a527-bc40cf3ed669", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622116, "uuid": "ac87d67e-a2bb-4f85-8d1c-fd2deb1c0b49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622116, "uuid": "62e34119-d145-4aa6-8dd9-1c9bd6b10b8f", "value": "268c6607_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c712b70-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563172, "uuid": "c37d4c65-0547-4b29-95bd-d70f1d01052d", "comment": "Malware payload (Dridex)", "value": "95253639903143f2304a44d3d8bebb5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563172, "uuid": "9e47ec24-599d-4bba-a767-6ea3438bab27", "comment": "Malware payload (Dridex)", "value": "0a3d876351507cf04451c5cb7ecbb1fc69bd40303216a52ed9c16ed3b41e01bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563172, "uuid": "38f10a86-9aee-41cd-ba56-e7517b7de938", "comment": "Malware payload (Dridex)", "value": "809ca67faf7dd762f7f2a97b09c78dd4ea59ec3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563172, "uuid": "33c70be2-c7e7-4828-9aa8-ccc46bc57cc3", "comment": "Malware payload (Dridex)", "value": "675cd670cae63b8878617eb6456f83cf26984793f591c4547adaa0e00a6e5ae685f647752f8b3920a3e6310df9a310a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563172, "uuid": "5ba903ef-c2a8-4a6e-a730-d99090187c3f", "value": "C104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563172, "uuid": "fcb83d8b-203e-4efd-b210-dfaadc30382e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563172, "uuid": "defe536a-4412-4a9e-ae4a-568cb4cc2e1f", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563172, "uuid": "239e12df-1f94-42aa-9c03-69eff45f0d76", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563172, "uuid": "743edd45-910e-450d-8542-5c619c8c4d5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563172, "uuid": "3448bf8f-a52d-4241-8cce-9e48ba4f0d03", "value": "95253639_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a00d46a-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574362, "uuid": "b70a74cb-78f0-408c-b6a0-73e01ab83c0d", "comment": "Malware payload (Dridex)", "value": "c3d70d648b4eafa70ee517c9a9d279ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574362, "uuid": "9a8834d0-99a2-4a64-bdd6-d2536669af64", "comment": "Malware payload (Dridex)", "value": "0a51ecb6f9ee2c5b17d0524d49fd1e75f72c88e79f0be58efc0c8a457d4b5c65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574362, "uuid": "4fee502c-5a28-44f7-b364-b0776f8a6e5f", "comment": "Malware payload (Dridex)", "value": "4dca351b8c28e2ee5fc7b14036d74962411f47a0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574362, "uuid": "fbe02f83-e4e6-4234-812a-eab70688a78f", "comment": "Malware payload (Dridex)", "value": "e37dfe65aac078f0261cb059842678315e56a521cb32947444f458cda8a1e699f86b8bad4845c6afc2156947187f1f56", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574362, "uuid": "fc2bddb0-18bb-43d6-b317-ea00cee31cb8", "value": "7C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574362, "uuid": "8123fc0b-c42f-4698-a1a1-379e7c33f2ea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574362, "uuid": "59a97302-8e07-4618-95f8-52b830ba3d4b", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574362, "uuid": "c41aadf7-1b71-496c-b723-c30c808cdf89", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574362, "uuid": "a4b6bd5f-01d5-4133-81a6-3e113908150d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574362, "uuid": "17761cc1-040e-4a21-b3ee-0d967fba79f1", "value": "c3d70d64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c64773c-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580916, "uuid": "79528fbd-2795-4da0-b3a7-a5ca94df0b26", "comment": "Malware payload (Dridex)", "value": "4f808750b67ec8b682a3272ffc422d6b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580916, "uuid": "bf04a160-7a98-4468-95de-20b1507e9dc6", "comment": "Malware payload (Dridex)", "value": "0a98cb644aaa6bb3c16de8d9e73742710a584093e16847532e7c3f2d624e1086", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580916, "uuid": "b609a51f-4180-4eac-a45b-bfaef6926adc", "comment": "Malware payload (Dridex)", "value": "b81252ab3c9b2978518543dd88350eb866696c19", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580916, "uuid": "983bc896-d7f4-49d4-9fae-ecd426f27431", "comment": "Malware payload (Dridex)", "value": "58b143bb31201e692fa40d386eb555df413f3776b5756ced67d65aa26c1aa57fc611feb11ae24d147bda05df0982a502", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580916, "uuid": "d4cf3337-23a7-4ddc-af2a-c447860717e3", "value": "2A04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580916, "uuid": "1eb8aaba-85e8-48ea-a3d0-9ad6bbd6ebdd", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580916, "uuid": "0f8453be-fc69-48ba-92e9-177ab7c54d51", "value": "3072:GqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:IVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580916, "uuid": "44a24d7a-1b76-404b-a261-f8282a83bd83", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580916, "uuid": "a0ca742d-4b1a-479d-87e6-b8183960522d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580916, "uuid": "1fad2c93-1a5a-497a-bb1e-1596ce139cdc", "value": "4f808750_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abbd77b-b9ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571437, "uuid": "ca693421-edbf-4599-b893-e8847d9da231", "comment": "Malware payload (Dridex)", "value": "10f30a05800d134ca4cc612367bc5756", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571437, "uuid": "70741447-ef75-4cf3-b280-ab3affba5ef3", "comment": "Malware payload (Dridex)", "value": "0aa34165571d496119d2f8e262fbc7852ee16dbd174bbce65ee5e106ca893226", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571437, "uuid": "553287a1-db48-4366-9b0a-f87d4f52ed9c", "comment": "Malware payload (Dridex)", "value": "6d797cd9d3722c6105376605a8b249d00387b18c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571437, "uuid": "e815ec64-f798-496c-89a3-79796a91f6f3", "comment": "Malware payload (Dridex)", "value": "e59acd8a8f7b7a312768a54c0719e1a6efaa91ec246ce967c8fd3af28a036514b02c1bfe44965f61089c96b532ecfd9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571437, "uuid": "2ba79a2f-a4df-489c-9f7f-4ca4e7436c64", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571437, "uuid": "e478ac53-94ff-410a-98f7-e07f24c48ac3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571437, "uuid": "d90984d9-b720-468d-aaca-21c2979fc23d", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571437, "uuid": "8d679e2d-8c69-49b9-9c60-a4e69482b76b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571437, "uuid": "d4e3e47a-a70a-4c63-998a-279d11543f81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571437, "uuid": "ceaa1673-e91a-48da-bad3-a852863b76c7", "value": "10f30a05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703901c7-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611443, "uuid": "4aa38969-1935-46a8-98eb-745e44b541da", "comment": "Malware payload (Dridex)", "value": "f74783903907837d00587023d5e83556", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611443, "uuid": "d546f174-69b7-4928-84ca-3a03079a393f", "comment": "Malware payload (Dridex)", "value": "0ab97eb947655239e7d25ba0fd9987474da3da131f260b8188d8577db86044bc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611443, "uuid": "cfd75a27-9f58-4742-a5ce-2f47f2d31ec1", "comment": "Malware payload (Dridex)", "value": "e587d0f0f2718d934588a38bdadcf53221e440ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611443, "uuid": "db595885-f105-4fc3-a37f-435c729e060b", "comment": "Malware payload (Dridex)", "value": "bbd6e12145d87dd90d0131c6fa2243fc5b31b50ac6de5bfc075556880a1c3d6bde3e4bcbe4ebb04fc87816e0494ea114", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611443, "uuid": "66079284-aee9-4419-b08e-5c06261a03b4", "value": "B504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611443, "uuid": "b9f14948-2e7d-4e3d-ba3e-ac92ff1ff328", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611443, "uuid": "9fe82d42-69a7-4f3a-a0cb-7c3a6527b51f", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611443, "uuid": "4195362d-20ed-467f-a078-f2396a1c9edd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611443, "uuid": "593ce4ff-792a-4a96-864c-ead8efa7f6a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611443, "uuid": "32f0aea4-bafe-4010-abbf-d0bed197d1e8", "value": "f7478390_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4c2a0d-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621635252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635252, "uuid": "6b5d0384-0935-4084-8213-d3a433875375", "comment": "Malware payload", "value": "b080f444b64a9ed21777b98e43ac09f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635252, "uuid": "5b9df635-871a-49b2-a348-86568d0a367b", "comment": "Malware payload", "value": "0ad94298a4cdacd300748c98093090f156401ae87b8bd4047136fffa846d7b6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635252, "uuid": "9d0ab9fa-5829-409c-a56b-8f8699fc2450", "comment": "Malware payload", "value": "7fbd9a7fca9220bea8ffd89a5f0708d5a3a0fe48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635252, "uuid": "8e289f60-17fd-4673-beff-099a41531c18", "comment": "Malware payload", "value": "8941434624dc989f511ac480287bf5dbf1e58bde794bc39cea4b26f9a38f9d66c608b835dcd2e285ee2a66db7e5da83c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635252, "uuid": "68dacaf7-d8a0-4509-bd1d-9e3c73e2b633", "value": "AEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635252, "uuid": "9fb59d70-4012-4b8c-a472-f326a851ce4e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635252, "uuid": "40a5ae34-83cd-496b-81c9-e48c6a6f413e", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621635252, "uuid": "d645fdda-ba3f-45a4-bf37-2740bdf7862c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621635252, "uuid": "36f572ed-92a0-4712-852c-3b7f428f5660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635252, "uuid": "dcc0a9e0-f5c9-4cb9-9095-60c0d3beba33", "value": "b080f444_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607b2f12-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627738, "uuid": "f218b216-ddb0-4b6b-bed1-dd40bf05df14", "comment": "Malware payload (Dridex)", "value": "bb279e5ca74004b1a3494df7c0eada67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627738, "uuid": "326d0fd5-45d6-48ff-bd7d-448c6e72dc65", "comment": "Malware payload (Dridex)", "value": "0b2c722feface056e2b6c8575cc34a7d934b6a53468e573b31d87016c4cfc72b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627738, "uuid": "29eb86db-8a3b-4532-a7f8-1203927367c9", "comment": "Malware payload (Dridex)", "value": "0d1200f318a5422328940df7894cbe3dc304b043", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627738, "uuid": "1080cd2b-2180-413c-a947-5878de769bb7", "comment": "Malware payload (Dridex)", "value": "407bab71d5e6b99bf9113a3ad5b29fc3f0fb39328fcf184dc13005223c79ae2a8f810389efa77466a130edcbbe58d2bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627738, "uuid": "06777f01-6bb6-401e-9201-c97a83b385a6", "value": "5304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627738, "uuid": "3a3f353c-f7b2-4730-9067-68cc244911c3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627738, "uuid": "c984253a-ebee-4eba-93d8-d5892a643dde", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627738, "uuid": "2d8e0a70-4824-44f1-8897-2891577d9716", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627738, "uuid": "1cec8c34-45b6-4a57-8b7d-92736bd87ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627738, "uuid": "c9cd6f32-ef3f-4830-a3b6-b1e5cd65f562", "value": "bb279e5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73988a1-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572022, "uuid": "a72b5162-ea96-44db-a572-90c596776721", "comment": "Malware payload (Dridex)", "value": "523933ac3feb927e6420172a49383b25", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572022, "uuid": "bbf98f49-a440-4a2a-80ee-50f344f3126d", "comment": "Malware payload (Dridex)", "value": "0b3cb9a3c3b7d9c8924c48c50953c5a0daf65af67c5baccbbbd70a35a377b521", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572022, "uuid": "ab1c5e8c-386f-46b4-ae7a-3ead8fdd8ccf", "comment": "Malware payload (Dridex)", "value": "e756a6c0ee76bcbf1eb0475f8c0cb19424663fae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572022, "uuid": "33397a3e-3eb8-4fad-aa61-c7affcafa0fa", "comment": "Malware payload (Dridex)", "value": "f91a0291d308fa3af67e162a57c45054c9cf0cdf40953150dbb518d161d999d8b64693439648690178c1ba426e4da335", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572022, "uuid": "0ed92d8c-01a5-4114-a889-f89dc932a9da", "value": "3204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572022, "uuid": "ff160d27-757d-407f-bbd3-14e6e9b577f7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572022, "uuid": "96158a10-068b-4116-9023-85f3eee8b4ff", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572022, "uuid": "d0af7610-7e10-41e0-8341-b8c293c2356a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572022, "uuid": "331648aa-288b-4a53-9642-a619401f61ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572022, "uuid": "c47f892d-9758-4487-9532-a59a952e5ca9", "value": "523933ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1769a57f-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565768, "uuid": "d8c1b7f9-9da8-41bc-8455-ac966fc470da", "comment": "Malware payload (Dridex)", "value": "bd07923f39fe18fb6de113edf770f9d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565768, "uuid": "238f36d1-e24d-4a92-b931-eacc9fdf5e20", "comment": "Malware payload (Dridex)", "value": "0b49fb2d3018d387d8c2a675dc4f2ca21552c04049a5c35ae1cb14d6a05717b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565768, "uuid": "35e94ead-d3a7-45f6-b353-310d4aed9764", "comment": "Malware payload (Dridex)", "value": "9ebbe8d89d31f84c020ecc80e9b14c00030617b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565768, "uuid": "34d4fc30-eae9-47c7-8618-9a841d68d460", "comment": "Malware payload (Dridex)", "value": "af79d99113c443edeec09c1126c9a97a431a369391044ea3cc95d1f65ae2fb097005a893f49683314c325abf0b6f7833", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565768, "uuid": "783794bb-dda7-4579-8785-a10e4a000bc1", "value": "A004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565768, "uuid": "a38d5e0e-5f1b-4b36-bb10-5a25122422ba", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565768, "uuid": "59a21793-3f16-43ab-96a0-e5bb6739aa46", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565768, "uuid": "51dc9449-6f07-443d-af9c-a652366a13cf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565768, "uuid": "60161034-0ed4-4db2-99c4-015e9a98753b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565768, "uuid": "ff2a22a9-bfc4-4dc9-835e-c445490ce8c0", "value": "bd07923f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7602b5-ba3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606843, "uuid": "f9744afe-5157-43eb-80f8-b37f457f6502", "comment": "Malware payload (Dridex)", "value": "ab71da00ed3121d6ecfddfd4125a62f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606843, "uuid": "10b60860-981d-47db-8d92-c10ac87dbbc7", "comment": "Malware payload (Dridex)", "value": "0b765de2d6cc689a5e861d2f1d2d40c9a2d8b7cc9168b5597567c98ffa1abc77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606843, "uuid": "ffa70ef8-0cc9-4416-a93f-717173bc3c60", "comment": "Malware payload (Dridex)", "value": "b0c0768c9a8d4a227d8bd484f5576b7a5d758e70", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606843, "uuid": "25bb0216-ac3c-46b1-aa11-43add34ac1a3", "comment": "Malware payload (Dridex)", "value": "d39dfd763beb87f7cb5da1158250d651f84f11693dbd080c849705e49c37f5188335936b65690fc3d25b4be93bbca3bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606843, "uuid": "eedd0806-d5eb-442f-88f7-8634169f2322", "value": "3604D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606843, "uuid": "b6590dae-0f8f-47c0-9fec-8b7ab984994e", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606843, "uuid": "b0b492cf-83cf-4272-9bf0-b84398d1722d", "value": "3072:ZqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:/VqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606843, "uuid": "4a2a1036-14be-4f47-a99f-6113dbe9e9df", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606843, "uuid": "0a704710-bd99-4095-8f93-9d7e7e80cb29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606843, "uuid": "e6afbd3f-516a-4cab-a9dc-529dd9c62dbe", "value": "ab71da00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12386b6-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621618532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618532, "uuid": "eb066722-cf96-437e-82cb-188c3f07c85a", "comment": "Malware payload (NanoCore)", "value": "61d068dbf5bc291e7f6f70cd00f192e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618532, "uuid": "f32fbe1d-37c0-4e16-aba5-b751a3b59519", "comment": "Malware payload (NanoCore)", "value": "0b81d859eb77ebbd238baa9c3bf027797c66a18ccc0a9e35e60c108295f6eae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618532, "uuid": "f925d751-e9d5-4dac-bed9-85524c707913", "comment": "Malware payload (NanoCore)", "value": "f24dc168ef0311805ac5ce85574415a2339ff4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618532, "uuid": "213b0421-ed35-4f7b-ae11-e908f5eaf3f8", "comment": "Malware payload (NanoCore)", "value": "97dc5f667006378448621db3bb717c285b5193a59b2a40ab903f75ebbef0811f78b05f0b29ef7589fd15af4c01791995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618532, "uuid": "bc4901ee-43ab-4908-9b9e-14d1c56950f4", "value": "8F14CF163BF84A2EE2DE86797022425393B9C2D3ADC3F3DA18D455B78B267E146071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618532, "uuid": "c57789a4-fa92-4c6f-952c-d4a093a3eb25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618532, "uuid": "4ee92726-e4cd-4336-86cd-876fee3e2071", "value": "6144:QLV6Bta6dtJmakIM5otDv+1ECGhAIgeHYut:QLV6Btpmkdb+kXxHYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618532, "uuid": "7d10cdc0-0472-4f92-b5de-4226d911d0be", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618532, "uuid": "60725e84-4d90-4f1b-98b6-259a8a7bc619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618532, "uuid": "c69eea04-4c56-433a-ac46-3acb9f3408af", "value": "61D068DBF5BC291E7F6F70CD00F192E4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af13272-ba41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607435, "uuid": "2a3d87a4-1aba-4400-b8fb-a0393ff5fdbe", "comment": "Malware payload (Dridex)", "value": "6bfb3975ec742a7cb7b0b5feb6b0f981", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607435, "uuid": "34499a9c-68e4-4308-b09c-4faa8315a1ed", "comment": "Malware payload (Dridex)", "value": "0b95265ca7796bcea4fa8317a3cf795bf1686bc2462f712897089c730857e8ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607435, "uuid": "e2da4e57-58e6-423e-8e15-47945d445daf", "comment": "Malware payload (Dridex)", "value": "b0e47a37bfefcc2fb1c80f46ee793ebd7d8e809f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607435, "uuid": "09f6106f-9ca0-4ed7-a5b3-c4d96cb81252", "comment": "Malware payload (Dridex)", "value": "d61c203f19e3eb773ac271f9b1887626240a81f561c96aef0d216e3701257eb725f3a70521c0680ea9db0c6d56cef4d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607435, "uuid": "db6f0c98-32da-49c6-814f-629fd80c3101", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607435, "uuid": "5a6a8266-0d6e-42c7-b0e9-b43184af0dc1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607435, "uuid": "38135e42-d7ac-40ad-ac71-46b8376acbf9", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607435, "uuid": "f347a665-c29e-4fd7-836e-0da33a6ba1a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607435, "uuid": "91d10994-8d21-4db3-afd1-793c743c3d13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607435, "uuid": "24e5b494-387e-4d23-a4e9-06e411f54518", "value": "6bfb3975_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a025c0-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581758, "uuid": "de2f7987-5ad7-4581-9ab7-9d6a48320cba", "comment": "Malware payload (Dridex)", "value": "4c8f9ff600b6613931118111372804cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581758, "uuid": "094da155-e4de-4fe5-988d-10bbe3289c56", "comment": "Malware payload (Dridex)", "value": "0bb2e3920cc35f44e3dc04ca812a5d9ef7f8008e99f1a8642b926b384e513a99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581758, "uuid": "784e162c-ae76-4110-8fab-ecb0c7718237", "comment": "Malware payload (Dridex)", "value": "50f088cac9c6efd2056adf3368fd256f53eac76a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581758, "uuid": "1c4e0a04-06d7-4785-b5b6-14b8ca603caf", "comment": "Malware payload (Dridex)", "value": "a5cb198a25506f7f5dd1231749a60645b72d73a8f757306b1424322274d6de8a687e97b780d937f32279223a7da9c860", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581758, "uuid": "bc74312f-8c7b-454e-94a4-5d0d543615c2", "value": "0A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581758, "uuid": "bfb5ff5b-93e6-48af-98c0-0fb193b1bf58", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581758, "uuid": "5c75a698-6528-464e-bc02-97793b9c815b", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581758, "uuid": "fc265d81-a94d-4938-9764-ba0816d5039f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581758, "uuid": "402835f6-bec1-40ce-9055-b53efe2b587e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581758, "uuid": "d78e0ab0-a09c-4f58-9422-06b51329a32c", "value": "4c8f9ff6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d914754-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575764, "uuid": "d9d99406-7ef1-4a49-ba0a-ecd50d74763c", "comment": "Malware payload (Dridex)", "value": "8a1a3be063b695614f356af8bf0d4cd8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575764, "uuid": "995f2c27-3733-4d75-890c-eda9c2924098", "comment": "Malware payload (Dridex)", "value": "0c2ad1de639f85889374509bea40fdf6a8cb13f4bb224de8124d2282406d56e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575764, "uuid": "0dbc6227-3b2f-43fc-a5cf-09658459b6c4", "comment": "Malware payload (Dridex)", "value": "05d3238fbb1bbdc91f9f419f90badb25f9122d29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575764, "uuid": "bbfa9dd5-54a1-4667-9b3c-108cb284d442", "comment": "Malware payload (Dridex)", "value": "8298feef4c83c5e26ed8cc95460b82967047c6a8f3ac81a40d120ffa9202f437a553f974de4a38551ae238bfca96ee01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575764, "uuid": "d364b990-fc83-48ca-b671-64374eae7b76", "value": "5B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575764, "uuid": "0e5f2e30-b785-44e7-89a5-83b81a736e0e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575764, "uuid": "3de06748-53e3-4903-92b9-6cb23a85cea8", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575764, "uuid": "7efbb2b9-d16e-41da-a7fa-ff096b4132f3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575764, "uuid": "48683eab-0a00-421f-9ec3-274ae4a83ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575764, "uuid": "1fb2732f-e560-4c2e-b7b8-7280a45e9101", "value": "8a1a3be0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52818e1d-ba2a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621597650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621597650, "uuid": "3829e7de-b292-4579-94e2-2fc5a26a394d", "comment": "Malware payload", "value": "28bbb92c62cc61cda92ddee7f3c369f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621597650, "uuid": "bc1bb838-af6c-4827-b205-57d801628d44", "comment": "Malware payload", "value": "0c4984fc05beb523bec235802538d75de14afe109ce4f8dac6de642407d0c5ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621597650, "uuid": "e06351f2-e3d2-4381-8839-2d5bbe1f8236", "comment": "Malware payload", "value": "6a338f671b8391257f2f84ae17bb63798e0ec7b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621597650, "uuid": "572d1a7a-d32e-4c4a-9788-0bd115d5c179", "comment": "Malware payload", "value": "aa6709facb6d83cb167dcb51be809138d0606d4494b01e3420dda4e8808f0b3aefc136e114d514ce82c0e4136125edba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621597650, "uuid": "c1db578f-1f4e-4aab-92fa-5720c218ff2b", "value": "61B2A7864503C7EA13F706582435BC29D9520353F0BFE44BBA2DB38BAB97368DC5985E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621597650, "uuid": "99d86904-5ce5-483b-98c8-9ef4b67c999f", "value": "384:WNDI6szRnYPwYcAbNMthaw0npcqAL9pJYAFavHiBrB:mIhRW1Mthaw0npcqALLikavHiBrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621597650, "uuid": "5cb318c8-6bd6-4409-b904-60f083fde08a", "value": 25557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621597650, "uuid": "7b899afa-6df9-4406-a6d2-09e027b598c6", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621597650, "uuid": "a68608f5-bc1b-4278-bdd6-01e6cc622cd8", "value": "p2[1].php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e83a6be-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569269, "uuid": "97b9d904-45de-4809-bca8-704264af2da5", "comment": "Malware payload (Dridex)", "value": "177414913d660489deb4988355b901a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569269, "uuid": "262b0170-a84a-4041-bee2-cbe1ba82bdad", "comment": "Malware payload (Dridex)", "value": "0c58d26be8b7c7fdf32c9d17dd8eeac902d7af38678434a17dba672b454068a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569269, "uuid": "c43ae619-9c61-421a-b3db-5d842dbe5176", "comment": "Malware payload (Dridex)", "value": "b82d232d2f653e70e235f53eeff4588a4712e742", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569269, "uuid": "daf5aa39-2367-4589-9449-a4b4742c3927", "comment": "Malware payload (Dridex)", "value": "983fba5a9bb5a3e1df8ba32379fc2f13df4afe66d96238d8ad6ab775cb0d0b63a5d41a6d23dd14e0dbc96ff6ae7ab050", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569269, "uuid": "aac0e698-dd46-4d72-9e74-87b7f8bae7be", "value": "2004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569269, "uuid": "25f9482d-1b24-4377-a093-f65b33e9d2bd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569269, "uuid": "436f8e08-6738-4aa1-935e-ffcb41f9806d", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569269, "uuid": "42f39a79-7f54-4dd1-b630-5f0893e1a68f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569269, "uuid": "78073441-0813-4d7f-b9ba-0084498cff09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569269, "uuid": "ad524cc9-e006-440a-88a1-738a4ad9d40a", "value": "17741491_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526f83aa-ba58-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621617406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617406, "uuid": "e158c3c5-b783-4731-bec0-0ddf0e186428", "comment": "Malware payload (Dridex)", "value": "09d56cfa5fb69faf29a6842908a86416", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617406, "uuid": "bfba1017-0f66-48f3-9a27-ff65b39d28d4", "comment": "Malware payload (Dridex)", "value": "0c8aa9eaab923d57c76290e90a200c6d41d3ed43a3ad494b69d326058237a732", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617406, "uuid": "5df39264-ab33-4fe1-85fe-caddc712e73a", "comment": "Malware payload (Dridex)", "value": "e11ed516350f06092c0e287716b51c9674885a4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617406, "uuid": "4b838644-c931-47fd-b052-96f98bc0542c", "comment": "Malware payload (Dridex)", "value": "02f8f41ab56be69d59fd64d2ac157ee0a94cb0551b7fbfbc5a35cc24d39efdcca3aab7a7833c7ffb22deb9cbd6f58907", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617406, "uuid": "57dcd192-535e-4bff-b4a6-7cf9196e4867", "value": "0AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617406, "uuid": "92a3ab55-214e-4c08-8082-3d36ad589ae2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617406, "uuid": "56b0a5b2-ad00-4b49-afb4-0aeb432083f2", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617406, "uuid": "8159b53b-2c3f-44e9-b9cc-330cca31acdd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617406, "uuid": "6d17d7bf-3854-438d-8692-52a71171577b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617406, "uuid": "9714aa2b-5535-49e0-a9e9-f1f08b786324", "value": "09d56cfa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98149ce3-b9cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558682, "uuid": "faebd27c-1180-4ded-8e6f-3850f285b989", "comment": "Malware payload (Dridex)", "value": "57db5a778cee16644210741684dce644", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558682, "uuid": "bb396be1-6d3c-4bff-9b01-25d0ad9007cc", "comment": "Malware payload (Dridex)", "value": "0ca0f382883fe8d80bccd870c9101b97e0b8eef0a1702704868f1d18a26c7b7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558682, "uuid": "91a4882a-dfdc-4731-b53d-6fdacce7e3c8", "comment": "Malware payload (Dridex)", "value": "4e8705eb9606d85bba095da17872ab3d22216818", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558682, "uuid": "2b3ab564-ff07-419b-bf42-fd8bba8a097c", "comment": "Malware payload (Dridex)", "value": "9a22a9db0b1b5522e1bd9760596547cd8fbc15cda898ad0d8795ee5a78e72bc3478f3175c9845ed6f3145aa18781b469", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558682, "uuid": "6e4d18aa-a97f-41d7-9e15-1395fca22b79", "value": "2B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558682, "uuid": "dd8e4f11-dc75-4d0b-b022-a64470c95095", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558682, "uuid": "906831d8-bf3c-4a1d-9264-b15d4e67b264", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558682, "uuid": "23035501-490a-4cfa-a8a1-9543a5e339c7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558682, "uuid": "b97f26f2-7984-4fcd-87b3-4058d9250178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558682, "uuid": "5750f2b6-78ac-4d1d-8fb4-60e252048e9f", "value": "57db5a77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3358cd60-b9e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567533, "uuid": "28858f4b-654a-4d86-8db3-d194489f4920", "comment": "Malware payload (Dridex)", "value": "47808209e5ed884d3e5ca52da1742bae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567533, "uuid": "d5ef83ff-e6c9-4630-a67a-0d1281ef9016", "comment": "Malware payload (Dridex)", "value": "0ca86d9af30e97a5d483b6d2eb12cedbc6e92ffd236d111ca4167c7f34493863", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567533, "uuid": "ca496767-3147-4418-9101-39cb27051228", "comment": "Malware payload (Dridex)", "value": "e1cdc32ee9a2c77285f7a70ae990aff85393b762", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567533, "uuid": "fcedf510-64b6-481f-a933-309031cf9bf2", "comment": "Malware payload (Dridex)", "value": "da153828d22d1b8cc864e11d9cc2364ddcfcd0d2888977cad5ef9bd8b9cf14f2c50b689b46e6ee119d2fbd82485bc009", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567533, "uuid": "755eeb57-a68f-4a29-bba2-8a6b14dd0b44", "value": "FE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567533, "uuid": "1da907ee-8a76-487c-a935-2ca13ecd4720", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567533, "uuid": "64b00aa4-549f-49a4-98f3-bfb414a718a7", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567533, "uuid": "890ba730-5e02-49c0-bb1d-1c94bec8cdb6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567533, "uuid": "5e450112-72d2-4185-838c-cc490373ac01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567533, "uuid": "4ff545b0-5b75-48b1-939c-554462cb4654", "value": "47808209_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f9b723-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563536, "uuid": "a61e7616-c442-48c5-af19-fce0c41fe5e0", "comment": "Malware payload (Dridex)", "value": "1e33d7810b9209a021115bc07a21ecb1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563536, "uuid": "642957b4-9011-4138-8cbe-f9dfa36a6af1", "comment": "Malware payload (Dridex)", "value": "0cccf0675c94de00608b90f679886e45b35691a6de5b0cbb5f2a6a0bd29a28af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563536, "uuid": "2b6ab9fa-e567-4f0b-9392-1d80ada6edbe", "comment": "Malware payload (Dridex)", "value": "97a27e3927aadb4e68571551c6e6f2461152c066", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563536, "uuid": "cad25790-abc2-41c4-8170-563b1bf1aad9", "comment": "Malware payload (Dridex)", "value": "10c63539fb4f8a1404c7400f3cb2a635caa71bf7e4e5527583690bbfaeed4565788f22bfe2b1de09e2c3c177ed631607", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563536, "uuid": "c13b6829-5ef5-45f8-8cce-aab9b861a8d5", "value": "E704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563536, "uuid": "485423ce-8362-476b-8597-c2490c5b286c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563536, "uuid": "20b0862f-2fe6-4508-86cd-546abffac141", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563536, "uuid": "e1aca3b4-b2c7-4b59-b3d8-9efe9fa12cac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563536, "uuid": "3d8f1ff3-b5a8-4156-8f4e-fde6b83f3aa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563536, "uuid": "10dcffd0-5601-42c5-8bd9-233efe9320be", "value": "1e33d781_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad33de6-b9fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578927, "uuid": "4bd54b7e-9302-46ac-bce3-381b2c917674", "comment": "Malware payload (Dridex)", "value": "2e1d378064b31b09ac1012147fe1a64b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578927, "uuid": "65a22a5a-2a37-4656-b2cc-bbd87ad4574b", "comment": "Malware payload (Dridex)", "value": "0d11b9641b416f2141d1fa663e7d7fdd4d9af6aa0ceda1120433a07c9bc57a84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578927, "uuid": "ab5a3a0c-75ab-4185-97ec-9c3c1aa85200", "comment": "Malware payload (Dridex)", "value": "26f1987a5a372c7c888584931c00e27834f18e1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578927, "uuid": "79b9f483-1860-45c2-ab91-4b525dd4b144", "comment": "Malware payload (Dridex)", "value": "7b84d7b6fc64bf60dff9a75e4696ff313aea2659be64b4667fd81b9437bc4c742a5c492b552240cefedfc96409c6337a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578927, "uuid": "fb63c29f-45a4-4949-9a67-6f316bb3e9e7", "value": "3B04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578927, "uuid": "d2b29746-3430-4ec3-97d1-68727dc0811b", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578927, "uuid": "5cfede97-3d05-47da-8ac3-58a0bf977c0b", "value": "3072:nWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:nWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578927, "uuid": "eb0724de-5c2d-4de0-87e3-3f33bc8675d8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578927, "uuid": "338b964e-55f6-4b8b-a24a-8bcda0dd5499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578927, "uuid": "c41dfeea-4845-4163-a833-f6f488399485", "value": "2e1d3780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be57bedb-b9cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557887, "uuid": "ce49f64d-24af-4d9b-98a7-7c1f9e4e6a5c", "comment": "Malware payload (Dridex)", "value": "a3825b414cd22c5b1847ba910aed8be4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557887, "uuid": "0afd77b4-38a3-456e-b927-5d0385af7fc4", "comment": "Malware payload (Dridex)", "value": "0d4902ba100186ce409af0d6c4a95cfbe1a242be1c7f8cb82f24b514e89b7d83", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557887, "uuid": "8686c512-38d9-4150-8fdb-f1f9fac5e563", "comment": "Malware payload (Dridex)", "value": "43889fc28b4d759eb1c16188fdd2aeee5ba246dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557887, "uuid": "cb95ca84-55d3-4087-b0b9-ee93919bf28e", "comment": "Malware payload (Dridex)", "value": "9a3363b0e030db6e5c15419331f54d9cdacfba6a3bc0b637d24e9c74307884a3b2592f1d26cadb80fc07edbb23be8dfc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557887, "uuid": "e23df28a-220d-456f-ae02-8781b62b07ad", "value": "1604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557887, "uuid": "e1e6f229-1ac9-4b01-a893-8adb109a673c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557887, "uuid": "6adb75da-838f-4f0d-a5dd-b367a7761850", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557887, "uuid": "d7ad3fc6-8f50-4a50-acfa-c08ac41c5403", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557887, "uuid": "8333d339-20c5-45e5-91d5-dd8a4d2499d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557887, "uuid": "c7349a9f-854f-4201-8ccd-3927d1e67ac9", "value": "a3825b41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fa3c6b-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577823, "uuid": "4d0fab48-2ed7-4487-9541-a00e5c18b470", "comment": "Malware payload (Dridex)", "value": "ef7d10b8f94c07c98fa49bf1f194569f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577823, "uuid": "3410c6a9-2752-4a89-bc97-69f7d6f51cf7", "comment": "Malware payload (Dridex)", "value": "0df0e21745156eebda8994c7a8314aacff72056abf6a9d3e82591855d1a60e45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577823, "uuid": "108ecdfd-472e-44aa-aec6-6727fea22c8a", "comment": "Malware payload (Dridex)", "value": "28ff07422051835d135b1cb082c035f33d7b4aff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577823, "uuid": "603988ee-3751-46b0-8a0a-a95e2c3999fc", "comment": "Malware payload (Dridex)", "value": "1163f3d870e31472085aabe5c492ce69a97a5d10405acf186a037a07d51b7dfa1428a689c857799dc4ee97ae54e54101", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577823, "uuid": "4cd69f30-c2d7-44d7-b0bc-31852cbf5f04", "value": "6904D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577823, "uuid": "97f8170b-ef33-4710-81b9-c537a3dcd6b1", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577823, "uuid": "1056d5d0-68b9-488b-9a09-c3e07f712e49", "value": "3072:BqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:3VqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577823, "uuid": "156fc418-e240-4aa3-b63a-1a14a9cc963f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577823, "uuid": "16cdb375-9533-4d70-9d6b-c111ec0c6617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577823, "uuid": "b93ecb9a-e3c9-4086-95fa-65abaa106fda", "value": "ef7d10b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ab864f-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621612286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612286, "uuid": "d8781602-8ad1-449f-ad40-95e4996e78d3", "comment": "Malware payload (RedLineStealer)", "value": "a110ce3f7366c6bb12553ea17a793110", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612286, "uuid": "31eceec2-3471-400b-9887-9e3a1fd1a1fe", "comment": "Malware payload (RedLineStealer)", "value": "0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612286, "uuid": "6deb514d-1179-4881-9b76-0f4e39799a15", "comment": "Malware payload (RedLineStealer)", "value": "8e10076496347d6324382f20968f3b7c8516eedf", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612286, "uuid": "0f4f7b1b-b2c3-40b9-9f45-8b281f487489", "comment": "Malware payload (RedLineStealer)", "value": "5eeb05b21d972bf900d015a35212be236b7dc226eb04021975b04bbb46ad9fb11eb4a6b9340eb3bf0e32747c7384305c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612286, "uuid": "3883c648-9d5a-4733-bc73-d70144bee1e3", "value": "D64633219DC0D571D9B02AB4CFE9E6F0997CBC30CB85464B47987F0E3A309D5A970B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612286, "uuid": "27426d6e-1e99-4f0b-8102-a75a68db8c9c", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612286, "uuid": "88693c47-f9cb-46c9-a200-8045479d5dfa", "value": "98304:46qFO22UfoOmhhttEPUF3Z1b16GjarczrcSCkVxXB77tkUP+FIpw:41FO22UMG8F3Z1b4Q5cSN/tkOdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612286, "uuid": "a29e2bfc-7c50-44b0-bbf0-2e7974d0e773", "value": 5841194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612286, "uuid": "0323b2e4-8c26-4ea7-b19a-464524bf7521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612286, "uuid": "90d92d37-cb52-4849-b18c-5f7c455b3ec7", "value": "a110ce3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d9df03-ba5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621620343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620343, "uuid": "f33b0eac-0389-415f-a96b-0ef6c61fe7e1", "comment": "Malware payload (Dridex)", "value": "5138b140e9a8aae41a76b3f550976bb8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620343, "uuid": "fca01b35-96f5-43eb-adb5-f52fff5e295c", "comment": "Malware payload (Dridex)", "value": "0f1051540050d6c47cb16d7dde3ba8b207bedf2306538756fc38e99a79733ea8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620343, "uuid": "9da2bf20-664a-4d9f-9265-3d0745012507", "comment": "Malware payload (Dridex)", "value": "fda1f55f82bac9a5ff657598dda279f511b9dfad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620343, "uuid": "55ad73cb-7bd9-420d-9c55-89f7367331f8", "comment": "Malware payload (Dridex)", "value": "6340049604575d9d1c682d343ea0ce470c0468351f6c408d4984f350d3c446710ab3810ecb2adc14773f664c8bb92878", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620343, "uuid": "ff55276c-835d-4b2e-9f06-066d119aae49", "value": "0C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620343, "uuid": "0b32d1ab-884a-4ba8-8b61-09e493eab445", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620343, "uuid": "133b0e18-5acb-4537-bb9e-7a8ed329d6e2", "value": "3072:Yi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:YH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620343, "uuid": "df8b1939-ea02-4b47-884f-a84f96dc9103", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620343, "uuid": "65e902af-a696-4fd2-a807-ccdafef4cae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620343, "uuid": "2b152b06-500c-422f-be68-1866a13dd620", "value": "5138b140_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaf1d0d-b9c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555412, "uuid": "ef876476-d42d-4b14-af25-a38ece2f4a7a", "comment": "Malware payload (Dridex)", "value": "050d98a38016c02b83449b47c9f994d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555412, "uuid": "97ac5791-7eb6-4077-86f6-9a375f8e67a9", "comment": "Malware payload (Dridex)", "value": "0f61cbc0de297bc05eae1e5f1063717494f344eca02bc8b9925dd8a47de0bd15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555412, "uuid": "ecbc9c22-bde1-4b75-b6ef-29301250cd13", "comment": "Malware payload (Dridex)", "value": "32e691f50fb763ed70504ba3df21d3ca2ccd5546", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555412, "uuid": "0545ba6f-72d1-4842-a8e9-77e2fa0eef5e", "comment": "Malware payload (Dridex)", "value": "21477cfd7f740c6fb309c82fc843536716cc4d447ee50c7e3872047ec08638643395b5fd8ae36e71736d403e87c12b0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555412, "uuid": "3c451b78-2e11-48b0-b4bf-b721f423124b", "value": "48F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555412, "uuid": "5160c213-ec7e-4db0-9865-3c768778c9f7", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555412, "uuid": "cd050442-c34e-4c8a-bdbc-7396fd6fe5bf", "value": "3072:8A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:83J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555412, "uuid": "f5f29151-165e-4986-9745-7fc81eb8c1a1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555412, "uuid": "796c2b61-9eec-4742-b8fa-9c3380ae7d97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555412, "uuid": "6a1aaa32-33ad-4d1f-807b-89ab02217525", "value": "050d98a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5010c6-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621634762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634762, "uuid": "876cc737-257d-4321-bb78-8528daa71add", "comment": "Malware payload", "value": "6ac9535f9e81e893e80f4e8d1af68051", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634762, "uuid": "65dbb763-dc91-4523-9112-3cbbb00f058a", "comment": "Malware payload", "value": "0f7500e60c0116f427f79005482bbc3a7fea136ab6ebf554a520589835c5dd3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634762, "uuid": "504220fa-c26d-4e5a-96e9-06e09305f943", "comment": "Malware payload", "value": "7e4d975eebb631605dce60127fd77feb0c955080", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634762, "uuid": "f0076843-be1c-4c9b-b940-8a932f75462d", "comment": "Malware payload", "value": "efa7d78799ba9276e53eb0eb9c5e1b57ba5269dc814cf28d70086c171c7547879b4e69605d452d6d8e7ebd6792b87dee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634762, "uuid": "422c4c5c-4137-4cdc-afc8-bcdab3a7e46d", "value": "33F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634762, "uuid": "c88d1756-c569-48d3-93ff-c0c5266328bb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634762, "uuid": "81f87b50-d4bf-48b0-8da9-a7c29924449c", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634762, "uuid": "2bea2a3a-0223-458e-a14d-8c6bfc071223", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634762, "uuid": "30d71083-6ba9-47d6-8591-883d4a429c02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634762, "uuid": "24e84537-b28a-4867-8735-80d007b9a68a", "value": "6ac9535f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093583ee-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611270, "uuid": "7751d206-1827-4a5a-9ec2-c1655c823df2", "comment": "Malware payload (Dridex)", "value": "4afbe983fe0a75efcf2204ce2e12fefe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611270, "uuid": "176b8e98-7cc7-4389-9d27-7ddc4ba7f34e", "comment": "Malware payload (Dridex)", "value": "0f8a38cb1ef7c3af38e3dcb0d0b6cadc60d7307fc7c3a1f94dbd76cc68ea3605", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611270, "uuid": "280a46b4-3dea-4689-a742-fcb244c34433", "comment": "Malware payload (Dridex)", "value": "206a983bd1b4ea726f38cb1e0a605e20231c0055", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611270, "uuid": "3023fcb8-ef88-493a-bd2f-0ef514ee06e3", "comment": "Malware payload (Dridex)", "value": "b20fb627c1e26df0c60fa8579d9422736a6192de936b9ad32156311c6e24bd6dcafcd4761b9a99ae59f20acebe7eff51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611270, "uuid": "af367897-5e34-468a-8d5b-e092b8efb86b", "value": "82F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611270, "uuid": "6facea9e-0021-4688-b202-2e3bdcd4f737", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611270, "uuid": "07b0772d-b297-4832-a281-b732317f8541", "value": "3072:XIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611270, "uuid": "d2ce220c-6ba0-4e98-a22d-da3a6d9da149", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611270, "uuid": "e2008d3b-dab7-4677-9305-7d5ca372c710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611270, "uuid": "47eb035f-49fc-4221-a31d-c9e1591e7106", "value": "4afbe983_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c5daa7-b9d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559802, "uuid": "6e430d02-c360-4619-9dd5-cfd0224df69b", "comment": "Malware payload (Dridex)", "value": "3d61aa675fea7d40eda0d3c200992eaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559802, "uuid": "43bc234f-7fc1-45e0-9e7d-dab940f7f5a5", "comment": "Malware payload (Dridex)", "value": "0fc5d84ba7fa522a76104d2c7c4790ac1b33877c11dcaf5a6444a296c70baeff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559802, "uuid": "10fdf64c-0659-4b3b-9c56-01cfbb6cbcd3", "comment": "Malware payload (Dridex)", "value": "27ffd75631411d1963ba49a629ff147748c4c746", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559802, "uuid": "e5ebb9da-ddc3-478d-a181-2bab7d2c21ef", "comment": "Malware payload (Dridex)", "value": "3f05c3dda4f17d5786e9b43e387c2e80cfcc8fed2065ff732b0fef0bae67de4e52bbc609cc56c8521e02f63742dbdced", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559802, "uuid": "38d4158a-c9b6-480f-886f-1d6e822ec883", "value": "3AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559802, "uuid": "8b8750b9-c6dc-4c10-b86f-1a02b694b9c3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559802, "uuid": "f9db74d8-f501-4c8a-a4e2-6d2a93fbbec5", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559802, "uuid": "32e2a4ea-43fa-4a64-bb85-5838dea48e7f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559802, "uuid": "69954521-b373-4574-855e-14f737817e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559802, "uuid": "0b940cf9-8a88-4167-b152-3af7c2638e8d", "value": "3d61aa67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c27ad2d-ba3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621605907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605907, "uuid": "eece7aea-67b3-4ec5-abfe-b0f366a82ee8", "comment": "Malware payload (Dridex)", "value": "085a4fa71cc47d155019e47fd7f5d7ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605907, "uuid": "f3b35130-a871-44ce-839d-bde93c4e84cd", "comment": "Malware payload (Dridex)", "value": "0ff753fe6b275add38c29f3270f31ec9dbefd3ba6071471aa2e4f076eb6b2423", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605907, "uuid": "57310f8a-49bc-4d20-9866-51b5493159ba", "comment": "Malware payload (Dridex)", "value": "dcfadc1823dfad8e7e2b71769b8df44837d44c2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605907, "uuid": "d6f99461-435f-4591-9353-9e884ba511ea", "comment": "Malware payload (Dridex)", "value": "4ba830e225492323aa14e6c00fd03e0ccfd97e51c5939f55818984a229e40a98176dfa5c57f155a62abc6558721a28ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605907, "uuid": "760a06f4-c1c7-4619-b7bc-86f57a713543", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605907, "uuid": "a602942c-949e-4a72-9ac5-012addb4d96c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605907, "uuid": "1695aabc-a59f-4008-9b33-1c1cab5088c9", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621605907, "uuid": "8356ad96-0f9a-4d7a-8574-6b9f48cbcbaf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621605907, "uuid": "ad8405db-ffc2-4a72-813a-9bc2fedf9c25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605907, "uuid": "e5b2e2e7-cbea-46d1-8536-b949ae90e75a", "value": "085a4fa7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d11adcd-ba60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621620806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620806, "uuid": "032ae3c0-dcad-4168-b138-995c3f9493eb", "comment": "Malware payload", "value": "cb108b9f333869fc51470365cfa602c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620806, "uuid": "1837b9cd-0d34-468d-b779-f28152296896", "comment": "Malware payload", "value": "101a796ea9e70f05520da74a6bd400a59a1ba1a2144b872e2da2100155f0ab8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620806, "uuid": "59c517d7-9077-475f-8364-ff4ea925748e", "comment": "Malware payload", "value": "f23a2a3e5a32cc4a31d0dfb5499c0a770b12c71e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620806, "uuid": "e99afc9a-7c48-43ff-a80d-a3c16ffdb20c", "comment": "Malware payload", "value": "e13397babc973a1a88625e3efe60b5fd1c529f0417cd688a016146f5df131b955ff3d289edde8767540ea72997f2082e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620806, "uuid": "9a62b80c-559a-48b5-af45-b439f4ecd352", "value": "3A0523F4C33C5D9A47C2B750A7D6287B0B0B39D255D11F0BBB768280512A5E9BFB284B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620806, "uuid": "a8021df5-c12a-4411-a827-7c17fe5992f5", "value": "12288:0X+c0RSQW3Uj552AAkM7Pr4YPezd3US2xG3GLH4JGQcjeRjSF+VenO8I1GEHfjV2:MH0jiW5U1DS3WLYyieOJBa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620806, "uuid": "0d42c2f0-429d-4c8a-9a69-a3a04974ff54", "value": 828520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620806, "uuid": "8ffbbbdb-dd87-48f3-a772-dd5e8be53b55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620806, "uuid": "5b7aeb53-0e23-4b69-9e7a-75ad963708cb", "value": "cb108b9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc745656-ba0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "4d3f9f47-5873-4631-87f9-fa5267d72851", "comment": "Malware payload (Dridex)", "value": "5cddb7b7c5b409146e7de5d10076da79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "35b163db-13c2-45e4-a6ac-1d59a52dfabb", "comment": "Malware payload (Dridex)", "value": "10207733820ecd47117f03776f3a381548159fbfff4d7fda49138c89e64456a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "3887624a-988a-4004-a912-b246208db532", "comment": "Malware payload (Dridex)", "value": "343eec1e888d36e668499d30354a8afeada75857", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "24d08602-e4a0-4a26-b3c0-492486673a5e", "comment": "Malware payload (Dridex)", "value": "ea76553770535164be871b2723099ef9c0da301b579b10794bc065aad33dbb991c6e116c3c15922ef0d83e0ce994e107", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "28f9f2cf-8e45-47b8-912f-38e6b2baf25c", "value": "76F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "85da5549-c5d0-47fc-b870-c189f4e3d897", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "56808318-f429-403d-a65f-08f3fa1e5f9d", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584110, "uuid": "87aa4fdb-bb45-42fe-8bd9-dd5d2b8b8903", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584110, "uuid": "4085b747-56bf-43d6-b639-6a688940f72f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "84a81020-8ef4-42f3-b65c-2d3cd15bb200", "value": "5cddb7b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d016464-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578394, "uuid": "f46e579d-7c8f-461c-a8d0-54e96df3ea3e", "comment": "Malware payload (Dridex)", "value": "72d0f5557139ea58626f58461336f8cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578394, "uuid": "cd6f8034-4ae8-49c0-9ad9-90eeb7efe55a", "comment": "Malware payload (Dridex)", "value": "1047763b65235a13a12a5c3d31a63f20cda8f0f2710c77b14fce40d18214af6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578394, "uuid": "cd1c6cb7-ec7c-4770-b818-df1d5f976bf0", "comment": "Malware payload (Dridex)", "value": "96b6f85a14fd650d0443f4ac7b4b8e07620c9664", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578394, "uuid": "f1a5c207-53ff-4f1f-9c55-f9bb49e01d09", "comment": "Malware payload (Dridex)", "value": "cee84b06d72148b58d0a1ed78c4e403f1dd8c6e14214cf42f8af834c76f876889c07678c1025a90da8722f91d4e7e582", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578394, "uuid": "0e1704fa-50e7-45d3-88c7-a97b71677df7", "value": "1AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578394, "uuid": "29f17289-e222-4afd-b876-f2e2b11fe867", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578394, "uuid": "995f6d84-974f-4668-8f99-ed45df129c75", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578394, "uuid": "fc4e0d1b-788d-4074-b4f1-48d2ad05d8a9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578394, "uuid": "b53f46b9-a833-4e26-b98d-1fc65101cad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578394, "uuid": "038b0cbf-c992-41a6-871f-8ca34fab0d2a", "value": "72d0f555_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7f74c1-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609905, "uuid": "c9372297-ee66-4bcb-9452-9f4113b80233", "comment": "Malware payload (Dridex)", "value": "2a12d04d403c031fa09b20cee82c6c3a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609905, "uuid": "b7e424bf-87b2-4452-8b0a-c5fbcde95fb6", "comment": "Malware payload (Dridex)", "value": "1057266aa4556dbda0d868b42bfa3ad138decd90c90eb051c51ecda0ff4c0ba3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609905, "uuid": "f7eaab4a-8cbf-4e50-9cf1-8d319e6a486c", "comment": "Malware payload (Dridex)", "value": "f96a15d62aa3a4108698187b438abef61ad26553", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609905, "uuid": "101881fa-0907-4732-8287-5fcac6537e6d", "comment": "Malware payload (Dridex)", "value": "84e2e0e4fc1e71cfd8a1b084422cb6ab381978a2980f674c5b346b75d8d523371e6e0f7070a432ceaee5a8b0286f0809", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609905, "uuid": "b0f1ff10-da8a-4901-a1ad-b76b8006b164", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609905, "uuid": "bfeac9f3-4343-465d-9836-a36ddf46fd44", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609905, "uuid": "fd73ea11-59e5-40a5-80f4-6970d1a164ce", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609905, "uuid": "60b4005e-2e05-4fd2-8f4a-e53933b1700c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609905, "uuid": "2942b6bc-6bf5-45b7-81dc-a1901cd42719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609905, "uuid": "09e3904b-5cb4-44e0-ba3c-b23cf5b7283a", "value": "2a12d04d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5e68fd-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616972, "uuid": "5b4dd466-0503-45de-b58f-254692ab9375", "comment": "Malware payload (Dridex)", "value": "18f8979966f4cb5e2b5776648d513db1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616972, "uuid": "b2be6c0d-56aa-429e-a0c1-ba179935b019", "comment": "Malware payload (Dridex)", "value": "107e0464c4ae3bc298dc04dc02f0205ea7d18fb0a5f7fded1ffe10635a3b967b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616972, "uuid": "afcf0d3e-984d-4a58-b79f-309cd87cd78e", "comment": "Malware payload (Dridex)", "value": "a59458947d178dcb1d0f022f6eb660707694f61e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616972, "uuid": "9e2f4f40-09dc-4a8a-8a94-76c2071ce17c", "comment": "Malware payload (Dridex)", "value": "6a53747e59908dc56dbba20fbc7fc6106588edcbb1fc9fc6829260f6c41e633d1ab54e972423865252849e5cb3a89c1b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616972, "uuid": "a0ca2823-a3cc-4fad-8b08-79465e547bfa", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616972, "uuid": "65689c77-6592-42ae-9977-c9161c4dfd72", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616972, "uuid": "6026a12d-69f4-421c-b7a7-2191819e0a43", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616972, "uuid": "d05cba55-ab00-4bac-8f69-bfd8fd9d1744", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616972, "uuid": "f5d8be85-5bfd-40c8-a3dc-c84b1888aa97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616972, "uuid": "539421d5-7b47-43ba-8e55-be72154aab1a", "value": "18f89799_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53939910-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591638, "uuid": "dc9156f8-1580-4b94-bf19-dca74b31fc3a", "comment": "Malware payload (Dridex)", "value": "bf8ec4d03d1b634790f35c2f59c73fb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591638, "uuid": "671f1b42-6128-4b97-a404-d485c40f93f1", "comment": "Malware payload (Dridex)", "value": "10a1b31c866f2041d556768e954a9f6b0865abd369aa1a3992c6773ea2754bb8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591638, "uuid": "674a31c3-0cb4-46b3-85b9-92e19e7b6fc4", "comment": "Malware payload (Dridex)", "value": "1e9ef9decbb65caa8ee623986002e92c9bdd3c2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591638, "uuid": "16f28480-317e-46a3-8ec4-3ff6cefc8fb1", "comment": "Malware payload (Dridex)", "value": "a9b929d6d9b3c8ea4701d71a06b1dd2989ae334ffcfaed0d38157c31ab5ea3a772f4f8764e90e180747edf2aef956f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591638, "uuid": "adb56f25-89a5-4127-9380-f66a35f6b532", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591638, "uuid": "5ea21b07-407a-4e7a-94c1-8ad88898f03b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591638, "uuid": "5d3a4ca6-c816-4b7c-9c8e-d3fb006be90f", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591638, "uuid": "40fa5c10-eed7-4df3-97d6-ea1789bcd60e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591638, "uuid": "e60b8858-fa06-4558-acdc-59bfe5aae4a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591638, "uuid": "1810257e-a474-4055-8c29-0ec375017535", "value": "bf8ec4d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6fd454-ba34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602065, "uuid": "614e99f5-e86d-451e-9e85-4f68cd2003ea", "comment": "Malware payload (Dridex)", "value": "bbb125b2be81b9f234adec8f79fd6e59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602065, "uuid": "854c7212-28f3-4e33-8a87-63b4106aa221", "comment": "Malware payload (Dridex)", "value": "1107c5c712c021426637a5f3edf42fecefdffd96eae36c522d4c83e068e38c53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602065, "uuid": "d6655a00-2068-47da-b521-9b6c489c951f", "comment": "Malware payload (Dridex)", "value": "032731af2675b0cf53e6c3849dc5619c0dbda817", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602065, "uuid": "835f0cba-a452-4f53-8c8c-4cd80f58eae6", "comment": "Malware payload (Dridex)", "value": "ba3919d9668091fe5c74b04fda4cc42b4c99021a935fcd34a8a16acaf918078fbe1e6d348c948241475a833ce4822bc7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602065, "uuid": "52278792-764e-43ff-ac61-bf8894770fa7", "value": "3B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602065, "uuid": "dfe47ed8-70e6-444d-94d2-5d3a19be8e3c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602065, "uuid": "af028ce9-2d79-422b-a628-a448985f990f", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602065, "uuid": "32107e7d-13e3-4fef-9eeb-57e701ff4d10", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602065, "uuid": "bb3a95f7-0f4a-4f03-bd43-fef43ff9aeea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602065, "uuid": "6b82adb4-d0ca-4e92-8dce-1d55dcf3bc96", "value": "bbb125b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cfb811-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1621618516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618516, "uuid": "7a51f23c-8f42-4748-8497-f21305d9c358", "comment": "Malware payload (AZORult)", "value": "30162859e70a2939ff2c093b8614d8a8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618516, "uuid": "933fbc6a-99d9-49c3-b79b-f54ea5fddd62", "comment": "Malware payload (AZORult)", "value": "11f79018bf51c296233091ca42ba1413fb371b3daa4d051c4d249cf43d5cc514", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618516, "uuid": "ff6d7359-fcf4-4247-b596-c36347b2db5f", "comment": "Malware payload (AZORult)", "value": "7f6aa0309a58da116437894e91c93fc0e8e33b83", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618516, "uuid": "a58ea060-bb41-4789-bf21-1b04c5f724a6", "comment": "Malware payload (AZORult)", "value": "1086bf9aeb808cda413c44e2f877d0dd7874d68be8ab48b643c1f09d054294264e4e46ba2fc4c790eef7de1e7fa8ead5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618516, "uuid": "7350b47b-0a66-4ab1-b0da-be02e6fbdde4", "value": "B6B3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618516, "uuid": "6d79f5d0-0364-49dc-aada-9206150a194c", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618516, "uuid": "0ab9a594-960e-48ae-9577-844ec67dc825", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/uxg/L:Zzx7ZApszolIo7lf/ipT/uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618516, "uuid": "0122f4a4-fe26-4337-8849-8bea141044a8", "value": 115207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618516, "uuid": "cff4b016-6daa-4b16-9830-2bd7b925e849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618516, "uuid": "70a60deb-c120-4bb9-a4f0-3d4f02413f8d", "value": "30162859e70a2939ff2c093b8614d8a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a62b599-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563276, "uuid": "9f24d708-53ba-49ec-9d4f-be2ff40d5e21", "comment": "Malware payload (Dridex)", "value": "9772cfbb54a4a85f0b39c042e300e3fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563276, "uuid": "65647e5b-7a9a-4796-915f-b1e29ed70317", "comment": "Malware payload (Dridex)", "value": "12168a805e7cc6501ec17ccead26bc72515a828af7eb8f92bbb0d67d71fee87f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563276, "uuid": "4a351499-c6d4-4389-ab9e-e7b82d6e3958", "comment": "Malware payload (Dridex)", "value": "5fd5fa6613910885a616cd185c38791825f6cd79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563276, "uuid": "956e179b-b695-486c-963d-7c2e0b02ea78", "comment": "Malware payload (Dridex)", "value": "b614349225bd5b00d4cd2cbf459038108068628a6bd5ff78a0f57f8ddd7e2d1f610a7ac8de4252db0a8614e62157d9f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563276, "uuid": "4a218538-d670-4207-b462-4802c5e36dbf", "value": "37F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563276, "uuid": "0624dd76-b00b-4ba8-935f-7971bdf49832", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563276, "uuid": "0646a280-b7e5-4dee-9313-78acfe9b000d", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563276, "uuid": "48a99946-99f2-4cad-b9d6-9eb3c0c290f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563276, "uuid": "00ddb2f4-b26c-4737-ab10-5bb8115b96e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563276, "uuid": "176ec2dd-0a5c-4dc2-b7b8-8a1174086a14", "value": "9772cfbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0126f194-ba35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602238, "uuid": "9917bf47-7a27-4fea-8070-127e5e33e5df", "comment": "Malware payload (Dridex)", "value": "59ec92d8565633142bf911be86f4fb27", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602238, "uuid": "26a2daf6-8b2a-4027-98ee-d19613737f6c", "comment": "Malware payload (Dridex)", "value": "123ed01415444e3a52f830c117dee9bca083b4e0d676dd3265e0db7efc84a7b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602238, "uuid": "b4971e9e-86b1-40b3-a08d-437453073ec1", "comment": "Malware payload (Dridex)", "value": "1fb6e6c59ce4ecde5ca7df035513a59806a16261", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602238, "uuid": "97b9d0f5-2067-464d-ad64-c57c8eb66f21", "comment": "Malware payload (Dridex)", "value": "8303dd4ffe01202bc8f6f1ae6ddf2a75a586b5eca6bfb82ef5a257f32cdf946176799cbc43122d826ce24927eb87c942", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602238, "uuid": "bd8d78b5-0227-4254-b68b-d9dc330b0dea", "value": "3A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602238, "uuid": "b08a9e56-264f-4a0c-a87c-f46f431478ea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602238, "uuid": "937bc305-8852-405d-ab7c-d638115369b1", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602238, "uuid": "dda411f9-acd9-43d8-977f-17406088be03", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602238, "uuid": "a7720c27-b7e1-4c04-9076-db49731a1f42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602238, "uuid": "ee915e12-1e4b-4af1-aa0d-f6fbb57a5b50", "value": "59ec92d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2305df2-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562699, "uuid": "5bfa2c61-118d-4723-ab05-1c2fda972717", "comment": "Malware payload (Dridex)", "value": "6917a0517ce3002a593e4030bd4fe06a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562699, "uuid": "a08cfbd6-3ba2-4927-a774-e75c88251004", "comment": "Malware payload (Dridex)", "value": "124d735d2cd1d014cccb8a575f425ae1acaa2b8fa5b008fe8d62370b43e6e473", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562699, "uuid": "f0d5abfc-22ae-482c-8632-7e9473349b2e", "comment": "Malware payload (Dridex)", "value": "c4c1176071a9db344dabdb70a16adbd783d74ce9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562699, "uuid": "5259ae25-4ed5-4c03-8ffd-d1566661fbe8", "comment": "Malware payload (Dridex)", "value": "e0b1faa92bb5ed147ad7e4058af54560ba832540f5f0b53437c564da005914bc45c6a10880368c885f5db9ed74b33cc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562699, "uuid": "76f2d53a-3d46-4b95-9474-f041aec26d20", "value": "0304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562699, "uuid": "3ca1da86-9af3-4ed9-b616-c161e58f0f8e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562699, "uuid": "88a0b1a4-0423-4217-9ce2-2e35dc9fe991", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562699, "uuid": "91f5e1a8-c4ce-44ae-aa80-bd832d78ad37", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562699, "uuid": "2c034cb5-abe9-4815-aad0-b3b0b00fd47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562699, "uuid": "98f212ef-4fe7-4c83-bd11-9cf17a4e84ca", "value": "6917a051_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2f3ae9-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573881, "uuid": "98a16faf-4107-4d04-8c1c-934c2ae9b65f", "comment": "Malware payload (Dridex)", "value": "cd7fa31a1d757a2e05739e9c7ea3592f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573881, "uuid": "4379cbb9-6404-4760-85d8-0f0fb319a524", "comment": "Malware payload (Dridex)", "value": "127200dc1a53b7488ba6e3c7267b0c1cad36f214986a167075ebd109fad5ba1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573881, "uuid": "43c1e953-39cf-4fc9-affb-c8b0dc5f37ad", "comment": "Malware payload (Dridex)", "value": "b6947ae2c86feda137adce4f4233438eb6e85364", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573881, "uuid": "1da10c59-76b1-421c-b564-f4265073f3ab", "comment": "Malware payload (Dridex)", "value": "bd8154f1537fec8f07d263fe036155145423d9328df55e33f126366826ad1ec9c6bd95fa84577625b2b6661acd5eea8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573881, "uuid": "30da0914-ac31-4b39-b13e-2e74d883bf60", "value": "4704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573881, "uuid": "a71e0694-f26c-4375-96f8-11af51ff6207", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573881, "uuid": "d9b49b9e-06d4-47d2-8b1f-8bd85c4dc632", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573881, "uuid": "7d83d3cb-cba7-4b0c-b83e-d50a6400a0d6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573881, "uuid": "53f54fdd-c3fb-4c7b-be7f-2adcfa2fd61b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573881, "uuid": "a657d52e-04de-41cc-bbb5-ad02cd9bcc09", "value": "cd7fa31a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025b759e-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621618131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618131, "uuid": "9a3d56ff-857d-4d70-bd9d-6382863650a8", "comment": "Malware payload (Dridex)", "value": "f25ca3dfee9e27f8a8f4a2a7bccffeb2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618131, "uuid": "26f766be-b2eb-47f9-92b6-4772ab75d83c", "comment": "Malware payload (Dridex)", "value": "127f00b3cf276190181f98119deadfe09f7716526bd972b29743a89a5b790888", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618131, "uuid": "64d93a46-f9b8-4e1f-aa06-405e11751f69", "comment": "Malware payload (Dridex)", "value": "151f6ead2965c771d59489a1c3c0ed1aaa15639e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618131, "uuid": "516ed785-ec5a-46f7-b809-37c20ccfc4e6", "comment": "Malware payload (Dridex)", "value": "e568727332ce360dcfd5ae9161eb6f8ed20bf89b058d24f1433a20c58f53243cb5ec2286dede820efed9aeb3520e19c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618131, "uuid": "29f4f823-0ec1-44f6-b44e-487c6a63634b", "value": "F6F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618131, "uuid": "dba17b09-fc39-42c2-ae02-d754d2054c1f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618131, "uuid": "9f9c84b5-7352-4a8b-a398-f6d200714d60", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618131, "uuid": "30ba091f-7e1f-4884-ac02-9878a8688474", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618131, "uuid": "97299aa5-9479-41ee-9153-57f0e8a8e5f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618131, "uuid": "3050d8fe-28f3-4fe8-b1ff-fd1620e8eb40", "value": "f25ca3df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240cf541-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621616469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616469, "uuid": "ba243572-8017-4413-ade6-46a5b16ad1bc", "comment": "Malware payload", "value": "360b52ee4f28aaf7a95a1b98342391ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616469, "uuid": "99c3f3db-70f0-4f44-924a-a04e7a16b27b", "comment": "Malware payload", "value": "131f545211db2b4cae7aea8303a9212f160708747364cd32cc1f3e8d739d288f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616469, "uuid": "c0bfe8d4-90d1-4102-8759-6bf895f100b5", "comment": "Malware payload", "value": "fcd7f3747819c0b57762365ee508866374a44205", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616469, "uuid": "1775db20-5c94-4ccc-a332-fe5215135743", "comment": "Malware payload", "value": "d2e37ba040842033dcc255468ad96cd63a51fe0c878008b79e554c4d0e37893f79736c43d43b0478eddc4c976eaefa3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616469, "uuid": "9a3a9825-6c95-4ae7-a9e6-692bc68e0a6e", "value": "FDD4AF27F7A0883BC133377D9D5B96949C29BE813D2468462FE81E486F7D3813E16297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616469, "uuid": "0f65d307-9e7a-4310-85fe-241b5365f07a", "value": "a7aba6adb1ae5b75efafc0349b38a1d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616469, "uuid": "eb82fd4a-3be8-4734-9165-39784286cd55", "value": "12288:kX8ImE3HOu+F0vZuPxdqrUrVQIKrX1U95RcYPXjC:kXZXXOQxm8Ur+XrX2ZLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616469, "uuid": "20fe2083-7fc9-4711-a12c-2aeb93124b55", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616469, "uuid": "bfe40e8c-8dfc-4c6c-beaa-4251796a27b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616469, "uuid": "7e6e7a70-6459-44a7-8693-dcbf2a52a531", "value": "360b52ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695e7e3-ba36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602784, "uuid": "d37b37f4-d0f3-4591-b785-c330fd44be86", "comment": "Malware payload (Dridex)", "value": "87c56a1feaad60e983228fd5d7e4ef42", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602784, "uuid": "6a8eb0eb-09b9-4153-9c4c-e9dbad8a05b8", "comment": "Malware payload (Dridex)", "value": "1328caa20a388a02fd627e313394995cb40a04ed8b6b370a902b3ee7b509f5ef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602784, "uuid": "797a1548-bd93-4a8e-b2ce-f9986fbf641f", "comment": "Malware payload (Dridex)", "value": "67a90b7baed08ac6a355dc16ecd69cf9fb3add86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602784, "uuid": "0f08949d-3dfb-4747-bb14-05433f68bf45", "comment": "Malware payload (Dridex)", "value": "8d1463dbf9eb5dd22f0ac038c1c65d19ed6d1ce9d3711abb9ab5e81dde135f49e400cf144e71c69059187f9b9f49c542", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602784, "uuid": "aedf86a6-65c3-47d1-8913-f786abd65b4f", "value": "AD04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602784, "uuid": "df8090f3-6ca5-4bcd-a754-8a7f43b9f4ea", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602784, "uuid": "ed2c7c8f-5dcb-49f1-9b32-ef8b8bb237d2", "value": "3072:2WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:2WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602784, "uuid": "1ca31e14-77fa-4088-b068-63ea2af0d6e3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602784, "uuid": "8961e325-e2b8-486f-a4bf-3075593ca37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602784, "uuid": "84c746c9-cb6d-4721-ba96-6fe0d1264a15", "value": "87c56a1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f492314e-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562703, "uuid": "e1b4fa49-3d68-41c5-9564-fe211932c4be", "comment": "Malware payload (Dridex)", "value": "34d9088048dfd45723299d41552af261", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562703, "uuid": "400de805-2e15-419f-a9fc-44c6ee23e398", "comment": "Malware payload (Dridex)", "value": "1384cf87ce7e1d93fa08ee0cba9d9e437c8b4dc2a45dfb7f3c0f6ec04ea914bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562703, "uuid": "0c938802-bdb9-4fe2-b850-eccddef2dae3", "comment": "Malware payload (Dridex)", "value": "912b52049c4f8a33df47ad8de10af7005258d51e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562703, "uuid": "cc53157e-019b-43ab-ad3f-300507cf8a94", "comment": "Malware payload (Dridex)", "value": "642c85cbee6142e845454efff49c71b76087869eb9b701fec6f4d7e46c5dcab7037d12f47093f8647d8ff5ad7f7a96b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562703, "uuid": "4c7723c9-f144-4e2f-b31d-9d29816829eb", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562703, "uuid": "9f8c73b2-b090-4701-9862-8d1476bceebb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562703, "uuid": "90af1caa-289a-4d70-b3d1-8ec67be7e1d9", "value": "3072:W2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:W2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562703, "uuid": "7e37088a-f499-4eb4-a5e9-7ed28c66e13b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562703, "uuid": "1281f44d-4753-463a-88c4-89765659ff3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562703, "uuid": "8aad0879-891c-4a4c-bae6-521de6e50b71", "value": "34d90880_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32378064-b9f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621576121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576121, "uuid": "516429c9-50c4-4655-847f-bac9bd76bca4", "comment": "Malware payload", "value": "7333c63e95aa06f0a02fa37d574e3e04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576121, "uuid": "a80425a6-f667-4505-a389-6171b1fe1673", "comment": "Malware payload", "value": "140e822c807f3e1d5a504ebb105a87bf055734e82756198d7cebc3855f67e9da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576121, "uuid": "045be433-8987-4c74-94d2-45191ad77a32", "comment": "Malware payload", "value": "c76bb3d6aeb28b6e51421d781263c84658b156fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576121, "uuid": "7e72c81d-8cf8-4759-9fd8-cde72aaf94bc", "comment": "Malware payload", "value": "d674dd5b52b1e57e9517249e466f3d819948fcd955b09d0d576e78899fb750fa44b21985a7b81913b6595e5875272412", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576121, "uuid": "1e37a2a7-27e1-471e-8f24-3b6be7b3b659", "value": "C187DFAC325475DEC46BD27ADE681C68EBF17077831BD20BA12710AD990C997EF601B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576121, "uuid": "23ae29f0-49a6-4765-9717-be5d6cdfb76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576121, "uuid": "dc86cf31-7e20-4fde-872e-93bd52881be8", "value": "12288:xKzYeuTxFgvaIJpMpFuBzd/sicTI5MXjh8jUzk7ZJJV8hClThd6/Qy4Hjx6tobIC:szYeuFKadFuBBsicTpOUI7ZJJV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576121, "uuid": "a6b32615-cf07-4623-8b16-51676c861c17", "value": 38797312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576121, "uuid": "c820a028-90b9-4382-8702-069363c6e936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576121, "uuid": "a4f7b0b9-271a-4128-a6e9-28cf22f66e99", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbf4ea-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "31cf7359-1775-41e9-840b-0ee666d57b0d", "comment": "Malware payload (Dridex)", "value": "694744ddf6fefdbe87655fd1571e056c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "ad7994b2-8a0f-4716-9b49-244538711fa0", "comment": "Malware payload (Dridex)", "value": "143b69c3ce2833b40dfc4ff73bb4b13b7de38074104bd4e0bd83fa831712015f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "c830b1ee-a639-4556-9a61-86cf910bb68a", "comment": "Malware payload (Dridex)", "value": "268fd421978a7cf2194f549440c6faaf21fbb9db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "02da05fd-c5cc-4cc8-b750-7971e4596f66", "comment": "Malware payload (Dridex)", "value": "4b5174d9488f8408165bed1f47e6b3642a4f7443d9e7ef646002f9953406dca5561f4a4b88376c2b0876b626fe116687", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "633c5fd2-3784-4f2f-bf21-f94c13e44423", "value": "21F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "c534a76d-24a7-4e82-be5e-fc9759513b67", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "21ff0965-90e4-4af2-8c37-d95d93da7d8d", "value": "3072:89F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:89F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616901, "uuid": "82720e0d-607e-4b01-948b-2bba55e0afb0", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616901, "uuid": "4f8c3e2b-ef6d-4b8c-af32-959c077190c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "ff07a6fd-f7eb-4d51-b61e-81047b831683", "value": "694744dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ca7487-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570575, "uuid": "39579ec7-3dba-4591-917c-281535706842", "comment": "Malware payload (Dridex)", "value": "0d376712bc0cf96ae0791bd7e3653072", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570575, "uuid": "bdfd7e22-b5b7-450a-9d03-83255aa8c7b2", "comment": "Malware payload (Dridex)", "value": "14dc6690b2647177d31ba38b7885e848eb8c3c02c014690367213ac618254063", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570575, "uuid": "688596c6-567f-437d-adde-1baf05ad5ba4", "comment": "Malware payload (Dridex)", "value": "eca4585886c6f96c182fe4134168f9a38dcb7bda", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570575, "uuid": "c36a8768-824b-4b89-8cf8-dde38002f64b", "comment": "Malware payload (Dridex)", "value": "1744b726f3598c499375f8e04071d120b1fbaa74578c6c0743665c92660a6620a1f1b1fdf88f42a32d0fa98cf6e796b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570575, "uuid": "fd4968fe-6164-4b9f-90ec-a7c7b5c920af", "value": "2A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570575, "uuid": "15ffe394-6fcc-4f3b-b39e-e63d778a3987", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570575, "uuid": "0d5897f0-ca62-466d-80af-45ec2c92371a", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570575, "uuid": "333cdfe2-a337-4832-aecd-853002160273", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570575, "uuid": "4d3dcfe7-ea35-4471-aa94-515467fbd2f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570575, "uuid": "49e48580-09cb-4520-a271-3897a1cdc8f0", "value": "0d376712_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b6a339-ba5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621620168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620168, "uuid": "1ba2909a-67f7-45cd-95f0-354663b55013", "comment": "Malware payload", "value": "3f471e4079fe67cbc77f5705975d26fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620168, "uuid": "9e371a66-f8b0-4e70-b73a-2e1a9b085df1", "comment": "Malware payload", "value": "151d3313216b97f76fec2c0450d26de34aeb0c6817365fe3484a532b4443ed4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620168, "uuid": "77318e28-00da-461c-94f1-7ecde42f5061", "comment": "Malware payload", "value": "7f55519e3fc02feace1e4bc55d984eef6eb24353", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620168, "uuid": "bdace597-929c-4b86-952f-ace30f8b2344", "comment": "Malware payload", "value": "49aae8f88d0f612d605cc49e34f128d5d81ee72d9d071b4226a15ef2b1a7b87d64460a1b28d90210c6acf4257f33be44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620168, "uuid": "b90081c9-d63d-4b61-b95f-ac49125e8a83", "value": "6FF4335D7C31463AEEFE232A53CBE075883E7AEE2667863A005D27DDC13D5C131A9681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620168, "uuid": "91e3916d-6d63-40b9-b3c9-073b2553b5d1", "value": "12288:yaSux5uR0s+yzdYmpxeT8UVWFnotCNUeiTw60kOfu8EWpoef/dOAI:IIs+YY+a8zFnou4w6vMnoe9jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620168, "uuid": "8aa4ac82-cbb6-4c42-a1e9-6f125bc2783a", "value": 733749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620168, "uuid": "f3cc82fc-0fe5-4230-a752-5e3492cda608", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620168, "uuid": "f35195ea-cfcb-4141-b25e-c966058d5913", "value": "3f471e40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863755ba-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571967, "uuid": "9c9fbc1f-e9e3-4b0b-a6f8-18ad5e1d4c7f", "comment": "Malware payload (Dridex)", "value": "fcfb6d53865b3bba3fe2578ee7c55303", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571967, "uuid": "b32cae2e-25cd-4f7c-811e-bbe2e1675374", "comment": "Malware payload (Dridex)", "value": "1542456d84e3a938b4f165e6a04c53f64f66076e3004ef615d84afc57ab34904", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571967, "uuid": "c241b48c-c59a-4c81-86ac-b341f841212a", "comment": "Malware payload (Dridex)", "value": "7519e56224f3542c0067b209d6f34c26ff248487", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571967, "uuid": "7088d9e9-6868-43c1-af57-5b4c23a19cda", "comment": "Malware payload (Dridex)", "value": "032830fe92ce0a8cdeb9a26ba3d1990abccee64320b9abd4c9c9d1138762b32c503d2818653bdad499ccd4f24bf6a118", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571967, "uuid": "92705ef4-58c1-4104-9709-99966e995509", "value": "D204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571967, "uuid": "9926e3e3-8326-40f8-b9e0-623329574fe1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571967, "uuid": "16922bed-c168-47ef-b481-854315f92107", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571967, "uuid": "cb0d9e40-d1a7-482c-83f4-41d281165c0e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571967, "uuid": "af82476f-10fd-4dea-abfd-42bec9c3430a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571967, "uuid": "9a364693-28ef-416b-8e05-9e8094d02192", "value": "fcfb6d53_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0303ad0-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571178, "uuid": "0ba61530-8e1c-4605-94f0-f1ab4eebb566", "comment": "Malware payload (Dridex)", "value": "c03a24cd50158d7068a28affb5865fe9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571178, "uuid": "09e9263e-46de-4751-9984-98f13c89350d", "comment": "Malware payload (Dridex)", "value": "15695705c9be1ce0bbe9bdd1d13a8e638256140074495ba5b8d77fe82aefd465", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571178, "uuid": "4fe8ad5e-430b-4ac4-8b4c-2056a6c19114", "comment": "Malware payload (Dridex)", "value": "647a1aed1a282d041971f672bf4bf61c90a5f6ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571178, "uuid": "4c80d380-72c0-43f3-91d6-5e5755a1ae1f", "comment": "Malware payload (Dridex)", "value": "2b824d49d2862ca801b322cc123a0d0ff19a102d275556fb118702c9f8a2b647705c4cb732c254b515bece9c0f074e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571178, "uuid": "308efb9c-645e-4d7f-8aef-1a762479c3e1", "value": "0FF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571178, "uuid": "a02a83b0-927c-459b-90a4-0ab95ae341f8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571178, "uuid": "a3b80c24-ba92-4097-8f86-ebddb2f5a10b", "value": "3072:WA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:W3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571178, "uuid": "e85a57ff-b1f0-408d-8c93-592410d8d389", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571178, "uuid": "705fe760-20a3-4332-9f77-fec98f64bdbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571178, "uuid": "ad0b6c58-c31d-4764-8cd4-fcbb2f5541cc", "value": "c03a24cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2470041c-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572661, "uuid": "1d737657-0260-4d28-ba1a-ac8eb7654fed", "comment": "Malware payload (Dridex)", "value": "3209189f39f2b7c8e50aea2376a6ecde", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572661, "uuid": "79d8b22a-093f-47a2-baf9-512986c9c7bd", "comment": "Malware payload (Dridex)", "value": "157c644cbf1afda61466154f6d6b6214bd025943853261db71c2227c0a8c3c53", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572661, "uuid": "4cd39c4b-7ac4-4d21-88ca-74ec255ebee3", "comment": "Malware payload (Dridex)", "value": "1d35316b75de9e9572c8d6d52ec02fce8ee959bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572661, "uuid": "9b6a1a66-cbe6-4f1d-9938-6bb296e29bcc", "comment": "Malware payload (Dridex)", "value": "4b4e867add3e2967bb401dfa9dc1ccf663f1c3af658e7daf6f516f3a7d8ad98040acaa3d6dada60cedb4319a1f4e1cae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572661, "uuid": "83e2bb4f-1e76-44cd-a39c-0059d21d2455", "value": "1A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572661, "uuid": "b85fd0fb-1811-4b60-baec-1cf53356d360", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572661, "uuid": "afceb7ba-1c0e-45e2-a57a-d115ebba4c99", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572661, "uuid": "d24b5ad6-3b6d-4e5d-822c-1b5e3f35976e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572661, "uuid": "c15ddd96-c6e8-4cd3-9eed-3bedfb328def", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572661, "uuid": "396e9535-f27a-4f7e-a5c1-63755c8df5c9", "value": "3209189f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8af8f95-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621587916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587916, "uuid": "86c2aead-0af1-4c57-8777-1cecd512e31a", "comment": "Malware payload (Dridex)", "value": "5fa4a58bb2a07bc57777cbca34ba8acc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587916, "uuid": "0c03649b-aee8-4e8f-bbb9-f674b4607f5b", "comment": "Malware payload (Dridex)", "value": "160409c85754b1636d4cd71f35f1129dbbc3617bbadd6fb2a38450f867e7cd2b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587916, "uuid": "7193032b-1487-413f-b5e8-1d4ff23dabee", "comment": "Malware payload (Dridex)", "value": "a78016b837ad4c7fa9a284c87cd881d736c10a5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587916, "uuid": "6a0e398c-2826-48c6-8aa3-f41eb034c996", "comment": "Malware payload (Dridex)", "value": "86219b7e85d2c988e1461099a782e2e9d3cffbf50d7a7af960fe55581188053448d0f3cb93ff4ff07525dda0f2d76786", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587916, "uuid": "9fe6d16b-e21f-4e33-bc6e-c6a4a150655d", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587916, "uuid": "c164a065-66e4-4493-bb86-76d596e3b7a9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587916, "uuid": "99b5fc5d-baef-4e7d-a633-155bdf834217", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621587916, "uuid": "119529c2-8940-471e-8663-6f819b6bc724", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621587916, "uuid": "c678295c-9356-40a4-8ab6-31b3f1bea2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587916, "uuid": "d8c980f3-e3ae-4ede-98f8-d0bb1ff8d13b", "value": "5fa4a58b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7597fc-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621575955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575955, "uuid": "0a65d99e-5673-4725-b17b-aa0dd3fdaea0", "comment": "Malware payload", "value": "c225922e8ec40ccca7d491fa57ece50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575955, "uuid": "dad5b019-a660-4543-b699-9d4b3881203e", "comment": "Malware payload", "value": "160507d28ba26eb0bd4f85d36c3b1200056c8499aceeef089793f5f3d0d576d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575955, "uuid": "8ca18c8d-4dda-4b6c-ad3d-80b53ca23415", "comment": "Malware payload", "value": "ee725b96ff98300936664944e3e7a67619540fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575955, "uuid": "665338c6-52d5-4211-b705-5b1ab63b9ae4", "comment": "Malware payload", "value": "04190e69f7b28322e3ff82fa67f41978e68fd4a70e01e448b4baab2a175ad3c24d0e15801dfde9a6d3c84d1bdeb6b1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575955, "uuid": "e8d96ad4-b82e-44b5-898e-57e5420f9a9c", "value": "36C4F17122E52F5AE47EBBB404B100511BF9F5A5EB32F70E7DA920DD0465F448BA2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575955, "uuid": "a180c37b-0ef6-4a85-8a57-9676c50e9337", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575955, "uuid": "4906d5ba-8e52-487a-8cb1-57f0ad66693a", "value": "12288:zBxAIaYWIRl88Zeovm0d/pMexaS8HvAjusRyt3Kz:zzaYWsvz/eesSq4axt6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575955, "uuid": "4972d053-8a53-4af5-9a9c-5649aed356dd", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575955, "uuid": "4c90cb47-6656-4fab-8378-bf2de260da49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575955, "uuid": "c4a9aea3-f987-434c-aa63-f22609bb09cb", "value": "c225922e8ec40ccca7d491fa57ece50b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7744bae5-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591698, "uuid": "7af46cb5-f796-4cb1-9075-86a3952d1f44", "comment": "Malware payload (Dridex)", "value": "d49021be5184e39c4655b141c59aaca7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591698, "uuid": "263fb140-30e4-4c4b-a036-a7ff5f94e46a", "comment": "Malware payload (Dridex)", "value": "1658391683ba2a12f569ac1e74c24371aa3ed9bfe2b84e1a5a66043f45261d65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591698, "uuid": "52bc2d4f-916d-40f0-8e57-0ef289329b87", "comment": "Malware payload (Dridex)", "value": "fa099f26d22bcf7131dc323dec3aaf5779e229f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591698, "uuid": "9ec7f36e-daf4-49f1-a336-5a4e3d21d06c", "comment": "Malware payload (Dridex)", "value": "a0991b74e5a75cd253b344d54cc3035e806d03d9806556f1189ffea819391d540b94d8ab936c42bdd4ca082e0c1b82db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591698, "uuid": "5e281128-d50f-4133-929f-f3ff9cb87012", "value": "8C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591698, "uuid": "8512aaf3-32d9-4816-b88f-05d7eb4b2d72", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591698, "uuid": "e66044d9-aaa7-4716-8122-9402d4b08565", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591698, "uuid": "e1826074-fc1e-401c-8b5a-d708e5731d89", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591698, "uuid": "3cc93864-dfd8-4042-b402-3cfc7ea5791b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591698, "uuid": "b0928d82-bb8d-4550-947a-cb501ce61fe5", "value": "d49021be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26a5fe2-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559585, "uuid": "a806ef60-3719-4099-837b-d77e0fc85e9d", "comment": "Malware payload (Dridex)", "value": "497bd676e91284fa55ba74b6697728f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559585, "uuid": "461a901b-78c4-45da-b4fc-5febf6ec2789", "comment": "Malware payload (Dridex)", "value": "16ee441405efacdcc8d51e16e3201ce09803a5458278b55697ff87749e404fd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559585, "uuid": "3edb9590-6f69-4a9c-9de9-192611893dba", "comment": "Malware payload (Dridex)", "value": "a0361ae1eada3b462ad52ad55646b1da009d8d50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559585, "uuid": "a7880646-1ed2-4b48-aaa6-7271799bb233", "comment": "Malware payload (Dridex)", "value": "0f306b4a672f80ec4c93dc3fdb81d42f28ac61b88b289ce571ca1278ee7bf0f84447a4f858653d57bd46b44393714553", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559585, "uuid": "dfcb0503-2489-4ae4-a16b-7552fec10f32", "value": "5304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559585, "uuid": "fc45866a-4674-449d-998d-b3e6b8c4434d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559585, "uuid": "0dd9f2bf-672d-41b1-baea-d77ccb9335e2", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559585, "uuid": "4486a233-748e-4eb4-8d18-8dc53134c140", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559585, "uuid": "14b618e4-ef9d-4148-9a06-484a0e134a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559585, "uuid": "bb837cc4-22ca-43cc-9f1d-99abe3549589", "value": "497bd676_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c042f842-ba14-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588385, "uuid": "351b1aa7-a6a6-466b-a1d6-39ca088c1604", "comment": "Malware payload (Dridex)", "value": "bd4fe567888bcf6b88a3a7994060be44", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588385, "uuid": "c040502c-70c3-4826-83d0-84473390ea81", "comment": "Malware payload (Dridex)", "value": "1711b337fff30879d0f583844cc29d37fae144f59a300947fb2e33954398e842", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588385, "uuid": "77376173-198b-45e2-9028-ad5dcf3cbc2e", "comment": "Malware payload (Dridex)", "value": "7c2491f5b9662ac3d60c10487aff4a8ccd2bc7ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588385, "uuid": "31aaa678-ffe7-4a9e-96ef-a266fb70dd66", "comment": "Malware payload (Dridex)", "value": "fa070cf412c385838c905db61000adeac883e6fc8a8f045fbbff66e7538cd0e0f6f37dcf52bab84011d9d099b121b496", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588385, "uuid": "6037e5fb-3868-4c8c-8214-68aee8591cd4", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588385, "uuid": "4db69125-d53b-4d81-93e3-6b05141b82f6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588385, "uuid": "b36dbfbb-68aa-42b1-8618-a8b921012975", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588385, "uuid": "da7d945e-05aa-4c64-9299-712a083f4d9d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588385, "uuid": "896639ac-938f-470b-9c21-406dbc9273f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588385, "uuid": "f2b67469-4401-48a0-81c4-76e9acd218d2", "value": "bd4fe567_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ee2acc-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580507, "uuid": "2a770807-d202-487c-97c9-988578448289", "comment": "Malware payload (Dridex)", "value": "aa437aeba0777b67c2fa051aadec9562", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580507, "uuid": "5a98fa1f-7e6e-4e30-8e0b-f207afef113d", "comment": "Malware payload (Dridex)", "value": "171f8550e8cf37750bf2c4648505dc44d7f41b43f304cc0d9d06a8314a9d38eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580507, "uuid": "d93ebc71-0038-4e5d-87b2-76d1e20fe9f3", "comment": "Malware payload (Dridex)", "value": "1b74e4c954319a1c9ad282bb676b08888ca47c08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580507, "uuid": "b6f5a39b-aac0-4b25-b02f-0b190a092ea9", "comment": "Malware payload (Dridex)", "value": "69eaa1f60d2c4b4b6c4adb7fccc3e62583f9995866707bbc7ac6481466d1ef0fcebce4e9be1edd60dad0845ce258ab35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580507, "uuid": "1f80c187-035c-4eec-b714-ee39bf5a2613", "value": "6A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580507, "uuid": "bf3109cd-0df2-44a1-9f96-e7eab04cbb0f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580507, "uuid": "6b518718-1072-4ed1-b2d1-ec54c0d8691d", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580507, "uuid": "cfe60f5a-8e54-4570-9b54-65696795fb8b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580507, "uuid": "3aaf0d1b-0685-4fac-a3b8-7a315309d075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580507, "uuid": "d36d3fb5-0b96-415e-955b-8e756d81b603", "value": "aa437aeb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16afce5e-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570920, "uuid": "6c63f0f2-c5d0-4c6f-a247-f8ce2dcad752", "comment": "Malware payload (Dridex)", "value": "02af3804950b4cac1488e7ad6745cc1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570920, "uuid": "c8880e3d-e39f-4647-9e8d-86edd9b3352f", "comment": "Malware payload (Dridex)", "value": "1762fa6edcdad718da0c5e9ce6bd610ad9d3445519cf83f383052960e17961ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570920, "uuid": "97b63bdf-28b4-49b0-b2ef-b190a9f89fe6", "comment": "Malware payload (Dridex)", "value": "90bd399c220d130bb6289db29c03cdd80727a505", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570920, "uuid": "2ab78106-7414-46f7-83e9-734de8f8a388", "comment": "Malware payload (Dridex)", "value": "081b7b04f72537d600df4c3ae0471ed859fcb97efe11ee835a8a29fc17b1cfadb4c1ce8d4e634b156b80e69c90df443c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570920, "uuid": "ca2aac6f-0bab-4c48-836e-90b81fed2ae1", "value": "C604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570920, "uuid": "b1c7b2cb-a0db-46e3-9ba9-734bad3a73c9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570920, "uuid": "54cbf913-7f9e-4eb7-b98f-2812d4615db5", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570920, "uuid": "a2b72378-5f98-4ccd-981c-ca33b1593ada", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570920, "uuid": "862594e7-dc0a-482c-b6d2-467ed38d5ac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570920, "uuid": "14b27573-c0aa-4f9e-a8d1-92a74e9c9517", "value": "02af3804_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e2bcf8-b9d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560965, "uuid": "99ef9f5b-95a0-4287-b01c-0d42072315ae", "comment": "Malware payload (Dridex)", "value": "5cf5ef97e98a57c1322569cd0d18b7ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560965, "uuid": "5d29e7ce-30f8-4204-a970-dd9249181f91", "comment": "Malware payload (Dridex)", "value": "177ce8e188a368040465c86c81548d552cb2244dd19c37fa40b988ebc5c9bda5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560965, "uuid": "d7526862-2e33-483a-ba54-29f08095de85", "comment": "Malware payload (Dridex)", "value": "aff4ca6e954161347657f946f73c26b6150eb2ae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560965, "uuid": "4e48d84f-b751-432c-bb69-a54d441ae799", "comment": "Malware payload (Dridex)", "value": "77c0ba0cb438df6f38504efa7725ff4e04909ce60b9b6120b8bd4af37dea159128728b9781ce0adffa181a9970884a0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560965, "uuid": "2edf0c49-3547-40e0-999e-a734688265e0", "value": "2804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560965, "uuid": "5f8a97a0-4351-42e1-a4a7-6445bc80ccfb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560965, "uuid": "d2527739-d3a4-4c51-81cc-2d0a3fced238", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560965, "uuid": "48ddffbc-cf43-47f8-b5e2-bb773c1e2fbf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560965, "uuid": "d5745efc-4c31-4bdd-8ff6-56e83e4ee121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560965, "uuid": "2b11676b-adaa-4538-9756-8a84ace249b4", "value": "5cf5ef97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b13328-ba64-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622668, "uuid": "cba50053-a2c5-4950-ac14-47df036d395e", "comment": "Malware payload (Dridex)", "value": "06d4edbf510d28fe4ae04a11fd139511", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622668, "uuid": "35092467-a871-4bce-bd2e-1d46b94f055a", "comment": "Malware payload (Dridex)", "value": "17d8ac012b6f49cbc889815c5e80a6d7d86c0ac4de38a2a642a0a7565c29e155", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622668, "uuid": "a82bf7aa-4b49-44ba-999b-ce65a5d4945e", "comment": "Malware payload (Dridex)", "value": "5eccc503148e8637535dea63df586a10afc69eb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622668, "uuid": "483d0f61-0b84-4ce9-9eac-06af8b892161", "comment": "Malware payload (Dridex)", "value": "c9b0740e5f2e4642e96582934f524667e1f9861765cbb4c71975c6e23cc1e70d9277c32150e39cab6083329813142b08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622668, "uuid": "0b56e4cd-0b80-441a-b947-2b042345be03", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622668, "uuid": "748ee443-426a-4fb0-bc45-da529af4d995", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622668, "uuid": "bf8a0bb6-d721-4bc5-b7f6-ba8b9f3db609", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622668, "uuid": "341c0091-4b3f-40e7-8553-d9dba7d688a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622668, "uuid": "3b1478a8-98eb-4210-9531-829a626a32cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622668, "uuid": "907b3225-7bcb-4b93-a24f-b0571664d114", "value": "06d4edbf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e95625-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621617253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617253, "uuid": "738897db-e0fb-4678-953b-a3fae29a264f", "comment": "Malware payload", "value": "7906dc475a8ae55ffb5af7fd3ac8f10a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617253, "uuid": "6d1d1394-6b84-4f3e-9455-e3adfd804b70", "comment": "Malware payload", "value": "1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617253, "uuid": "771519d0-cf5e-4778-af47-7260a56fdffe", "comment": "Malware payload", "value": "e7304e2436dc0eddddba229f1ec7145055030151", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617253, "uuid": "ea322b42-e720-4ea7-977e-b28c993f6678", "comment": "Malware payload", "value": "5220ad49838d42d162e1266c030c27d1351f4e1cce96f12c25914758598e99ac83a4d4ef4e1ffa5986a4ec57fb838961", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617253, "uuid": "fcbcf1f3-266e-4bbc-a77e-d52e57a91adf", "value": "77A2CF67B2E96DC6CD88247E3D87AD1815322D41F7021FAE1C4C3B7C095F12899629EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617253, "uuid": "c79f0eb7-63f7-487b-b1c2-9f16dfcbad4c", "value": "384:otLvArTA5n2Kc/vURgbHs19l897hkuzetFS/z1ANkp2RD0CwMiOQkSd:odvOM5UNMRS7W2AiEd08D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617253, "uuid": "dff65b35-4953-4feb-b125-5042159f6418", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617253, "uuid": "5fc90f05-dbdd-4d58-9180-5f84c5262505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617253, "uuid": "29bf8049-a7ee-496d-8564-d153b8e4f7e4", "value": "7906dc47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330cbc91-ba07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582564, "uuid": "9d8b0d33-2999-4dc9-a11e-931f3bb8c36c", "comment": "Malware payload (Dridex)", "value": "738827e52923dfd8f1577673616102fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582564, "uuid": "c6e478c0-6a4b-49a3-b8d7-84314f2f5583", "comment": "Malware payload (Dridex)", "value": "182dcbe6344c2a3cc86a6b02202cbfe5538129e240761d1ce391604907337e59", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582564, "uuid": "f9356799-3049-4f04-9e46-653ef623d2d1", "comment": "Malware payload (Dridex)", "value": "a8aa3cc12ff607a489e1020c0ada32ea481c4120", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582564, "uuid": "00f0acb8-5754-47de-acdb-cda52a6c9ef2", "comment": "Malware payload (Dridex)", "value": "eba3eefcdca006f259f2e0387c915bfa197c09b8b4fdad0f256425aa4a9882e203dbbcdc9ba64c75e19634d2803261d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582564, "uuid": "1718d1bd-e50b-4d98-aace-a945f126e535", "value": "9704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582564, "uuid": "4032b834-06eb-4de6-af82-2cec7e015e1c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582564, "uuid": "1f72d3ac-7bdd-42e2-8ce1-145948f08a7b", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582564, "uuid": "a9f90899-168f-41cc-8010-3e880a37ceb3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582564, "uuid": "ea73a29f-ab3b-4d46-bb6f-cdc6b0bf0805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582564, "uuid": "311464d0-b7b1-4829-b923-cc344efe6b5c", "value": "738827e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b98f1eb-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563305, "uuid": "73a75616-d645-48e3-9ef3-948592616f5e", "comment": "Malware payload (Dridex)", "value": "2ed4821c0ff15d72bb07e3ebccd4679f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563305, "uuid": "9baea256-14de-4d8d-b91d-eb9fa2d5bb9e", "comment": "Malware payload (Dridex)", "value": "1873521b7c783528bee1805c65f8703c61d739a28e1b41c14cfe8df7f9a79ac9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563305, "uuid": "d5d54e70-63fb-4e95-a993-4e63318ffb68", "comment": "Malware payload (Dridex)", "value": "32dd0863a883f9b3f2981db00523571ef6359fae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563305, "uuid": "d395570e-19b0-4949-ab24-59c691579dce", "comment": "Malware payload (Dridex)", "value": "b3df6509d6ac2f5d36816133ca0669f1c8d0f526f0668f15db36e3848f59286c88affec50b5dea0a4be71acbdc073d64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563305, "uuid": "fbb1671c-795c-461c-894a-4542b71a1209", "value": "C6F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563305, "uuid": "4768e650-31ae-48da-bbec-4b2f894faba7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563305, "uuid": "88887ca5-6b9a-456f-b725-8d93f8f92298", "value": "3072:4IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563305, "uuid": "cc83db87-0e66-41c9-9a90-7e1976018a8f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563305, "uuid": "132dccd2-7a7f-49e5-bbcc-36a2816eae24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563305, "uuid": "74137b93-aaf1-4eae-aee9-6b7db5543207", "value": "2ed4821c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5943bd62-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610975, "uuid": "e57f8a8c-63a0-4dd9-9c53-32d878c92837", "comment": "Malware payload (Dridex)", "value": "124705ed7809e22455035994098b261f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610975, "uuid": "931f4113-861d-4108-a57c-91c1771416ea", "comment": "Malware payload (Dridex)", "value": "18af3e1d2ac3560a28db04d11cf090cbf54116f3c98fcfda981c5de2316e659b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610975, "uuid": "62188619-fc33-480e-9a83-565951ea113e", "comment": "Malware payload (Dridex)", "value": "9c549c0735ef2d0c3dd6c1cb96e7b049d85b315b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610975, "uuid": "c24d5c28-2362-4587-a0c7-e02e22769d35", "comment": "Malware payload (Dridex)", "value": "0cab810fed4fc8ac60d56d53c64574615c5df73b786b9f219c57ca92c400ce8cd0e53b568da3d839755c19453635b0bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610975, "uuid": "fe3222e3-bd19-4817-a19d-41630d4aa2c7", "value": "D404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610975, "uuid": "9d0bb5a2-dba1-4f58-a6e6-8f98fa6049e8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610975, "uuid": "84e28869-ca83-4214-99d4-cf4eba6470bf", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610975, "uuid": "e92b124e-f676-4b2c-986d-95a190b0a01b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610975, "uuid": "0b23c057-25b0-4000-a56e-3c8a3d7c355f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610975, "uuid": "17368262-33cd-44b6-81b4-1af1c7e22c25", "value": "124705ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73870f2-ba24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621595268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595268, "uuid": "9b12b1ef-78f0-4572-ab5f-c929c4a14797", "comment": "Malware payload (Dridex)", "value": "11adc03d4c49c49308061e9cd93d99a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595268, "uuid": "c4775d38-6497-4b5e-9799-d13066689df4", "comment": "Malware payload (Dridex)", "value": "191a972ddcb797ac1a691f1853550fb1250a5902021ded7ee23d979c3a8faa68", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595268, "uuid": "3789990e-689e-4e70-bf67-e5d23c9fa289", "comment": "Malware payload (Dridex)", "value": "03ed8db11a5f9834b251900fb008c513a8adf6c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595268, "uuid": "3328d05a-4fb5-44bf-9a4c-a1fe37dd9153", "comment": "Malware payload (Dridex)", "value": "f465ac36d21a5a7c542a84be1a11036dd12521e7aae91d74fb0ab0ee5360050916b171e8b9e208dc54eb87827a01c085", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595268, "uuid": "2c6a7f89-a565-42ca-8c8a-f0942397316e", "value": "EB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595268, "uuid": "a30b7ca5-c23a-4025-8305-afe5bdad74b5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595268, "uuid": "35ddef35-9353-4ecb-b966-7489fd053374", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621595268, "uuid": "bc3c864f-b9cb-4e95-ae4e-8d412ba288a7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621595268, "uuid": "16523089-92bd-4483-a5f5-e978a8fa5757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595268, "uuid": "dfd0680a-52c6-4743-974f-339478894619", "value": "11adc03d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3b065b-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609396, "uuid": "f5762ba6-92e8-4c72-9927-f0223da23453", "comment": "Malware payload (Dridex)", "value": "69c6b28b199e4d2e1269d6b9c76519df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609396, "uuid": "47e82bb9-a29e-489d-a5b5-6e4126998cf8", "comment": "Malware payload (Dridex)", "value": "19222989ca9f0989a2150ebb9b95baa7fe9e01ba7657b64d4ac1ecabc4b97ae1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609396, "uuid": "79cb98a8-7a80-4881-9fee-b574a07d95ac", "comment": "Malware payload (Dridex)", "value": "3694bea3f6ea62606e335b0dda891ed5c78b1f7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609396, "uuid": "b0514857-4291-4156-9d6d-5725e7c9f492", "comment": "Malware payload (Dridex)", "value": "ab8508ca165f06a24b66ddbf62a2928ec51f70e0fece6fb62a7810d97ad66c44bba22a2c0319b743a67fe03aa519f8f7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609396, "uuid": "508f19c3-ba54-4466-8be0-8ff8562ece88", "value": "C004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609396, "uuid": "b1332b5e-bdea-4114-b449-16a45f65a02e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609396, "uuid": "2d6709fb-2216-4672-8cfd-a4e8c746c68b", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609396, "uuid": "8cf2654b-7f0c-485c-8d98-f0546ce479ef", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609396, "uuid": "069f9537-8708-407e-b2bc-0087ece235fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609396, "uuid": "cd3d11f1-ee48-428c-97ac-1c2fb92a09d2", "value": "69c6b28b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e44f142-ba2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621599736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599736, "uuid": "b436d092-65ac-4494-acaf-87f6e7ef3a6f", "comment": "Malware payload (Formbook)", "value": "b02c08317297ec3a190f8a3bc9b160be", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599736, "uuid": "cc29454a-da45-45b5-a9ec-76a0ae206e24", "comment": "Malware payload (Formbook)", "value": "196b6069472a478c158cae56200e7d627d7e6b32ab1f361a36b75234bbf998de", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599736, "uuid": "b420e450-2fb5-4e3e-8223-fac62239b393", "comment": "Malware payload (Formbook)", "value": "78520a373601e375682442820a8d97bd9a28ef80", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599736, "uuid": "34b878d3-f0ed-4275-b107-f44f33b6c250", "comment": "Malware payload (Formbook)", "value": "493cef75e17d29760958599e25d073d8446bb06b04ab025d0262826416b80593e015b571a4046c39799841bf26938da0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599736, "uuid": "9edbdf8d-7f83-4909-921a-645483d48c75", "value": "7415DF2033998359D0BAA7748C72C7905BF2BA15E715CF2F3DA8218C5DA37934722B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599736, "uuid": "67fad319-5eaa-49cf-ab36-33bd2336337f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599736, "uuid": "3628cebd-729a-491c-97cf-4a9b6866341d", "value": "12288:q6EhtMN/heiEXc0G1soLmQ9EBbS+twwTg5vKBQpNgrOMJz97uxZPY58gKz:3EhexkjXcbsNRBbSZj3kOMJsgAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599736, "uuid": "9163985b-25b9-435a-a655-e5f72c5e4976", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599736, "uuid": "5b979098-83d6-4cd7-baa8-2fff937a4e3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599736, "uuid": "460cb7e5-c0c2-49eb-a2e2-dc1c7efb3ca7", "value": "b02c0831_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0f4b32-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581721, "uuid": "b3973245-b971-475f-88e2-4ca24970642d", "comment": "Malware payload (Dridex)", "value": "20ce7619de6e31559b9f0f3a7adab129", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581721, "uuid": "c2ca9c46-b769-4ee7-aaf5-91abec9fd090", "comment": "Malware payload (Dridex)", "value": "1985705c54c3e2c3ba3df22dc490fcb792cff5e0e395053acd54167378a73661", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581721, "uuid": "8ae4b32d-cd48-47e5-b83a-b845889052f4", "comment": "Malware payload (Dridex)", "value": "a27b804275cb1452b6b10099276714f6297563dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581721, "uuid": "02e4b7dd-e7d0-410c-835b-ec06b258f1b2", "comment": "Malware payload (Dridex)", "value": "7a31f3b5b9c8d111c0e5d926e281e536adb6afc63d3e778e07b912fc46339b929f8e11021ff2ddd8c25ac7a0eab62334", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581721, "uuid": "2f75c5bd-b2bc-48a1-b371-e56be23d0b9d", "value": "CB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581721, "uuid": "9924d835-1fa9-42bf-bb47-7dad9dd35bc9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581721, "uuid": "2eaed584-5f0a-48b3-bc31-3e2b39788add", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581721, "uuid": "9a37c82c-dbc8-4fde-9486-0afa9a40c4b3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581721, "uuid": "13558845-3871-46f5-8a65-54aa7544a268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581721, "uuid": "e2eb587f-b023-4a84-a9f4-71410ec426e1", "value": "20ce7619_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ed3b1c-b9e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567864, "uuid": "083396ec-f723-4cbf-8ce5-20c9f114d4e1", "comment": "Malware payload (Dridex)", "value": "0bdbd5cedd6db95cc9456be7db1cb032", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567864, "uuid": "d654c226-99fb-47fa-a2c8-2824ac7ddd0c", "comment": "Malware payload (Dridex)", "value": "19f15c62902a07b7ed4d6f48c63b68588b8e219518ea1c55d304db4ee6bb21d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567864, "uuid": "047665ed-837f-49d2-9073-54f9d8160b62", "comment": "Malware payload (Dridex)", "value": "a0931cd1f5e61f3fad1acc49eb8dc77053fd365d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567864, "uuid": "7caa4981-6adf-4b58-9648-8b2fb21fdfee", "comment": "Malware payload (Dridex)", "value": "ab3d1137d6be08d17b37d40fdc19d773cbf00f16283500529e3c5462987fa9cddb434fbc1d70145d7794759a6d6116fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567864, "uuid": "dd15f9f8-a302-43f7-8749-3f7bc4eb298b", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567864, "uuid": "cff0dfc5-fe86-49e4-a309-d405926412ee", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567864, "uuid": "9f2c446b-208f-479f-ac37-f6b3eaea88a1", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567864, "uuid": "23bcf61c-a5df-4aeb-9c5a-1756474ecd54", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567864, "uuid": "f68a0af6-c2bc-493c-a9b1-402797aa0d2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567864, "uuid": "b576483f-dbb3-43e9-8edf-904d16089f79", "value": "0bdbd5ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103c82a9-ba08-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582935, "uuid": "63eee437-7f01-4b89-8a39-71b77afcfa89", "comment": "Malware payload (Dridex)", "value": "46b6705760226eed3efc06f237b41c6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582935, "uuid": "9d8aba16-cbf3-4aed-8579-bb3fc9f8902a", "comment": "Malware payload (Dridex)", "value": "1a198a4e3a4ffcd45baf256d6c69b95cebf25bf01ccebe1d8841427be954f3b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582935, "uuid": "c9011984-a2f7-48a8-acee-3fae8cb13a78", "comment": "Malware payload (Dridex)", "value": "caecd14e913a959c631e4d4b405e430603980443", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582935, "uuid": "368060cb-7621-45f7-b0d3-4378708f2f68", "comment": "Malware payload (Dridex)", "value": "a04aee72f1d3f1df1578597af71a73d897e2bb68eca4fc7a746e456aa6c041026f3db873de8f83bbc3d0c3151e1b91b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582935, "uuid": "e263a178-175f-4ee1-86db-13a3c83efd6a", "value": "B804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582935, "uuid": "646df5d2-0aa7-4c20-a496-63d7fdd5c305", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582935, "uuid": "ef773560-0fb0-4614-916e-1a58c96d69da", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582935, "uuid": "97e8efc2-1a20-4ed9-bb75-02eaf38db3de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582935, "uuid": "29afaf5d-3917-4a0d-8394-d11d1c795831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582935, "uuid": "8ef57ffb-8929-4a1f-a3be-244d9398870f", "value": "46b67057_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4762b5ec-ba42-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607939, "uuid": "a1c12861-66bd-4164-8431-95014b404198", "comment": "Malware payload (Dridex)", "value": "0e34ca2584196797066dc93d68449668", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607939, "uuid": "4a253a76-5998-4bcc-abf0-be0cf807b919", "comment": "Malware payload (Dridex)", "value": "1a3aa1333704b77bf8ac59e7dd93665902920c9faaea5d4280cff384d5e1e04d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607939, "uuid": "c0c08800-6912-46bb-bd36-8192d6ebdecc", "comment": "Malware payload (Dridex)", "value": "f597e007a9169684c16b30652083c21953c3cadc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607939, "uuid": "6ab49ba5-51a7-4547-8ea0-e60273d68f13", "comment": "Malware payload (Dridex)", "value": "766e14088bf6505982d959097e83932d3dc185a4a8dbc0e8cadf2a547db9d1f024b07a0f84a8ddfa5ab40a4efc809878", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607939, "uuid": "0a2406fb-619e-4a50-826d-40fda42d01e6", "value": "5D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607939, "uuid": "9bcd045f-cf39-4b21-bab2-826ecbc9f877", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607939, "uuid": "7f8196a4-632c-4f81-9d90-3ea19e6925ad", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607939, "uuid": "00ae3705-e571-4529-bb78-1f1cb236c0db", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607939, "uuid": "107e32cd-d31d-47d3-8b6d-10326ccad04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607939, "uuid": "d5c52c5f-450e-467c-bd7c-88a1e9f3a037", "value": "0e34ca25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10263d69-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558884, "uuid": "de287c57-7f82-45ca-9592-86e97b1f0aeb", "comment": "Malware payload (Dridex)", "value": "3aa5b7b0b971f94dd475cd703c29e801", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558884, "uuid": "be13d357-235f-4010-8a12-40f870947359", "comment": "Malware payload (Dridex)", "value": "1a70ed459ba9fdcd04ddbd93bebf2b525504da887843e860b8f516c4eea19082", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558884, "uuid": "267400d4-18d9-4353-bd79-7400de817c9f", "comment": "Malware payload (Dridex)", "value": "6b954817f289edb420a5b7b941c0f21f7912d300", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558884, "uuid": "bc7a76cb-8193-4938-91e5-25fe5ce49ae6", "comment": "Malware payload (Dridex)", "value": "7824cf2cef4713d064799a637140bf46c8419991ee5d8853a003c10f62b1db96200ce3abf7ca200529b3f9294ba4e7e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558884, "uuid": "2d8345c4-3b13-4303-b4ef-2353e39258ba", "value": "8904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558884, "uuid": "4c7c4a27-1145-4e22-995e-45a071ddb161", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558884, "uuid": "dfadeccf-7478-40e5-a6c6-e3cb0d8b7d3f", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558884, "uuid": "c21e3669-79e5-43e1-9e7e-23a0e6447f63", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558884, "uuid": "b2d24bfe-6f76-49f7-afa6-e8bbeb30e4f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558884, "uuid": "abde2c86-966f-48ec-9536-b80cdbc4c564", "value": "3aa5b7b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3afb6e-b9e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566848, "uuid": "4bfe1202-0381-4799-bf51-7fbbeef8d990", "comment": "Malware payload (Dridex)", "value": "2f229cb729699b3637a2b773b931b691", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566848, "uuid": "a9086b7b-d9d9-4120-ba74-e86dd7924642", "comment": "Malware payload (Dridex)", "value": "1ab3be908c6c8efd3a0e121993df1c93176c2c01d49d1134800f4eabc077ff66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566848, "uuid": "24e5cb24-f6fb-442b-94bd-1b0eb7e6abeb", "comment": "Malware payload (Dridex)", "value": "ea21d831503731dae111281a872a5b7d786fe53b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566848, "uuid": "edc360a1-9d1f-4065-b94f-1cb8028b7ae6", "comment": "Malware payload (Dridex)", "value": "aa6b74282f17e65c0daa771f8c780247a6794212fb2d9ea0d9293373bc3c1bf323c7450899bb0abb08191f075e5ad31d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566848, "uuid": "de52aaeb-c747-4012-b342-c5e1f28ca459", "value": "06F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566848, "uuid": "9d0ec3d0-b87c-4a43-af50-ed2984df02ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566848, "uuid": "93b31062-624b-4b24-b672-37bfd7630879", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566848, "uuid": "d26f29fe-decf-4776-b783-e584ae02ad68", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566848, "uuid": "6906070d-940f-4ceb-bf8d-e1353ba89cf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566848, "uuid": "023285b8-16ff-46a5-b905-2b15dea9d15e", "value": "2f229cb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f6c55b-ba69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621624586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624586, "uuid": "21b1f188-d014-45e4-af15-7c2edf6c8707", "comment": "Malware payload", "value": "e4104a595b21062176dc7da75f23f390", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624586, "uuid": "4ef070ab-239a-4bf7-b02a-fb3c677bef2b", "comment": "Malware payload", "value": "1abb11c52cc0ff807b1f1bf8472a63b9a3526e84b0c715706eef624d7188a202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624586, "uuid": "93610f0c-1ebd-453e-a083-3d6ef7ae3f19", "comment": "Malware payload", "value": "151099ffa5bc76007c7c58ae0e5cdfa5d4bf4d3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624586, "uuid": "58f18912-a735-4835-9e12-f13e3cfa44ce", "comment": "Malware payload", "value": "5632e45c20b822d84c9bb85c66460ef11d5a61bfa416954ea893ea7ad1fc54ba742c32023af5c2c8a0a2c869c0a2dded", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624586, "uuid": "065f4ab5-7bf6-4ed4-954e-08186bbfa691", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624586, "uuid": "f978aa21-91b2-4293-a146-60a092614ce8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624586, "uuid": "688a1ba4-c460-4e4d-a3b0-fdd7da21e708", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624586, "uuid": "3e8d2acb-16a4-4664-82b6-de7477e77fde", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624586, "uuid": "ee3b190b-e223-4502-8783-8577245a6df0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624586, "uuid": "4844fc85-58d1-4281-92ec-e7fb21b72416", "value": "e4104a59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec191746-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573855, "uuid": "8be5b0c7-bad0-4bab-a66d-852829765a22", "comment": "Malware payload (Dridex)", "value": "06273847c8101d0ff88115627cd15f86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573855, "uuid": "758cf5c0-d346-4a29-87e3-fe08df4a17c2", "comment": "Malware payload (Dridex)", "value": "1ada7b5deca9b71f12f219a722971f9244db8db27913e3422ea8c20eb1ebf84c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573855, "uuid": "c01387db-fdd1-44c3-961f-d6210377613b", "comment": "Malware payload (Dridex)", "value": "33a4cf40747d56730e4e8f1fbc0acece15322040", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573855, "uuid": "f5d065c9-4b27-46d7-a497-333492ccbac3", "comment": "Malware payload (Dridex)", "value": "7dacdfec95f24e51a69eac1d22ebe9848cdb7ccbb7e21132b331af2dbf79c6dd74071aa178cd56f6656ed408528acd9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573855, "uuid": "afd74d3d-a99e-49c6-a790-6744ff28b1af", "value": "6304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573855, "uuid": "11cf882c-e0ca-4d13-b35d-96f3860c508d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573855, "uuid": "c8750fa5-fcae-4d56-9fc2-a52ca2caad9e", "value": "3072:VV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:VV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573855, "uuid": "c3244f2b-a1f6-438f-a6cb-98e667c9666b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573855, "uuid": "fa6f5a64-adae-441b-8b26-f6936c281e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573855, "uuid": "0b4fc94b-41a6-44a7-b0d8-1baeabebd3cc", "value": "06273847_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ed36a1-ba79-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631552, "uuid": "2f4220e4-42ed-49c4-ab69-8916ebcfa57a", "comment": "Malware payload (Dridex)", "value": "720e56a8af66e191702fdab8f932a53b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631552, "uuid": "eb0c5cc3-078d-41e4-b966-c8209a3c53c4", "comment": "Malware payload (Dridex)", "value": "1b40fe1671380de18419a97dfd72cc20e60457e0d001de5d98aa4fd1e8c7a496", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631552, "uuid": "fd895fc8-137f-40f7-91f4-aba6a2f442a1", "comment": "Malware payload (Dridex)", "value": "16928e14fb36f1ae39a39c16cb4cb92ef255d826", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631552, "uuid": "46128529-0534-4893-9128-eda287b4bfdb", "comment": "Malware payload (Dridex)", "value": "58b86c3dcbc6b2b0ea3e79091acfce046baa99678f3f188b273cfebac35925517c3faff8b0ccc5e3798a6ce7593b07f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631552, "uuid": "76b9c511-1ce8-433f-9317-5f9841b0c3ca", "value": "E0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631552, "uuid": "cf17c5e1-db0b-44e2-b7fe-fdd1e88c296c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631552, "uuid": "02d06911-7f4f-4af2-81fd-11f7c6202577", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631552, "uuid": "a2190628-9471-4b53-a3ec-dcdb164ddb6b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631552, "uuid": "06d74f81-fc79-49ce-b248-d8a11a30c702", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631552, "uuid": "33d09dc5-035e-4769-b07e-ef16271f2040", "value": "720e56a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a07022e-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623915, "uuid": "8be4c6f6-86f6-4913-853e-4b9beb971e27", "comment": "Malware payload (Dridex)", "value": "282940b642d14268e55c655a432fab48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623915, "uuid": "2080e960-f5ac-4994-b0e9-83cfe0abdb8a", "comment": "Malware payload (Dridex)", "value": "1b491b750a37d6704c21a30921b61300f8d6ad69baf0bb6808d2e5d733f6762e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623915, "uuid": "4f19980a-1fd2-42ee-b2b2-aec1771ba83a", "comment": "Malware payload (Dridex)", "value": "607d45cb31f47352d31afad3911a84c654f0c2ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623915, "uuid": "26e84aef-a155-425d-acdf-6a95a6d7148f", "comment": "Malware payload (Dridex)", "value": "c9ef07c0be8f26fe5dbeb48d720551aed748e3db225acfe04a1b407b1ffcc8d67ecfc2dbb57129aa8703ad66da969e23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623915, "uuid": "f7fedf5c-f9c6-4dde-93a5-db928cd9eecf", "value": "B104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623915, "uuid": "ee8dcc1d-b585-4ef8-9d93-bd3a28a6ce73", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623915, "uuid": "9db17d5c-69de-417f-8ce8-e4564b6ecce8", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623915, "uuid": "c57e1955-03f1-4eef-a9d1-3c524e8babe6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623915, "uuid": "046a88f5-f39d-479f-a19a-23a586e9eb0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623915, "uuid": "0b56938c-f84b-40dc-ac46-407f0880fce3", "value": "282940b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c78fda-ba78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631293, "uuid": "089fdb4f-546f-4c7a-8d29-7e3c7278a62e", "comment": "Malware payload (Dridex)", "value": "79bbc60538863e3228e803e53a1cb1d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631293, "uuid": "8ad029e4-97e8-440b-bf98-013448aec351", "comment": "Malware payload (Dridex)", "value": "1b9d2b5491fb76fdb0e97f55fbc0a681ecf18bdf3028d0369a250d30fe1ad7a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631293, "uuid": "3ab1d144-f496-483f-a3a3-40eb14328e85", "comment": "Malware payload (Dridex)", "value": "b387713ae06c0011edfaf113f6d11bab34578c99", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631293, "uuid": "c8600ff7-f958-4526-9193-e8a3915113ef", "comment": "Malware payload (Dridex)", "value": "d12d122e99f9378fcb0771bb98cff27d16f37b1715968b7033327ad5e2317c1051ef31e0c1ac0375dd28fa92571a8bff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631293, "uuid": "8275b473-a296-4708-a585-3967ef5cd0ff", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631293, "uuid": "d632a6df-4a34-41ce-8c33-02789713fe94", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631293, "uuid": "75c7e6a8-2375-4ea0-9110-0a4178bfee11", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631293, "uuid": "c8fecf21-a499-4db0-81f6-12fa3b79de78", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631293, "uuid": "9a80d8dc-52c4-4417-b988-6f58d475940b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631293, "uuid": "5fda4835-ad38-4c7d-8a72-857c3c9d91e9", "value": "79bbc605_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e714eb2-ba25-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621595522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595522, "uuid": "deaee3d7-97b3-4917-8c74-216d27152964", "comment": "Malware payload (Dridex)", "value": "379c744d2817c1f0ae5b944d93c2d0a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595522, "uuid": "c45ed209-3c3b-4da8-9b21-b0b00b939f3a", "comment": "Malware payload (Dridex)", "value": "1ba672f558bc2b7e34abc717d82d4b52efeb527d305202d92526c385345d07cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595522, "uuid": "68b2b48d-7048-476f-ad75-5f452d51a6df", "comment": "Malware payload (Dridex)", "value": "3ea9d8537bfac11fc23d6d53eda8ecf52198206c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595522, "uuid": "66725c55-d805-4d2c-ba3a-031545d9dd3e", "comment": "Malware payload (Dridex)", "value": "71ff61ddc574e8bde5503f3a0c3f9536a66fd8b2d24e5bbfa93f9d0b9dc518196cae2106b8a183298964ed5a5cda745c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595522, "uuid": "ae5ea81e-46fc-4ae0-a674-b3c71c0a42c9", "value": "8204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595522, "uuid": "209d9c15-1524-4c88-956f-96bdb70f1894", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595522, "uuid": "cb7f5373-6682-41d8-ae2d-90c2af963910", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621595522, "uuid": "46f8ff19-a2da-4b6d-970a-61444f8b0c53", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621595522, "uuid": "db50dba1-3fb9-41e3-b775-4024f848e604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595522, "uuid": "de226e52-d983-4318-8214-f4c00e990077", "value": "379c744d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf0871-ba40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607294, "uuid": "20d8e024-6d23-472b-aa27-e16bac7cb509", "comment": "Malware payload (Dridex)", "value": "554e8defd47073e4082ade223daaaca0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607294, "uuid": "bdfd69d9-ef84-4ae3-bb52-79aa394ebe5b", "comment": "Malware payload (Dridex)", "value": "1bac19ca7de31b4136ed7de3d90068902d373c19dd965e20aeb8d00f28805e36", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607294, "uuid": "2e6face3-ce5c-484e-923b-dfed1e59915c", "comment": "Malware payload (Dridex)", "value": "ffc65a3720904dcda4e677c4ccd6aed39ce14a20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607294, "uuid": "0e46d17d-4594-4176-add2-03cacba04144", "comment": "Malware payload (Dridex)", "value": "03e9e4bf4482108daa91be503651f2bfcc80ae52552277f8a5b41200e0afc9209ce4604918fa6e22587a99b24b957be4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607294, "uuid": "309c54b8-09c8-4d7e-aee5-9d00e10a264b", "value": "3B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607294, "uuid": "98d025cf-fa1a-434f-bff6-8e2d752323a1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607294, "uuid": "0471ce2c-4995-41d8-ba82-cde93421c604", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607294, "uuid": "5590bc9b-0489-4346-920b-3f8ecd2c5a53", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607294, "uuid": "8c284aed-d754-4828-892e-75264020632f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607294, "uuid": "8851cd8a-846b-4657-8731-89caa814f39d", "value": "554e8def_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7490a2a3-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1621613598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613598, "uuid": "88f6dd28-b490-4d4b-bff7-bd40b3425bdf", "comment": "Malware payload (Stop)", "value": "fabafeb54af0f1161b949348467fd78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613598, "uuid": "66875916-0e78-4728-b638-50a95b692a14", "comment": "Malware payload (Stop)", "value": "1bd1ce92414630da3bbb7a0f5f12d1a28be0cd370466db5fa03934587854fe53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613598, "uuid": "98e7fabb-2ec2-49ba-a95f-72eb874ae811", "comment": "Malware payload (Stop)", "value": "c3b64a84bf86641ea40255d4e9f4d717bfa0aa32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613598, "uuid": "3d53c654-a847-468a-b8ad-5d13cd7996e8", "comment": "Malware payload (Stop)", "value": "b041e06b29e7f921b69629a4e45697ca14af0f91ad4f05a7098f65376303f41665b089d69d8b8452c05f42f47ba1322e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Stop", "colour": "#589677", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613598, "uuid": "cc761c4c-22ae-4af6-873c-5d0b7a11d8a6", "value": "B715F1306A60C036E5FF16B449F58279A52A7DA2AB2450FF12D63BEE46345E06D30F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613598, "uuid": "198327cd-8cdd-431b-9fc3-fb99512aec9e", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613598, "uuid": "c206b82b-e6c5-43fb-b736-a8eafc15937b", "value": "24576:fM1R5iRmGOm83zPVpA4r7M+/PSQoxcMdXXsL:OiZOm83zP35M+/KQ7yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613598, "uuid": "3ed792c9-14bb-4c49-972e-cd4ca7dfdc94", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613598, "uuid": "2f59f08c-6502-4955-b3ed-d42c7e3c22d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613598, "uuid": "d4dc4f15-0a22-4d65-9425-ccc339f35e68", "value": "fabafeb54af0f1161b949348467fd78c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a5e229-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610380, "uuid": "beaea2e4-05a5-4fdb-9676-52faeecde029", "comment": "Malware payload (Dridex)", "value": "b1ebd2050d6ad49a0eaedbd4227631d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610380, "uuid": "77edbfd8-9606-44bd-9334-d9ab5f812f89", "comment": "Malware payload (Dridex)", "value": "1c13ade01646040fb3f7ecb0e4f466329bf6679ddc2ff3636c7e472e523d931d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610380, "uuid": "f511ffd6-6d1b-49c3-bced-bf1476c49e68", "comment": "Malware payload (Dridex)", "value": "ad0c8b4ca1ef5d6a4bd8e772f38646cb3bc53104", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610380, "uuid": "165bcd26-b157-48e7-8366-f872048030d8", "comment": "Malware payload (Dridex)", "value": "e5acee1e5c1fe8cd8987e160ca7fc80e24b5eff0ca8e453d81390fd7daa1a85f9867ca582ae534421e99e3279c466d5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610380, "uuid": "481901df-2711-48db-af93-758ce4161fa4", "value": "0E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610380, "uuid": "3e08a64b-8f44-4aad-9f8c-76284b63c352", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610380, "uuid": "e8e5ff28-1899-44fb-8812-b812e6328e73", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610380, "uuid": "fad9af06-dea4-45f2-a0e1-1c50f57e2429", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610380, "uuid": "3559633c-4923-4f9e-840c-bd5a26d50ecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610380, "uuid": "2dd968a4-b1ee-4ea8-99af-7d71aac22732", "value": "b1ebd205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3027b81a-ba82-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621635388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635388, "uuid": "0f12f297-3b99-4366-8d53-19593cefebcc", "comment": "Malware payload", "value": "64ae8d70adc4225521982214f1da8f5b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635388, "uuid": "1b3a7e85-f753-441a-8166-872668e6f57b", "comment": "Malware payload", "value": "1c3de1c9bb29b4bb27fad7041dbe883397ed69df419ffe939e4a661bbeb630d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635388, "uuid": "3f1e5b68-c530-43ff-b678-60e4c9bfbab7", "comment": "Malware payload", "value": "2c84e98d0fdb8ab5e40fc32096bf8a931a6385d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635388, "uuid": "37415a53-8952-4939-9643-f615453ca3e8", "comment": "Malware payload", "value": "6fc4741f3f6fa638431cc0e5b61c384132bd6389250d66e4c6b0c722d7d03d0129a200e4d1851e1e0954dc5fa2308c5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635388, "uuid": "abe2c745-c574-4468-81a8-48499ca6ab8e", "value": "41F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635388, "uuid": "99a8d312-eacd-4adf-9a5f-86542465a934", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635388, "uuid": "738abe11-70db-41de-bc83-af406eba960c", "value": "3072:PIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Qc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621635388, "uuid": "9f677073-b441-4e55-b14f-2f7f561708f2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621635388, "uuid": "2e7fbace-c1ab-451c-bf1f-355f0214d4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635388, "uuid": "1421f891-8f4c-4060-96de-1aa2319ad957", "value": "64ae8d70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cc2a75-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611184, "uuid": "77b5d4cc-5a0f-4dea-9a13-cabff99d4d4b", "comment": "Malware payload (Dridex)", "value": "714ba2ce656738e89e8d2b74882f9a63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611184, "uuid": "72bce427-97bc-46b1-89ee-94b8945713ab", "comment": "Malware payload (Dridex)", "value": "1c5c9b7f2142a5e6e2471df651440cf2d003e841c2cb38579fef039f246f1a82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611184, "uuid": "0f26923e-babc-448f-b5e5-eee878419fe9", "comment": "Malware payload (Dridex)", "value": "97a0ace1f80890295e12db8869f45339358fd1bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611184, "uuid": "9f6baefc-eccd-4ef1-94ec-cd0e47080e6c", "comment": "Malware payload (Dridex)", "value": "d97649597d40d7f6b29b8005b07ee888677b754f8a1d613d0989ac5071f3ae883b958eefcde0d050d6848a10f206c053", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611184, "uuid": "9ee6faae-884a-4ddd-b81e-f39526b78f3f", "value": "1204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611184, "uuid": "1e8529d6-69af-4ca1-bb0e-2e387aeb27de", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611184, "uuid": "a800fb85-ea28-46a7-a7c3-27045c322ebb", "value": "3072:pWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:pWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611184, "uuid": "90a0c841-3054-40b0-8fb4-28b45878769e", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611184, "uuid": "dea46497-4d30-4a20-8127-6c915777763d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611184, "uuid": "f45e61f6-ad11-4073-90cf-66ef2cb8e147", "value": "714ba2ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76b268f-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592719, "uuid": "6dc48cb9-079f-4f50-9cf2-6bc061ab37ae", "comment": "Malware payload (AgentTesla)", "value": "0377a0ded56ed8d823147ce67e436f21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592719, "uuid": "f373ebbc-5f3a-42eb-b148-72dc24b9aafb", "comment": "Malware payload (AgentTesla)", "value": "1cfd24915eea68b6e583d2b49a0d071c33d60e71e3a68f550b4b904d7209833d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592719, "uuid": "71ceb6c9-c7bc-49c5-8e59-483f81a970ef", "comment": "Malware payload (AgentTesla)", "value": "c88c2ee677edde22b3cd741a71d4c57985a67bbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592719, "uuid": "b30cf9e9-75df-4227-8820-71c93e280d5d", "comment": "Malware payload (AgentTesla)", "value": "04bb261bd03fcb3566e2537625bef05da54d5b1b1d70235756c29d1db83422bf59e7f90d7299eff6d8d6b9ba2e3603e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592719, "uuid": "b8925e6c-da58-43f0-88e7-fc99f3c16abc", "value": "3E71E77604773CA2CE5D852FD93FFD4926EAB98681D71A80328DF54117A73344B8284A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592719, "uuid": "e9603eda-1632-4f12-b202-2ec091af230c", "value": "48:ZEdP3p63CQqraLlci2ThCmY0ZYbRMuurWYo1SL3rZGxHlvPt7GFYqNZuB8bSXVNw:y3J5jCmYEYbjPYLL3rZGFVAsq+XKuyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592719, "uuid": "b263a32c-75ef-4653-aace-bbd29b871229", "value": 3538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592719, "uuid": "8a35e458-d72d-4088-a6f9-5bb94505d6d0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592719, "uuid": "6760ff1e-1619-4cd9-aedf-938c2d8100ee", "value": "AWB-182673890205121_ES.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902ce8d3-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621613215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613215, "uuid": "265e8fef-4bdc-462f-8c12-8661d4b1bbfe", "comment": "Malware payload", "value": "783c875966566e7cdc9abda312f0cd0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613215, "uuid": "0ce5290d-dee9-4bfe-804a-16e9196a006f", "comment": "Malware payload", "value": "1d1ca131b24aafae9ff8dcf5d96f524eb214fb2976f7908f008195449b1dec6d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613215, "uuid": "98c50754-ba27-4eb4-bcff-63ac2afedd33", "comment": "Malware payload", "value": "412da5ed961ff5f0236bbd2c9a6c726000c26f5f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613215, "uuid": "753fe9ca-2e8a-4871-8d4f-65a44ab88049", "comment": "Malware payload", "value": "63d10cc5201840030cf0000b0319c5283190d1eb2f3d21337986f229610fe021c53045605c271a019d22f8ab4d31f7bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613215, "uuid": "48bf603c-8fab-4c48-bfb0-e3dd5949612a", "value": "FA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613215, "uuid": "0d68d39b-75bb-4624-b24e-3a21660ccc5c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613215, "uuid": "d6a59a0e-73c3-4306-a462-7407d58a41bc", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613215, "uuid": "8e711aa3-5eee-4e5a-ae48-a111de6fc1e2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613215, "uuid": "1059c2c2-c0ed-4c1b-a63f-15fb26f4f1d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613215, "uuid": "2a2ba4a6-c9c9-4f63-a354-516f21c459c5", "value": "783c8759_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a173ef0b-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609808, "uuid": "f0ee6877-311f-470a-8f6d-47b59fc706ae", "comment": "Malware payload (Dridex)", "value": "e0c0dbe48029d839cb6186cacd6a5ece", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609808, "uuid": "e5360715-eb19-4943-871a-eaac5e418f35", "comment": "Malware payload (Dridex)", "value": "1d96ae43c97acf5dd0cdfc0e84a6354150f2d9569bac6c602ff8820ae4bcd657", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609808, "uuid": "28c19952-0c96-4e92-9ff2-a2e3b36bcede", "comment": "Malware payload (Dridex)", "value": "051713fc66e14b55fcde98d4bda6618301d818a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609808, "uuid": "4ec1c62c-b08a-4785-b0be-afecbfad1d86", "comment": "Malware payload (Dridex)", "value": "52e000d9d7036d6571fcbd8874f8c68228d72dda0fc608b1ac997ee2d5209105b1f86932501274ecd9a1a3f85f323900", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609808, "uuid": "df1a3b02-1546-4bfc-8dbd-2ac53dd6f4d6", "value": "4204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609808, "uuid": "f2e48a91-9916-4389-a957-1926235be8d5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609808, "uuid": "90080321-5927-4707-bc69-50366dd57920", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609808, "uuid": "132eae2b-f5fd-43b7-ba16-a3a744463b78", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609808, "uuid": "b64e0deb-a2ab-491e-aee2-458f50d957f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609808, "uuid": "95ca1837-3839-4b36-ab60-415ce36fe162", "value": "e0c0dbe4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2f2460-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570557, "uuid": "ea752bdf-bb19-43fc-8940-248e87c869e0", "comment": "Malware payload (Dridex)", "value": "69d4519396b9ea948b8dc5f6154d85bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570557, "uuid": "3b72660a-e7c7-4219-9818-853231e50597", "comment": "Malware payload (Dridex)", "value": "1debeefc4e250084808fbe92fa077505d4cba1fc83c24e3d37df0b83a0f66d82", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570557, "uuid": "390c59e3-7601-424d-af23-c1b46ac75dd9", "comment": "Malware payload (Dridex)", "value": "73022d7d1766274b9cb7d6b79774fcc6a80c9590", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570557, "uuid": "cc6134ee-8061-455e-a423-f152b005c298", "comment": "Malware payload (Dridex)", "value": "5430bb1355403e6687356f3b930201d1da2cd3de288e3fe9226bd791a43f448268846f2a9c77bc5c1428ee56045d1be2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570557, "uuid": "26489827-6d78-474f-9d58-ba7273f38f3d", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570557, "uuid": "48f349f4-b41d-4c97-8440-37b19e254c7c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570557, "uuid": "54b7e50d-7d2d-447e-b56e-adeb62a4efbd", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570557, "uuid": "51e7dae0-5d95-45cc-9fe4-641f894b137a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570557, "uuid": "0d4e6640-f47f-4066-8c1f-9d736c57c1d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570557, "uuid": "aaba1cfc-4a8b-474d-a674-405d4e0e4c68", "value": "69d45193_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f18082-b9ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556684, "uuid": "73cb45fb-0bb0-4c62-8013-2ed9ff207f1f", "comment": "Malware payload (Dridex)", "value": "eabe7888cf732bf41c032e2b190abfc5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556684, "uuid": "ca50703a-aa0a-49cd-8d8f-744635743dff", "comment": "Malware payload (Dridex)", "value": "1e378193a3fc2ace3f26e93f925d5cef399dbd8e2fedf40fe19ccc69be6ef621", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556684, "uuid": "9cd946aa-189b-4b77-bae8-8a1ce99c29f2", "comment": "Malware payload (Dridex)", "value": "59cedb2405d3300189a864138545c27f25cf0fd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556684, "uuid": "b5c8da7d-e984-4df5-bf18-e083a4894ad4", "comment": "Malware payload (Dridex)", "value": "26f0f0045cbbe759ced6dbc85d29ade77e9b6e3e2fe0228a521007be5d6bb641b712fc479ebd94898bec70cb95891edf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556684, "uuid": "de1043f8-1a4b-4044-a942-dc55eb4e6a2d", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556684, "uuid": "c731d421-9650-4eac-bddb-50ced827cb3c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556684, "uuid": "7ebe7fc7-8ca0-431a-bdc0-a64c6b1a3e2b", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556684, "uuid": "1fecd38c-5f45-4e84-aa1f-c5c73b3b0809", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556684, "uuid": "f245945a-7316-427f-9de1-44ed9169608e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556684, "uuid": "ffd83503-a942-4bfc-9d73-62acef9abe97", "value": "eabe7888_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230f4a00-b9cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557627, "uuid": "9e57b1d4-251e-4ef3-8c41-993ab7d33f38", "comment": "Malware payload (Dridex)", "value": "664cd8adb25585f1ddc4ba1a62c24d2e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557627, "uuid": "393129a0-4c97-4710-8ad0-8dba8813b1dd", "comment": "Malware payload (Dridex)", "value": "1e66e36857e2f680e72723a90c903d29b59277a4028782bbdf57002a4a0e72f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557627, "uuid": "cceb7702-76e4-46f4-9e89-2c2da9f38546", "comment": "Malware payload (Dridex)", "value": "30d193bc30029cdffa4887bbe35b95f1eaf7129e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557627, "uuid": "071789b7-39df-4fcb-bcfb-f5e628aa9fcf", "comment": "Malware payload (Dridex)", "value": "77a5e4511c7d6ca6c24daef609e7e0e2d4a0d1eb48c62d77e48f8c8a42b6cd718e2dc9c61eb0ccba3730ac7cea40918b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557627, "uuid": "90ec2908-1849-413f-8b58-0b4559d82b30", "value": "F204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557627, "uuid": "c9de81e0-34fc-4d5d-bec4-8cf94618b983", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557627, "uuid": "eee5bf36-8760-47b3-b463-230d5424bc79", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557627, "uuid": "b4d9f0d9-14cd-4b3d-8696-9b812ea81cf1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557627, "uuid": "de73dc9c-afbb-4f3f-954e-7271757dfea4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557627, "uuid": "46c3ab95-01e7-42da-9356-dc029879a5ce", "value": "664cd8ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcc6fc2-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569862, "uuid": "7ac8f20a-52b6-4908-8bf4-6177a1b8a29a", "comment": "Malware payload (Dridex)", "value": "b83ee1b49a61d1b94ed9c4cbf49a24f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569862, "uuid": "9a04f45c-fb7c-4e97-a86a-1a52e70aa1ac", "comment": "Malware payload (Dridex)", "value": "1e8cf92fda5e25f369e8d78d8aa74422ef518118e2b1140187e8d98dd62cab4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569862, "uuid": "97fc5a82-be91-4cb5-a7fa-57e03568c6cc", "comment": "Malware payload (Dridex)", "value": "843ddcdbdcf52b697dafe388afe4447881af71bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569862, "uuid": "273a6b6d-2a2c-4f26-8c62-38c0754a5df9", "comment": "Malware payload (Dridex)", "value": "c025033d06959f5b813b9dbbb1b4096da5fffc952fe3d33b43d346b4c3c407b90f0b413516f315e6d72e827cbedc6a6b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569862, "uuid": "68b8571c-7726-4388-ab0b-5930bebd6b3b", "value": "9904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569862, "uuid": "df1820a1-3248-4ca7-b2a0-01e290aaabc8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569862, "uuid": "992b403f-62b3-4251-94b1-b632faea65ca", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569862, "uuid": "df49ac41-943f-4b1b-a295-57506a7db4fd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569862, "uuid": "193bf8a5-34f1-4e8b-b5df-3027dd21fef3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569862, "uuid": "09f1669f-f1d7-4580-a407-83aac1337d24", "value": "b83ee1b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667493c2-ba42-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607991, "uuid": "45c809b1-ccab-48e3-9bf7-d6bc3d367f81", "comment": "Malware payload (Dridex)", "value": "fcbe2c0607fd26b865c7954e48c9b66a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607991, "uuid": "77f04219-e99e-4cf5-9d3e-8abf14d5219d", "comment": "Malware payload (Dridex)", "value": "1eb2b89410843f6c3572517c9d98611b8b64148c0cfcb74776e01b197e66f32e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607991, "uuid": "06fa183b-9234-4a6a-acf3-e69aa9ac5f15", "comment": "Malware payload (Dridex)", "value": "4649cdab9df9e550286959a26165af6529c8db1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607991, "uuid": "c12d62a6-2e69-495d-a682-1e716f142d66", "comment": "Malware payload (Dridex)", "value": "d8f7302624200362573a1dbc4dfa70c70d1051a9b7b75ae2fc3ce8854958f6aa85c2054ea9243c04782534bf985f6ab0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607991, "uuid": "2d85788a-e9b8-42a8-8691-30ee0928fb60", "value": "6CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607991, "uuid": "3862243d-6771-4155-94b5-443bc0625a16", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607991, "uuid": "22651cc2-769b-405f-b4aa-3cb3192c50b1", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607991, "uuid": "74c56533-0c4f-44f6-a5ec-1d25180a63bf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607991, "uuid": "d2c486d3-3282-440a-9985-007319341b5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607991, "uuid": "2a9f28ef-2adf-44eb-9f12-97cc0ee9f78e", "value": "fcbe2c06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6c768f-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578419, "uuid": "84f776f1-668d-446f-98ec-9ac0278122eb", "comment": "Malware payload (Dridex)", "value": "070ea3920722666d2743cdf6ea0c15df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578419, "uuid": "5e6285e2-badc-484b-8857-074beac21730", "comment": "Malware payload (Dridex)", "value": "1f2beacd0d727924e03d5baeaf4a0eff2a8a316f0eb30c5e3db9e761164f99bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578419, "uuid": "c518b02f-84da-451a-a755-b80c5f4249d1", "comment": "Malware payload (Dridex)", "value": "d598c8e9dd829d29e17b9e0ac1878ab8f320a07f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578419, "uuid": "e7aa9dfb-f017-42d9-b90b-406e480dee6a", "comment": "Malware payload (Dridex)", "value": "02f84196821ce87addf7c8ff15b907dbc6ca7e9754742774c78bc9ded8932c5c4393878da53f10ef9eef4317d96a981b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578419, "uuid": "40b2fbc2-1da5-490e-9ac3-ced1826aa571", "value": "CCF3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578419, "uuid": "69408cb2-647e-43ed-b64d-6b5c2add096b", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578419, "uuid": "5cf05ad1-9ca3-41db-8663-2f87cc99da61", "value": "3072:Y9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:Y9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578419, "uuid": "e234f1a5-c259-4fe4-830a-167e14e87248", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578419, "uuid": "df1b001a-386a-486d-9a85-d0b4ebf65088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578419, "uuid": "a3513776-a8f4-48e6-ac45-b0954dbf412f", "value": "070ea392_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76484d2-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574680, "uuid": "28a130e0-2ed6-45b9-ba85-62c4da4f4582", "comment": "Malware payload (Dridex)", "value": "54972a62df41e082ffe595538ca474fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574680, "uuid": "8eb6d30d-7440-4aeb-b713-ab84573f759d", "comment": "Malware payload (Dridex)", "value": "1f3aa1643629fc7fb72e48d6af623df8f6d3c9438ab6558ffa959f2b0467ba0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574680, "uuid": "86195fa5-1a7a-4707-98f0-fe1636693769", "comment": "Malware payload (Dridex)", "value": "e6332a5da497330faa60744e95d69d690405b4c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574680, "uuid": "ca65a04e-fb4f-48c0-a1a1-e0f483d1ae35", "comment": "Malware payload (Dridex)", "value": "eac73d29e2494d64243bef0673bebdd12b71bf11934a11e59ce6bc30992838d184f5333ba08f1aeccb5ef0946ef513b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574680, "uuid": "bcd8ac2f-f716-411d-b16e-56388a64638e", "value": "0404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574680, "uuid": "b0fe67cd-e72e-4916-b14e-5df316678afa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574680, "uuid": "52b5cf61-74a5-4da6-89f2-b452f01b59eb", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574680, "uuid": "d53f0379-af21-42ba-9ce0-9d42cfd62f96", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574680, "uuid": "93a1ab81-1dd8-4f3a-a234-8f7da5d40509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574680, "uuid": "a3882072-123f-4f1c-9c5d-b10cca5da88a", "value": "54972a62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec77abc6-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621576004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576004, "uuid": "f25bad36-2824-413c-a8dc-8cc891769121", "comment": "Malware payload (RemcosRAT)", "value": "954c0aca0e69b9a749777aa28d35d881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576004, "uuid": "6bd4742d-de31-4178-8409-70d4017d64c5", "comment": "Malware payload (RemcosRAT)", "value": "1fc8b21214b10720988c33582ca6415bf3d052a829ba4db3dcbd77655de4f95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576004, "uuid": "861e831b-483b-4290-b3c6-e9baf2f08619", "comment": "Malware payload (RemcosRAT)", "value": "cc727e6e6b2f8436f2f0bfe3ff4584818ab88340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576004, "uuid": "56a61ae4-1f8c-485c-b11e-d9700b035e21", "comment": "Malware payload (RemcosRAT)", "value": "507c91132130a93f348adb425bc0579c98a0ed29f2dde3031ef59a23118592a4f355b13a0754b1b7cac64de1ea6ca3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576004, "uuid": "c94d2ae5-5da6-4407-a9f2-07e46dbcd475", "value": "D715AF22B2510437C16A1E395C0767B99939BE30ED1895AB37F97D4CBF393913A282D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576004, "uuid": "5c0eaaab-ac77-4054-a0cb-e4e1d847ed1e", "value": "3e8a518ae58159a44bd8bc83008aa8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576004, "uuid": "dde7684c-31d1-4dca-b8e3-bff433dbc45c", "value": "12288:9S80SbYOAD65QF6ofEwawyWCqGjUwudw1239PadHiomSD1zmEyCiomzNs:93VbRAQQF78waJqqtGoOAHaCSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576004, "uuid": "19e32b32-6ec2-4a07-8853-6387a4276664", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576004, "uuid": "de4a115c-73e2-446d-8d6d-4801b6d4a692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576004, "uuid": "f3f884c6-7b9e-46d8-8c07-6adac7d6076e", "value": "New Items RFQ & Specifications Revised_20210520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6982b150-b9d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561610, "uuid": "f101d87a-889a-4df5-b4f4-539505748939", "comment": "Malware payload (Dridex)", "value": "7d115c9c78581a07b45f50e5e5906f74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561610, "uuid": "eb16fc95-9737-4ce0-a479-a75fca08fb6d", "comment": "Malware payload (Dridex)", "value": "1fe81953ffcf443751429205261d190f4abd3e64f189dcca5b487d9297b36f7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561610, "uuid": "7c476b2f-cfbc-41e6-bdcd-910b73c12770", "comment": "Malware payload (Dridex)", "value": "6eb0c31f02c091a7cedb196e71bbbf29fbbdb309", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561610, "uuid": "752e413f-8521-4c9f-a7b8-0dc80fcfeb13", "comment": "Malware payload (Dridex)", "value": "5b137c9a0a41089f6a5b82295330f6842fcdae9a4f3502ec8b59fbfd93f475bdef090269c010ed9ba7b3f946a4f889a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561610, "uuid": "84d9a0de-abd5-4ee8-9cfc-5b6ad2590b95", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561610, "uuid": "df084402-fd79-4fff-b911-a65ee9ddc45a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561610, "uuid": "05aff8e8-c0ad-4cad-8db7-253b6b058720", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561610, "uuid": "b9ca3fd5-cfa0-4cb4-b510-a755840f02ac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561610, "uuid": "ed524d55-a946-4770-ab57-201c5a7a7f04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561610, "uuid": "9d146a35-312f-47a6-b561-ebcaf0b14516", "value": "7d115c9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbfd499-ba8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621639273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639273, "uuid": "77662fa7-b45e-48a6-8e1d-da50da8a15e3", "comment": "Malware payload", "value": "c62a45fb3f8a841621ade915e9a8c7ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639273, "uuid": "ecd91a0d-bfb2-4790-8afc-fac045d54f1c", "comment": "Malware payload", "value": "1ff9c00a79b95e9d5c5acbf98f42279da8a2b39cfdbe282b66271d8cacee0bef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639273, "uuid": "dcd0b0eb-3a76-4773-93bd-f685afbdc341", "comment": "Malware payload", "value": "0273a12d7bd311bd4005fa9eb5ecb7f8d6f20362", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639273, "uuid": "9d87e85c-41a6-4b7c-afdb-b21d2264374b", "comment": "Malware payload", "value": "f09db5f3aca13e4e67f784f76b30422847807955d99a8598b136a0dc5da2d34938a638b01cc6333593a4e86355b9bfb4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639273, "uuid": "2b87f3ba-ed02-409c-82fb-0626bdf82ab5", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639273, "uuid": "48fbc5a4-15ae-4644-998b-13f2729ef23b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639273, "uuid": "76e2b876-4b37-48bc-bec0-f33a27c0ea5e", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621639273, "uuid": "0ed497ad-6ff7-47e3-97f4-ea101203474f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621639273, "uuid": "f18b6336-0e4b-4378-a713-9a997c7af1f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639273, "uuid": "752084d3-f700-49ce-a2b7-3328e163b0da", "value": "c62a45fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58764191-ba07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582627, "uuid": "88e926fd-aad8-4eb8-80ce-79da3d399c98", "comment": "Malware payload (Dridex)", "value": "7d567354060a3616269720c9abd498db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582627, "uuid": "080274bb-1e56-49ca-94e8-a7f0d502027d", "comment": "Malware payload (Dridex)", "value": "2060cea16c37c664cdd7d1a09af413fbe92b9677733be3f72dcfb4755084e600", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582627, "uuid": "b50e4481-c20c-4078-bc87-a56aff7f3a2c", "comment": "Malware payload (Dridex)", "value": "a6af425bd704c9e066c0ef673778613742e58d11", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582627, "uuid": "9134a538-1bd1-4e03-ac43-465da344a6b8", "comment": "Malware payload (Dridex)", "value": "e83f53e049bd2862288402fa391217bcee48afba2780694381a895c20ff70aed7818b2d491e7d985124973d9f4304125", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582627, "uuid": "31f7a4cd-1a18-4942-9c5f-35e69d310319", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582627, "uuid": "57c3fd96-0308-4172-bf9e-ba6a897baeba", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582627, "uuid": "82aa10f6-0387-47a2-ae2f-8f6d5f4bc358", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582627, "uuid": "9c860149-883f-491e-af29-8ebcaa329b6b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582627, "uuid": "c3f520e7-c0de-4a47-9f66-37816e496ad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582627, "uuid": "36e8f055-bf67-43fe-b7ef-11075eb1f690", "value": "7d567354_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a359ff5-ba62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621621795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621795, "uuid": "bf474065-81c9-484d-83f8-bd8cf5ecb116", "comment": "Malware payload (Dridex)", "value": "9dddd7eca6eb09b279f8e3533c5425f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621795, "uuid": "a5c274c6-d7d7-4539-9807-dc60d6f586d0", "comment": "Malware payload (Dridex)", "value": "20a1b4e13579938cd8837f5b142465ef88747c1cfb63802489732f18488090ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621795, "uuid": "63031cdc-1eaf-4a8f-9257-104716611d3c", "comment": "Malware payload (Dridex)", "value": "baa57506ffea20315fcbd37c10287d3b6f285671", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621795, "uuid": "09faa57f-d7b6-4f7b-abfe-d684127d2458", "comment": "Malware payload (Dridex)", "value": "adce2ba809d54a65022103995181f41d746e7fa2a811880999feab1c5e19f4cd61417fcd9057f9aff0a5a11c235163d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621795, "uuid": "d6d095c2-d2f7-426e-b98c-767c342fb131", "value": "08F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621795, "uuid": "8a6f64f4-ce2d-4d31-87a2-e76987a0a86d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621795, "uuid": "fb6d8873-fabd-4b45-a4a0-cb0eb13e3bd9", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621621795, "uuid": "0701e99d-0f61-4400-8b0e-9a25ca332030", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621621795, "uuid": "a60115d1-bcba-479c-9aae-a0efa9e444a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621795, "uuid": "9ac3aef5-ab6d-488c-ac74-e25a4e3e8026", "value": "9dddd7ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef0d93e-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612032, "uuid": "cea1c089-8c85-4748-959a-cefb71f4012b", "comment": "Malware payload (Dridex)", "value": "d5129274fa3ed5e104f88fa8790de33d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612032, "uuid": "99c15d5d-7fb9-4481-a670-0e8f87469be2", "comment": "Malware payload (Dridex)", "value": "20a5ed0ea1927b4a02837fdda63811c162b15084617a79683423ec7f071d2c8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612032, "uuid": "6e7808eb-3785-4abf-a369-26bce9fe5ab4", "comment": "Malware payload (Dridex)", "value": "1a96368fc3c1e96b8e504fa97ffba95c3cfdf4a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612032, "uuid": "6a8afca2-7415-4901-ba15-2c0aa5544487", "comment": "Malware payload (Dridex)", "value": "df593cc9c4aaf9b638e7a846365247f44df2adf4f1397eb475990974b40ac277553149ac1442c259d9dfe61c3bd2137c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612032, "uuid": "74fd3a6a-e406-42f8-9bc4-1448e055d6d5", "value": "47F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612032, "uuid": "e6f199ab-b098-4e80-a8dd-0b9c3f585c51", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612032, "uuid": "3946521c-b6ab-47a4-9f8a-4349b3b301dc", "value": "3072:1A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:13J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612032, "uuid": "a3fdcb4e-d5be-4c5c-ad6c-cd327a4a7e4d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612032, "uuid": "bb5fe3cc-5b17-48b9-946f-2a241856d536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612032, "uuid": "8a8d1164-9068-451f-a86d-121d1e43783f", "value": "d5129274_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ff946a-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555941, "uuid": "bd200f01-db24-4e95-834a-d3de4a9485d9", "comment": "Malware payload (Dridex)", "value": "940707a7506e76719752d85fb44b5bab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555941, "uuid": "27603cc9-33a0-43fd-9fef-76164e9dedf2", "comment": "Malware payload (Dridex)", "value": "20e867c66a78788333d41cfae68fe8dc445be1e7af662bee1e0df67b69cc36d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555941, "uuid": "ee27f580-6855-4036-adf9-3e9d70bd60ce", "comment": "Malware payload (Dridex)", "value": "de4264f267c913663e4fe73ce201bb071dd43865", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555941, "uuid": "7d52cd69-a699-4f1a-91cb-44e038b46e83", "comment": "Malware payload (Dridex)", "value": "29284cb068c882206c3d48c4d4986cfa2ab4a5da34bb2d374f1bbbf885f4b6d4ee91761da48fc37f14b1fab6c5e30a3d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555941, "uuid": "d1f05ff7-27ee-4b82-9b69-dece3c877bb1", "value": "4904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555941, "uuid": "77aeadc1-2a25-4f19-b0cc-ccfd8e3c52a0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555941, "uuid": "b8eacbce-dd28-4a33-9d68-ddd293dee7d7", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555941, "uuid": "51b069b7-4af4-428b-a580-24e1411c0207", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555941, "uuid": "8c023e87-5075-4a66-90c1-74a1f2d987ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555941, "uuid": "25637a89-0eb7-4efe-82fa-c7b12e032e1b", "value": "940707a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1ad0c7-ba40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607168, "uuid": "0aa68155-6030-4eaf-b8cb-fee68abbe0df", "comment": "Malware payload (Dridex)", "value": "8c8a668664735438bd03f736648ad5a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607168, "uuid": "1fd27166-316d-4d33-9266-84f7eda2eeb6", "comment": "Malware payload (Dridex)", "value": "212333c54e54367b082671da15784c53a8372433dff4f5864068498884269ae0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607168, "uuid": "98363f80-5758-4246-9030-6665e0013977", "comment": "Malware payload (Dridex)", "value": "b14e30b5db8a4f8a5945a4e185600d597c3c88f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607168, "uuid": "1e16422c-c112-41ee-8f2f-78a36b83083f", "comment": "Malware payload (Dridex)", "value": "05190c116043ffc804507e4b784432a974b8f3c18fcd0014f488bdb8a49fc6b95a12107b2bc19425ddc6c872ef653950", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607168, "uuid": "7d38c20f-330e-4cd4-b403-930a72185a11", "value": "C8F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607168, "uuid": "77218e79-864f-407b-b314-7410f5e781d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607168, "uuid": "831cb7cf-aad4-4db6-ac4d-782c7e301ceb", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607168, "uuid": "818be811-d372-4bc7-80bb-936c7cf12156", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607168, "uuid": "bcbba167-c143-4e92-bb27-2ba9a22b2546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607168, "uuid": "a29b75fc-838f-4a8b-b273-e3c5df565079", "value": "8c8a6686_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a71fbb-ba37-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621603310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603310, "uuid": "5104eba4-f2f4-4a40-ad1f-617a89760c38", "comment": "Malware payload", "value": "1bad0cbd09b05a21157d8255dc801778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603310, "uuid": "486d3950-e13a-4f6d-bd11-1623b4f8b142", "comment": "Malware payload", "value": "218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603310, "uuid": "9e733522-76ec-4019-891e-f4432f254ad4", "comment": "Malware payload", "value": "ff284bba12f011b72e20d4c9537d6c455cdbf228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603310, "uuid": "6133166a-da2c-4f91-b6f7-ffcbdf2ff3d9", "comment": "Malware payload", "value": "1d4b9f7815dbb075c1a59dd2930aeb01506ba1bfae9c3d72a6817b83dc846df0c15e36a5f7919d9ad714ada71e3afd79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603310, "uuid": "0b672571-f975-416b-bb5b-c5f71eb0dd30", "value": "0992490077DC5226CABF8ABAE8B202144B71F4069827E72D5CDC70AD1A637C856D7B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603310, "uuid": "16a0f349-fa64-4533-83f7-11ffa3311d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603310, "uuid": "355953fb-33cc-483c-92cb-643986d88112", "value": "192:ZGkI6IPfDE7443KmP+uHYKOtKKhWOxj0ZsvyweL+LwGLTCcbmMLyoCgzyRc5jtvw:49eOzp0/TGXLKM2fgz9jsl30uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621603310, "uuid": "b479a534-4790-4999-977d-9629872cc95d", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621603310, "uuid": "785bd492-216e-4375-b9f1-ed71498e5621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603310, "uuid": "be24a023-364b-4114-b301-03cf3fdd9b74", "value": "a310logger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53de27fb-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569305, "uuid": "14b44f0a-7791-46f0-b45a-1238b448783a", "comment": "Malware payload (Dridex)", "value": "984fda64fc2b38b6ddc47ea1815d1225", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569305, "uuid": "666b6c33-8ee5-4c23-88a9-c41f6938ce03", "comment": "Malware payload (Dridex)", "value": "218c30c50c737d47861ac82b2137171b396296a86ed66c8bbe38898cfa964712", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569305, "uuid": "31cb165e-ef09-496f-8a70-7b8a0070c644", "comment": "Malware payload (Dridex)", "value": "1f29123cdac2e23d6d5611d89e92bb48ca7e960f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569305, "uuid": "04463121-c681-4ff9-8af2-1e7f12c5aef7", "comment": "Malware payload (Dridex)", "value": "6137dbb8d60a6a647d9415295bdfaa4bedd44f8cf0e7ee7eae84a353ed581b25282b210c79060f6da5d89994f3627b74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569305, "uuid": "28e13166-4ced-40f2-9151-b32ad66e98c1", "value": "0704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569305, "uuid": "e7c4c119-45ab-4ac8-b5e2-0034d937d2bb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569305, "uuid": "efea615f-79aa-4fb9-a5e2-805d93dbcd7f", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569305, "uuid": "d5e0e1aa-1665-45b3-af37-b5938be47746", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569305, "uuid": "ed3e23e4-eeeb-4ae7-a4dc-3d99e3993b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569305, "uuid": "76fc07f4-b6a5-4410-8f80-34d3d8b7131e", "value": "984fda64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5012c417-ba52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621614825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621614825, "uuid": "bd2e2f39-842e-497a-b7d2-bd004c34ac26", "comment": "Malware payload (Dridex)", "value": "a124a6f25cb353c0294b8f8bc27f419a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621614825, "uuid": "23b2af17-cc9d-4199-a459-e05a85ba94b3", "comment": "Malware payload (Dridex)", "value": "21a997450155a9ffa20e32d03b5cacd8ab061c93fbae8a8d8f36101deb524443", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621614825, "uuid": "25cf5615-a7c4-48d9-bc3e-fc1baa087716", "comment": "Malware payload (Dridex)", "value": "d15d915f01a209b9d2d1e90a7c2343f82a30d8c8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621614825, "uuid": "2ed52535-3fe2-485a-8b7a-04fcb025ead4", "comment": "Malware payload (Dridex)", "value": "28cc8a004bd7abece033125e12f77cfebf09330189cc7c7572ff03bedd5b91031122d607629ce81f3a12d4458f279bf4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621614825, "uuid": "0f897de2-cbbe-4280-a008-b17f123b7547", "value": "CB04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621614825, "uuid": "65329511-f0ae-45d3-917a-3cd040e21548", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621614825, "uuid": "8d5d8b41-0c56-4036-a041-4da6308d596a", "value": "3072:EqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:CVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621614825, "uuid": "71ea7581-c8f8-4025-8a12-4624a2a37168", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621614825, "uuid": "1b05addc-62d5-44c3-b2e9-ebf8aa823edf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621614825, "uuid": "05f1b9c3-53a2-4a43-bd1b-40904ab5458d", "value": "a124a6f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5495a0e-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "17346d1f-e14e-42f3-9c66-a4ffcd4053ec", "comment": "Malware payload (Dridex)", "value": "2587906395c972d5b21b42fe3792ae05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "dc3d602a-b6a6-4cba-9355-b52aec19e635", "comment": "Malware payload (Dridex)", "value": "21bf2f7d851ade1bff725bad9e69ada3503f55a9fcdc9c3b6c041556dd5cf699", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "cbc7ca76-ea26-4ea6-b338-0b7cd41783c2", "comment": "Malware payload (Dridex)", "value": "9a3741ee4a5b6163c09bb4a0ad39c0aa297e2036", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "fe1fdad1-8e45-4c5f-b9b5-e8586e68d97d", "comment": "Malware payload (Dridex)", "value": "85d23b1538dfb8206602e889e689b2e675989e8ae15ad5c595c10d469cb9391ca526797f69c3d3e654e67aa3eb61a18e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "e46a03ce-a43c-472c-aa4d-04606dadd92d", "value": "1104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "47d34648-7359-414d-9d84-3281e52860e5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "5e36c20f-01d9-412a-8b17-d8cf23791ef1", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581897, "uuid": "f17cc9b9-1f9e-416b-a1b2-f84ffa11cd25", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581897, "uuid": "abd0928d-346d-4125-ae52-27b348ffe218", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "dea71759-2bf0-48a3-bbc8-9d016c55784b", "value": "25879063_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5191bd50-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621578321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578321, "uuid": "0a163976-28d9-4de9-894e-d95a108bca00", "comment": "Malware payload (AgentTesla)", "value": "4580cd8c275536509bfe149f9cd1a36a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578321, "uuid": "c979d2a1-294d-4e14-867e-fbcde1b3192c", "comment": "Malware payload (AgentTesla)", "value": "22238723d654e50aef5e03ba47f3a878c1398411ae5d7dc8010143841fdb6576", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578321, "uuid": "5d3d6191-0a9d-496c-a594-4c94395d8369", "comment": "Malware payload (AgentTesla)", "value": "587201b8d5dcf085a950f507df46087d27a66205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578321, "uuid": "8045e306-1a1b-4567-9fca-c5ba2438b079", "comment": "Malware payload (AgentTesla)", "value": "5e2c7d0535869a9ee9efe2d50d11be6bba24808dcb271e1d80a759a4061ec31fd93d6ec21bdb6b5e171209bd387f4cc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578321, "uuid": "708b2511-ec67-48a4-b4b1-8c02e7b69a90", "value": "C891F7A2037A1583EF2B81F6EAB6FE6215E2F242C5CB0884339DF9B10B1731395A4900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578321, "uuid": "011b9a10-711e-4be8-acec-24cef27def89", "value": "96:Oz1Y/w40/enOgeB2+pUWfWmYWu6SW7GsgFdFTwo2T5Vcuj:O6/w6OL4+pE3Wu6SW7fqdyVVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578321, "uuid": "6b86153e-7cc4-489a-bc2d-e6c452c04215", "value": 4381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578321, "uuid": "31d40604-e344-49fe-b9d8-831f03cb5b4e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578321, "uuid": "5699d250-4307-41d2-a23b-4dd6c52a1979", "value": "ORDER CONFIRMATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa807c43-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621575893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575893, "uuid": "851bdad3-fa81-4ab9-b294-13b555949970", "comment": "Malware payload (AgentTesla)", "value": "6385f48cdfc26ed3059de022a68a2ede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575893, "uuid": "007584bb-cf48-4f3f-8a33-7a099c6da3c7", "comment": "Malware payload (AgentTesla)", "value": "22637e06185c1729dc491bf0d47763f8e549ae5a16223b04579240a0bbfa9f1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575893, "uuid": "29d945c6-d610-4b00-bc25-9c45e013207c", "comment": "Malware payload (AgentTesla)", "value": "19c0ddd6b039fa411782878a34f4bc285fb4d374", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575893, "uuid": "a05b7df9-3b19-4cfe-b3cc-96a17e95176a", "comment": "Malware payload (AgentTesla)", "value": "46b3040703b9aec9d21eea21966d105dfd6dcafee5bc428de45733c25e6a4d3a79f4581bbff980a39f9617c5dd310c27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575893, "uuid": "91143088-3a34-4465-b336-f8e50300bbca", "value": "C005CFAC325475DEC43FD279DA681C28EAE07477C31B920BA12710AD9E4C987EF651F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575893, "uuid": "cfa282e2-8a6f-4cb4-916c-4c2e79c1060a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575893, "uuid": "f1cb5704-6a2f-4c10-a381-c5a7220503d8", "value": "12288:VKzJf3KX2RPShyhlw4yycW9f6YZ6IGxuq0fTIuX5bZA5BiiSj7QzOv4xF2fESDHi:gzJnRPS4w4yyZ9fbMxuDIuXA5BAPQaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575893, "uuid": "bfe7d105-1e45-427e-8091-9801ace588e3", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575893, "uuid": "8b444843-dbd7-428a-9525-66d689c553ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575893, "uuid": "8bcf2101-fb74-4eec-bed6-f843189c157c", "value": "RFQ # GT20-1779809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2026bf8c-b9df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565353, "uuid": "9a0d4a6c-59f6-450a-b11a-d891ac2516f0", "comment": "Malware payload (Dridex)", "value": "3016f52e42504684fe634900cc92598d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565353, "uuid": "23c229c2-ff22-436d-bef9-f6622121ed77", "comment": "Malware payload (Dridex)", "value": "2288e0af4f4024afb4cc4c7061055411ed1a3e76d6e71edbe080826f65779b2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565353, "uuid": "a2e6c188-fc97-4e86-80ff-7435025a10f6", "comment": "Malware payload (Dridex)", "value": "a5d59c3d40a201797ea2b4cfcf6c9cf13cdf7ed6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565353, "uuid": "4cf1e2f2-8a6c-46c9-9852-9f6ff1273934", "comment": "Malware payload (Dridex)", "value": "31e399e50cabb8ddfaf2272c2aabcc5ae7e5313e7e2aa01c8093203c5e9ddc331f28c8ca9efd12f1073040ea92ed8eb9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565353, "uuid": "8b3df299-7660-43b9-bf54-986f760669e2", "value": "7AF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565353, "uuid": "2de7d7c1-dc57-4b79-8506-50a7b4a1ba33", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565353, "uuid": "f3e43ccb-ad08-4dc7-9735-b30e36447d6e", "value": "3072:s9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:s9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565353, "uuid": "e7654787-d02c-45c3-82d4-ef7cca282ca5", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565353, "uuid": "677d40b1-6643-4175-833a-254d5e725cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565353, "uuid": "6cbdcd90-5861-4050-be78-89692db340df", "value": "3016f52e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f30e56e-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573700, "uuid": "055fe65c-d826-4f6d-aae5-62c88437a142", "comment": "Malware payload (Dridex)", "value": "38e0bfa39607d46d79c7e288ebbf0f1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573700, "uuid": "e5956ef5-5b71-412f-a2d7-2dcfb3f6440c", "comment": "Malware payload (Dridex)", "value": "22a159553da05752d795debebe18bcdaf91442551a4614165adbc3ab68e5f4ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573700, "uuid": "55003456-b232-4d2c-8b02-99ca09cf77b9", "comment": "Malware payload (Dridex)", "value": "14ddf99d8bff9cc946d9e8d4daa9af46356567f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573700, "uuid": "88b02074-1ef9-4333-accb-1f3e3240cb21", "comment": "Malware payload (Dridex)", "value": "b7d053ea718be8177f4f08ef0e25ab50384e131d8dbd51fb0d53d5692c471c216451db35ce9420459f0ac3677825cad8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573700, "uuid": "f4160819-73d4-4c05-9d4a-4e52663cb8ca", "value": "ED04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573700, "uuid": "363df001-b3ee-4b0a-8a39-35d4bafeb73e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573700, "uuid": "25b8c8dc-323e-4fe3-a118-bbb9d7b17645", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573700, "uuid": "a2147223-1faf-42c0-9c6a-5c3a69f2143e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573700, "uuid": "4950e431-8278-4b4b-a929-5ca3bd6d2214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573700, "uuid": "59d0e673-ef70-4c39-8dd7-d2bf76e322af", "value": "38e0bfa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dd6d51-ba42-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607862, "uuid": "13aaff7a-6606-4f72-b88d-f11b079f6943", "comment": "Malware payload (Dridex)", "value": "b09282dacd8e5f09d55b6f8d0b45414d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607862, "uuid": "74f3bc66-55be-4138-b29e-7fc94267609c", "comment": "Malware payload (Dridex)", "value": "22b9609e252efa9ce3e1582e12d88ac1d2b7c038425ddf0a0601cbf0f82b8642", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607862, "uuid": "402b3bbc-2482-47de-8f1a-dc7706207594", "comment": "Malware payload (Dridex)", "value": "54fa09e70ee34a9ce6b6b965670d1c1ba03853bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607862, "uuid": "4584b6cd-595d-433c-800e-5da45003f75a", "comment": "Malware payload (Dridex)", "value": "b5d17c07a294870829107cfd1f6f8ec499e63e1eae62437d088dc1e1fa4350334c78ad30f4319087230dfd8dea32de71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607862, "uuid": "d956b44b-2a43-4cdf-a728-14a46b9f0641", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607862, "uuid": "7a50c711-28b7-47a9-9c7a-c3c548dacb46", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607862, "uuid": "0492bf24-a397-468e-a8d7-412fd6830f73", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607862, "uuid": "8d1896c5-9b1a-45d5-8611-4e6743be465f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607862, "uuid": "fa6bc70b-eb9e-4aac-a3b2-e3050b9da312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607862, "uuid": "39c7e8aa-f235-44fa-ab41-7b0130bc5704", "value": "b09282da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80da4b32-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570240, "uuid": "a1fb1502-483b-4dd9-ac70-1b8c3ca43d2c", "comment": "Malware payload (Dridex)", "value": "40d8b526913aa0d7a9880d6b57508702", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570240, "uuid": "30d5e094-bce0-4435-aee3-927335ddfc64", "comment": "Malware payload (Dridex)", "value": "2304b3709f0424d980df9536e67bfe7ea4d991da8af373c26fe80bcb159653f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570240, "uuid": "137a899f-3db2-4780-9787-180097f2be25", "comment": "Malware payload (Dridex)", "value": "c823ad538c8c4d3478bdbb7cd0415b857b517eb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570240, "uuid": "817f7d27-46b0-46eb-a601-d8877a0f3a69", "comment": "Malware payload (Dridex)", "value": "eff59c68ca4053ab3c8f2890395bb5c537381fcae0b177e5d723e93fb8dac4cad873e1450d359ce4a5308198f248b273", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570240, "uuid": "955d8a3e-1db4-4f9d-87d7-cbfc352a1d84", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570240, "uuid": "77fb43c4-cd6d-4c71-a2e3-3b7a42769087", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570240, "uuid": "ad6c26ff-7642-45eb-9adc-cf08efcfd07a", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570240, "uuid": "6c8227d3-721c-443b-96c9-57ffd601a088", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570240, "uuid": "f83cb12e-70c0-41a6-baed-2145b7dcd6bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570240, "uuid": "9e78b033-c903-4a48-8a31-4876e21f57ea", "value": "40d8b526_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c483bf77-b9ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572501, "uuid": "3ebea27e-0350-4c69-8780-781cc7da1ff0", "comment": "Malware payload (Dridex)", "value": "242cc6779c0a8b1ff16eed2d7f5f5f50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572501, "uuid": "82e401ed-cb3d-450b-b920-b64105a77f2f", "comment": "Malware payload (Dridex)", "value": "237e8e14def7d0d2814ee5639e16b45cb1a9c46bfacf5830dc493935aae29598", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572501, "uuid": "2ab60fd1-2a70-4bc4-a8ce-db603a042d24", "comment": "Malware payload (Dridex)", "value": "5e1283f9a6dcf4a6b95d93ef5d51ea69f3e660bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572501, "uuid": "8f90b6e0-5049-4b64-ac49-5e5063125fd1", "comment": "Malware payload (Dridex)", "value": "b333b73cb3647f4dcc72e99df07de816eb2c2a542e00addb8ef5414400354a51b862cbfe5cece97b88c96783a77c3b1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572501, "uuid": "7de73220-72e3-43ec-bbbc-3d51c69e154b", "value": "7DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572501, "uuid": "9dabcb99-3240-4b70-ba00-2858f85dab19", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572501, "uuid": "ee24eea0-ebe9-4dfe-8c6b-91f23bc8c761", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572501, "uuid": "0e8a417a-a892-4949-aacf-628485776449", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572501, "uuid": "ca9061dd-7ecb-43f0-9191-5a94b24e1a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572501, "uuid": "1ec1959d-ed73-4d64-a7b7-82e97fa41f12", "value": "242cc677_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb44251d-ba66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623676, "uuid": "018a7832-19dc-4ecb-b0f3-19d109a33079", "comment": "Malware payload (Dridex)", "value": "eebd290c00a6177f85e9cc081a1ad63f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623676, "uuid": "f8fb0c92-dad5-40fa-acfe-75b6cc3ff614", "comment": "Malware payload (Dridex)", "value": "238173f1c9c2ea162504f8ed3539ae9ea7b67323a268aa4da8b2f61edd9ed20e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623676, "uuid": "ca96b31d-3ab2-46e6-8c47-0b045ced0e15", "comment": "Malware payload (Dridex)", "value": "a323a374e168b830c1b6078fe5527b36381d4f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623676, "uuid": "9807abc9-a171-42f4-a235-8f04c12178a1", "comment": "Malware payload (Dridex)", "value": "e16baeac181a27b15e2841d53e4ad2f91d3e169108f5de75143dc5634424ada53ddd945ad27e0b428421ba83efe01868", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623676, "uuid": "909f47e6-81e5-4627-85ba-0d169eef50ec", "value": "C7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623676, "uuid": "ead5fef7-281e-4a43-b6e8-ced658084450", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623676, "uuid": "0ab38fe0-63fd-47f3-8482-95d46eae1853", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623676, "uuid": "f4178e45-a645-4d56-9f17-239c979e153c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623676, "uuid": "c4f33097-8ad4-492a-b33e-12a31be31508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623676, "uuid": "1c1d7605-25a3-4b51-af64-923c305098d2", "value": "eebd290c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847f6781-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612336, "uuid": "1d1867e8-96d4-42c0-a846-940396fe97dd", "comment": "Malware payload (GuLoader)", "value": "c2ed4186ca593ae3a4d1132be9e6010f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612336, "uuid": "56b5417e-1034-401d-8ff7-2113e271d9e0", "comment": "Malware payload (GuLoader)", "value": "239629ce61bd284521557512f4781f72e7b8bdd56a8691845dc180ffc77b5252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612336, "uuid": "c8e0356b-8bd6-4385-95e9-573f8852d9e3", "comment": "Malware payload (GuLoader)", "value": "9b7cc499c8a1ddd8ac341c080a5dc5dec1a043d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612336, "uuid": "a0ea5095-b44a-4483-a639-27b818484c21", "comment": "Malware payload (GuLoader)", "value": "cf5cc7f7d1bea9e1b69050bff934fdc340642b994d8af652856b57748de1a978cd057a25b82275f76c40088661d11ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612336, "uuid": "f7f1632f-ba61-4c9c-9408-adab17c61b26", "value": "D7348386B962A579F8C69174F526C20F0CA53CB372854E07BF832F63B0340576EF9966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612336, "uuid": "0685a279-4058-4a42-8746-1ccabea00572", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612336, "uuid": "88fd6560-c27b-43ee-a509-8f8a5539e1ce", "value": "3072:y+I1eY7cyEbbpVTGYsUOKDj4UlAYa8BNX:yUbdgtUBjCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612336, "uuid": "a7cca54b-b030-4f75-a914-97bc4d84347a", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612336, "uuid": "4061846b-812d-4535-8913-6529d28bbd30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612336, "uuid": "903ea3c3-9117-4286-af05-50cc1ade2749", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debbd3b5-ba15-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588865, "uuid": "f55f75c1-546c-4b5c-b7d8-4688625d8632", "comment": "Malware payload (Dridex)", "value": "a0c2009235089ad38576fdf2b1294d1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588865, "uuid": "0d73694e-e0da-40b2-9803-ea0978f889f4", "comment": "Malware payload (Dridex)", "value": "23ccb85b50b0274dec6c68d897b790f6a7ad4de032da2865c7bb56a7fa45a0c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588865, "uuid": "fd9b7951-08d1-467f-a17c-c92c2ee341c5", "comment": "Malware payload (Dridex)", "value": "855ed0634d06226e1818b21975a1b26e5fc003fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588865, "uuid": "274b4f90-ba19-49fe-a498-7b93cee27039", "comment": "Malware payload (Dridex)", "value": "7ac54103652b9c0cefb19a166509d8ce4a44f05797ce40e4e4e24c49d623bb669a60a01a9ebc61610bdf5db5095ac5e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588865, "uuid": "a848c8ee-6429-49c7-b4de-21cfc1c4c9c2", "value": "5D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588865, "uuid": "3378db37-acfb-45ec-bebe-59559dddd839", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588865, "uuid": "7bcf0083-be8d-4d54-9408-afc0789f8fd0", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588865, "uuid": "44ed48db-1d7f-44cf-8831-af7626ab9848", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588865, "uuid": "8bad93a3-55dd-4c0e-bf02-0fb0d2e9369a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588865, "uuid": "f8867d97-3fe2-4a77-bab2-2da5b99ce4fb", "value": "a0c20092_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f9dead-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634998, "uuid": "d7628946-f72c-4ab2-bd87-24ee2aa4c9be", "comment": "Malware payload (Dridex)", "value": "f0d573bbf42e65df889507db985ba935", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634998, "uuid": "7c3d30e0-9c83-49bc-b46c-781948f328ae", "comment": "Malware payload (Dridex)", "value": "23e0d5f5af165e0293993eea9d6467e444e60cc3bb140e0c86118eca3c04ad56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634998, "uuid": "d1360462-1288-493d-af48-9c580dbe7847", "comment": "Malware payload (Dridex)", "value": "a74fec7d61113fecfcc7f0af95d41e66989d55a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634998, "uuid": "ba12a4a1-52af-491f-b33b-b75eabe14196", "comment": "Malware payload (Dridex)", "value": "da7cb7a8ee3c3e2c3475d61c150e668e503c912e30997b14a1b970d892b1249f1946bc0e1c345fd0c8d4c87ba016baab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634998, "uuid": "e4f5253b-20ba-439c-ac0d-3522f48027d4", "value": "52F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634998, "uuid": "e632868c-a2df-4447-a088-dccb4306a1ea", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634998, "uuid": "17ff55a8-11b0-43ba-9ee8-7c9f36ee76b9", "value": "3072:M9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:M9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634998, "uuid": "6045dce0-8d77-4224-852d-cd35afc92514", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634998, "uuid": "187c3cb8-d267-4199-8c71-6bc877aa8cfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634998, "uuid": "e726479e-5a8f-4611-ad75-b73c36fcd73d", "value": "f0d573bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718eaae8-b9e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568066, "uuid": "edababe1-9f7f-4fff-9305-33fd9cc12cb1", "comment": "Malware payload (Dridex)", "value": "05599b7446ab625d4b2758e7efd998cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568066, "uuid": "bd4ade21-ac87-4a84-9b4d-705c2cfd26a2", "comment": "Malware payload (Dridex)", "value": "23e61026b4b00f339aaf0b8ea7d73ebc853387a2255fabb5ba6c70ff5c3e2d7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568066, "uuid": "4365ce29-d5dd-4c77-ac55-a18044a6e50b", "comment": "Malware payload (Dridex)", "value": "fa7c1672c0bfde8a695999708f1b611977befba2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568066, "uuid": "bbbda1f5-3520-461f-af97-63812300baea", "comment": "Malware payload (Dridex)", "value": "a84983e1523e7b86d680e7d1eb0e2ea6abaf4997989ff56e89b2ceab95aefe0e11e7055a119bc283fe7a1c833cb6d1a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568066, "uuid": "d1ca2b8a-642f-453c-80e4-e28281b85d4b", "value": "D904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568066, "uuid": "64351473-33d9-47cf-bf55-f296601f52ea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568066, "uuid": "7806c941-5800-49c1-92ed-b564692f74c3", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568066, "uuid": "948a842d-205b-4222-9616-829b90fa1d05", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568066, "uuid": "6a1dba03-b5cb-4d14-a7a9-13df3df23faa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568066, "uuid": "defff808-49ac-4edf-afff-6d510869dff6", "value": "05599b74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8019ce2-b9ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558387, "uuid": "6c3310ce-ba15-4bef-add4-94de349d7963", "comment": "Malware payload (Dridex)", "value": "fc0520481304601df76b03c975048afe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558387, "uuid": "e4879d25-e72d-4f97-8308-d0207f6b26cd", "comment": "Malware payload (Dridex)", "value": "23fcc95cd86a062c850f3e4c0f1d145b2c8a2fcf65624dccc2a70047c2999466", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558387, "uuid": "8aa07351-5a18-4fe9-a3a7-0c0bb5db78c9", "comment": "Malware payload (Dridex)", "value": "8ea5d36cedddc37631f3b4b9e5ac432fca4a10bf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558387, "uuid": "0f540a59-842b-4f9e-9be0-4a7fa1b1d7bd", "comment": "Malware payload (Dridex)", "value": "1b5c5ed91d892d35b133b1336481aa218bbbc416de8bc49c3f3ead0859bae4d8915104e50d11f74752255bfde38a9c05", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558387, "uuid": "0a26b15e-4977-4d91-9d03-97ba2c9faf07", "value": "4304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558387, "uuid": "f822c7ad-c2c7-41ab-a35f-2802ca52319b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558387, "uuid": "7dc84a54-7061-4073-84be-836b30528e52", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558387, "uuid": "c520729a-a97a-43f4-ba63-7f28416d51c6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558387, "uuid": "05a01ae1-a6cd-467f-af5a-e98527f450b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558387, "uuid": "a50a415f-4392-40e2-b050-a3a3ab5a3a3c", "value": "fc052048_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e688257f-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573417, "uuid": "70cfe89a-06e7-4393-a830-36e5b9cb2ead", "comment": "Malware payload (Dridex)", "value": "f73bea4e0590826416719ab72789e262", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573417, "uuid": "0338462f-3ad3-4b1f-96a0-c58573bfe006", "comment": "Malware payload (Dridex)", "value": "2447d2f17f3cb244beb0fdd66935500375902305db246ae6fdb19e56d73ff5cc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573417, "uuid": "3e6b3878-9808-4797-915f-9057236a430e", "comment": "Malware payload (Dridex)", "value": "ad0c8773a38c93547c6745ea3da1989e78fb4670", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573417, "uuid": "3ff8ebcd-8b4e-4d4e-ae62-f6f36a919797", "comment": "Malware payload (Dridex)", "value": "64e10e05934af344a349e43e64801230a7fd53cc9451298086f315bcb4d26d33794b769a5f01d5014600e4f2402ea88e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573417, "uuid": "1d3ef44d-232c-4d29-85f2-89ec7a8bff19", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573417, "uuid": "d27fa131-30b4-4471-9b0d-3e6bf2410f78", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573417, "uuid": "37e1c957-cb5c-4260-ab3f-3dda0f0582a9", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573417, "uuid": "aba386bd-b689-493d-a4c5-dcf875b424e4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573417, "uuid": "997a98a6-3180-4f6b-99c0-59e361783f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573417, "uuid": "c0bf7cfe-822d-47e5-b6f6-45ed9950a3be", "value": "f73bea4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d803f931-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567379, "uuid": "94c9af88-54fe-420b-9e81-d4e99ef283b8", "comment": "Malware payload (Dridex)", "value": "c6bb1dcde95cec2ed3a25a3f75e68d03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567379, "uuid": "ece6b989-5464-48fc-82d6-187f5d0db6f7", "comment": "Malware payload (Dridex)", "value": "244f4ed09ea82f42bcd1e0994ff4edec9a835d6915bdd965193e059006ac1dc2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567379, "uuid": "107480d8-1a34-402d-9c9d-d3a3d6ee6e5d", "comment": "Malware payload (Dridex)", "value": "35c687c00188c1e8a2aad991eae496aa7d924428", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567379, "uuid": "ea4b3a48-5624-45e9-a2ca-d06e99328ef9", "comment": "Malware payload (Dridex)", "value": "5c8fbb219cddf8edbb96557c78f6234bb7f88c61d4684ec0aef5717e119a09d75210ac63422e50c355372575d2514397", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567379, "uuid": "540e317a-5353-450b-9f0b-15a7b8d17047", "value": "AE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567379, "uuid": "71fb079c-6956-46cf-bdcb-65cefb7d4a4b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567379, "uuid": "3cf02124-4dbc-419e-9611-3c313ffbe024", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567379, "uuid": "25bf1808-1c0e-4866-a6d6-46ff78aa420f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567379, "uuid": "67ff35a9-df46-4a01-aed5-97717ab4186c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567379, "uuid": "154e58ed-293d-459c-be0f-b9c612201b3c", "value": "c6bb1dcd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f4e862-ba23-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621594867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621594867, "uuid": "273416fd-968d-4d88-9791-afb63dc8c9eb", "comment": "Malware payload (Loki)", "value": "eb3aca779e36d70f76bc240753823c25", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621594867, "uuid": "22aec917-db0e-450e-8e19-d1781b45d9fa", "comment": "Malware payload (Loki)", "value": "2511ceb25fbad4e442babf8d272e829cc2f18a088ff31f5f3db2fb14455b2727", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621594867, "uuid": "56f1b0a1-2c1c-4626-9dec-cda7eb82537a", "comment": "Malware payload (Loki)", "value": "e2847d2da9d8606b371183e7ca6d8669fbc444f0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621594867, "uuid": "3bf8b946-d77e-4fe2-a850-454106c2c91e", "comment": "Malware payload (Loki)", "value": "1e6f17dafbbcfc68c392c2497e3ee02e82a6c59b2cf2b9761091d3dde8de1f24f46ba64b1347356d13383b343b40af51", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621594867, "uuid": "6d29ecd6-2b2e-4528-ba08-f93fcef3a88a", "value": "F2E312E40DD62661F89D9CE38C3932FD6F0DD4DA3891F7451B06AC68CAD80495727EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621594867, "uuid": "2b44f5c8-3801-4011-9253-f8b88cf5d375", "value": "3072:ibk5G+pMYwag2Ytx6O4zF8LvF+tIzpz6XqDY0J3GTcqR:KNY/Na4+F+GcJ0J2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621594867, "uuid": "71a06a88-1419-48d3-8010-eb09fe1ff487", "value": 156548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621594867, "uuid": "5ba0ce3b-f8c0-4405-a907-9198ea8a2d94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621594867, "uuid": "7a258932-69df-48bd-974a-0bc50c14e10a", "value": "eb3aca77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf14cff-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621609315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609315, "uuid": "a9f894e4-24d8-4eb3-8650-4ac1b709b8a1", "comment": "Malware payload (SilentBuilder)", "value": "a5c377473d3cba689822f7c22f9d0382", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609315, "uuid": "40de8da4-6804-48e2-8d84-3e205aae905a", "comment": "Malware payload (SilentBuilder)", "value": "25605c6aaeed4b3803602b7d118eb60106b014f1b97739a094402e70593947ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609315, "uuid": "52de0fb6-884b-43c3-b7f7-7a454b935af4", "comment": "Malware payload (SilentBuilder)", "value": "5c54c1bfe35ed3e6c8c21e3f3828abef35fa9778", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609315, "uuid": "76940d55-8f98-4549-80ec-a2a3a5d0fc35", "comment": "Malware payload (SilentBuilder)", "value": "777cc37a75341a722de59835222b8bc61c37a4f91b996f0ac87e8ec9f3c7d8570f8b6720ed8f6982c60cea52e4bbbffb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609315, "uuid": "2d84d0c3-6d08-49ae-a07e-96463ed0bd02", "value": "6EB49D42A309D4A9C3614B3AA5118AE8556BEC52860EBF43374BBF2CDFF4390F718765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609315, "uuid": "3af90f4e-49ec-4d76-b65c-f1a286b3ed73", "value": "6144:C6tIrWqrY5O3NMHGRYc9u/YRTP85XbDu1XYiXRy:Ru1XPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609315, "uuid": "af166d7f-01f2-4668-aeab-e50bd045632e", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609315, "uuid": "9c2f8098-6d80-4680-93b5-539b7a0d9849", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609315, "uuid": "882d8156-f390-4dd0-b898-e03681a8fcb2", "value": "statistic-290131807.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a08ad8-ba2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621600066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600066, "uuid": "4dfac279-d426-4bbd-ac82-5ab1b9e38d21", "comment": "Malware payload (Dridex)", "value": "8340e642f94b739f88d748fa8f9e3051", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600066, "uuid": "f13cd1be-4d78-4d8d-97dd-cd7ec852f6fb", "comment": "Malware payload (Dridex)", "value": "25891523276c26e67ceef9a56e5b6c70f7747fc7bd87b34b4c32f14f254b76c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600066, "uuid": "22534a74-b621-4ec0-a27e-e061942bd2c3", "comment": "Malware payload (Dridex)", "value": "8db100b06c3272309e82fc42119d44a7a2776510", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600066, "uuid": "52957eb7-d6c7-4bf4-a268-fde5767196df", "comment": "Malware payload (Dridex)", "value": "8e81ee74961835df1310250bdadc5ac26d12b979a1d3f95e82636cb866f470df87d166dd422b8f1f768828ad1619c245", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600066, "uuid": "1a70a741-bebb-48cf-b5e0-959ce5ee63fa", "value": "DD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600066, "uuid": "6a3df001-b1e0-4130-9fb5-3c7cf24744cf", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600066, "uuid": "dde05cf5-266a-4be8-9b87-915c35f8deab", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621600066, "uuid": "089f7df6-cefe-4d84-8645-91b2eb27a0f3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621600066, "uuid": "16cb83bf-b692-4481-8316-fc35247da4f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600066, "uuid": "bb1acb02-0be1-4820-94a7-f93bf616fb61", "value": "8340e642_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f929ff08-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634866, "uuid": "a300c889-50fd-4dc7-a9da-3e99c0fee2da", "comment": "Malware payload (Dridex)", "value": "dbd9ea2ec4274cca69f6ee529a2b9d4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634866, "uuid": "1cd42488-a99b-4377-b82f-7eff3fe3dce1", "comment": "Malware payload (Dridex)", "value": "25bc541b683777bc0db1f82099d16d18c433f71a24260454d6a01941cb5af242", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634866, "uuid": "ccad32be-ab3b-48ce-8094-070b2b247a34", "comment": "Malware payload (Dridex)", "value": "aa54b4f25662daf2b1b99c3fcffdfbab8b37f561", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634866, "uuid": "51c1af94-283d-4a09-aa77-0cd5850803b2", "comment": "Malware payload (Dridex)", "value": "20666a85b252ce7e924dcf29ecf61a33c776032aa34a5622861e7bc7a0f6236cdd06a142b685ba20590532be408afdf9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634866, "uuid": "28cfc9cd-628d-4a02-9efa-56c133b9d56a", "value": "98F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634866, "uuid": "d6e8ee78-03bb-40fa-8bd7-b9dee2a3f4d8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634866, "uuid": "e858bff4-97f1-4ff9-8306-a1ce66e2241a", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634866, "uuid": "f5ed5e14-8b3c-46a1-aa75-f6336af8bdcf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634866, "uuid": "70e60216-4799-4893-8c56-6aff888690c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634866, "uuid": "54874a71-6493-49c6-9c04-8819f04cabe4", "value": "dbd9ea2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd7f57f-ba33-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621601667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601667, "uuid": "5835045f-65ce-47e3-994a-43fb5cd426e4", "comment": "Malware payload (AgentTesla)", "value": "2c320b83bd6a600c880858ba48c53caf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601667, "uuid": "829b027c-91e2-4c45-b440-2a02adc40c59", "comment": "Malware payload (AgentTesla)", "value": "25e023b62ee80e6d9de88b4e98da96e085f690d11a3b0c4d7a5aa1c1ac7bf4fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601667, "uuid": "44d4e092-2a59-4789-98ce-37a25ea3d2c7", "comment": "Malware payload (AgentTesla)", "value": "66219eec6cff25e695f9e710ec73f406b409aefa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601667, "uuid": "18f4883a-df5f-4f3d-8300-4a7389605866", "comment": "Malware payload (AgentTesla)", "value": "cb8acaf549e23ba17adba645e413c88185785b3f26539aeeb530a6c60fc1d3079e86ac0b9b6e651865662bc2374f5468", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601667, "uuid": "25e923b1-810a-45a6-8e09-90cc1a9daefb", "value": "0515D0AC325475DEC93FD67ADA681C68EAB07077831BC20BA127009D994C9C7EF615F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601667, "uuid": "e2aca053-26e8-4e06-953b-4472aa41fcd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601667, "uuid": "9d945317-6f5c-4768-80ea-5766e6f1d5e6", "value": "24576:yz+T735Pu/cNm/jAP2dZuGG4zOQjoD2J:yz43500P2qsjoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621601667, "uuid": "18073310-ad47-4b75-ad26-d3e92c6d8b54", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621601667, "uuid": "a8072fb6-26a0-4043-874f-ef0eb000f8d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601667, "uuid": "0ff58209-82dc-45d8-a3fc-b501330828f0", "value": "rOlepmTYF4QMA8r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a89089-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627983, "uuid": "fed9aa7c-96ee-49ed-af77-eef46cd8f663", "comment": "Malware payload (Dridex)", "value": "0a7dd1e225117e9dadcd694f1eefd6ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627983, "uuid": "871ef58b-1f1f-49a0-bf39-7644422d7f0d", "comment": "Malware payload (Dridex)", "value": "25e0b41d72387c34a317d4047b5d157ded02fca6de762132bba503da0b8ae173", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627983, "uuid": "1c9f29b5-ac1b-4dd4-8de4-ce5f666ac908", "comment": "Malware payload (Dridex)", "value": "0feb1b704fa97d5ce7f008fd3180c14aa654845c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627983, "uuid": "c30e2009-a9f9-401c-8981-f8af11a2c7b9", "comment": "Malware payload (Dridex)", "value": "d158c4c43a8d731e19ac17a8deafe8d979cdd7e9429a508a679fcd803f8e92ae1678541b821c6517492d13f7f66bb442", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627983, "uuid": "8f2ac5d7-2735-4dfa-998d-95672614fd7a", "value": "D4F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627983, "uuid": "31551d83-4825-4d19-842c-5da5fd83eb91", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627983, "uuid": "95231e7a-3f34-4b81-9b40-2e2d22874d8f", "value": "3072:69F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:69F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627983, "uuid": "5edd1d0c-e715-4453-aa14-34111e375f1b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627983, "uuid": "c3893edc-6822-40d3-a63a-f6291e4f6955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627983, "uuid": "9c6991fe-828b-463e-a53d-de35ad4c4d45", "value": "0a7dd1e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133fc043-ba3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606563, "uuid": "f4b06e87-ac43-485a-934a-92bd7f5d81f0", "comment": "Malware payload (Dridex)", "value": "b1f9eb6044b1ca3d4ed9d9ffd3db07f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606563, "uuid": "2d6346b2-347d-4665-a901-11ae6b99a744", "comment": "Malware payload (Dridex)", "value": "260c2c2b03eb100d505c967f08204d65d96147a0769370012566dadcd6e92649", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606563, "uuid": "12d2d895-a985-4a11-b8fa-50b1667f5b24", "comment": "Malware payload (Dridex)", "value": "479c8ab471a1ae082f82e4ddfb6c10ffcbf63ec6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606563, "uuid": "57677ec1-2055-40ee-820c-691727a5b5f7", "comment": "Malware payload (Dridex)", "value": "c8c56abd60bb33f1974c19c967c929ca2f3e5409b434a18ddbf4921fb28a3918a7fce16663da72c758affa7b0883c0c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606563, "uuid": "76a28d57-2450-420f-bfa9-066ebeebd310", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606563, "uuid": "8719e4f1-5183-4b55-8e84-d8adc735019a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606563, "uuid": "9e1f9032-11ed-4105-8e5e-bf02ba51c976", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606563, "uuid": "45014e83-a32e-4286-8554-ced516ac4d4a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606563, "uuid": "f299b238-2223-414b-a6f0-a84bb3e5ecf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606563, "uuid": "cb4adff2-a952-4a64-88d0-247e3d3c67d2", "value": "b1f9eb60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80cc994-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621618409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618409, "uuid": "2df6d574-ae6e-4754-97a2-a0f367e92a4b", "comment": "Malware payload (Dridex)", "value": "246d3f17d04f3fcf03e654b7a7f6af0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618409, "uuid": "60621e82-bc33-41d0-9a15-6b18186a02ad", "comment": "Malware payload (Dridex)", "value": "263d9ecc89c4f6d0a274894ad8c5b5d2a628770434aceb67bd35d4d714d2c06d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618409, "uuid": "455d2584-a07a-4ee1-b97a-4257115e14fc", "comment": "Malware payload (Dridex)", "value": "dcfa8c61a45d6e327832c7ed9fb040819e5f4d24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618409, "uuid": "404d97e7-9669-4597-91ef-d0a6da4042d3", "comment": "Malware payload (Dridex)", "value": "177ec2b2d0dc3c1cd829e5a3475abac7e757428bf2cd8cf823da19c1627e59c19f398803afe2e935cf004c557859cf88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618409, "uuid": "19566fb2-ccd2-4c48-b8ac-ab034eba4673", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618409, "uuid": "a56f3777-ae42-42bf-89d0-0bc2077e16ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618409, "uuid": "15ba8c7c-b20f-4e9a-af54-6a106d1f253a", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618409, "uuid": "8ddcbca3-19d2-4894-8d6e-bb4a65f3047b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618409, "uuid": "f0ca0143-b59e-450c-823a-62f3d1550a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618409, "uuid": "7f7dae52-c488-4172-aa7e-92fe52be8a9d", "value": "246d3f17_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956437da-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611506, "uuid": "be4be688-39c2-4850-b815-c9cc5e61a841", "comment": "Malware payload (Dridex)", "value": "4638e706ff2c55d131ac24d7f7d0c2d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611506, "uuid": "b6a1fcb7-6b21-42e6-a906-09bbb95fd81f", "comment": "Malware payload (Dridex)", "value": "26d00fc6711103817a82a1b99bc335155e91a3910eb8cda2d955e6db5a0995c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611506, "uuid": "995baf2f-824a-4801-838c-3ba18a6a4af4", "comment": "Malware payload (Dridex)", "value": "755df808aac379bb3111d2f58a22a0c5623bae4a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611506, "uuid": "2fbe5fba-ea74-4705-9c0d-5b5aa2810e9b", "comment": "Malware payload (Dridex)", "value": "0818c34f06559983468756b4c678737f48480a06d7047867a8a9a0c26bc921deaafc831ec48412a0717c3aa4ddf0e271", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611506, "uuid": "8ae8aecd-772a-45dd-9aab-5bbaba0e3dc2", "value": "3F04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611506, "uuid": "24623214-f171-47e8-9a3c-81149a98de83", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611506, "uuid": "529ff12c-66a9-4cb2-b103-59be6b414119", "value": "3072:4i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:4H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611506, "uuid": "41e3e64f-bcba-47dd-9a8b-4425559bebc6", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611506, "uuid": "1605b02f-2ad8-458d-bf33-51a979c5e8bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611506, "uuid": "6586ef9b-a671-463d-8e53-bdab8e293ae9", "value": "4638e706_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2ea8d1-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573510, "uuid": "d833f447-60cd-42c3-b268-0a162714a574", "comment": "Malware payload (Dridex)", "value": "89e77ccbf48720b99d1b3d95faa1cc75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573510, "uuid": "a15c5d9a-9179-499e-8e9d-792f89a77cab", "comment": "Malware payload (Dridex)", "value": "27216ac123c4ac11e2788706ba733cb9808ffa56adc3e492e460cc09cbfc1aa3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573510, "uuid": "5d97803c-6709-46d8-acb8-e7ee17366960", "comment": "Malware payload (Dridex)", "value": "404bda1b83f5ea376a541d8e17a01a808138c1dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573510, "uuid": "b82f9637-0e65-4aaa-93ec-8fd1be462dd6", "comment": "Malware payload (Dridex)", "value": "c86631b55e64522737b8ecee7d1eb423fbe4a3a5b7150763da1131202ddfbdd7027f55c9199cbf396936479ef22826cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573510, "uuid": "8385c33d-b0ff-43dc-a07c-30b641bd2ff0", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573510, "uuid": "904d2666-13cd-4d94-a004-767230d4c237", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573510, "uuid": "21c964dd-4fc1-42f6-b43a-f1e4a72511fb", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573510, "uuid": "d72662f1-7a8a-4588-8032-e16e3aa0a004", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573510, "uuid": "427f9856-db81-4c22-b131-a9f848275633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573510, "uuid": "5016aaeb-3e59-42ea-b7b9-f2f5ea8dc74d", "value": "89e77ccb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3192ad-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578120, "uuid": "1a994e01-983f-465c-85b9-5c2e557320f2", "comment": "Malware payload (Dridex)", "value": "2ecfe7be86c8d414b915b4988df33e7f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578120, "uuid": "29aac4da-0e41-4ac9-bf48-e3f7752f4291", "comment": "Malware payload (Dridex)", "value": "279057b6da8158e4c0f7ecb9162fc40516f9cffe557dedb52a8cf9778a82cab9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578120, "uuid": "a6a078a2-85cc-43a8-ac1a-dc8d01957253", "comment": "Malware payload (Dridex)", "value": "5eae34f1ba3135dc665a13f50fbc8b2214b6355c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578120, "uuid": "b1efbd27-7b07-4e9b-86f6-c3ff6f3a77b6", "comment": "Malware payload (Dridex)", "value": "2f306d1867c3c67d2220e8068944e91682a3607e1cdcc967d22c40c4bfcddb5058d65d687297ca77cfe1fc6ba718a20f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578120, "uuid": "79969c5b-5c17-4528-90ec-96cb55780f95", "value": "FD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578120, "uuid": "968b8226-a514-459f-a7c6-4d6c5cb60df4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578120, "uuid": "5a5a5a9a-7b26-4572-80e2-6c5631b96fd3", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578120, "uuid": "8fe1e92f-d3a9-41e0-bd3e-34c618bed2fc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578120, "uuid": "1b0d3f00-8f85-467b-814a-1a2924f2d9cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578120, "uuid": "dd9242ab-80aa-4486-95d6-98eb224b7f9c", "value": "2ecfe7be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355955dd-b9e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568395, "uuid": "c2b3f22a-1a75-43f1-ba10-3f780a200652", "comment": "Malware payload (Dridex)", "value": "d30c59ee4b99397385fe3e7c74499ebe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568395, "uuid": "8eec0e23-5532-4a66-a3a9-11385b30e038", "comment": "Malware payload (Dridex)", "value": "27dbcabb1c67168c84586e26372c3dbfd3b23df05c9c0e6f506140c6ee438464", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568395, "uuid": "926ce8b2-e2ed-4d42-b4b3-ac933f3bf8cf", "comment": "Malware payload (Dridex)", "value": "1dd94bbb370d21769a2df19a9d0879a4d11c0f54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568395, "uuid": "187f4d96-b259-477a-a113-7bc6a5fab252", "comment": "Malware payload (Dridex)", "value": "4726b4623d56fb0722170b90de8c9afea73910ae47f10a1cfd58baea0a258cfc64db3cf8a6de03c87e5f0c04a00200cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568395, "uuid": "a4514940-608d-4d9b-b031-862009e0bd82", "value": "1A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568395, "uuid": "04daf358-c95a-4879-a7c9-2b5e381389e4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568395, "uuid": "4d83aacf-3ec9-4054-9c8a-3b95a586ea8f", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568395, "uuid": "278ca931-b1e6-4d07-8372-a23cae40d251", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568395, "uuid": "87c71bf2-4b25-4acd-949a-41d91cac312a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568395, "uuid": "93c3ed8a-382c-4961-b20f-b0467023a2c1", "value": "d30c59ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7ad495-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563008, "uuid": "37c396fa-98ee-4816-bc58-2c843f19d65e", "comment": "Malware payload (Dridex)", "value": "1159c75591d53c8f44df4652b56b9344", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563008, "uuid": "da229322-c656-42e5-a903-0af6fbb8cdb5", "comment": "Malware payload (Dridex)", "value": "27edbce867ab451a249f2b29546781d6716da7812afc5075ddf198fb2972e94f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563008, "uuid": "a3f35d9d-f775-40b5-958e-f0941f058cb9", "comment": "Malware payload (Dridex)", "value": "2eae8411100918749f1afa2f2fae5ea2c6db2cde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563008, "uuid": "d1baff78-6495-49cd-a5c9-73e3ab5eb5dc", "comment": "Malware payload (Dridex)", "value": "8142d31071fd1a654c0109b16fa3fd964c1a70d05652f818e26a203889d47284b11f618c0ee836d7ecd4239acb84e5ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563008, "uuid": "e7102cee-ddcb-4479-8d19-268a0f0b1cbc", "value": "7104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563008, "uuid": "29588862-c1ce-4cf7-bea9-2878d7521c72", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563008, "uuid": "69673119-76e5-46fd-8886-6077082815ea", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563008, "uuid": "897207b9-d300-4612-8bc4-aa93f3606124", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563008, "uuid": "a90ed87f-4c75-4b29-8daa-aa405b5b7a75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563008, "uuid": "ee10d8f5-d865-4988-a613-e2b7b2d7820a", "value": "1159c755_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b86288-b9cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558517, "uuid": "c7e6aad8-314d-4b8b-b039-4be8ed75329d", "comment": "Malware payload (Dridex)", "value": "6e823bb1ab1ebd1f68a6a8e4d58cc3ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558517, "uuid": "c338bb61-f611-4eca-a8e8-abb19abc525a", "comment": "Malware payload (Dridex)", "value": "289e3c312785d675de9df0c6c81af32a3401cf58f5ba118c59b2a6d92591c44b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558517, "uuid": "2caee4f2-6239-40fd-be30-2a7e07f3800f", "comment": "Malware payload (Dridex)", "value": "744629784bcfb79ace862e2fbee948f2c56f2cdf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558517, "uuid": "8d4ae522-6ede-495a-b570-60413fdbc115", "comment": "Malware payload (Dridex)", "value": "9774e5b01c4e8ceb6e346ceeaee128bffc33c48b8dfab4955ddfb96ab55b30eba41d0430e3e8f5033da9f39558206857", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558517, "uuid": "dc4a03dd-647d-4d25-aa7c-10ad79e9506a", "value": "A904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558517, "uuid": "a3ec4288-4d5a-40d1-9d9b-3fe58bb74240", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558517, "uuid": "bd013692-6783-4af0-b6cd-8b4a195af75e", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558517, "uuid": "1066b88c-815b-4f66-93e8-5e493d0b8dbb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558517, "uuid": "196e9fb7-860e-4ef7-be9d-780427c76c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558517, "uuid": "3be8b964-e515-4f6a-b7fa-03625cd04081", "value": "6e823bb1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ab57b1-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610345, "uuid": "cb10b866-c8f2-451b-a329-2c897f7551e4", "comment": "Malware payload (Dridex)", "value": "2fa60bdc1f48f31b5eebb019253b0853", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610345, "uuid": "b7c9daa9-69d6-4223-896b-59dc899873e6", "comment": "Malware payload (Dridex)", "value": "28f429f7cff0e8389e2a9ed43c146a85a4e012d7b8fe4a1da1226413bc3c3850", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610345, "uuid": "bd06422e-6b24-40eb-95e0-1cef061b34f3", "comment": "Malware payload (Dridex)", "value": "0ba963c51008bdc96751ffd6112643841bd4224a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610345, "uuid": "ad945edf-1f99-47fb-a50a-b6c4ac941cc1", "comment": "Malware payload (Dridex)", "value": "6da13ef1102f0555c91627e36cad411217db90d2d86741959f3c1bd36645b18a986e6c8475b143a5bb6397e4dd32d89a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610345, "uuid": "e33c0877-cb50-4948-9383-75622c328c7c", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610345, "uuid": "26421eec-6250-4bb2-a72e-ff9857497bb1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610345, "uuid": "95c8dd61-0a0f-4008-9cbe-be1e762a4c7a", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610345, "uuid": "cdbb89a8-3210-4ce0-9a9f-97c8e73f2bcd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610345, "uuid": "49e1b2d7-902f-43f0-8fe3-bd3b702f4a3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610345, "uuid": "f22b6ced-b91c-4e71-8e8e-488b47c1190a", "value": "2fa60bdc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22d3a00-ba88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638290, "uuid": "87433a67-15ac-4dd8-8495-1d2b217e24c8", "comment": "Malware payload (Dridex)", "value": "c85e6fd9a609bc16304d2c7d818de121", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638290, "uuid": "19aaf626-76ed-4065-8a96-9098ff5008e7", "comment": "Malware payload (Dridex)", "value": "29b2ff29e7e90d89cf31a09050fb9066929536e89d104b61e557ccb7898cc8cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638290, "uuid": "8749ef44-3bb8-4408-bb90-4b74a0d6f59b", "comment": "Malware payload (Dridex)", "value": "ca70be8c10bd35644d89596f0027d212e5dbeebf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638290, "uuid": "d2aec46a-9935-4526-82c4-f0afb5292f33", "comment": "Malware payload (Dridex)", "value": "de19db2add7cb5de2ec1d3dfc1ead2cc3496b1e5cb3b883e0b990e78203cacf69b3204bccf589741a1f51c6b6a0921e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638290, "uuid": "e4457f85-a2b3-4caf-989e-2a13e11ae6a9", "value": "A4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638290, "uuid": "03212aca-d525-4513-bf9c-cf52829c707e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638290, "uuid": "147e4fb5-d8dc-4fbe-bc5c-53348d2db6e4", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638290, "uuid": "dcb214f8-2a80-47ed-a1a7-7d30b277a66b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638290, "uuid": "4896217a-7cf9-4904-8ab3-f551f1e1cb29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638290, "uuid": "535a013e-889a-4da8-a3bc-e211814e8c77", "value": "c85e6fd9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6969f5-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559545, "uuid": "eb35db97-72c5-412c-98c4-2d962278973d", "comment": "Malware payload (Dridex)", "value": "c85e1fc6288189caaa6cef0770538a6f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559545, "uuid": "ee53c8ea-e507-4cf6-8e22-fa59b749ebba", "comment": "Malware payload (Dridex)", "value": "29c0efdefd1252fb8edf72df1772eac0dc68ab768519f25d2bdba4958e1d0082", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559545, "uuid": "d332cfc9-bbb5-498d-bf45-c7162b5dbe0b", "comment": "Malware payload (Dridex)", "value": "39a6b09a6aed8a6c947abe73efde8f8a643ae545", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559545, "uuid": "2da5d9db-a5ec-48ee-bd11-b7ccadc159cb", "comment": "Malware payload (Dridex)", "value": "6f21ae43df63887f7bc7609317f4ca59198b7cd63cb7e30978e58be410c2785832c07ce25d463d8b676557ceb69315a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559545, "uuid": "6b7a8c37-2657-4375-97b2-2af09b2c45e9", "value": "B004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559545, "uuid": "6a03ca5b-d722-41ac-a1ea-3b968bc34e0e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559545, "uuid": "1dad5903-8b47-4e83-ac1d-5b4376d26c41", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559545, "uuid": "5f0d8cb8-0080-4a16-958e-ad48c50778f3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559545, "uuid": "4f8cdb87-a46c-41c4-8801-0346fb345c65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559545, "uuid": "de5e9e3b-96c5-43b0-ab8c-d2db1cb64927", "value": "c85e1fc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae63a93-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609341, "uuid": "7426983d-67ed-48c9-9ff0-816fc79154eb", "comment": "Malware payload (Dridex)", "value": "72a3f849c61cec83590a91ed13f2c4a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609341, "uuid": "894e4e70-705e-465e-9d98-c1210ded87a2", "comment": "Malware payload (Dridex)", "value": "29c1993d8ce39ecce431ccb44691e13bd9b937bbae11360dcd7ba672cea5925c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609341, "uuid": "0c3be6a4-8915-4bec-aa06-151f2ad17c9a", "comment": "Malware payload (Dridex)", "value": "8950d66245bad0384ebbb88f93159874a0f471fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609341, "uuid": "48705421-6e5e-4582-977d-56a6477215cf", "comment": "Malware payload (Dridex)", "value": "03d5615be39791692ddab10a18533bed1d335d2416fde96c674a12659b2494f0ec3f62660ecc5f95a078245f1f6643bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609341, "uuid": "8b74d847-ac47-428f-95e6-47e32e998209", "value": "E204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609341, "uuid": "1cd1e0d1-ed98-4539-877f-aaae0c0c018b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609341, "uuid": "27e92c96-cef7-4be9-9563-055af273c5a7", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609341, "uuid": "d9644e39-7fd8-425c-873a-2b7da0ecd9a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609341, "uuid": "e9ca0f97-5ee2-4dcd-9402-6cff2492c5bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609341, "uuid": "1985df47-d430-47e0-a02f-3d1cb34ec179", "value": "72a3f849_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9902b54-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573824, "uuid": "796e1484-66f6-408b-aa8d-4e909056ea98", "comment": "Malware payload (Dridex)", "value": "4d002c9bd49679ceafcc6113689ac979", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573824, "uuid": "d50e5b82-5269-4059-a67c-facecb335380", "comment": "Malware payload (Dridex)", "value": "2a038f4988faab30fa7a3a557428182ff9344fec5f88154dace4dabdd9afb974", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573824, "uuid": "f3080999-9ec5-40ac-a7d0-c16ee6013cfd", "comment": "Malware payload (Dridex)", "value": "4005c39ef927a49fec8e733f1f949c0e84d347b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573824, "uuid": "b260a96c-656a-4fbb-a10e-b3e79dfa85eb", "comment": "Malware payload (Dridex)", "value": "21a22b7c8a06a1b7a26c5ad2c91e9eb6b75ed69c02ca9e6c7c1e1cd77c13bb2116b72bcf31eddf343da4d905e79e61e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573824, "uuid": "b5fd7de2-730e-4f63-893a-b89073d40acd", "value": "B104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573824, "uuid": "0071a34c-f8c1-447e-b6d9-051b2f7971e5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573824, "uuid": "4c5b4aa2-8abc-4020-b34a-4ff80ffbcb36", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573824, "uuid": "6333709b-3eb4-40a8-8578-920d7de649d4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573824, "uuid": "b6f13d20-08e9-42d2-bccc-fe404538743e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573824, "uuid": "706e6b83-b30a-4d26-a994-c752232e49f6", "value": "4d002c9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6924be04-b9db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563757, "uuid": "3a21b91a-1403-4132-a35a-e977b3065335", "comment": "Malware payload (Dridex)", "value": "8bc481d22797c08e88aa287a45cdc7f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563757, "uuid": "18b9e2c0-3468-415a-b9ef-406fb9dd93a9", "comment": "Malware payload (Dridex)", "value": "2a05c3827b6ec7ec023c5aa6d78bd68d267a5bf59a402cbdc346302660c7abc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563757, "uuid": "1f23aff1-8b0d-4f01-995d-7b129fb75239", "comment": "Malware payload (Dridex)", "value": "2520b89a8d2165d249549483d2652db687955a71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563757, "uuid": "e755bf96-bcb8-40a2-98b2-0da094ce1ce1", "comment": "Malware payload (Dridex)", "value": "f5c787d4fac09c2bc1e7a643fb53e3f17481735bb3dc62b045081ded5027125492c84bf51804a8892cbd0350bc0001d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563757, "uuid": "f698fd71-c936-4675-9c7b-e3193024418a", "value": "FDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563757, "uuid": "c8a5bd7e-9160-43d3-a7a9-31edde26eb9c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563757, "uuid": "e2f6f65f-3c7e-4ff5-9fb6-3d521614893e", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563757, "uuid": "a6a64892-aac2-4876-9676-ff6a8f24ad70", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563757, "uuid": "71b45d16-0c18-46ee-a5e7-7429ae2590c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563757, "uuid": "8d068f08-c7c8-4da4-bae0-059a778f6423", "value": "8bc481d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44cb9ab-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634804, "uuid": "8792b226-5ce0-42cb-bec9-38afe15d4928", "comment": "Malware payload (Dridex)", "value": "5891fdc255d140f136891b60c7843fe0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634804, "uuid": "0b549a9d-cc93-4eae-ab70-d7a3314fe207", "comment": "Malware payload (Dridex)", "value": "2a0b294ab55b72fe1b867f8b3f4cb11816e14153f9583d3ba1b2f6f0b9b441b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634804, "uuid": "860a4baf-9b7f-44c2-8b4e-e5ef536a6388", "comment": "Malware payload (Dridex)", "value": "403c4df7ca3621916f909bd06db98846feca053e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634804, "uuid": "a5f05aaa-146c-42ac-891e-8c57bec67ecc", "comment": "Malware payload (Dridex)", "value": "3749fa62c94ce43f77c6c6a365607d7eae062fd4b194f22a244d0f6c262b36497e34896fbe0b731191e91cb6b9cd0313", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634804, "uuid": "7bc14c22-69cc-4597-b72b-38360c45d01e", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634804, "uuid": "fa6e2734-6615-4dc8-9888-d35b2e9b4ab8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634804, "uuid": "e62a6449-c3f2-4da0-a916-a2216ad1c6c2", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634804, "uuid": "6ad67290-ba70-4f55-95f8-f6cde35cea90", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634804, "uuid": "779f22d1-939c-4742-a656-7371b91e42a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634804, "uuid": "be1b8c59-bb05-469d-927c-74aa7cad650b", "value": "5891fdc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effa2295-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621612517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612517, "uuid": "800aa4d3-10b2-4d12-b75b-a2014e462c7f", "comment": "Malware payload (Formbook)", "value": "9729c60b4184f3fc15d1d9f834836923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612517, "uuid": "9ffe2318-c79e-481b-b781-afe3232786e7", "comment": "Malware payload (Formbook)", "value": "2a526051ff0dface495696af4bb9a540ced5d608e777625da8d456fda8888ac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612517, "uuid": "96e1456f-cb4a-4e69-8c9e-63ede0ddcacc", "comment": "Malware payload (Formbook)", "value": "78f0ed8bf5c47f995bb0c3efb06e50d05741c749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612517, "uuid": "1a51f0cb-623e-4779-8901-504d56cfca37", "comment": "Malware payload (Formbook)", "value": "6c882a82e8c56e6987f7b01c898280edc3e944af6c5a2819b61e7a7140b789689555ce8763857e976356f5754e29a6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612517, "uuid": "e9d83f3e-02e8-415e-a4d3-aec1cbeaa018", "value": "3A75F07062856DAFCC7E2630444C5184A3FBE7433B16DB8D7CD4009E6A99B56CB327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612517, "uuid": "eddaa372-b147-4146-80f9-48db18e63d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612517, "uuid": "d2dc1c30-5999-4327-ae91-30dacfad1a64", "value": "49152:hs5LzdMOx7FxV9/DfEbAS/kVAaRSPxBM1NZv:hUX7nn1WJkCBPMHZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612517, "uuid": "0a6b0b68-1d69-44a2-b8e5-931872c4f8c9", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612517, "uuid": "53a16b4c-05d2-4707-a38c-e9de62645863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612517, "uuid": "6ff5e89f-8237-46d5-af69-cdc80289df56", "value": "Order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e708c56-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573269, "uuid": "4c7a59ec-6077-4528-afd6-8bd50c9be3e3", "comment": "Malware payload (Dridex)", "value": "b83d5f9503d58907a2f1fae995d982e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573269, "uuid": "80c9071c-a8f6-4d9a-8774-3d15136adfe9", "comment": "Malware payload (Dridex)", "value": "2af96d495844998afd4a14aeff93ab25027fc82324a6a4dddab56e09050e694a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573269, "uuid": "eb3b2262-d3a6-4c3c-92dc-10be11d7411a", "comment": "Malware payload (Dridex)", "value": "3f283a3c6b255a85616da56dfa1a5448d0dbab00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573269, "uuid": "c2452dc0-7df4-487f-b780-90dcc7b209fa", "comment": "Malware payload (Dridex)", "value": "f129ada12ee954fb8ed401414ba809db3f9a2346a5e0ddcf8c46b12e0d1b73e4c4df367b7004fb5b58178019e4329822", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573269, "uuid": "a3cadafd-0c6c-4cb2-b42f-93ab2ba0566b", "value": "4404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573269, "uuid": "433ff75d-c662-4978-bb22-d7be576dfe3c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573269, "uuid": "725d5740-5517-47ad-8fa9-d76665b908e8", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573269, "uuid": "6497d11c-12a0-4beb-a1cb-b45dffe10fab", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573269, "uuid": "3247fee9-5218-409c-b7e8-11542c5219e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573269, "uuid": "58cb948a-7177-4b43-826a-ee1d9816d64b", "value": "b83d5f95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfe85ed-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575657, "uuid": "853bf496-f07d-4c9b-a1a4-b81a358f684b", "comment": "Malware payload (Dridex)", "value": "60d8921dfe272584982ff816d9ed2378", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575657, "uuid": "c8e0b793-02b4-42bb-bfbf-f1cf6fff5e1c", "comment": "Malware payload (Dridex)", "value": "2b00969ed1cc43c09cc93095adf0ae71a607f61a4c046c2ab8b6e32c4cd3b0ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575657, "uuid": "32a86d29-8c24-41dc-afae-228fa65ff90b", "comment": "Malware payload (Dridex)", "value": "05f0ec5e9f2b3f941b2859f538f2b5e7d3d4e331", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575657, "uuid": "1274473e-0b91-48b5-837f-06026db0415f", "comment": "Malware payload (Dridex)", "value": "90ec50cebebd97328afe01381ddbf7a92349307b337ded0e63ea08cb69b4c6bdb9c5b12e7645db62107fe29d64592a83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575657, "uuid": "5a24897e-4b07-427c-b910-dce6c8a252e2", "value": "0C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575657, "uuid": "b17b5123-06a4-4b77-aeed-f769b778d264", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575657, "uuid": "b278529b-bdfa-4c00-a23b-e2756556f2c9", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575657, "uuid": "444377a4-e94c-42c4-ae19-3016f84a0954", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575657, "uuid": "9c17e08c-a1e3-4fc3-9056-851acd959cf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575657, "uuid": "11e2daef-aa19-43ae-b000-f552be8bdb25", "value": "60d8921d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4e14c3-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571841, "uuid": "007788af-c673-4a05-b06e-5660cd4e993d", "comment": "Malware payload (Dridex)", "value": "e46ef6e420a4d82e4b803c75ecd72bad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571841, "uuid": "fcf0dd51-ea51-4ae8-b17d-d28696426d3d", "comment": "Malware payload (Dridex)", "value": "2b20ba74f75283a80e299a9b9e792ed2f5361b06bb6045dec0308b2c68fc8dd3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571841, "uuid": "bdef51b0-05e7-49b7-9c1d-6e2f80d83591", "comment": "Malware payload (Dridex)", "value": "9dae6ae0c7b9f3a5b9f1ea11b483b7661e5d0dae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571841, "uuid": "0ae2b14f-8407-4367-8d93-1eb7fd90a85e", "comment": "Malware payload (Dridex)", "value": "730f98f54a39ff890b5b74b1b50033141acdf08045e6af32fe4a429ac5a73ac3084ab5460704145395ab1c1f87e5ec96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571841, "uuid": "7ad0744a-c267-4488-b024-2b3eaa992c52", "value": "F2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571841, "uuid": "499c3add-a78b-49f5-b3ff-230ccb74a7c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571841, "uuid": "1d9d40df-ab44-4995-878c-de3fde94d6ee", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571841, "uuid": "177c636e-4341-45f7-9a2e-a19349ac4aaa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571841, "uuid": "6dfbe834-64fc-4ecf-a1ee-433210db52e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571841, "uuid": "438ec09b-317c-42e4-91a4-9876b90f6a17", "value": "e46ef6e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c1c2c9-b9e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568122, "uuid": "8c11aa18-3ee0-47f2-8df0-2b80d9791e58", "comment": "Malware payload (Dridex)", "value": "577e06b1474780e326a9f32dc6c5a61f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568122, "uuid": "4153f3e7-24d3-4903-8264-8b53d1f9e71d", "comment": "Malware payload (Dridex)", "value": "2b38a774b2bdedb97051cc50e894fe03ef43e2bf23ba29ef5a5fa6b1b6954e23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568122, "uuid": "a51944a1-0429-4a3b-8942-2552817628fa", "comment": "Malware payload (Dridex)", "value": "f1c7c3688482b9c9b963f37e7b2fd72791659a86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568122, "uuid": "4ba8b2c2-e482-4e9d-afe9-a5643d8acd55", "comment": "Malware payload (Dridex)", "value": "541f396df3de223485d6686a9a4fa85a34d606b4ff9f428a953acb6a7f49d7be3eec7fb711bbde8646ffe8c94053ea82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568122, "uuid": "6a35eb1a-b00d-429a-9afd-c2d475076e27", "value": "3C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568122, "uuid": "37988331-2ad8-4912-ba5d-50ace82dbcea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568122, "uuid": "b0f8a9e6-3c9d-45fa-9ea4-fdd626c379da", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568122, "uuid": "3c8a1f20-ab45-49d2-aa46-4702b6eb5125", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568122, "uuid": "3fdf98d2-dec2-4c6a-b63e-a064f4c7d5aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568122, "uuid": "e9c97a45-d458-4088-b538-dc16ff6b11be", "value": "577e06b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592b5cf-ba2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621598890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598890, "uuid": "6036f996-ffc8-4397-8f7a-2efe64dc7ef8", "comment": "Malware payload (Dridex)", "value": "683e784dcb4cc2b98f389374245fc8c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598890, "uuid": "dd3f9ebf-ba51-4c0a-bf87-ba46a0c8bb4c", "comment": "Malware payload (Dridex)", "value": "2b393080f9b97d9072c98192a0e749545323cf69b375cb000c354f0a4f6a9c50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598890, "uuid": "028322b7-89c6-4f04-a4f9-dbd898b77a18", "comment": "Malware payload (Dridex)", "value": "d7d98a5853b23acc088e30277c6d0279c33d5256", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598890, "uuid": "ee1a97cf-141a-45bf-8558-ed261c8b65b3", "comment": "Malware payload (Dridex)", "value": "71c35e55bcfe420be5fc10919637c346a339c889f929877ed68f4b2d874db5edaddc0caa9cd1d2d221491fdcf0daf3d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598890, "uuid": "dc194b8e-73ac-4cac-8cd7-d6f1d3c9dd98", "value": "9D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598890, "uuid": "945eb3be-3e00-4deb-81c2-cbde2dbc1982", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598890, "uuid": "b9ee82bc-a566-42dc-a848-d3a5e38b8b2a", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621598890, "uuid": "4ada50e8-cb65-4f9e-b20a-22fa1a684ca2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621598890, "uuid": "64660f55-1750-4ba4-8ce3-e5a762184812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598890, "uuid": "07ecc26a-5350-4e98-9264-aa45e4db0f25", "value": "683e784d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5215e842-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573168, "uuid": "f942f128-327c-4446-9224-535868560e1b", "comment": "Malware payload (Dridex)", "value": "30c445fbb93b18f0bebdd8052b5b1275", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573168, "uuid": "6341188c-058f-415f-afe5-e4a734b1137e", "comment": "Malware payload (Dridex)", "value": "2b770671b284884b2b1c93d845c54acc5774eaf36fdb120cc1988d98685280ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573168, "uuid": "190af11e-9b8e-4ecd-8910-8bdbe3f07039", "comment": "Malware payload (Dridex)", "value": "9ecee9d33c12cf194974210a3480ee8b592b0a87", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573168, "uuid": "a82b7ff1-43e3-4870-b51b-1aa42495f471", "comment": "Malware payload (Dridex)", "value": "c49a30ed9becd8bacfc9d36a3a85bb987f3bc462b066b6fe4e6ee478d80b3188cd41a87370c14490b7c09ffb2af42a5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573168, "uuid": "1d1ef149-9a83-4397-9a69-8d48245eb003", "value": "AC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573168, "uuid": "0a37f2f2-bc6a-493e-82d2-cd2b0523115c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573168, "uuid": "1e986fd8-874c-4c47-848d-3db5d2f160df", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573168, "uuid": "cd969860-a6fa-49cd-97fe-c0e40592d810", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573168, "uuid": "18f29a70-fefa-4f4e-9a29-1cc6b5a440be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573168, "uuid": "590acfd8-3ccb-45f5-874f-76f72353e329", "value": "30c445fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034368a9-ba5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621618562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618562, "uuid": "e3330139-4401-4c16-845e-8a5634f26a59", "comment": "Malware payload (RedLineStealer)", "value": "f0db487d045d10b26d1c56ad37394689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618562, "uuid": "8b37b334-c3ca-4a2e-b823-112bc3ef55cb", "comment": "Malware payload (RedLineStealer)", "value": "2c00e86dbb2ac6b2b8cb19ab454068bb8621c8f2069535451b5794896793a610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618562, "uuid": "2c4685d1-31b0-45cc-a1ef-e19bef74ff87", "comment": "Malware payload (RedLineStealer)", "value": "11ef74160cbde27369a37db4d92ad2243e71ad55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618562, "uuid": "6740c039-fda5-47ff-8954-e594b02f1bc1", "comment": "Malware payload (RedLineStealer)", "value": "5f42349e16f6a3c3d7cf58c644939f122eaefc71763ea1d8f3acccee9968a1c3a3504962c9e6e75acd6b67ab7be3910f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618562, "uuid": "8a58a98d-b696-4193-9a90-8e5dec645a03", "value": "2D1629F13B0BD2DFC24644B4F401B987D52413E29A69AD40DC7978BCCB52CAA25CE79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618562, "uuid": "feacd852-1e5f-49c2-b720-c9e6f4d94596", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618562, "uuid": "29d68c18-c81b-4dfe-93ca-4b690b4c4595", "value": "49152:4ebSAAcfRK4e3/ri8n24h0i/Vf7/0gWvB1qoFbjOtm+/0Ma395E:Zle3/ri8n24h00Vf7/0gEPqoVjOtf8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618562, "uuid": "1a07cb1a-9722-4d9d-960a-e5f1ef8854f0", "value": 4139008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618562, "uuid": "8acb0e4b-8ed4-43d0-a4d2-7379ceaaed8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618562, "uuid": "007319a8-4be9-4b26-812f-f966d6875137", "value": "F0DB487D045D10B26D1C56AD37394689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a014dc7-ba79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621631458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631458, "uuid": "a4b34323-9355-442c-91b9-18d3916c3532", "comment": "Malware payload", "value": "6b23cc8579e4837f48b229074e933d1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631458, "uuid": "45bd8d8b-5e32-4c20-ad5e-c3383e990270", "comment": "Malware payload", "value": "2c28df3c62cedbed0339155881b0ebe7819c9516f20d85f57c9be608046c6627", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631458, "uuid": "eae78b8a-180a-4409-9441-ffc6bf211ca4", "comment": "Malware payload", "value": "1cc24ae089c3bb0c94d7ca155c16b1c9c6282141", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631458, "uuid": "38af559a-a246-48fd-9550-73df41821848", "comment": "Malware payload", "value": "8303dad03c500dd3da9123a50e2f700746c95cc0550f39a81248fad8ab4e9668ef7b7a2953d176a3eb3a253d717b3dc0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631458, "uuid": "db407d34-12c9-4a03-94ee-886f332b6843", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631458, "uuid": "7124ddd9-b7ec-460f-ac4e-bd686742604a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631458, "uuid": "d566ccbd-a6d5-48e9-beec-f585b15cb251", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631458, "uuid": "8868b563-eae3-43f0-81bc-53ec9371b4cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631458, "uuid": "00035a66-6f17-44bf-b26d-c19bb8fb2120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631458, "uuid": "beda425e-2da8-427b-b7cd-f3f77d61d133", "value": "6b23cc85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47a10ee-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1621618510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618510, "uuid": "b686a879-4781-44ad-8727-c4b9536a22b7", "comment": "Malware payload (AZORult)", "value": "907bc9c2c15cffa571224ab54f5734f6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618510, "uuid": "9ebccd2a-5b99-4250-94ee-0abee6a93aba", "comment": "Malware payload (AZORult)", "value": "2c60a0b2c0d0f79d9c6833141a65886d194228405e5f7b6fac91eff9becde79b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618510, "uuid": "c62ecdde-e510-4626-8862-cdc7740194ca", "comment": "Malware payload (AZORult)", "value": "00d230f3f4a447c473d9b8fbcdb4a39ba276c2d6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618510, "uuid": "7fa36978-fa72-47b3-9433-d0bdc87f90f9", "comment": "Malware payload (AZORult)", "value": "d23bb2123c18fcda3ef6a2e2ca3f4bac0645eeb1061ff9ebf36ed2a6016c50114f6cc221aa4d4179836318f231017d96", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618510, "uuid": "d456b886-aa4d-49c5-a468-c532c959e7e5", "value": "7DA4F15072F95713E4FE23B9497172000BB5741BAA21F32D5ECE62CA1A73B828B15F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618510, "uuid": "96759ed2-b4dc-4382-a704-608606b644a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618510, "uuid": "37baea4a-25fe-4d5b-b4d7-ca88728eaa1b", "value": "12288:R3xN2/rjBnPrWJ6Us9W2COQ2g+tS+oz4uk0V6FX:FxNiho6UuHlg+c+uUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618510, "uuid": "e539ac7d-518c-4afc-9514-26c60938e14e", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618510, "uuid": "548ba4a9-d4cc-4ef4-963c-88049b8b3056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618510, "uuid": "0162ce05-98ac-4332-b751-a71451b83514", "value": "Req for Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435d4a29-b9d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560258, "uuid": "80b20d7d-9688-43a7-9730-1d5ba3de0596", "comment": "Malware payload (Dridex)", "value": "860136d8110d8af1d231e8dea6f4b69e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560258, "uuid": "afcac5df-ff02-427f-9e44-8524fdb54476", "comment": "Malware payload (Dridex)", "value": "2c64b97a042540f386c709602e89472730f3d5432f71abccd1c41f80858f8126", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560258, "uuid": "5b2a5e43-150e-4853-bb24-c1b4cada366d", "comment": "Malware payload (Dridex)", "value": "381f293c69fbb430f16bb58a567dd1c215ab8073", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560258, "uuid": "621f1ad2-61f5-44d4-bc20-14bf61eab53e", "comment": "Malware payload (Dridex)", "value": "690c0807e99a24c71e05718c2bce6894873879a8847f272d4c877fe1f42b40e3c0b4cf4005c1493f8e9148e4c8a238e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560258, "uuid": "6c73253c-b4b0-406f-b413-2359a989c47c", "value": "BD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560258, "uuid": "7700dd4c-d7a4-4b7c-8225-4911df2b2d56", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560258, "uuid": "5a9db11e-11d6-478a-9216-a2b6f4a36eac", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560258, "uuid": "ac9742dc-4339-4d98-a02c-e1ff10c86673", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560258, "uuid": "7d0781a4-c00f-4f63-8a9e-cf0689685fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560258, "uuid": "9b69016a-e265-4989-a2ca-e6646cab993b", "value": "860136d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180bbe81-b9ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558038, "uuid": "05c1fbb8-42e0-4464-b423-7a05f7d04806", "comment": "Malware payload (Dridex)", "value": "ae659d7b3c8a65a1e81a92197c809037", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558038, "uuid": "f965ed10-d6cc-443d-be33-52692a7a8dd0", "comment": "Malware payload (Dridex)", "value": "2cc964abaa9bcea3cd118c211e2e80512bbd97c05b0e9643a34e548050ad6037", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558038, "uuid": "412f6423-dd33-429c-8391-1257eec43240", "comment": "Malware payload (Dridex)", "value": "0ee620917f27fe197878cf3953ea0fc7222a10d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558038, "uuid": "c5a78dfb-0894-4363-b8f4-e66f7757e108", "comment": "Malware payload (Dridex)", "value": "d5a3f47ffcbe832fab545080f5aae0e8033d68c59ce828dfa38ec3b16d5afcc05d310f64774c09362a70415415022825", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558038, "uuid": "7552655f-a006-4c8f-94b7-10b797f70321", "value": "A804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558038, "uuid": "e225066f-92a6-406f-8eb5-1001c6e77f79", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558038, "uuid": "c4076a45-23c5-4663-95af-e7329052cabc", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558038, "uuid": "f2f1c356-ad07-4dba-af6b-5ea228801060", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558038, "uuid": "055e8a67-b8f6-40a9-8eb4-de88c297a3b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558038, "uuid": "87ac8645-0532-46fa-b965-cba1766d976f", "value": "ae659d7b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf87227-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580380, "uuid": "db351645-304a-458a-8a79-6cf133341c6e", "comment": "Malware payload (Dridex)", "value": "1605d921c0e30657db3d8a8aefebf16a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580380, "uuid": "bf0b427b-71dd-488b-ad8a-d283408eeb96", "comment": "Malware payload (Dridex)", "value": "2cd529d34ee5bb6d691b575cf2b2b9463ec92f836af92b66d60d3d2266ec1ab6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580380, "uuid": "55b495bc-cb5f-4643-b394-444251963125", "comment": "Malware payload (Dridex)", "value": "0b8bcc94a7b878d4c85e3456bfc0966cd9df8605", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580380, "uuid": "2b54f784-5ac2-4735-8f39-bd1a7152a510", "comment": "Malware payload (Dridex)", "value": "bd4e4fb0880cb74eb168ffe43b0d178dd00ed4dce31914aca772a630d27f5ed78b23b77a0c2ab41faa8dec719cbfc41b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580380, "uuid": "d9d147a5-0e75-4732-b145-2c2eba140bda", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580380, "uuid": "13b99ec4-2fe5-46a6-89c9-c88076d9357c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580380, "uuid": "e860873d-db10-4e26-9f36-76322054d1ea", "value": "3072:6V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:6V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580380, "uuid": "d9238c4c-c975-407e-aa20-026a105251dd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580380, "uuid": "a0d5547e-a5f5-4e87-a9bd-a608384da9ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580380, "uuid": "24e13c2e-6fc1-4bfe-a753-08b745982eef", "value": "1605d921_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4408f650-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621578298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578298, "uuid": "1e351fc0-9d04-44be-b330-608b07ded3b7", "comment": "Malware payload", "value": "5ff50bac624822c216da96577b2a0c0a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578298, "uuid": "730092b9-023f-49de-82af-18376791da79", "comment": "Malware payload", "value": "2cdd65a3b889cda978747bc8787b55d6a4f5df81e6aa14cf49102262cfa77380", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578298, "uuid": "c58d108b-31fd-43c7-8e19-deec7e6a7d7b", "comment": "Malware payload", "value": "fa4df3d9d18e856a4156a08aa8fc3e6393011d99", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578298, "uuid": "a26c668b-804e-49cb-859e-76908e1d4720", "comment": "Malware payload", "value": "8a348776f16a7ad8bc36448919220eb3b726b32711cad5bf6d28b0ddff7cfdec069fc133909b821aad7ce5f462ec7570", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578298, "uuid": "d97ed595-cc14-4f57-bc6c-75ccaa3b4260", "value": "50910BAA1B441853D667D5F4C8E8BF0508A2FA6AA2CE13C5377DF4B007371A4BB72587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578298, "uuid": "41bca299-073e-4b93-b96f-16fc0a9c54ad", "value": "96:3qThkTNc9h9K0RvWA8S4WmdOCJkyUWp91E:aT8c9jFRjPwUWlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578298, "uuid": "a4725f58-0748-4732-8ee9-1cfb8fbb8650", "value": 4243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578298, "uuid": "6bf90c6f-758f-4924-b54d-d55cc94ccfe9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578298, "uuid": "54a1b1a3-b4c8-4515-8d54-42d33b413bbb", "value": "DOC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4682dd-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565241, "uuid": "51101517-a08b-47f5-8770-206d8f414300", "comment": "Malware payload (Dridex)", "value": "e0617350d78b9056bfe2986a8ba90624", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565241, "uuid": "6b654d6a-201c-49e7-bc36-692a7143dd0b", "comment": "Malware payload (Dridex)", "value": "2d1492537c992c513e3e46ec0877614b364e78806703a652a02e5e8b29d46358", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565241, "uuid": "4fd1a89f-359f-4909-8dfb-e91a5a5e1b6e", "comment": "Malware payload (Dridex)", "value": "522c55df95d002a5f28601a299ebbfafae2b0a29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565241, "uuid": "2a79ed12-afd5-4bfb-b98c-d18ee0e3c3bb", "comment": "Malware payload (Dridex)", "value": "6201e0014e7c1f113dab33efca9295fc23ae5aabb097af4d5a146c54297b10cfaccbc4fb7ef5891039bf4c53b09f6520", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565241, "uuid": "8ccced89-4aee-4cd8-bcd4-0cef241dfbbf", "value": "3604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565241, "uuid": "7c0dfed6-312f-44cd-98a3-2f12b87d11e0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565241, "uuid": "c9bc5813-66f0-464b-820b-9ac9d29cc8fe", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565241, "uuid": "04408a3c-3ba3-4ec4-8e7a-131d6847163c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565241, "uuid": "be620a7c-df4e-4373-a1e2-4e9c0c325080", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565241, "uuid": "b1238354-aa81-433b-bd18-875eb88993d3", "value": "e0617350_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1dc9d6-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577157, "uuid": "352290fe-5888-4adb-acc7-62881b833b03", "comment": "Malware payload (Dridex)", "value": "6418d5455a42e3de72e5019431384a8e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577157, "uuid": "6ce42b70-e04f-46a0-a987-5c4fa00ebf71", "comment": "Malware payload (Dridex)", "value": "2d4ad50c37d80394589c6c1e40a5df33cbf82d0a7d3f0c68713b380b99dce690", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577157, "uuid": "eec401c5-21f2-4ed8-a70c-782bf1f3ec5b", "comment": "Malware payload (Dridex)", "value": "aa532909eeb873d2a54d29edccbdc8fa2ca95835", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577157, "uuid": "51ce9978-f5fa-4fe3-a4a7-e500de66f664", "comment": "Malware payload (Dridex)", "value": "7fe9dd2359be07400a39988bc7e4ebed397882538c9a574aaa7fd6b418389d4e2d3272c08a185ae65709a3d73c898715", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577157, "uuid": "1c037993-1dc7-450f-8d93-d107ce661251", "value": "79F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577157, "uuid": "36bb424a-e593-4796-b15b-1b950984fa32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577157, "uuid": "dc893973-80b8-4f81-8d59-2f1e9f8382cb", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577157, "uuid": "81e702d2-c430-4180-b0cb-d5ee646b5863", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577157, "uuid": "0ba60fa3-af95-45d9-b069-2bf5a7457666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577157, "uuid": "6cb7ea1b-3fb6-445d-9d5e-e2b349289897", "value": "6418d545_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75a959f-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581578, "uuid": "55a83771-e1e0-4db4-a51f-93e010b811f6", "comment": "Malware payload (Dridex)", "value": "3e183f343ed4e9e3197892968d73c3a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581578, "uuid": "cbdf9a64-3629-4c2c-870d-55cf676ff616", "comment": "Malware payload (Dridex)", "value": "2d51cfc41cae08d6717d5528b443569fd56ffdb8942d22544615cce0d5a6b69a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581578, "uuid": "abc2f672-0a81-4db7-8351-fed41e19ca05", "comment": "Malware payload (Dridex)", "value": "9ff018787b6578182cd548e7dc8cce4c97fd1432", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581578, "uuid": "3348b860-a356-424b-9c24-9153e423a353", "comment": "Malware payload (Dridex)", "value": "cf0f2e8ee2b9f502688fcc1af999b85ceec271a02bdd939f2084b72a14afd4ff8e38275c92f6be7ece7dc3d8db40d02b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581578, "uuid": "665b8cc1-7350-49ae-ae8e-2d3ce65402b6", "value": "46F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581578, "uuid": "4aff2ed6-ed08-48cb-ac34-4601f986f299", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581578, "uuid": "b72a414e-f529-47c7-ab6a-1995dfd4a80d", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581578, "uuid": "ff325b08-8d2a-48ad-9742-906f3f54cd64", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581578, "uuid": "71f933a0-46d6-4317-94e7-308e3f5ac6f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581578, "uuid": "0007882b-77e0-4484-99e9-ea9fb8e3c88e", "value": "3e183f34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e0c3ef-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613334, "uuid": "64ada100-5bef-4a11-b7ba-01218b2bdf37", "comment": "Malware payload (Dridex)", "value": "d02c59208d8a20879a9a4e66e2594046", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613334, "uuid": "1e245db3-6a3b-4dbf-a8cb-5c8b1fc49ac5", "comment": "Malware payload (Dridex)", "value": "2d59df0120598087d6ea66b36f65325b4b4bbcccb83defea8c3b15eb787871b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613334, "uuid": "480327ef-b480-4ec2-9037-76c26582947e", "comment": "Malware payload (Dridex)", "value": "40cf14f8f0041c008ae58a193f7d97a4a99d01b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613334, "uuid": "397531c2-ae8b-4e99-a625-e85d1045775f", "comment": "Malware payload (Dridex)", "value": "ba82c7834456c6c5020f6e9528badf2b4d69de3443931b7f3095d3d9734b481750cb9d9a42514cc502e9113dda242df6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613334, "uuid": "a26a4eed-66f0-452f-8889-1e2f8ed51e95", "value": "E004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613334, "uuid": "7ff5d48b-03f4-4453-9fa0-9bf35a018eb5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613334, "uuid": "2b58597e-6846-4c19-87c4-b8b33318d569", "value": "3072:AV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:AV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613334, "uuid": "fe631b9a-186f-46ca-a104-dd00e32bb7bd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613334, "uuid": "b9ab18bd-a4ff-4fce-9a8a-8edee4b63862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613334, "uuid": "ddbcffd2-57ef-4ec0-bc24-cd5ef1c3979f", "value": "d02c5920_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93101a7a-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570700, "uuid": "654a467c-caa1-4801-ab82-993335cafbc2", "comment": "Malware payload (Dridex)", "value": "7161116456e9521b3a91e395d670ca3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570700, "uuid": "ef63485f-8050-42f5-b5ca-bf575c81c85c", "comment": "Malware payload (Dridex)", "value": "2dc6b0666d689c2d2cda2bb3f307906af94e272ea23ba636538d8bff9528494e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570700, "uuid": "c7667f3c-81ea-4b42-a79f-66b65f1c561d", "comment": "Malware payload (Dridex)", "value": "21e227dbbe5a288321e6d8fd063c0cef28160be2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570700, "uuid": "665d3d51-14ef-47ae-9a5d-f1d7d523119f", "comment": "Malware payload (Dridex)", "value": "fbf50b021119207fb701b41a525285cf3c138565ff3d365bcf3f60dbebbb423b71842eb743aee2985ddeda803258ae82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570700, "uuid": "029897de-9a67-47dd-99c6-16317890f0b3", "value": "F3F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570700, "uuid": "a219d1bc-ce71-43cb-be1c-12bce6a4aa67", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570700, "uuid": "c0340867-e969-4b25-8c2d-30f60e6ac08d", "value": "3072:D9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:D9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570700, "uuid": "1e476ab1-d616-476d-b981-06441524b9a0", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570700, "uuid": "75e761df-eab8-434b-9d14-af133741978d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570700, "uuid": "ecacf735-2646-435a-9eca-94dc5a33973c", "value": "71611164_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9ddea7-b9ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558344, "uuid": "c7e94728-77a3-4392-b6b5-d4c998cd1838", "comment": "Malware payload (Dridex)", "value": "74393efdc57ee217c669a25a68b0c9f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558344, "uuid": "ebcb7583-963a-4dba-94fe-edeebdfe9382", "comment": "Malware payload (Dridex)", "value": "2e2b4eea4bee705e7308c81b8bda4eb87c603fae82e3af1e563a6e6f535a60d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558344, "uuid": "eb1069f8-c9a2-41d4-a301-0b7240d44444", "comment": "Malware payload (Dridex)", "value": "e461b101efe704e06291fc45aee9061ecb7e0954", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558344, "uuid": "38c6ed0c-9877-41d9-a109-7f84151eafa4", "comment": "Malware payload (Dridex)", "value": "18b332f4d393dff14d9f87c65142e8984754d255c95e95fe2a7f6f8871ccdaa642a196e5cb425aaf6faa6f380f930296", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558344, "uuid": "4cfaf144-7aeb-4e6b-872c-2d046125f890", "value": "3804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558344, "uuid": "26ca8206-646d-45b4-9e4d-bdf00986cca7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558344, "uuid": "35df694d-608d-4de3-9654-05679bdc1175", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558344, "uuid": "40177339-d7a3-44cf-a5fd-a35fd7f76c68", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558344, "uuid": "0e20b1b4-5a6a-40fa-8f8b-c10eea9558ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558344, "uuid": "639fff38-9477-46b0-97e9-01bc1a8a9d7a", "value": "74393efd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77b5c55-ba8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621639104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639104, "uuid": "96765459-a15c-45f0-a66b-8ed161da69b2", "comment": "Malware payload (Dridex)", "value": "4770e30232cd36f51f126ee01538bd66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639104, "uuid": "c3d8e2dc-4a56-4603-bd95-d8ffb17ac41f", "comment": "Malware payload (Dridex)", "value": "2e587fd5e243fd631c23397f52b31fe7f45c45796253217a14ca83cc1895dacd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639104, "uuid": "764ce7c9-d751-456e-92f2-5c98520ce268", "comment": "Malware payload (Dridex)", "value": "db33b8c3dd08e5b06c837cbe433b569a5c09dd9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639104, "uuid": "a28e71d5-f281-48a7-96a6-e7b532ef73c9", "comment": "Malware payload (Dridex)", "value": "e7b56e99945aa98e141d5f83fffcf40ba7305e51e960762cc9147867325939a6c79020bec09acf83075ad0f02d82df7d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639104, "uuid": "d74d9f7c-4d1a-48cf-9ece-959163205b7f", "value": "01F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639104, "uuid": "eb704f42-55a5-481f-94e1-a18731bcaa29", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639104, "uuid": "ba3d6832-2a18-4cd3-a15e-de0f8609896e", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621639104, "uuid": "4d08fe19-9f11-4d65-84fa-085b00c55d7a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621639104, "uuid": "10598901-2eed-4f0e-aa3f-439619bd54c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639104, "uuid": "1d03874f-8e4e-4ee8-a90b-40a5ca4a8223", "value": "4770e302_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230128b4-ba5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621619045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619045, "uuid": "7f2026aa-832b-4ae1-ba20-4039240b7551", "comment": "Malware payload (Dridex)", "value": "106da773e29820d182cd673dd94a8fa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619045, "uuid": "eb6204a4-bfd6-4e11-b4bd-14bf1eb01353", "comment": "Malware payload (Dridex)", "value": "2e73890762afb8511a74281583f7b359dc6e26e0e891590f3bba58def5195c50", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619045, "uuid": "1bc052f1-c2c5-424d-b0af-e4bf138021df", "comment": "Malware payload (Dridex)", "value": "7db3d271a477af9a4edbd0cff35b11cd5fca9e71", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619045, "uuid": "b407f853-ad9d-47f7-87dd-a8324b9f3651", "comment": "Malware payload (Dridex)", "value": "5b47f5e3d6b3238b5d7788ae9ba531ce891712da311234d04318fa39032e5ce9c27e2f55f735fec8d138a02c5c172bb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619045, "uuid": "ab79b394-94f8-4743-9cd8-24f170652b0e", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619045, "uuid": "dd33f446-3c84-4c7b-9e10-09e6368f9167", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619045, "uuid": "3075b260-e2b8-4c0e-81f4-abd5e0c19de3", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621619045, "uuid": "26da578e-0986-41f9-b6e3-2aca78027677", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621619045, "uuid": "a4d1726c-a895-4856-b766-bad3a45536f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619045, "uuid": "1f303b7f-0aab-44a8-8e04-59faf89e1344", "value": "106da773_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d4fa2b-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622170, "uuid": "13f9e150-fc14-4628-8826-af718979f6b9", "comment": "Malware payload (Dridex)", "value": "18069aa3c6b7661d58cbcf900b427228", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622170, "uuid": "82fa089d-157f-4f0e-9f58-fce594de85f4", "comment": "Malware payload (Dridex)", "value": "2e80ec1afd2129ee4d3d5fec6f348916550903d57a51407afec56b9d85b7c14e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622170, "uuid": "c6ad26b5-b1b5-4810-a9f5-1ec80c588d93", "comment": "Malware payload (Dridex)", "value": "cc8d74f4f10bd0bce0e46871f96712d7f6ac4eee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622170, "uuid": "b93f34f8-451a-4d51-89a6-428e797fa0ee", "comment": "Malware payload (Dridex)", "value": "75c47601671e3d3a4e0f09bbfbad150e85d379fe36c8d9598ed26d818259118a120516ede3e8cace1ab48e43a980e63f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622170, "uuid": "0b08c647-d07a-49fe-8116-1c8425ee527f", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622170, "uuid": "611a3704-6fb6-4d9e-b50a-a6acc0f1b19c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622170, "uuid": "3d79a844-b10e-4a59-b498-b338b4f639be", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622170, "uuid": "bbc2fe2c-d1ae-413d-9614-8031591a4fef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622170, "uuid": "73f7c83e-2581-4d2e-b6a7-9b0ddb72c83c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622170, "uuid": "4b6dd039-9531-4320-b177-7e98f4df797d", "value": "18069aa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2384f719-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567076, "uuid": "8189080d-2da4-4612-ac05-6335b4eb839e", "comment": "Malware payload (Dridex)", "value": "9b4338538e904fea0ab701b95321d315", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567076, "uuid": "4dd252dd-4887-4799-bcda-7e5112ad9ec7", "comment": "Malware payload (Dridex)", "value": "2e8b854e2e9c2cdd60a6804247e44e79dcf3e31e06d54e3130b1d1cc74b18853", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567076, "uuid": "aaa99411-1381-423d-bb72-ac9fab03cbb0", "comment": "Malware payload (Dridex)", "value": "04e77aa16b7ea4fae5a36be7949e99ef9251449a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567076, "uuid": "b1886788-de0a-4d4c-a7fc-e1c946dffa6a", "comment": "Malware payload (Dridex)", "value": "af7adabf5073f7efdeea9cce5e003bce44e21279830e8143e61b73b3dd1e5203763bdb9ca41e3956429b1f4cac1ebb9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567076, "uuid": "b8a4a465-29b8-4765-bf93-8bc57038c2de", "value": "26F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567076, "uuid": "924877cb-ca6f-4c34-b2aa-fba4de872569", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567076, "uuid": "fcdbc290-1eac-419e-bd3d-80a174aa1778", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567076, "uuid": "91db48da-66f6-46d7-aa52-f8c02abf6532", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567076, "uuid": "61863e5c-183e-40e4-be84-573d295ce313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567076, "uuid": "3b44619e-733c-4093-aaa5-6df8d10ebc63", "value": "9b433853_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23e4162-b9cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557464, "uuid": "f36b867b-a50a-40e0-af93-de0be90824fc", "comment": "Malware payload (Dridex)", "value": "4614ae0ff9d98eea804179b7811c63a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557464, "uuid": "a8f8c3db-555f-459e-b39d-67363dc6d575", "comment": "Malware payload (Dridex)", "value": "2edd11777a6da9d53082cda11390393797eb3b9d054cec07e46f09f8c87e6d72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557464, "uuid": "ada5e1ca-8e00-4e38-befc-bc0a937e1cd4", "comment": "Malware payload (Dridex)", "value": "467b79aff51aed5f5e9214c2e0b47a1eb76ce13d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557464, "uuid": "213b2248-ded7-43fa-9aa4-582cba197e88", "comment": "Malware payload (Dridex)", "value": "5f80962408a1f95f8b508c662665dc26461d8d30ed14981300c70308dc20136a8523f489a9bcc2937c9320843372d0be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557464, "uuid": "7ef71051-06ff-4642-955e-3fe18c5746f3", "value": "AA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557464, "uuid": "90ba3c21-3c96-4532-b9b4-98847e2bb1c6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557464, "uuid": "2dd53983-3277-4e86-8da1-fce576b68e4b", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557464, "uuid": "29368461-389a-44a0-9294-8c32e72c43df", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557464, "uuid": "c273ca5c-4e25-4cfb-9bcf-4a772b9a0be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557464, "uuid": "c5f6ead8-2e52-4b43-b944-0c989c09ee40", "value": "4614ae0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda42e1f-ba68-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621624539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624539, "uuid": "46133f39-eb31-4ddf-a61f-c98657103e28", "comment": "Malware payload (Dridex)", "value": "2ad1a7ce90cb18ef7ff9217d2ab1bd08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624539, "uuid": "98fbe1bf-c202-4cfe-abb1-d2882f2757c4", "comment": "Malware payload (Dridex)", "value": "2f16b6bbf6951a550f07bc5f12e04feab8261e71289e649a75544f8df61b3f1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624539, "uuid": "13975ad5-f127-46c2-99bb-90071a11c085", "comment": "Malware payload (Dridex)", "value": "9d64e77e9effc30162d6f1a9e04c998ca78538fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624539, "uuid": "fa47c9dd-d916-4458-8417-c160135c5dd3", "comment": "Malware payload (Dridex)", "value": "6b1b00d54d32042ba1a755202cdb5b1b336a04842dd4649fa78e31f9f04b40e8c53d7a2a25c20b0839cd19c51674cda7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624539, "uuid": "c34fdfa8-18d3-49f1-bd2b-d93494b15700", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624539, "uuid": "1bcdf70f-a218-417e-ad4c-1e80c46a0bc9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624539, "uuid": "99ac2c39-7cbf-4edb-9f34-3e2bf9cefb0f", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624539, "uuid": "8ea6af45-643f-4adc-b9d5-29b9719b2580", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624539, "uuid": "96713931-2c0a-475c-8a7a-ad5b87ce2b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624539, "uuid": "40de2549-b2d1-4c4a-a694-9afd7c82a477", "value": "2ad1a7ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8828e9ee-b9ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579271, "uuid": "f718af81-31e8-4335-acb3-38ade937dea5", "comment": "Malware payload (Dridex)", "value": "4a2c659e049fd90a512142baf63b1886", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579271, "uuid": "d361bc2e-b812-4562-bc47-12f0b45f9fe8", "comment": "Malware payload (Dridex)", "value": "2f33e1f2f9fbed55df7b5d3c8f7a8f5696e23d4b0d49daf722e1aeb540ae9aab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579271, "uuid": "47a33e2e-a703-403e-ac25-da95d980a21c", "comment": "Malware payload (Dridex)", "value": "fca062bb621756e9d83cd80654cd76af778aaedc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579271, "uuid": "eec5f2fb-45d8-4fb4-bb65-a1be9d6b6a2c", "comment": "Malware payload (Dridex)", "value": "7ed2b4f71714b624ba55f0ea05da30b736188e516662bdf680804f80f68f0061ae5de7acd55f935b444cf9eae8892bb8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579271, "uuid": "4e814b20-5a7d-4aef-a801-074548ebf2a2", "value": "A804E0D0C6C62687E4A7DA729CC17D2A57356809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579271, "uuid": "1ef63780-1e9c-413a-85ad-ea453e6b6ba9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579271, "uuid": "088df0ee-6e15-4b0f-ad23-2235754afbf9", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579271, "uuid": "f42bcfd7-0f6b-4ea0-8afb-7c4679ec243d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579271, "uuid": "ca56bdc4-1134-4a37-9b14-9d07987d4df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579271, "uuid": "ce1dae61-bef4-4700-908d-fc9898bdc131", "value": "4a2c659e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c22cf2-ba16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588956, "uuid": "f494e412-f35e-4750-975f-88409285918a", "comment": "Malware payload (Dridex)", "value": "5ac62c7212d46e80b1d98e51316fabbf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588956, "uuid": "4bbbdf5a-a236-4152-92ac-0968b8930be0", "comment": "Malware payload (Dridex)", "value": "2f74295409bc9647ba6cd1ae45724e9055546e9d289ca1db3cb527945c977400", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588956, "uuid": "4bbb55db-b22a-4e39-9edd-1930ae2b790d", "comment": "Malware payload (Dridex)", "value": "77258d92d7677df2b1eaa55ebf688723da5cc82f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588956, "uuid": "bdb60b29-1782-4ac4-b9a2-0401e6fbf966", "comment": "Malware payload (Dridex)", "value": "8daf7c45f427823b85add083786453cbbc87cf7723deefedaf399adaeedbbf6cda4676bff9f8c081394c4222a977c0c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588956, "uuid": "ad600dd3-13df-492f-be60-01fe45c3b78b", "value": "2E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588956, "uuid": "99b239f3-6f0c-4884-88e5-52bcad496c05", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588956, "uuid": "886d75c2-bb54-4f02-ad67-d440116fa874", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588956, "uuid": "719fce89-5451-440f-a167-d96fbe7c43a7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588956, "uuid": "bc229cda-2ce4-4c44-af13-7ad1a8f0a931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588956, "uuid": "36c5e9cb-340e-43bd-8549-54e3bc70e437", "value": "5ac62c72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350f9eac-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572689, "uuid": "5d2a2149-3905-4759-83ef-a623b244cac2", "comment": "Malware payload (Dridex)", "value": "02ef4e95aeef71fab68aa154415d6585", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572689, "uuid": "ff843ba7-8826-42b4-a5b2-9c950bcf8bc1", "comment": "Malware payload (Dridex)", "value": "2f85a70941cb0c2696a02824a3656ad45eebcb94635a39a8cefe4b9e7be27ffb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572689, "uuid": "0788a369-7d4a-4054-ad48-9d45c44a10f0", "comment": "Malware payload (Dridex)", "value": "f1ccff1f0a4a7b52515dcc713345a4c72e23e29a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572689, "uuid": "e558fe9a-779e-4b37-93f6-2d2ea11fff2f", "comment": "Malware payload (Dridex)", "value": "8e0dd6ed056cfda3f17b5dfb5971ca54b7725a4d57f5e5c58f52db6c8c9273d527307a0d92636f671d7c8d274be79025", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572689, "uuid": "07c2cb8e-1dd9-4d2d-adb4-561902210a69", "value": "EA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572689, "uuid": "340b110d-36e7-4827-a05f-d55cdaa4d826", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572689, "uuid": "60f43ea0-1091-487a-bbaa-5457413e1852", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572689, "uuid": "8239c9b9-9c8e-44a4-b5f3-391ed1ef3f7f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572689, "uuid": "7e396bff-1492-44c2-b4b4-044e6e7db2cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572689, "uuid": "2d25dffb-710b-45ca-a6fa-27fbd4f0f1d4", "value": "02ef4e95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af812502-ba16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621589216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589216, "uuid": "4bdb8f1b-a51b-4497-a222-956b4d3c93f5", "comment": "Malware payload (Dridex)", "value": "74bfb17afc31f3f44bf36ce95a3010a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589216, "uuid": "619b382b-7cf2-47dd-80f9-f8dc1359a3e5", "comment": "Malware payload (Dridex)", "value": "2fb2d6f9359af16aa99635773a9f0b3a677da4e25b60ab138a467091f0c5ed58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589216, "uuid": "dece55e6-357b-4ee3-a5ba-74600cdd70b1", "comment": "Malware payload (Dridex)", "value": "8e52dcf9a2c4e7d3ba3e547d860da8e58415e3b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589216, "uuid": "55394a90-208a-45fa-9792-a15e91788c3d", "comment": "Malware payload (Dridex)", "value": "3645d25cbe9c34e640846be2fd10522c2e3c68198607bcb275bf8a8d8376c14dca2e48e6880b0886060b8cf79c331494", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589216, "uuid": "a3f5cba5-3132-4b08-8a50-6f0090517243", "value": "2804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589216, "uuid": "7d55da5a-1fb0-4ab2-97ba-09d66c3b590d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589216, "uuid": "24e84240-15fa-43b1-b4f7-12d537c2a69e", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589216, "uuid": "c84c102d-9e06-4336-a0df-9b203ec29263", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589216, "uuid": "bf270346-7b1b-4d2a-ba0e-666465304d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589216, "uuid": "40fb552e-e322-4e60-b9a5-7fb5a1f30226", "value": "74bfb17a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc835b6e-ba28-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621596968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596968, "uuid": "dd1e9285-6b4c-4406-947a-30e9cc95e3e0", "comment": "Malware payload", "value": "ff369abdff6fdee48d12ce002a7b3c82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596968, "uuid": "310f6fde-a33a-4563-96ec-574e4b07d7fc", "comment": "Malware payload", "value": "2fb7877ad035abe25c17e3609f73638d87341df107f761e82c30b93878b19c58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596968, "uuid": "fc11b161-e05a-4a46-978c-5de674b9bcba", "comment": "Malware payload", "value": "5d9d47387ba20fd804bff912234690b9a4ea994c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596968, "uuid": "16943d63-62f5-4fcd-ae42-89f1fb39025e", "comment": "Malware payload", "value": "f7e29eec2e9422e508656763da5ca557ac3370df7a0aa3f4ea4a589a156531545e55b97129a50c27bdf6509ef956a1eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596968, "uuid": "561f0cf4-607d-4c83-aa9c-91c916f4dec3", "value": "B7E2DEE6F6B116D2C8D5B414D9763B8FEB81C8E51131F2807AB196EF3F2066BE060179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596968, "uuid": "883be715-efc4-4f60-9319-0a38e6e803fc", "value": "384:W3C4EeDOojt2jNSSMluq8IKe+xgs0whrGRcCwLNz+KhFcSRO0i/8njzM8xv4IdGr:hg/QM81bhltgWVdLuRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621596968, "uuid": "844a3daf-019e-494c-90ea-b282d59c58e4", "value": 32003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621596968, "uuid": "49c7f29c-98e0-45e9-8f9d-4e03c9c40b3e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596968, "uuid": "9c370efc-31fb-4b02-9350-373a5494004b", "value": "Cup\u00f3n2600306.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88de941b-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570253, "uuid": "df125f45-a15a-4962-b2c1-f091bacc7d5b", "comment": "Malware payload (Dridex)", "value": "985291b461912607bf19c0b14dc26b91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570253, "uuid": "4cbff367-e8e0-4f79-8643-66deb5676258", "comment": "Malware payload (Dridex)", "value": "302db075e2795ad7eb3159a18a54236d14230c4a88b5fc3831f861cc37923cbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570253, "uuid": "c50ed2f2-f1d5-4eae-923c-a8a324479342", "comment": "Malware payload (Dridex)", "value": "7e46dbc0d7f286c2cb5a77034d09a99a080a0cd0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570253, "uuid": "18d0185b-99b6-47a0-b17e-73e5f8fccca5", "comment": "Malware payload (Dridex)", "value": "fdb194944a73025a801c125a3f9f7b2686835c0558338b957b692debcf2e6fd07df80655e623c7240a9402077e4b46ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570253, "uuid": "57350dee-a2b7-4185-a764-005fbd0a19bd", "value": "FC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570253, "uuid": "424d2136-2376-4ee5-b842-323d16118821", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570253, "uuid": "16eb78b7-c292-485c-9ebf-fc085df7aabe", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570253, "uuid": "970e8de8-ac93-4cd3-8f26-34a0b90afd4d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570253, "uuid": "10a3bc84-0937-437f-8b0c-399ebe6e0092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570253, "uuid": "9f9dd77a-dbf9-4912-8b32-1a1e1b4cb380", "value": "985291b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d71403-ba54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621615724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615724, "uuid": "63fd575c-c5e9-4ff2-8476-bf575c3713a3", "comment": "Malware payload (Dridex)", "value": "b1e1824310db5a870b2f4e72cd0fb76f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615724, "uuid": "d57a0df5-fc26-4569-8f64-b6f158fd57d0", "comment": "Malware payload (Dridex)", "value": "305560a7291a16d52262f753282b0e2e5b310bd240db687357fb302ce8d67d6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615724, "uuid": "524476b2-ae2d-4b14-835c-deea0fa1ce96", "comment": "Malware payload (Dridex)", "value": "29684bef78d02a840b5c8fcfaa8d1bcdb5f93aee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615724, "uuid": "9a87fba6-e4e8-4aab-8943-a733fb9a033b", "comment": "Malware payload (Dridex)", "value": "4eb832a979a0d3044c6625bfba5de1d9d1c89fb7fe797d412b72f55ef578e9bdbf13259e37abfd280455b5de1bf1d3a4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615724, "uuid": "5b7a2783-b45d-4a4f-9b78-0f7d7736e46b", "value": "2C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615724, "uuid": "7dcdd2dc-86be-4a54-ae18-d87f6008448d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615724, "uuid": "d185f2e5-d401-410f-8b8a-829f038b5594", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621615724, "uuid": "e7192696-53f1-43a8-9495-0294c1bcf066", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621615724, "uuid": "0c6171dc-d7a7-4cb0-8d84-7a862302ef1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615724, "uuid": "11730d72-ded0-40a8-8ef5-8e823322a088", "value": "b1e18243_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bdd26f-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611484, "uuid": "8c5f43dd-003f-4b22-98d4-bb349a110a09", "comment": "Malware payload (Dridex)", "value": "e97b2307cabf8b8fa01f4826dbdc1523", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611484, "uuid": "d449b998-fede-4462-beb5-871da7cd391d", "comment": "Malware payload (Dridex)", "value": "30b473e205967d2818641db49a04bd883cff1ae7d31b82bb9ab2af19eadf2d94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611484, "uuid": "6dba6b11-c02f-47f4-b55b-26845780db6a", "comment": "Malware payload (Dridex)", "value": "729c6a74d3cdf8590ceee3389c4bd8af95a91dd0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611484, "uuid": "c379f929-2e19-428e-bd55-cceeee1c345b", "comment": "Malware payload (Dridex)", "value": "634b36ef73d6860dcd31def52b96926f3993e53173af186a59fd7122e705540de5fa0108e6d6821a64fe0c77c642e54c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611484, "uuid": "2fdc033e-2aa3-4a1c-a682-7c720be5332d", "value": "B604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611484, "uuid": "226c7877-b334-421c-92a5-95d4660c9cb0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611484, "uuid": "1cd2cdc5-0d02-4ff9-ae72-b35e7eaf26d9", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611484, "uuid": "9cf0e914-7ce9-42ae-b8fb-c5a1050e76a3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611484, "uuid": "f4788957-b7f7-43c0-bc15-a86386c9c2e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611484, "uuid": "74d3a4e2-5f85-4885-a8d6-7f9668e41daf", "value": "e97b2307_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6729b44-b9c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555297, "uuid": "99b6db64-82c7-47e4-9542-ac32b427a928", "comment": "Malware payload (Dridex)", "value": "9839178d44f8ff2d0846f60db6e1550b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555297, "uuid": "1b7cd308-60bf-4371-a70e-e76278fa73ae", "comment": "Malware payload (Dridex)", "value": "30dee0c671cb23274f79614dc01c1a013540ced0ee96a0e701dc7e0511b49a49", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555297, "uuid": "d167e230-33d4-4d69-ac27-91523fd7424b", "comment": "Malware payload (Dridex)", "value": "2b9e32c6da8b29a41c33a66ef9de7757e1ab1652", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555297, "uuid": "9c845f02-cefe-4363-8673-cb60ba93c694", "comment": "Malware payload (Dridex)", "value": "cb67fd9151297bca9ae38716ef90108416c9b3aea3feb487cf80abfd2b3fa04b34acff2e85c0574ea030498eeb52183b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555297, "uuid": "ffc0d5d0-c425-42ad-8e4a-cd028ba32e76", "value": "0904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555297, "uuid": "26aa900f-0cc9-404d-94d8-b755a27cc333", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555297, "uuid": "54c6ac4f-cf65-4020-b2d1-1f12b6b53bca", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555297, "uuid": "bfe7829c-0e82-470f-9ba2-e0b88901ff03", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555297, "uuid": "32946ab3-869c-482b-90d6-225b83541983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555297, "uuid": "833bb744-5f03-49d6-b731-0cd1aa1ad6dd", "value": "9839178d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4f54a4-b9df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565512, "uuid": "d34909b9-4a07-442e-901e-4494743ae101", "comment": "Malware payload (Dridex)", "value": "a2453e69d3318a8a4caf0d0df262fadd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565512, "uuid": "a972e092-ade2-40ee-9587-a9c23db35937", "comment": "Malware payload (Dridex)", "value": "31a0fb6cc9c3df430231bd2d84ecdf9dcde8e81c9e13547b9975d67810c7f52f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565512, "uuid": "e7283a15-7cb4-42a8-9e7b-79ea1e92a770", "comment": "Malware payload (Dridex)", "value": "65b0a411d4ec7d3b3cb6548f15f4ce8c38d8bc8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565512, "uuid": "f0d60f08-30b6-464a-9f24-ee17711c3a93", "comment": "Malware payload (Dridex)", "value": "f41ec82be8042b83f3ffd366ca2a4413ff84610672b87fe7b26e16be26fc8512cef9a81d273dee40b4a5c2c741a42408", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565512, "uuid": "59f47b85-38ed-479c-87ee-02bcf19b34f5", "value": "CA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565512, "uuid": "6e72b7fe-ff56-490e-9c2f-2ace43c6f42b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565512, "uuid": "2fbff7ad-04fd-4e62-864d-0d23f848f6d8", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565512, "uuid": "7b4ea4c5-d613-48cf-b9f7-4da0a62be12a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565512, "uuid": "1d56a8ea-27f8-45de-9689-2783a9df9c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565512, "uuid": "f11279e1-4e43-4c0c-8f00-bdf26d9df6d2", "value": "a2453e69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24598da8-b9e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566648, "uuid": "8ddc4026-b45c-436c-a793-f9e5b7a7d664", "comment": "Malware payload (Dridex)", "value": "984d7888e4652f57ce6b4af57e724c7c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566648, "uuid": "5deb7fcc-7dde-4b28-a47f-66c157c82bfc", "comment": "Malware payload (Dridex)", "value": "31d4bf20fe7843fee90cf3f43d6c8eb66d946f7af367f160859acb10d9a68412", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566648, "uuid": "9d5d0270-b3d3-4149-8bd4-28cbc6179433", "comment": "Malware payload (Dridex)", "value": "7f205d5f54d44c878df08f2d05291213879a87f9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566648, "uuid": "6d1e1d64-7c2a-48eb-b3d0-220e790fa88f", "comment": "Malware payload (Dridex)", "value": "09d3bd73779eb00b1f3708e83ee79e652b24a9f31e3d323f8747a49c5615113da1f8b37c4ab0eca6e6c4d681d76666e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566648, "uuid": "9d86a75b-7ee6-4548-b6fb-d2e3686feec4", "value": "2104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566648, "uuid": "3e9868c8-7176-4bee-9deb-7c53d19cea1a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566648, "uuid": "34b177dc-d669-446e-8b10-5f04dce1e85b", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566648, "uuid": "90d8a705-f396-4709-aa63-1c528d77e497", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566648, "uuid": "ff2d5821-20a6-46a9-823a-aab9e1eee3a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566648, "uuid": "0fdfcca3-d1d5-4e4a-b71b-af1e4199b51f", "value": "984d7888_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9ecefb-ba09-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583765, "uuid": "4ff346b2-8387-4933-b7c5-dbd290327785", "comment": "Malware payload (Dridex)", "value": "432c5fbc682467b90f4a0b3f376682d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583765, "uuid": "46ec2cd4-cead-4aad-980f-d0692663492d", "comment": "Malware payload (Dridex)", "value": "31ffb366420f9b1b461ce7c1b7bbb432f689b5577ec5cc32d3f651af61e27762", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583765, "uuid": "a69735eb-2a4d-4fff-a9b0-708c6d3eefcd", "comment": "Malware payload (Dridex)", "value": "e1612e4a148407143bb68ffe60cc583f1724bb7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583765, "uuid": "1be1ba55-d8db-4d4f-b9b4-a44f4fd1209f", "comment": "Malware payload (Dridex)", "value": "fb5230711ba0acc13ee7cd748d1fd97a827b92fed4e062bd63769b70270f088176d5d760e8fb4ea6110f8141424d5469", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583765, "uuid": "dff455e3-2345-4a7f-95e2-13664966e1a0", "value": "4404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583765, "uuid": "bbe8e43e-689c-4395-81c1-f6317355e89d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583765, "uuid": "ad8fee07-04b5-45e8-99a3-70027c3f817a", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583765, "uuid": "8584797a-5396-48b5-8de1-a62316c4453e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583765, "uuid": "3ac4111b-5386-4828-95dd-1d71ead85341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583765, "uuid": "5c96da95-33ca-40ca-8e2a-08e3be9189f2", "value": "432c5fbc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cabad0f-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581373, "uuid": "d197dbb7-0c34-4107-97fb-1912c5206520", "comment": "Malware payload (Dridex)", "value": "4d725f015ba83a063082816466fc1ba0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581373, "uuid": "701edba8-f789-431f-b645-504912dad4b1", "comment": "Malware payload (Dridex)", "value": "324732d38f61dd649f183880a92488d7bcc02d4a1793aaa3d80c3bcc34c1812d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581373, "uuid": "4098d89f-4f45-4e76-aa3e-8077f68c2a53", "comment": "Malware payload (Dridex)", "value": "12373c7dd2a6f0277c72d239694706310beea0dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581373, "uuid": "3f0221ba-4bc5-4683-9735-1b2b9e52c250", "comment": "Malware payload (Dridex)", "value": "e07eed360d54df921c5d15ec0905ea9c162dd24a31eda3c129fdac63b7dca07c587e2a97ec0704b086a425044e6fa885", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581373, "uuid": "6efdbabe-0f2c-4d1a-a798-cb32e51a9872", "value": "8E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581373, "uuid": "db4a1d1a-6bd1-46aa-904f-b32947ee28d6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581373, "uuid": "cff1576a-5ea5-4707-8f65-04b19d7ec554", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581373, "uuid": "c259bf39-c159-40f7-9116-348cca8eb36c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581373, "uuid": "37fe9aa7-5083-4d93-8198-d2bc93762960", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581373, "uuid": "9876cf34-3f33-4ab4-a01e-23ecd187e512", "value": "4d725f01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ad14a5-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612229, "uuid": "46c92f0a-b176-4292-bad3-dea11af8a311", "comment": "Malware payload (AgentTesla)", "value": "9aeaa45b857d722debeb764af01fb0a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612229, "uuid": "6869ed2b-4dca-4e9a-b99c-b44be588272f", "comment": "Malware payload (AgentTesla)", "value": "324da20793064b2d6510d1368811d0029d531c42afc4d4ec1dc0ce19ccb630bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612229, "uuid": "b3bd8fb9-c924-4589-ac8a-001ff4fe24f0", "comment": "Malware payload (AgentTesla)", "value": "5b36b97bfe90a93e3bc2d3565a05db2b4dfc540c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612229, "uuid": "761f866b-a411-4440-b5b4-2fa213478cc6", "comment": "Malware payload (AgentTesla)", "value": "62cbb92618bac068460faa6131eb9b745e2ca3c8a90bf5c2e119fd9e0b3fd950ef136c147993be1638ab0abce46be69c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612229, "uuid": "ebaeaa90-a089-4cf1-a373-e527f2b3ff4b", "value": "8A25CF2C37599274D0FA5B740822908163F6B41FAB11C72E6CB8DE4C7D73A52872DBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612229, "uuid": "0f26a9d2-b71b-4bde-a073-055f3f6616ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612229, "uuid": "3a8a1f63-9af0-4d33-ada9-c320a3c65390", "value": "24576:NEh9AzzhTfACCjzCX0rbj+PUSscA/hix/YshRZO+:TzhACN2KsSMhix/B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612229, "uuid": "b1fcd80f-403b-457e-9e98-5e87f2c278f9", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612229, "uuid": "c2c45e73-3f19-49af-a9d3-64995a707573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612229, "uuid": "166d72d7-715d-4e98-b736-c5d279900962", "value": "TT Scancopy876594987658000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cedd661-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562395, "uuid": "d510d574-9b6f-4e6a-9a97-07e657cbd6a0", "comment": "Malware payload (Dridex)", "value": "7c3dadfc7b8e777bc0f449dcc44da861", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562395, "uuid": "481f9b7a-7b4d-4cd5-afdf-6841a491dd4a", "comment": "Malware payload (Dridex)", "value": "32790ebfcea39bdce85b909c9fa50d1d2072b7152784e5f94c80831640a864ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562395, "uuid": "ad4ff8e5-09d1-415b-95df-1a956ea94ae5", "comment": "Malware payload (Dridex)", "value": "9d3b64361f0d4607f0aa3fcbdfc9c04a9b622afb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562395, "uuid": "f7e7bac5-f157-4df9-a5d2-ec6c23ebd6ff", "comment": "Malware payload (Dridex)", "value": "3bb22de4211245f957574812ebdf67c17dca7c2b53ff62ca7281e73cbc49ae5b1e7de00ac116763d3deb6a4ee27cb5d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562395, "uuid": "3d5316f5-8491-413f-ad19-2398bbc06ea9", "value": "0904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562395, "uuid": "7f866c89-6b40-4c78-a5c9-ad33d69acd63", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562395, "uuid": "ffe4e261-8c1b-4504-a3dd-bab545fb6990", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562395, "uuid": "a21f92b4-9d14-44f0-8111-ec7792731b78", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562395, "uuid": "60d984a0-7e9b-4c9b-af6a-3251213ecd89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562395, "uuid": "679accd0-9055-4107-9c03-005d54a52734", "value": "7c3dadfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13ceab1-b9e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569005, "uuid": "122b6895-3c1e-4c52-b034-e0095303511c", "comment": "Malware payload (Dridex)", "value": "16bb8c86be304b83c271d7a5b9cdbcc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569005, "uuid": "e46ffd99-97f8-4256-8d98-c5bb1d5dddc2", "comment": "Malware payload (Dridex)", "value": "3292813283b20392ad72d81c87e923cca97231164d5743523c6094d50f4ba109", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569005, "uuid": "70f7958b-d4bf-488f-909e-cc701a88c387", "comment": "Malware payload (Dridex)", "value": "18876c7144d2a8385a3dbbaeb33a79b0213ea996", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569005, "uuid": "5f496851-76f4-4b48-a5dd-56264a212afb", "comment": "Malware payload (Dridex)", "value": "3ee9f5a88e11925645e910e91bb4ee591309aca1c952b0ac6b3758355056d7a326d2f5f25196829ef2eaa028c7f673ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569005, "uuid": "7de2a781-880e-4fbd-83ed-f26f0a67ca7c", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569005, "uuid": "feced691-ddeb-443b-8095-e06ae4583aef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569005, "uuid": "b6f3932e-1f88-49bb-9ffd-d73341f612c3", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569005, "uuid": "94008213-69fa-4067-a655-9107179ed878", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569005, "uuid": "75439b9b-4658-47d5-84c5-fffd954d5486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569005, "uuid": "1d8c8534-9464-480b-8c26-bed0d396dd1c", "value": "16bb8c86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347053a6-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573977, "uuid": "1ce8da00-c739-468d-80e7-e7b34ff11e58", "comment": "Malware payload (Dridex)", "value": "3f3a513934c5df7783282816ceea6507", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573977, "uuid": "33faa6e9-0e19-4fa1-858b-3516d1ff5dca", "comment": "Malware payload (Dridex)", "value": "32a3450b38b5d3f3793b505e2933741ccce4e2e28d2fda6d5b879d27fe77fb79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573977, "uuid": "12f79723-1a80-4d4c-896d-45070a08c1b0", "comment": "Malware payload (Dridex)", "value": "cb835f86372347c4c0e4ab05dcbd4e79ecce5a24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573977, "uuid": "9060f5a5-adf5-4e7d-b7bd-db32373a9c8d", "comment": "Malware payload (Dridex)", "value": "77799a323c829cc8d88d9ddd1784bcc76b0fe78d7191333bce055b5dba90adc49f3991dc224cc613a27361fd502f1a75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573977, "uuid": "b51efa7f-0d48-4df7-b3b5-81848d36e07e", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573977, "uuid": "b57587b1-5d5f-4fb9-9576-64447b5b7af3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573977, "uuid": "efae96c2-b74a-443e-bec0-baaa26ac29e1", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573977, "uuid": "7d384769-3beb-4617-9bc3-bde27ec7961c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573977, "uuid": "391c0cdf-9e80-4646-8b28-7bc35fbb08df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573977, "uuid": "49bc5840-df1b-452d-a513-b8888462ba4d", "value": "3f3a5139_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04d1ce5-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569863, "uuid": "4496d970-c75d-4b95-ac98-37168bcfa354", "comment": "Malware payload (Dridex)", "value": "5f568c69c316451caf64e0b8ee085520", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569863, "uuid": "329338df-3d6f-44bf-9e26-2946f30be3c6", "comment": "Malware payload (Dridex)", "value": "32b7fb011c5f06e65558b4778b2980e5b067131cbe33359f0e4f7502b29ff128", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569863, "uuid": "d833d6e5-544f-4382-a87e-9e9bf5d52ab2", "comment": "Malware payload (Dridex)", "value": "a719427124f1f7e680abdad4ffe76c3cab230f1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569863, "uuid": "c3d46c09-7a31-40b6-9414-025fc6048165", "comment": "Malware payload (Dridex)", "value": "502af53baa6b96167ee70c48d4237e51c463bde7ff6a4217531dd9b98057f503b6417c1931a66f72e6ea4a01829c0765", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569863, "uuid": "2cab4cef-4f6d-4094-aa7c-4a1d6e3c72e1", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569863, "uuid": "aa204109-97ea-437d-9626-92e25b7fc736", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569863, "uuid": "833e1f25-39b7-4d25-aa58-5eb0d84ea866", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569863, "uuid": "077ae520-a2e2-4861-bda1-feb2fe249328", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569863, "uuid": "e5565c42-59e6-44f5-a422-b702a8aac5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569863, "uuid": "c097856e-5650-4a01-861b-1e3ff78d241e", "value": "5f568c69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf446c75-ba58-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621617589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617589, "uuid": "c41ba426-7560-455e-b5a5-9c1d77e67a64", "comment": "Malware payload (Dridex)", "value": "29cbf4e85c6471002f564dab39d876e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617589, "uuid": "31b80593-8880-4984-a0ac-f6918b6832bf", "comment": "Malware payload (Dridex)", "value": "334a98255ac1a0f7c9a756b2a282a98186146b01b64d66e1188725fc53b08b6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617589, "uuid": "42641371-c211-45cc-8fb5-ddb551a3fbae", "comment": "Malware payload (Dridex)", "value": "9a70ff72f249f9a130196a46efa55e2ccfe9bcb9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617589, "uuid": "177fa459-99ea-48bf-a234-c559c0a2f441", "comment": "Malware payload (Dridex)", "value": "5376949b9ed40852bcd59015d6aae393ad6926b07b9028e8792bb85b68ebff4eafdb00cc6011477d82d9275bad01688e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617589, "uuid": "05597ef1-0fd4-482c-b2c6-2d4e7fb5debf", "value": "EFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617589, "uuid": "6c3214c3-f652-4307-a732-418a9aa26877", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617589, "uuid": "095c5d07-4739-44d3-8d25-5447c1b5d548", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617589, "uuid": "5002c371-ae23-40e4-bb96-2e19fe09c663", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617589, "uuid": "2d0eca14-b58b-46d6-bfc3-b370faaac806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617589, "uuid": "6036139b-189c-40a7-a808-854be0dc07d6", "value": "29cbf4e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdcbaf7-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556892, "uuid": "6d55c5d7-2213-4e0a-bac1-c183f771c8e0", "comment": "Malware payload (Dridex)", "value": "af0ced32b7febd4b9b0c05a9eb99e6d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556892, "uuid": "e99f8f24-6008-4927-849f-ae42b5d0c957", "comment": "Malware payload (Dridex)", "value": "336776a3f57efe465793c0fba653cd276f15aa54c84890220003a05a522d2f0e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556892, "uuid": "009c1ff0-4d46-4916-8a5f-2f58037dcffc", "comment": "Malware payload (Dridex)", "value": "0112eb502c2887d42d5a6904ecd467c88bb155e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556892, "uuid": "d2dc8f1f-3e89-4dc6-a359-7953b4dc37f0", "comment": "Malware payload (Dridex)", "value": "08859182d91d4ba9c97a2a52a6d9d99917d18721446a32039b5e468050ecc44111105418c605bbe61288f0a6d33dae35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556892, "uuid": "accbfd92-60b0-47b5-a8a0-ede9b94e6483", "value": "B204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556892, "uuid": "28df92de-0fbc-468a-942b-ebd9b6f3270c", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556892, "uuid": "ce6965b8-508c-47c1-a80d-db99e57b6955", "value": "3072:3WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:3WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556892, "uuid": "851044d7-36ea-4a44-9c02-a44e7756540a", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556892, "uuid": "924a4fc0-4fd2-4f8a-978f-0052223c505a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556892, "uuid": "6154eaba-94e7-4fc2-91fc-875ba40dffb1", "value": "af0ced32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c56f25-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621618534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618534, "uuid": "e1c45f08-e9dd-42ff-b195-7b852c3dcd04", "comment": "Malware payload (NanoCore)", "value": "d0d1601b11d5cc352cf779edd08d0cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618534, "uuid": "b541edf5-f76c-46b1-9085-ab30194c3758", "comment": "Malware payload (NanoCore)", "value": "33796c5495a2eaf1fb3bd918cbf6d599c7cbd74462b693a802f834a91fa7ab40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618534, "uuid": "b4f77d8b-2677-4e67-9bf9-475b3440d478", "comment": "Malware payload (NanoCore)", "value": "29de952e850d55c360497387550697534a8d5d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618534, "uuid": "8cc37696-56a9-4f56-a0c0-61389bedd8f2", "comment": "Malware payload (NanoCore)", "value": "367ee3ddc69336d7b2fc28d2aff0cb8fffb93917dde0952343b6534fb00fbb2450f710bc2072894c2a0c0216b8f0d9ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618534, "uuid": "b56e6c1f-4838-49fa-8704-528e4eee38ec", "value": "B0A39D2377D1483DF67501B02ABCBE7A97FEB9750321895FA36811836E72548E926343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618534, "uuid": "81e14760-7850-47e5-83ed-7ab7a2efbb39", "value": "b76aafdc988ade2ab3db3b02fa4c6d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618534, "uuid": "743bb210-125a-4c0b-b2eb-303632eda7b2", "value": "1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618534, "uuid": "6dff85e0-a463-4f92-b617-02525307e30b", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618534, "uuid": "9210f777-f7a9-4e48-96b8-bba51df4dfdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618534, "uuid": "19f5233a-5259-4104-8164-c9bb387917d8", "value": "D0D1601B11D5CC352CF779EDD08D0CAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba8450a-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621576029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576029, "uuid": "b8150304-eeb7-4a63-8a9c-9a7b5a2c5f25", "comment": "Malware payload", "value": "a33f5e0477033889800776d25297ff3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576029, "uuid": "507238c1-77c9-4cc4-b391-60f21102f9ad", "comment": "Malware payload", "value": "33cd7d0454ead1f9c3d3ee7a3e4e2fcbade8b8a7523bacf65b81ae6eeb707e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576029, "uuid": "75f052a9-7725-49be-b16c-c23624a78541", "comment": "Malware payload", "value": "0ed2c5f41f683e8688b57f1fdcb69c5dd315104a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576029, "uuid": "907e37a0-0c07-420f-bbff-eeb134044a62", "comment": "Malware payload", "value": "171cec0b0d605b459d94c55a668c61d1801bdef4b081ee8942bec3287692f4f1e62ff8c4e6ba2d6a5e948ec8097c759d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576029, "uuid": "c8c80728-1daa-4b02-8598-c66b5a7efa3e", "value": "FFB4E13112E96F96E5BEBBB9097100011BF6F865E732F71E7E9660CE4175E0087E2B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576029, "uuid": "a758e0cb-e307-4979-8925-e2279c047454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576029, "uuid": "2578d429-0f40-439c-bcc1-ec5cf44e6f4b", "value": "12288:Z/xIsKzuPYjrAp+/UG8lBrsOK6h03zbCcrNxHHTc75DEn:ZczqYjrAp+WkU0qcXgdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576029, "uuid": "fa4a2b06-7a27-474d-a3d9-e782a30df150", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576029, "uuid": "4b080077-561a-48c5-b3ce-02e4367e62f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576029, "uuid": "681c62c3-4928-44fb-aa51-d513111fa008", "value": "Purchase_Order (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f6bc02-b9df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565608, "uuid": "77137d33-a714-4a8b-9480-21dfa9902e48", "comment": "Malware payload (Dridex)", "value": "d824253b8eda9f8cc4db7f4c2cb4567e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565608, "uuid": "8701b175-7260-4b52-ba49-60afb7511bd0", "comment": "Malware payload (Dridex)", "value": "33d0d2b5a6a469b0b862a4b68834f39f815d3f69506db70fa8e359b4c93f60c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565608, "uuid": "0354b3ae-f9f2-4ecb-8f37-1e100ee4a24e", "comment": "Malware payload (Dridex)", "value": "71c8e54c5152a3a4b6a5992aaa0da6a0a4996dfe", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565608, "uuid": "3f5498cf-2eac-4885-9225-1168325fd361", "comment": "Malware payload (Dridex)", "value": "1585186e78e37a3e8fb46df7e1d4a39e33add8a0063c70615609fe0a4cf7670fe9672ffbd9259c1654ccb5c77e6217d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565608, "uuid": "5994c64c-14e4-4218-8765-5fbdbd9e110f", "value": "1504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565608, "uuid": "c7e2b6bf-19a3-4673-afc2-3ac5d8cc8892", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565608, "uuid": "6a5895e7-002c-4374-b1b5-3974a83be415", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565608, "uuid": "7f2d14a0-8112-47ea-b2f6-8b289030a6f1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565608, "uuid": "f7e72b30-7060-4baf-a218-d12461137ce3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565608, "uuid": "44f062fe-8c99-4518-9696-314478d3225e", "value": "d824253b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76f74d2-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612100, "uuid": "d067d33b-6b66-459a-b043-861ce7905e6e", "comment": "Malware payload (GuLoader)", "value": "664ba1f3eb923e06d45221009ff4c017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612100, "uuid": "e2ef4d69-bee9-4409-8122-8c3574038310", "comment": "Malware payload (GuLoader)", "value": "33ee2504a81c487ee235c0b171ffa1151f6bd4efa3ee0eff07cdff633dde2e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612100, "uuid": "98b18d4f-477f-481c-870f-2e9199abf596", "comment": "Malware payload (GuLoader)", "value": "cc89f3817fbfa567d0b41944a0c8c79728656d3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612100, "uuid": "bd574592-fc88-4233-9c47-d5a32c77050a", "comment": "Malware payload (GuLoader)", "value": "75956d46872607c48860ced6014a8809741d92b0b677e7f212020b8c71451645ec9d3375cc756fea82de5121f70cbb1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612100, "uuid": "4a8e13d2-61b6-48fd-b806-8cf87c34ef2c", "value": "5D349386B552E0A9E88691B4F476C20F18A67C7371854E07BF833F67B030057AEF9967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612100, "uuid": "f8c25569-bcaa-4ee3-a6b7-bc57dc639c74", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612100, "uuid": "8093a2d1-88e6-45cf-b9b6-53881a9af9a4", "value": "3072:E+IcY1JanLvsP38FzLGnGbMcI96CNjNX:EdJaT08FzmGXCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612100, "uuid": "7bf9334f-8796-41bf-871a-d6197a599d9f", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612100, "uuid": "a9283a74-8dec-40a0-a7c3-02113869b439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612100, "uuid": "c64f2479-be3f-4f7c-afc2-048f884bb628", "value": "Zam\u00f3wienie 20211417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a383ed-ba48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610508, "uuid": "9df079fe-e3ea-44e3-b633-d724fafbecae", "comment": "Malware payload (Dridex)", "value": "56a848cfbd74d4ab2604f90bea934458", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610508, "uuid": "0c5c32ab-b3c3-4d5f-abf9-ade84a41ade8", "comment": "Malware payload (Dridex)", "value": "3429494fbfbd9ccda0e0ae103cc2c80cea486d7f3e51360c367b68f6887186ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610508, "uuid": "e901b685-c3aa-4697-98de-05bbb3c21743", "comment": "Malware payload (Dridex)", "value": "481a542479fc38541ebc56ca7a7b6d52113f2a21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610508, "uuid": "bd3a24a7-a542-4638-92e5-713ab8e66868", "comment": "Malware payload (Dridex)", "value": "257ba8a60d1d747c9a81626a5fc0e2fe6a2f604694c2104d2234faf32e9de2c34ec4ec318b6afb38b4aec2bba7ce24ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610508, "uuid": "a502083d-41a1-4ac6-97bd-ee689599ad92", "value": "A804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610508, "uuid": "81733355-8c3e-4a94-a030-1171aadd0432", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610508, "uuid": "bd94abf4-2891-4f39-be7c-debbecf3f589", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610508, "uuid": "ac16b21d-2d58-47de-8791-08fe44d798a8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610508, "uuid": "d9f5fc71-b8a2-45a5-b2ad-c66f6c264a69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610508, "uuid": "00e3fbcb-2b48-4aba-9cf1-221b5d4fad75", "value": "56a848cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d72301-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613151, "uuid": "92e9eaea-3597-4136-a9b1-28c303140b1d", "comment": "Malware payload (Dridex)", "value": "1076f323d73d6714be9d8ffa5b88f7b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613151, "uuid": "6ee434e9-045e-4318-a588-0d8153b6c289", "comment": "Malware payload (Dridex)", "value": "34304b15d9e26249249cf6927ce1b74f94437f97ebcdaf7133e0b88eedf9bcda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613151, "uuid": "a16f150b-4555-40af-b564-e1695b4bd72d", "comment": "Malware payload (Dridex)", "value": "572e41581f1f23bcb75e8ef78cde81613639b92e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613151, "uuid": "560e8716-2a3a-4666-9537-2b22faa5f2cd", "comment": "Malware payload (Dridex)", "value": "2d419811dc405d8693cb111bd442f7db84b04dafe516e271248dc38f4907f025615bc8f1cbd97abfe5f699d3910898f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613151, "uuid": "b3f3cf8e-6288-4a46-bb01-3b0501b2a5d6", "value": "9EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613151, "uuid": "cb5500c7-92b2-484f-b5a9-2cb701f3fe4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613151, "uuid": "b1df41e7-4dc6-4c7b-8cc8-f6e18ce0ea3c", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613151, "uuid": "1b372f74-84ec-42e4-b597-287ece463079", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613151, "uuid": "fcff4b39-7159-4e94-82f2-1622dfeb6bcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613151, "uuid": "c7deacba-1072-474f-90f7-4ac40521ff18", "value": "1076f323_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84536a2-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566548, "uuid": "a22c6c0d-d7b1-45e4-bdae-0c16f310877e", "comment": "Malware payload (Dridex)", "value": "ded4687e147e3cc00b752b8cbbb3e790", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566548, "uuid": "cdcab9ad-cde8-4455-80f2-adf9f133e86c", "comment": "Malware payload (Dridex)", "value": "343ce554963bdc6ec8a02d3430fa88fdd2ecf960aeee99e760682c13b7502b5f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566548, "uuid": "3dd73495-6ff9-4a49-a79f-3276b4d57d2d", "comment": "Malware payload (Dridex)", "value": "a4b7bb42ac799030c280fc77b2ea828c6792119c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566548, "uuid": "0470119c-6fff-45d3-8903-91c264e7858f", "comment": "Malware payload (Dridex)", "value": "043604b407ea11143eeadc069e3d7ff737b67493094688f023af0f1cc6e3eaf2bf1adab60f9e7e75b431709fc2eca3e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566548, "uuid": "cbc4114c-5dcb-426b-913d-d97507ac2ab9", "value": "92F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566548, "uuid": "1e720d02-cf33-41a6-9f48-ccda0a187b00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566548, "uuid": "ecffdf77-e9f2-421d-b6dd-8d75a3b862a5", "value": "3072:MIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Fc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566548, "uuid": "a880aa64-f5da-44a2-9c36-596b9e5e4e1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566548, "uuid": "8ea0d0b9-143d-4cd1-afbc-ac23cddc21fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566548, "uuid": "ee367173-cf49-4dcb-8af1-a751d802b847", "value": "ded4687e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b557c01e-ba64-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622726, "uuid": "7c3b5c7e-afdf-4d35-a7f5-79fa9530aced", "comment": "Malware payload (Dridex)", "value": "b9385a1d4f5d798cea2474200f1ffa49", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622726, "uuid": "02f01745-b602-473c-b941-d2beaacf1f47", "comment": "Malware payload (Dridex)", "value": "346c40a3738f143448cd2e8d148a7489a071cf514611e761841323c32779bbbb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622726, "uuid": "515951cd-a815-4a28-9fa1-ef6c27f8f028", "comment": "Malware payload (Dridex)", "value": "6a877cd96067cba342c73bd6ed335b398d6f8830", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622726, "uuid": "cc1f2d0c-7fa9-43c2-81ca-07232703a84f", "comment": "Malware payload (Dridex)", "value": "a7275e67ca8e91ec331bf6a346d68fd6c2e5b3e121b6589fda1e563d6ed0660301aef7de0c66dad1df754608be431b17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622726, "uuid": "28400cf3-4623-48fb-a63d-2f4d3e247737", "value": "2EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622726, "uuid": "e1a2a2c8-3d7c-405b-a00e-64ccb16732bd", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622726, "uuid": "3b8e937c-91e2-4dcf-9131-533775e9f601", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622726, "uuid": "c15fe531-82a0-4f38-8ce8-c8ccc0c47726", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622726, "uuid": "c73c5c0a-ece4-4c96-91a0-b38800cd9270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622726, "uuid": "b88f135a-eb0f-4110-adc2-6f275500d7d6", "value": "b9385a1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9b3ae0-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612189, "uuid": "54356e8f-fa12-480f-be40-bb14d280a757", "comment": "Malware payload (Dridex)", "value": "8c94c5c5f022f60417f79ce71a76ad5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612189, "uuid": "f254b988-d40f-4d22-9dc4-7c00167c1c89", "comment": "Malware payload (Dridex)", "value": "347190fb298daac5af05924860b8d5a705c3d5c5fa8e069b9ceb65430eedcc71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612189, "uuid": "aa1a0174-cc91-42ee-807e-3752a9e1c456", "comment": "Malware payload (Dridex)", "value": "0b7cdc32ca9458e504fdf34770a1790dbce372ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612189, "uuid": "2a148b0a-a68b-44e5-babd-ceeebd5baf06", "comment": "Malware payload (Dridex)", "value": "6920e9434c44f217cffd72070a99bbccc1a9a6d872282fd3317e88d25aa2766115683b41485de9d8777a16cdb4605e3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612189, "uuid": "69dd8478-f60d-43a1-aaf0-9b51ef38a7d1", "value": "0004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612189, "uuid": "21ed956a-10f6-40b4-ab0a-35df77c56f6c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612189, "uuid": "c0795809-3760-4005-b541-aeeb630bbf96", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612189, "uuid": "b3e7c6e1-f36f-4af6-b522-dc388fd0baaf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612189, "uuid": "b527cc01-b933-4783-924f-66d5a95ba3b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612189, "uuid": "469e7279-6c7c-4f20-bed3-9d2efe0fa1d2", "value": "8c94c5c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c570ee-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616984, "uuid": "865d2010-d49d-4bd5-b2e1-12f84f0b683d", "comment": "Malware payload (Dridex)", "value": "e180fce5ac3f70db7160fa084d0af9d2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616984, "uuid": "0ccb13e2-9ffe-4c6c-8d65-5872352e0658", "comment": "Malware payload (Dridex)", "value": "353be9ee8e03cdd2d2689386e173d58907dde0ce8978b0dd72e9361cc5ac3abc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616984, "uuid": "5b16dbca-f53f-476b-a12d-ac3205586764", "comment": "Malware payload (Dridex)", "value": "b58afb47438355e2396bf8a335deafaa5f480f1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616984, "uuid": "f1ae8d70-d191-4b0c-af8f-27690f9f7ce5", "comment": "Malware payload (Dridex)", "value": "40a2ef8e516ee9c8d1c8d8182fd3bee67f41e9b6e927e763a5ca87f0d6e71ce0d691413862c99395dfc26c11488b8d4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616984, "uuid": "c3b1924e-e931-472c-9fa6-b9c1da94b159", "value": "E0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616984, "uuid": "e4a81738-5a60-4da7-ad58-b082cef13e5d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616984, "uuid": "4460c131-8c75-46af-87e8-e3fb0a31a1c6", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616984, "uuid": "3b8e83d3-f91f-41f6-8e15-c6fc79a50c39", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616984, "uuid": "8d4e15e8-32e0-409c-8afc-5fd577515813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616984, "uuid": "aebef64f-8029-40ee-8c7a-0c11ac6bbf18", "value": "e180fce5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744b42f0-ba3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606726, "uuid": "59594f76-c062-4254-8a4d-2caa3d304d16", "comment": "Malware payload (Dridex)", "value": "66adca606aa1027996fe0d68315b1df6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606726, "uuid": "6bd5eb16-f5cb-41de-a4fb-c13bd6a57d45", "comment": "Malware payload (Dridex)", "value": "356c617481bd674db22f92cbd8811a3af400c58efbdfc5b75ded25641613cf3b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606726, "uuid": "c1cd9f48-d041-4063-8031-2fedb4dd8864", "comment": "Malware payload (Dridex)", "value": "2030568ff391ec336c13e07265f1079591ddac13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606726, "uuid": "608117d5-1261-415f-9264-68c31277ee99", "comment": "Malware payload (Dridex)", "value": "cf6f8f019e0113898c655d757889c563ab109d37f768f37d91f6957af1eaf60652993af4120ece0dd327fdaabb00d428", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606726, "uuid": "8ab71827-cce7-4df6-9ab4-eec0bc377e2c", "value": "DD04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606726, "uuid": "e73421c8-c567-4deb-b553-89980460c256", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606726, "uuid": "59dffc3b-f5b2-433c-9cee-7c057cb9ebd9", "value": "3072:9WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:9WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606726, "uuid": "c9d8f3ac-a8a4-406d-b300-ba1b3d736d63", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606726, "uuid": "34c22a50-3a31-469b-9b48-791b75a55fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606726, "uuid": "30f8fdb8-4a87-497b-8519-206f75fe2909", "value": "66adca60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be615b8c-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616299, "uuid": "77aa37f3-9a0e-4b0a-8cf1-5764684a171a", "comment": "Malware payload (Dridex)", "value": "cb09c08475aca145c34dfd822fc2c516", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616299, "uuid": "b986a70e-3fe5-432d-983a-7ef3ea68630b", "comment": "Malware payload (Dridex)", "value": "3587cc2742597cd7ab0826015280a5cf0d76a760b35ae3ed67e45fd0dfafdee3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616299, "uuid": "832198bb-4d39-4efc-979b-b5b13b7f2a59", "comment": "Malware payload (Dridex)", "value": "369e336b4ee10607bdc47c5dffa58a569b08ffb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616299, "uuid": "723ec1f4-20f5-4981-8c62-375ff2e2d2ee", "comment": "Malware payload (Dridex)", "value": "705a4b4ecee1ca4da627db49e836d909e39350b3805f77989e6e94291fc957e8762cc35048c0b03ccd0bc17a9411f93e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616299, "uuid": "4144a9e3-1d7c-46d6-bfcd-58ce61397a2f", "value": "F8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616299, "uuid": "5d14eecf-ecc0-4f7a-a33d-84cad8e07367", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616299, "uuid": "b02174be-7b2e-4cd5-ab29-c6872719ee86", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616299, "uuid": "cacf08db-4fb2-41de-84f5-d728f72456ca", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616299, "uuid": "df0e5c32-2ea6-4af3-bb7a-87967365c2fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616299, "uuid": "24f4fd03-d8ae-4849-8472-59a06e6a8747", "value": "cb09c084_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f30366-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621615993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615993, "uuid": "eebca25b-7f91-4594-ac4d-3cf0e0a22b0c", "comment": "Malware payload (Dridex)", "value": "96d5432cf6fd636e9386792342d2f129", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615993, "uuid": "d3cc9fbd-6ba0-47e6-9116-09e3ffcd6a53", "comment": "Malware payload (Dridex)", "value": "3598ec547d8e6d1a06d00e1905123b7ad744bad141a928c498c152400e533cb4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615993, "uuid": "bbc5215a-9013-4662-9b35-5fce3fbaee32", "comment": "Malware payload (Dridex)", "value": "d0493682555db2874fe91d9260ae4a2fb5a80b58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615993, "uuid": "5f796353-f237-4344-945c-898b9bfb31b9", "comment": "Malware payload (Dridex)", "value": "2c0bb611cafa13b848fc8aad2ecb277fa192f21da67c3f6d7504bf5978d06dcf3dcc71b68c43b97337e7bcc4c0d5461f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615993, "uuid": "08ec7a56-40a9-4989-93c8-f558c4604f1b", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615993, "uuid": "dcb9fb47-8534-4542-ac8a-551385806596", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615993, "uuid": "ceaaf8ed-85f1-4e57-979f-812859c59f53", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621615993, "uuid": "e548cd1c-2e55-4af2-a916-444477ccd138", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621615993, "uuid": "f7be3749-4798-44d3-b51a-e4d4efb352b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615993, "uuid": "6b874ee3-d494-499a-a1e7-c721c632b209", "value": "96d5432c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55af43f4-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574462, "uuid": "c8b9da6c-0b0f-48dc-b085-16ba1ef8d90a", "comment": "Malware payload (Dridex)", "value": "c20c26e929e5e42f36003670b716732d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574462, "uuid": "b482c929-56d8-45a3-8603-b58858093f65", "comment": "Malware payload (Dridex)", "value": "35bb3809de844e35588a6b96691191b5e8b3fd394f1a6c46e885314b9ab863fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574462, "uuid": "049e9a0e-e932-472c-b17c-859ce01b761c", "comment": "Malware payload (Dridex)", "value": "6d7f36cbf0556da085e046c3ba60ac2c12a0d9b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574462, "uuid": "31df2fbc-e2c2-4eb6-bee4-5a65df2ea333", "comment": "Malware payload (Dridex)", "value": "001b2beffa93e4b85a80b2a348c77d21864d9f36acc510c59f822c094aaf9a49b34a4e2324d9bfac1927d3a4d5f0df77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574462, "uuid": "ede4a984-e96b-46db-afe8-9c24e67c7212", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574462, "uuid": "3f23f3c1-70aa-48bd-a7db-e916b1788b3b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574462, "uuid": "7ff27072-cbab-4b7f-867d-4d8c08b8058f", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574462, "uuid": "6adeeeca-1a2b-4faa-99c4-63adb28591e0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574462, "uuid": "fd1cae0f-4bf7-4af1-8be5-fb67e956bfa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574462, "uuid": "8c322f2c-a857-41f7-8e30-2c89615fdf70", "value": "c20c26e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072ac595-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562304, "uuid": "c8c506c5-0c23-4264-94e9-b9cfee3f78a9", "comment": "Malware payload (Dridex)", "value": "edfad7eabb8c32a398ecd40bce5e4199", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562304, "uuid": "42987b86-cf73-418b-8cc9-3d86d2befb2c", "comment": "Malware payload (Dridex)", "value": "35d15fb734330fb2e3d9ae910ce11f561f77034690a931ffb1eb6cc05b2aef29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562304, "uuid": "976b9964-4834-487b-97e5-8df105ed75a4", "comment": "Malware payload (Dridex)", "value": "9b6b4e281120e675ab2ca388ccb3fe808001b1a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562304, "uuid": "fb693039-7926-43df-a199-0597038d9dd3", "comment": "Malware payload (Dridex)", "value": "c96260edfd87d6da2bba53c3e759c33e79b672db7296a16ec5293f0b9bdec0269640a5f7eb883c7cf1967ce1e60701c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562304, "uuid": "84ae99e8-437d-4158-aa5f-1ebe3bb4544d", "value": "3904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562304, "uuid": "bb6cd17e-f99e-486b-8ec3-32cb59a945ad", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562304, "uuid": "9ad1e599-2028-4ab6-bb54-95eb20ad2fca", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562304, "uuid": "bce1bbe5-a78b-4d73-9a81-83ed0d9b9457", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562304, "uuid": "65a129ef-17da-40a1-8981-3eda52baac42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562304, "uuid": "6509f1b7-caae-420f-9fc3-06e710c936b8", "value": "edfad7ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca26f04-ba50-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1621613907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613907, "uuid": "e7cefaa7-20eb-4948-a0e1-6043c135524c", "comment": "Malware payload (CryptBot)", "value": "02e171ec492666d05afa7e86f10cd2a4", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613907, "uuid": "8eae80c5-7df6-4c89-a3cf-b8e485f5e689", "comment": "Malware payload (CryptBot)", "value": "35ff264d4f296b3fcf8a4a86cbda7246e73862e99e35b71bbd2499d9028024b3", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613907, "uuid": "a4657686-e968-42c9-99ff-8c9ac73b839d", "comment": "Malware payload (CryptBot)", "value": "02a486ed29073270e3c573125004082cc606ee08", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613907, "uuid": "a9760094-2c56-4b33-81ec-557a97a1d7a7", "comment": "Malware payload (CryptBot)", "value": "b067ca14a0961fec3f16fe7c3a7278ccddad9cd875efce83327a875c11921230672f694585a1d973c57d9eabeda50fd4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613907, "uuid": "ccd6a100-1a1d-47ba-8359-668645ca98a8", "value": "C6F4E02066A0C135E1FF1EF449B9A269A53A7DA16B3410FF53C52AEE46346F4AC3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613907, "uuid": "4cbbe234-5b12-4d2c-b164-daa24adc86a0", "value": "5e4af829e45903391dccafe97a3396f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613907, "uuid": "f21db48a-6ff3-49f6-a894-142117ba1a23", "value": "24576:yfNE4ru0tVccL3I20O6LcQDK9Xf/xzDOXNqRXsLj:yJuWccNh6LQpN+qRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613907, "uuid": "ba6fa54d-095f-49a6-8a6c-b90e54e9c5bc", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613907, "uuid": "cc8f6e2b-f7df-4ac5-9b7b-fa8db91d4c91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613907, "uuid": "5d3de5b5-7014-48b5-bb0d-ba6f2e1c2b97", "value": "02e171ec492666d05afa7e86f10cd2a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b32f8a-b9e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568015, "uuid": "4723010d-d639-4049-b44c-f50b3a2f0986", "comment": "Malware payload (Dridex)", "value": "cc11cde13c962957b815aa07d531fd5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568015, "uuid": "c234b230-1439-4bae-99ba-8bbccd51456e", "comment": "Malware payload (Dridex)", "value": "36220a1a5c993c0e4a2a1bf256c2182a76a803d0ff57675fb7e663ec206e2c8e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568015, "uuid": "f46f64e6-ee1e-4db8-9e3d-93a1bbe52c56", "comment": "Malware payload (Dridex)", "value": "6cdc694eea5c5e81d5f2794891f9db4f7597d5ef", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568015, "uuid": "fe2d8f6c-caf3-49b5-b42e-b415e6f8e61d", "comment": "Malware payload (Dridex)", "value": "d5e056103ae095136632cc9c1beea29f1292756cc58ca3c80c8e4842c8638a2ef089394ea1d4785c0d45603808044a29", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568015, "uuid": "81d6f796-a5d3-424d-bdae-aabed85b510f", "value": "D104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568015, "uuid": "96b4923e-b738-4a4d-8692-77386a666602", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568015, "uuid": "e9a8ad16-17b9-4434-91d0-faa7e6805d38", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568015, "uuid": "90a36e51-fe8c-42a0-b365-f05e7886a3d7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568015, "uuid": "60775b8e-05d8-46ba-98af-d34a526707ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568015, "uuid": "ec9eb794-aac4-4894-b578-940dad7747ce", "value": "cc11cde1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb66c15-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562586, "uuid": "f46418b9-3910-4dde-a48e-2c52ee39b3ab", "comment": "Malware payload (Dridex)", "value": "ea3c872c55707cb16afa38b3c9353adc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562586, "uuid": "30bb074f-0665-4157-b531-704e33f25b8b", "comment": "Malware payload (Dridex)", "value": "3674c861ec96dc7b782c46228a9fc0888224ee2f31b30cc08db61072b43ce1ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562586, "uuid": "44bfdec7-9cfa-4f92-a0e2-9528d090cb4f", "comment": "Malware payload (Dridex)", "value": "2d326cbbdc0983291966bad666a6467eca00790c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562586, "uuid": "183faa4a-51d8-4b49-9be2-7a8069f1e6be", "comment": "Malware payload (Dridex)", "value": "8d5be2b0abd35dd815e15a1d50365800ade6ec0d00431dc3737fb2b45fb5934135682872308e86da1ee429d652f70bda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562586, "uuid": "6dcd8622-b2d3-49f6-adf0-5cd34e0e181e", "value": "01F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562586, "uuid": "236b7af6-6615-478c-b0ce-074b7a178026", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562586, "uuid": "dde14ad8-a7ca-4685-8b08-26a8205cce93", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562586, "uuid": "d752df32-f60b-4519-b866-c46acfad7279", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562586, "uuid": "8d868a59-fb59-4cbf-bf40-af9b41b9b726", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562586, "uuid": "8a27c3d5-ad0f-4252-8519-85210ef19462", "value": "ea3c872c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f29e2a-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571993, "uuid": "80e8c71b-9ce1-4d72-8e6c-52fa75bea1ac", "comment": "Malware payload (Dridex)", "value": "6c30a655958f81d78d5adb70fed7b0e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571993, "uuid": "013966d9-6da2-480e-b732-d3a64411369b", "comment": "Malware payload (Dridex)", "value": "36c57f913192a019c65a68bbef642830686051b5033548fefdf10ae4253f9255", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571993, "uuid": "09d5f6a8-dcc3-4601-b342-94021a139c52", "comment": "Malware payload (Dridex)", "value": "7aabfd781d0cc0217b7f467ae4f6e7d8035e2fe7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571993, "uuid": "61d1e262-5bad-47d1-b98f-917b9efe065b", "comment": "Malware payload (Dridex)", "value": "7a76dd9cdb72621fa7f816dbc1001031cc5ec06a14d68cd4a6719e05c56a6d48fc81d7b9074a12b68e69cd1c37c7eda6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571993, "uuid": "cfb98266-e497-44dd-9972-2cbf293ddd08", "value": "0504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571993, "uuid": "52ab5602-37eb-4025-9f9c-7017be3a0bbd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571993, "uuid": "7510460a-bdcc-45f0-adc8-69f50174c788", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571993, "uuid": "be3cf108-c369-45bd-a23a-c360bfefd780", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571993, "uuid": "53fe9a24-d883-429e-b318-40d6d0df2269", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571993, "uuid": "0449bbfe-eab2-4e2e-a18d-b69325039e07", "value": "6c30a655_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711052f8-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613592, "uuid": "0aa5c536-2707-492e-b04e-aab6863eda32", "comment": "Malware payload (Dridex)", "value": "963f4fb213258210773b1de7a3caa2da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613592, "uuid": "40cfb053-9449-4f5e-b3d8-77992a479656", "comment": "Malware payload (Dridex)", "value": "37032c8e15495901537752f074e468eeb79ebf7df5bc2671e000be4bf680c6d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613592, "uuid": "e296f71d-c723-439a-9312-72021c6fa9d6", "comment": "Malware payload (Dridex)", "value": "69dfa4128565c6127bc1c6c768500ef508483bf9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613592, "uuid": "bb776e17-9fcd-4c09-abb7-7685bceb348f", "comment": "Malware payload (Dridex)", "value": "b49229d689abe704720d3bf32b91c032cfcfe5181d8f2481ea10d9198aa5276b6c77c1a7b641eea7bb9e819d023c630c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613592, "uuid": "2da4be83-c87a-4cf8-8b1a-3dd1a0e80f57", "value": "E1F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613592, "uuid": "c625e19d-077b-453a-8701-2766d8ac7f16", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613592, "uuid": "0e646a8b-c222-4683-8563-0ca6e69daf2c", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613592, "uuid": "6499bb30-ebeb-4b86-8275-abb6077ea27e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613592, "uuid": "e24ced35-43b4-47b0-aac0-ec378d4fa919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613592, "uuid": "d161ba92-874f-4d25-ae65-5da6d5e67e3c", "value": "963f4fb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0a885c-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555598, "uuid": "76facb57-6735-4c06-8eac-40a87229d3a1", "comment": "Malware payload (Dridex)", "value": "52bc438f121d3253f4e6a5c7be793187", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555598, "uuid": "5edabba9-9a84-4697-b92e-bd4ad508d739", "comment": "Malware payload (Dridex)", "value": "370bdd644a85115de5775aa6e4dfd76f1ef471ae2906d075089f66de7729e10c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555598, "uuid": "392ff530-6e95-4766-a505-4b3d0da0835f", "comment": "Malware payload (Dridex)", "value": "c9ccde482b03528c43659b4faeeeeaec7b391b6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555598, "uuid": "5a677021-7080-450f-ad9e-c23776418914", "comment": "Malware payload (Dridex)", "value": "bfc6d15f69d220a9450cfd95c137f103d3ff0f2d5ac8560d81b9934587f84ab68af7f73c70d0c961367b0edf336e84ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555598, "uuid": "87e4df58-b802-4344-830f-cf1eafe2f9e8", "value": "B304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555598, "uuid": "367520a6-883e-4965-8c49-2858923f25d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555598, "uuid": "9e576ecd-9c7d-47b0-b111-dbcf3066a1a6", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555598, "uuid": "b6b82cf7-93da-4179-a048-2e678ca3f903", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555598, "uuid": "9d51dca8-f6c2-4204-9a3d-4526de446e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555598, "uuid": "0d7a352b-d577-4306-96d4-7e9405697be0", "value": "52bc438f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07b2632-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559689, "uuid": "01d972f5-4822-4b9a-99ac-e364f6248c7e", "comment": "Malware payload (Dridex)", "value": "a3fcc287f31d8017267eea2cbcae2a29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559689, "uuid": "214f21e3-0fb0-4b94-a8f0-fa65412f54c3", "comment": "Malware payload (Dridex)", "value": "3727a22614d11d39d2e65b2ab5734e6f4b582b37147393806440b62f4fb89dad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559689, "uuid": "ddbad0c4-cb16-403d-8bb1-1db812b75706", "comment": "Malware payload (Dridex)", "value": "940ba5e341b75202c127b61490f1003ac51e61df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559689, "uuid": "e8b65054-abbb-419b-adc4-8d46609d22ed", "comment": "Malware payload (Dridex)", "value": "3ca8372af74f203f74f6a9564160a275d61a01848350c4394d412fbce65bee84813509b8200a3d58376538e2410f2555", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559689, "uuid": "2d002bad-4f0e-4471-8ae7-c75d2b9bb8ef", "value": "FA04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559689, "uuid": "66df5e35-71ac-4307-8969-3bef0cdfee8e", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559689, "uuid": "6ac29d29-52fa-4fae-9ce3-3b532331f4b4", "value": "3072:kqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:iVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559689, "uuid": "e8c6e385-83ed-4078-a7be-445e411961f9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559689, "uuid": "a956330f-a4e3-413c-8b7f-6f84144ef46e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559689, "uuid": "8a2c5756-80ff-426b-9ae7-b126925b8d85", "value": "a3fcc287_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1788da-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556270, "uuid": "481cd0c9-89b5-4288-8d71-8dac22e8b7eb", "comment": "Malware payload (Dridex)", "value": "4ebfbae9f3a70c0f5923333a161972b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556270, "uuid": "c728b810-47c1-483f-ba66-a26cf4f042f4", "comment": "Malware payload (Dridex)", "value": "372f7fcaf3824c750715491a375dce91dddd49bf82c7c9fe27acee07b5daa0bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556270, "uuid": "a11fabd6-0cd1-4e3f-8cee-1675dcaf5baa", "comment": "Malware payload (Dridex)", "value": "3630d168f4f5039c7d58195f7a6454d5b6b13f8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556270, "uuid": "503430cf-24cb-4241-a1c8-496293d65baf", "comment": "Malware payload (Dridex)", "value": "a2527c68ece0c22e7d7e54c23ca4c7a81be7076d42436caa9950e909996a6aabbd495c52dbe898130a86c777845fb4a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556270, "uuid": "190500c8-d68e-4185-bf28-f44c5ec25e0c", "value": "FFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556270, "uuid": "8d9242e7-ca86-4ccb-8306-9f04eae8033d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556270, "uuid": "b9b9f61f-2144-4838-81e5-f4ffe53ebe2a", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556270, "uuid": "6e7cae08-8265-4840-bd74-58fc5b4d5e68", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556270, "uuid": "0bfa4a7c-d83e-4214-845d-3bc16a2b4bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556270, "uuid": "40b5598a-3667-4eb9-92fe-7fbf699d400c", "value": "4ebfbae9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc6bfec-b9fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577670, "uuid": "4591d6ba-cc6e-491b-a4ea-784e52fe0715", "comment": "Malware payload (Dridex)", "value": "4740aa197cb7527f154fd3c2f0cfe3c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577670, "uuid": "ada1f8b9-f3ec-4b41-859e-442cd9c83728", "comment": "Malware payload (Dridex)", "value": "37d3bdac2c6cbe560378470fbd46aaf076184b02a99749803704fad477f96b7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577670, "uuid": "e1eda46c-aa1e-420f-8d20-83230b145fab", "comment": "Malware payload (Dridex)", "value": "0cda62b51f37eb88b6dc823c0382078145c57c25", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577670, "uuid": "1c1db73e-894d-491b-a177-dc9c6dca78e0", "comment": "Malware payload (Dridex)", "value": "cf333ecdc32508037f8f8801c696c1d0e5bf098dec4e7f7e5f3b0c6271d63eaab0f0eeee4111df7ed7c96f960c2d6359", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577670, "uuid": "01030532-61ff-4723-8cb7-a042a7a3fc5d", "value": "8204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577670, "uuid": "610088a3-fecb-4f4a-92f8-915f20bfc010", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577670, "uuid": "256fddf4-a51f-4fed-bf22-5ecc9f867eee", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577670, "uuid": "f3202fc3-1bc7-4c22-ad61-4e7e09d8c280", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577670, "uuid": "e171ec38-54fb-4aed-833e-b46dc0b774c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577670, "uuid": "83d73959-4765-4555-8684-3d4a34836530", "value": "4740aa19_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a2120e-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612313, "uuid": "a50f319b-44d9-4c0e-98d8-1ab60dedd834", "comment": "Malware payload (Dridex)", "value": "5d187f0482da67490bfed186d651e9d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612313, "uuid": "bc401f8a-18ae-4ccc-b30e-d2cd20c5d1e2", "comment": "Malware payload (Dridex)", "value": "381366174087eff922480088fba9d64ed28b543d7144e9b98feaafadcec8e31b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612313, "uuid": "1401b74c-c572-40ac-bac2-b5fd427f7a02", "comment": "Malware payload (Dridex)", "value": "a88b5535a6ef81d572f087836a2e9dda9e6febce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612313, "uuid": "2bd1d662-00de-42f1-b6b8-ccee7a8d0c10", "comment": "Malware payload (Dridex)", "value": "22499d3cb7f1cb08e4692b379c8c6933e924204b485253e5b231597d461d9e6816ef4f6249efb59df27c95f6f1555b95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612313, "uuid": "0a3b1d9d-fc02-47f2-a5dc-0e85e33df0be", "value": "0BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612313, "uuid": "5928f70a-04ef-4ac3-b955-f388cb2edb08", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612313, "uuid": "e1e1a9b1-5962-443e-a78c-bce0446eafba", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612313, "uuid": "54466c23-c0a6-49de-8dce-435d93bec106", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612313, "uuid": "2f3cb9f9-4150-4875-ba32-5db084fc1b7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612313, "uuid": "3d9d5dba-c30b-41ea-af58-046c2f4e1fcc", "value": "5d187f04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c009e7bc-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612436, "uuid": "13eb4f76-cc30-4c66-8880-60e83a07be4e", "comment": "Malware payload (Dridex)", "value": "dfa2fdcb546dd39ac46eaff7182af624", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612436, "uuid": "6f4587ba-859b-471f-88b4-be489d6a6a42", "comment": "Malware payload (Dridex)", "value": "38800fceef070967a5b4a1bc430d3ff05f16d887c5ef0c376fbe4762cb94e0a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612436, "uuid": "642b33d0-95a6-43b2-a7cd-7044eacaed92", "comment": "Malware payload (Dridex)", "value": "1338f09ce758cd16e32c227939d86fa2cf4afe97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612436, "uuid": "3be767dc-8541-46c6-8e60-75b34a75892f", "comment": "Malware payload (Dridex)", "value": "3145156a6d8eb7fc9832f5b79eb535604e3744d92b198f0c6e7e1f6f75b9c5efed57bc2b1a84d8d1b02cdec3f20c361e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612436, "uuid": "6d137cf2-d651-48be-b2b1-9f11cdb3de62", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612436, "uuid": "a92c9a0b-b81a-4f80-8dc8-e409f8aa64e5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612436, "uuid": "c151a800-7c81-464c-9cee-a027820b8712", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612436, "uuid": "ca2deb14-f9d3-43ee-9454-c47efb7631f6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612436, "uuid": "cf39930d-9d78-4086-af5f-9a629d27775a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612436, "uuid": "cd27470d-bafe-428f-821b-d0ada6641f03", "value": "dfa2fdcb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f0c04b-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559212, "uuid": "233f5ef6-ebd0-49e1-b9af-3fa563c8c696", "comment": "Malware payload (Dridex)", "value": "ddcb4c95fef9b075c0aaf7891e9669da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559212, "uuid": "dbee77a7-d88b-4962-b900-6b6306154722", "comment": "Malware payload (Dridex)", "value": "389c5c84fe220e91d3d34a3a06e545046ffd4ff719942489f20fbc98cd96be62", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559212, "uuid": "768b461c-42b0-4236-b35d-9ce339122449", "comment": "Malware payload (Dridex)", "value": "c471730bfcb4a089d7448714f187ceebfc2c6ec7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559212, "uuid": "68e78c66-6b59-480d-8a4a-68be3a804b07", "comment": "Malware payload (Dridex)", "value": "2e5dbce203d9668e5a9cacf826caaa17378b566f1fe2317abd89801c63429f0ffbf32e6cd7407d0ce95a58b03bd56e81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559212, "uuid": "ec157ef5-5823-4642-a2ed-41553d63658f", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559212, "uuid": "31a0e9e3-d601-4548-9e47-8ac7efedd1bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559212, "uuid": "4f802bc2-5df3-469e-8f21-83758e7cc2a8", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559212, "uuid": "312b1bdd-5bf7-41f5-bf73-ff1325ed7e79", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559212, "uuid": "7215d730-1fe8-4286-a78e-4f874df00579", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559212, "uuid": "d3cccf9b-df05-4e4a-bec2-dd7ddcfc1a47", "value": "ddcb4c95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce82dc80-ba68-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621624486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624486, "uuid": "dc421fad-ce78-4b2b-8884-083cc3bb4624", "comment": "Malware payload", "value": "4c7a4a11ccac593a3777ecc8ff471fb8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624486, "uuid": "2d562ab0-31af-447f-80ad-f468768265ae", "comment": "Malware payload", "value": "38fba27c12c5c3d901616438a2662e447241904fc3f13db0ab81023518476d2d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624486, "uuid": "d1e30b02-3a0e-4567-a1ef-18ac49f57bdf", "comment": "Malware payload", "value": "d76bd91dbb77db9b0ee382a16c7efa5c348ed1d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624486, "uuid": "0c18af1f-d49e-4cc0-86d2-9cbb856250a5", "comment": "Malware payload", "value": "ff64d1d0310da607cc81251443606fb247a0515ad3e3be8c8801e53b1fcfdb181f0dc464086fa120d5f3f413a8ec02ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624486, "uuid": "1c589f81-1e0a-4c26-b237-7a57a56663b3", "value": "CBF423E82883E706CA6823FB5153F2DF5569DC9B42E691A6FA04FF35A1F0110B934F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624486, "uuid": "9fecf58e-7248-4a41-8365-101e38d3944d", "value": "24576:NbOHWyGHTiO0wIL6V4/MuJlu4j0Y7wFhWx9F0/G2Wu+S:YHfGHTiO0wIL6S/JjHQFh8TXk+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624486, "uuid": "edaed6c2-356a-4c15-adbc-ef025cd9ecca", "value": 790235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624486, "uuid": "938dac30-4990-4527-a203-7b7d84aac1e2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624486, "uuid": "716dabf3-56c1-46c3-93df-f7033d700524", "value": "4c7a4a11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5f1cb0-ba08-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583063, "uuid": "6c63f0e6-95a7-4b03-bc86-586f8c95b45f", "comment": "Malware payload (Dridex)", "value": "5b3ba28bf47a0d28b1f81c26e2d23bae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583063, "uuid": "8cbacea3-b41c-4239-a71c-d5f9e07d42ec", "comment": "Malware payload (Dridex)", "value": "39211ff545a3bdd902e7eaa3b55f131b22b06fedeae379af66b789e2aba05a04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583063, "uuid": "f82cc854-ad2c-4c87-9d8a-83e99be8192f", "comment": "Malware payload (Dridex)", "value": "bf55afe18560043637538b4b6a967af5ccc6c25d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583063, "uuid": "2ed8a3db-8551-4bf6-8605-3108e2a7f114", "comment": "Malware payload (Dridex)", "value": "858c85fd03016277cff86e055281d5bb88cd3e12efe041984722bb4757af395603f7669b05249ca04cec3fa490d5b6b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583063, "uuid": "5474677e-b740-4776-911e-c01fefd3b85e", "value": "B004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583063, "uuid": "57d0c81d-c197-466d-a1cc-c47290a54ab6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583063, "uuid": "ce98ffc2-27a1-4802-8305-a0f255f1bddd", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583063, "uuid": "0273af64-c2d2-4b20-8784-0a46d08160b4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583063, "uuid": "209384bb-c6ef-481c-b1b0-d2a85b96a960", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583063, "uuid": "78a94a50-ce3c-4701-9d57-ea28d45f9b6c", "value": "5b3ba28b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d96d52-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622027, "uuid": "376d5dc5-2cbb-4621-ae96-8f3697979024", "comment": "Malware payload (Dridex)", "value": "c582de3b4edea434ca13e01308323907", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622027, "uuid": "72a47ae5-489f-4618-b9a8-d47808af7f61", "comment": "Malware payload (Dridex)", "value": "396c6d016d5d6f4f4568ae61d131ded10d7bade176ed9185d9576ba053fc060b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622027, "uuid": "aa828433-3d24-493f-8880-e27557db7438", "comment": "Malware payload (Dridex)", "value": "5918a7caab8523ad16ac7acbca8a6fa6ce7f334c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622027, "uuid": "bd3ed086-1410-4e3f-9e04-d911ef1300fa", "comment": "Malware payload (Dridex)", "value": "f43c55a93f6b380d5aa8b8e7eb17175739bc2734d91cbb11544024189751115791f514ab2a345849082e8d3597c8613d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622027, "uuid": "2e7ecb6f-3784-42bd-984d-d3b1675232f1", "value": "EEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622027, "uuid": "8e15f191-23ef-423b-885d-4f181fa8b7ba", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622027, "uuid": "6224a75d-736a-43f7-accc-ceb388db105a", "value": "3072:6lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:6lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622027, "uuid": "411d433d-3c0c-42ca-8996-ba1c9a2d6b2c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622027, "uuid": "ba628c7a-a5db-4803-a25b-1a445d994c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622027, "uuid": "73ba53f9-e015-4dd7-8fb8-cf2655068252", "value": "c582de3b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae35efe4-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621635170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635170, "uuid": "861ea864-bb05-4695-b494-e983306b4aad", "comment": "Malware payload (Dridex)", "value": "56927ce69c6cadd02033945cc189d4c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635170, "uuid": "f497d302-283b-450d-8673-72754896457c", "comment": "Malware payload (Dridex)", "value": "398127c6048bc172f1d06a81cdb077c671160edc2bb271de7125e2a41e904d20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635170, "uuid": "50602f70-e4ae-469f-9419-56c6a881b8d8", "comment": "Malware payload (Dridex)", "value": "879a4a69dbe71713bfe99861aff73676e8ca4cb0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635170, "uuid": "4a4f72c3-3c82-4f8e-bd02-a398a352c0df", "comment": "Malware payload (Dridex)", "value": "db93149c838070cac97a35b12b47b5351345cf0c64387afbcc75f19b76fe0786432173bb1b6e9457c8a3d3ebd9fed1b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635170, "uuid": "8d7b1a6a-fbaa-49cc-895b-e3adc64c1d87", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635170, "uuid": "4174d7d6-9891-4b37-9a42-f25d8e20bd71", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635170, "uuid": "79a6f648-bd38-4dbe-8846-fce95a37fff4", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621635170, "uuid": "42543924-e412-4538-a2f3-05447eafe083", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621635170, "uuid": "aa2e7c7b-270c-4e2b-ab8d-5e3a706006e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635170, "uuid": "90983c6e-ab64-4982-8bd9-5c0fa7e34143", "value": "56927ce6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3aa017-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575116, "uuid": "c339460c-1a0f-47aa-b60d-bb3381a753fa", "comment": "Malware payload (Dridex)", "value": "66dc32997f1df6e4c0661c32e4c568d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575116, "uuid": "69ae2124-1c10-4e40-b618-75ddea03c3c3", "comment": "Malware payload (Dridex)", "value": "39b52436151b247d4977fa97f0fdc7dd60b43f5962726a9dd33aadccb2608e37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575116, "uuid": "38f4b1bd-e7d9-4e8a-b440-5296c92361b4", "comment": "Malware payload (Dridex)", "value": "1f7f2fd61ca76b80d1533ede6eec94cc6a7bbc3c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575116, "uuid": "c583e22c-eefe-45cc-84d3-527671a03bb0", "comment": "Malware payload (Dridex)", "value": "dc13daeb57a6185d9a5a7c41aceefe2c5b01fad8b9a70e018e694077db8d07542d75a3341f15e5558396e28c37288fc1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575116, "uuid": "0664de9f-4a8b-4362-8d7d-071440dc8efb", "value": "2D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575116, "uuid": "6e368ae9-342c-4dfb-b1ff-b03fd9f827e2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575116, "uuid": "9cb2511f-6ef8-425e-b673-e6098ebe4908", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575116, "uuid": "7edde8f1-68cb-457f-b47f-e0bdd2fdbfc0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575116, "uuid": "d2029bb3-3303-4ba9-88f5-636cff967f1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575116, "uuid": "63734d05-92e7-4462-b695-d034baf71740", "value": "66dc3299_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7d03e7-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592777, "uuid": "ef268a50-d314-4527-8a6f-454cd803ff8c", "comment": "Malware payload (AgentTesla)", "value": "dede35bbd852933529ed2b6e9c67d7fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592777, "uuid": "3fb6e13c-a22c-4603-b184-b2b8fb9f345a", "comment": "Malware payload (AgentTesla)", "value": "39f71db5d9a883cee88c17e50b42e790b307d67487e2a26601abf445c04a7e90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592777, "uuid": "7a414be9-787b-49f4-bd23-083173b68d8f", "comment": "Malware payload (AgentTesla)", "value": "1d8e2dc086aea5dff3a4e83521ddcb90b6bd02ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592777, "uuid": "5297aaba-b102-462e-949e-d4b1148b54b9", "comment": "Malware payload (AgentTesla)", "value": "5d104986847aa34481c39f5499a270a7939a7aa5079a43957f26ae3b98171f488077e61f62aafe9ba2c9101c291bcb15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592777, "uuid": "4dbe245f-c269-4e72-8eef-23e1158fef4a", "value": "7D65332C9A8747C6E09F947ED22E8EB847665EA22B0D8C463BD0F995507D33033D17A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592777, "uuid": "08f2bb9a-50c4-4fb8-919c-b743761dffdc", "value": "24576:m+PQ2N4m+0yynUO5dWRI7iFP1IaWCieNYyaHWBOITr0fwlk58/dc:FQ10yAzmI7iFZ7OHWk82wW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592777, "uuid": "fac3fb1b-ac7d-4fdc-b38b-5e8ce8e43914", "value": 1438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592777, "uuid": "7192bb02-d564-40bc-8bf8-f1e023c0fb1c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592777, "uuid": "1dfeab9f-c4d7-47fc-92fa-d4fff941afb9", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05436c7d-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580770, "uuid": "5ecc5c65-ae5b-4c07-b444-48eab2118160", "comment": "Malware payload (Dridex)", "value": "2171cf4268f1fe24fbf7a8e7968ca396", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580770, "uuid": "91203f9b-a277-41a4-8bff-44a72a1b0add", "comment": "Malware payload (Dridex)", "value": "3a06a9098874b4ca544ee528a0cc0b620d9d109f38e4b339f5560f952deb8754", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580770, "uuid": "2f1d5878-7650-4ca0-9237-2c10c5c08a74", "comment": "Malware payload (Dridex)", "value": "26dfcdeb1332ebf29a0fe341ffff2cb866c240b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580770, "uuid": "d0c30863-c656-4856-80ad-641c32263e32", "comment": "Malware payload (Dridex)", "value": "a94b326e3f40024f28900b2f8990a4225006a42e084f1fcb3d9b36bca53336e2a471e3adfd8fde56cc41fea372dcc3e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580770, "uuid": "cf0c6855-e18f-4909-8086-e0d43ed8e9ea", "value": "4904BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A21A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580770, "uuid": "452fae86-a90a-41b7-8752-157e45ac5a41", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580770, "uuid": "07025e25-6cd8-4f3c-b0b9-e98853e30805", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580770, "uuid": "f064b2e3-9623-4264-86c0-83725948e7c5", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580770, "uuid": "410c21e9-1120-4e7e-88f3-69c3d41025c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580770, "uuid": "48b4b673-84ed-45c1-953c-cd0589d72811", "value": "2171cf42_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa18d20a-ba17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621589770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589770, "uuid": "41d55626-fdf1-40ce-a1a5-2360ec43674e", "comment": "Malware payload (Dridex)", "value": "160e9abab7f9dd6c0156fecb202852be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589770, "uuid": "d50e9915-d561-4383-a1ea-dba8c9f30e8c", "comment": "Malware payload (Dridex)", "value": "3a0ab1b4cc387fdaf51c4813bc22f90bb89d9ea208cf91e6f8bd2a8f27aa8c1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589770, "uuid": "a6dad053-add1-4fc5-8023-cefffb509ee6", "comment": "Malware payload (Dridex)", "value": "0189f122126b28e8f9e0c95c7eb15af9716a5c9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589770, "uuid": "6ec90606-d619-4704-9a82-f45b7e43204c", "comment": "Malware payload (Dridex)", "value": "5dc2e838319d9809b7771c1e627b70c43354d74823e2b939bb3d1876457f38a74c566b15eff807378e716e3b776031e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589770, "uuid": "695b6d97-135b-4a4c-9ddb-e97703996827", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589770, "uuid": "66ccce8d-08a9-45a2-b9d7-a0f8939a47f0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589770, "uuid": "4b3d0249-00a0-4703-850a-294c7baa8544", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589770, "uuid": "f7c1e44d-30a1-4b45-a50e-ab8b1df735d9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589770, "uuid": "655a2bab-dabf-463b-8c50-5952b9a0acc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589770, "uuid": "6d8a4282-c88f-4991-b66d-fe2c5129760a", "value": "160e9aba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7092f231-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565917, "uuid": "c8d1f5f5-4297-4979-8b16-10522836ea2b", "comment": "Malware payload (Dridex)", "value": "262ae0e3c6de429c47a7a7abb08c5be0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565917, "uuid": "a704260e-8203-4427-b008-0c122911be87", "comment": "Malware payload (Dridex)", "value": "3aaaab4e3e0bc965872db88560dd56c5b63ae929cc6c7b742bc6a953c2d6732c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565917, "uuid": "138bcb0c-8651-469e-ae82-eb19a373ea8c", "comment": "Malware payload (Dridex)", "value": "5195db6927f103b27ac14b2029e596537cae47b8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565917, "uuid": "0ab75931-e6f6-46b9-bf98-063bdc1dc9ac", "comment": "Malware payload (Dridex)", "value": "579c2c390cefbe618151bfbb2381ee44146d4fbdd37c3aff18e105b91eb71f47cceb401eae2a3528bfc9e9a100d9773c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565917, "uuid": "32d85fbc-42ee-4763-93b9-528402d3c91c", "value": "FD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565917, "uuid": "0e874331-87c9-4cb9-a27e-a8f8bd29c410", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565917, "uuid": "83ad9c1c-4646-416e-b361-b62ca663782e", "value": "3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565917, "uuid": "91d20ddf-3202-4ec8-9037-e9e67fa919f8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565917, "uuid": "2cc9018d-b208-4f0e-84c0-be4909f206f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565917, "uuid": "3ab8c5bb-db7e-4b03-9be7-afb209895fae", "value": "262ae0e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac4958d-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567250, "uuid": "33bc8b41-973a-4192-80c9-e1e21bff4470", "comment": "Malware payload (Dridex)", "value": "6877e011168f8a38602f888cb0cde155", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567250, "uuid": "f684c0bb-2ab6-4aeb-b38a-5f0b3be2f3e8", "comment": "Malware payload (Dridex)", "value": "3b94c5aa0f8ba544ac165daad038b9a5761d45e58c626700309d960bfe982728", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567250, "uuid": "7008b619-ddb5-4aca-a1e5-da12046ed99d", "comment": "Malware payload (Dridex)", "value": "363c66ad3ea0837b6a0b5e121d6a4eca69fa9c48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567250, "uuid": "c88b013e-f6f0-42ae-b377-6318fc9aaa53", "comment": "Malware payload (Dridex)", "value": "0c8770aaee5315e80e6933f80c6b4d5bd5edfcaf4ded7a0b2b8a67ceb7d16c434ee8746986d5338428eff5c7ffe4771e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567250, "uuid": "d69f04ce-bc4e-4d59-9733-d23fffa7e10f", "value": "6A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567250, "uuid": "88efa919-56ad-47da-82f9-de282856427e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567250, "uuid": "1c3a0bcb-4ffe-43cd-b171-d7fba0958f03", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567250, "uuid": "63532b1c-9b7c-443c-9dd3-88483fcb2050", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567250, "uuid": "2095a466-dc83-429b-9114-b91663db427c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567250, "uuid": "39d8823a-dbac-482b-8101-21bb07c8c26d", "value": "6877e011_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51e96d3-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555724, "uuid": "790ede67-6f17-4713-a9bc-3d9efb4915a9", "comment": "Malware payload (Dridex)", "value": "c9e81607d7a9def32059cd31466840ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555724, "uuid": "2b1d7d77-c355-47c4-86b6-b9bad1e6fc72", "comment": "Malware payload (Dridex)", "value": "3b95290101ee1f45a5f5c8f89e2b249b6013784d6e67537142984f1caeb0eb1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555724, "uuid": "dec9849b-516a-4a76-8cfe-72305aac9b1c", "comment": "Malware payload (Dridex)", "value": "01f62d374fab95fcf0814acd6d309c3fef76ee6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555724, "uuid": "8828fe15-30af-4d50-917e-08032e25f8ad", "comment": "Malware payload (Dridex)", "value": "b13c0e4278a9fa5e8fd715615b5b593675d2c521bbd3ae240cabac6871b6590458c0d85f4a7b58bb4b663cd6ae62cfa1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555724, "uuid": "d352698a-b889-4bb8-bdc4-e09d35c977d4", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555724, "uuid": "b226b608-aa72-4d76-8258-40bc754dc268", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555724, "uuid": "22973782-8f59-4232-adbd-701601e8e056", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555724, "uuid": "87c45b21-8aef-42b4-a29b-7944ff659c97", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555724, "uuid": "846bc6ab-ad27-42d5-b39d-8f4d91698d3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555724, "uuid": "da347771-052d-4072-98cf-3e2f001dee6b", "value": "c9e81607_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bcec27-b9db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563939, "uuid": "bb866ec3-d5d0-449f-80da-8cceb73c3607", "comment": "Malware payload (Dridex)", "value": "73d0cbee5fd56ca2d179fc8af9aeeeea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563939, "uuid": "aa65962d-d790-4adf-92c3-313abde31d1b", "comment": "Malware payload (Dridex)", "value": "3bf1f005b0cd51f9e0bf40c186dcc217fef1fd3b98eb69c1fac0dc1cc2f170ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563939, "uuid": "67d63085-7f06-4c2b-bce2-1e8f008c9405", "comment": "Malware payload (Dridex)", "value": "1a4519206039898e086fd247bbe824da0d5424aa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563939, "uuid": "85c246c0-2f2f-4f71-821e-89ca82be722a", "comment": "Malware payload (Dridex)", "value": "de5d78bc8193f1b48d9695a4549a2f124cc2cf7caa3fa3d3eaecdcb77ced4a9b51d65df4f10c384c0841a33a8d3e38ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563939, "uuid": "c303b548-e97f-4c27-897d-ec6f3cf0e5c9", "value": "C304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563939, "uuid": "3f34acf9-300b-458e-b41c-b1b0b0757cea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563939, "uuid": "04ef05f7-9bec-4531-a812-75f9c68435be", "value": "3072:fV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:fV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563939, "uuid": "b1d04834-6297-451b-9192-795697bb723f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563939, "uuid": "4dea885c-98f3-4172-8899-f930fbf3ba6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563939, "uuid": "c429eac8-c12f-4362-9a2c-19cba2f2be5f", "value": "73d0cbee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b204fba0-b9e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568604, "uuid": "99c29235-9016-42f3-9e40-8ca1318eb322", "comment": "Malware payload (Dridex)", "value": "0c78dde35347093788ecc4fd14e68c1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568604, "uuid": "c6e3a4a0-ddd2-44ab-8869-16d108682684", "comment": "Malware payload (Dridex)", "value": "3c2ba6392f641984dc61b603dfc58a657cb594fbed9ca1ff9fc2cf4e8d81e178", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568604, "uuid": "031e9a16-bf96-493e-91f0-de1dc738fe17", "comment": "Malware payload (Dridex)", "value": "def9e2c726f22d625b6c533f87a3113ed2625892", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568604, "uuid": "61c48615-f5a8-4666-9bd5-c7101ddd410e", "comment": "Malware payload (Dridex)", "value": "98e515a08e61134fd9d7ece04a3d3ef3a04f6960375645b541d0bc50c9a72dd9cbf8f5c0942476ed0cfc70139e4448fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568604, "uuid": "fdfb1ac5-8e90-4af2-944d-88c4d4c2e8b3", "value": "8804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568604, "uuid": "b2dc25ba-9761-4928-9f18-9e26504a1ecd", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568604, "uuid": "4efb5e4b-5f29-4a14-9356-bb497589fcca", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568604, "uuid": "8c5ccb90-0e80-4a65-aa91-897cf5493c9f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568604, "uuid": "bc137459-08f0-4786-8591-8b7a48e6fca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568604, "uuid": "dbd1f9bf-f7e2-469c-b647-8aa24ec3b9f9", "value": "0c78dde3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df29b03-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1621613533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613533, "uuid": "aad5d327-b9b9-4d1b-9410-6b2a5ea39fe4", "comment": "Malware payload (DanaBot)", "value": "627abe7098689569c23adbac05c28fda", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613533, "uuid": "3cf81d6b-05cf-4ccb-bf8c-f4facfcbde21", "comment": "Malware payload (DanaBot)", "value": "3cca783febeb041bf21545d727c32f37b7b94687022f0432a2fa5abe9316db5a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613533, "uuid": "765797be-5bdc-466b-b5d8-f81610b0df88", "comment": "Malware payload (DanaBot)", "value": "133a14cf9fd58af8494c0020faa6246cf614bd9d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613533, "uuid": "357ace10-f262-483a-9f0b-32499db175cc", "comment": "Malware payload (DanaBot)", "value": "4014170e8e090c66278ca4198dc40142d856d850372b05afc10c7846ecad07448ff964a0234e4c2a82b6882ec78c2c72", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613533, "uuid": "dbafc382-f134-47b5-99d1-2cf59851b0ef", "value": "D856332162B08075E6FF15F4E9A986782A3A3DE9673C50FF12C226DE45276D58C3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613533, "uuid": "a8915d9c-a2b8-4f26-8121-a911afb5872c", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613533, "uuid": "ec213174-a53c-4cd0-af4c-502f39497828", "value": "196608:eJ/u124V5RTvZcgPlOs5a6wrs7FTynQJ:M/u1HVvzQ+JwrsxTyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613533, "uuid": "e332d2ab-1327-492b-9b21-f19854009925", "value": 6350848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613533, "uuid": "adb73167-d7d2-452d-87d4-6ed0a48a521a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613533, "uuid": "f87cb18f-4bed-487a-b1f0-9bee35c94fa2", "value": "627abe7098689569c23adbac05c28fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f29cc3a-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609562, "uuid": "7eb4896b-4e2d-4831-8afb-96703867674e", "comment": "Malware payload (Dridex)", "value": "b3c8d4634167ee5ae44e87f4f0dac7ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609562, "uuid": "2802dc8c-88af-481b-b47f-3303ce03908a", "comment": "Malware payload (Dridex)", "value": "3ce49313f030a16de2d95ee20c5e6275568e2fd7f29593804aeaa98986deea45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609562, "uuid": "1bd228f6-6acf-46fc-a1ba-416e408dda04", "comment": "Malware payload (Dridex)", "value": "c643b60f0334738657e170b1f18f6df9febbd537", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609562, "uuid": "151a8a8c-c363-4d7e-8340-e15ddb121cd9", "comment": "Malware payload (Dridex)", "value": "216c5722b06f4851205d91f779cdb77bcde8e6a29fa640f0d744feb07bc951286730b2eae0602407d63c846dae61fe38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609562, "uuid": "c90ed473-ba5b-436a-bcdc-d50ce37ff7af", "value": "CB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609562, "uuid": "8c423b66-6779-45b7-8714-823831a0f9ec", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609562, "uuid": "fb4b32c6-5a7a-4b66-874c-a9a0ec5dd7bc", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609562, "uuid": "e2a533e1-e031-464f-863f-a5434c454a00", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609562, "uuid": "a66ee9b4-7ba1-4aee-a664-49b0c3d24e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609562, "uuid": "20d04a0e-f226-46b6-9d0d-a8b9c7022af3", "value": "b3c8d463_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556a1028-ba01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580045, "uuid": "a23a12cf-7f0e-4da3-8ba6-5ec0cebbb260", "comment": "Malware payload (Dridex)", "value": "3c8ccf41d5c3c2e1f97b1739c8bd48ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580045, "uuid": "30ceb861-ce97-4cde-820f-fd217e2a1d59", "comment": "Malware payload (Dridex)", "value": "3dbc7f183d88f9fd8433c485406aed82a66d5c5a89644eedb6791dc37ef3abe1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580045, "uuid": "42f04c86-474a-4a7d-95b3-2ee20eb6dc0a", "comment": "Malware payload (Dridex)", "value": "cfa10d355b291f20e6e7eaa04032f10858346091", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580045, "uuid": "b259ab0d-3669-45a1-9b7e-4bcbdd187edf", "comment": "Malware payload (Dridex)", "value": "abe81b3b7d2d23976e4143643c2af0c85674e1d9b6f0e59acf0cc8e5b1e4ed4f9497665e24059a2522c48d87199916e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580045, "uuid": "09ff3057-8a42-49bb-9a40-60a45c6b9f2b", "value": "C404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580045, "uuid": "9c18baaf-8699-449c-9773-c3de248d3243", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580045, "uuid": "d2e1e371-0b28-4d2b-a2e0-771fb4960829", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580045, "uuid": "80316091-cab3-4575-b1af-4a8fb02ffe28", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580045, "uuid": "277093aa-0af7-43f2-a50e-efbf9a84e060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580045, "uuid": "cf04b442-ab3b-40b1-91b8-6d502fbc8a13", "value": "3c8ccf41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bf931e-ba40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607231, "uuid": "44e1d24b-f992-48d0-84ab-01b4710f75aa", "comment": "Malware payload (Dridex)", "value": "47eb0e6f73cfa3243f3f74e699477e76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607231, "uuid": "c849820d-8bb9-4528-bcae-cb5549b06224", "comment": "Malware payload (Dridex)", "value": "3e7ec3cc0c8f5144d8e48bf7c2094ae75717e33be3098f460bab822bd7a8190f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607231, "uuid": "44941ff1-2db5-4ce8-83e3-35229a1cb38b", "comment": "Malware payload (Dridex)", "value": "b916087e065bc0a635f6a3478c65a20dec322997", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607231, "uuid": "08d8f677-835d-4514-9e6f-c6f3c8210e16", "comment": "Malware payload (Dridex)", "value": "36458d834274a6cc40c316b4ccd78e3eea501e150b3035bcf21f3bb32354b55b3519f1d1cdb277b2d9bbf6ac8971b2e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607231, "uuid": "6166062e-9a8c-489a-aca6-de818003ae23", "value": "E4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607231, "uuid": "74d12d9b-92bf-48f1-8c3e-f003de4c1acd", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607231, "uuid": "017e8da6-bc47-4c96-9882-419e78079741", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607231, "uuid": "e923a0bf-4c4e-4785-af77-d349b06936aa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607231, "uuid": "141e56a6-0414-4000-9222-d8dfe1273c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607231, "uuid": "7730df2b-b4b4-4c60-b667-57570b949f3e", "value": "47eb0e6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c8736d-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621611887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611887, "uuid": "5f9efae3-5a24-4ad8-9c33-d9d8bda50400", "comment": "Malware payload (AgentTesla)", "value": "371e7d753016191705778e99fe1d22a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611887, "uuid": "12a53e19-b458-4721-b9ec-e4471dc35f5e", "comment": "Malware payload (AgentTesla)", "value": "3e9d3486c11343201d2251b1cf78147ba2d57241b888ea07d841c59c13756891", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611887, "uuid": "3b93747d-52c1-48ae-bcb8-43bf9059af8f", "comment": "Malware payload (AgentTesla)", "value": "ccd96d52229747854650a8fe52d9b8c34edc8b72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611887, "uuid": "102313fa-91c4-46f8-92b3-7dd1a5e033c2", "comment": "Malware payload (AgentTesla)", "value": "15a7ec5a3ecaa85ae5732ea51ac908a2a01298e945f9e97df90662c825836bb85ee14478f9e6e54caec143d07187e360", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611887, "uuid": "910da7dd-964a-44db-97c6-c9447b02ae0e", "value": "EE256A233EC4D65CF0E90A3D04FD40523FA3E8966A1ECFDA68D7736C49A2552F621A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611887, "uuid": "3b023f3d-50d4-4a0a-9d6e-dcec0e025c7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611887, "uuid": "9edf2213-d9ad-442d-b972-5032c7e75aff", "value": "12288:kuEhYM0KzRA4FyAVD/bJavdknUb1kzLAWs172l3rf+MjF/sRgTj7/NSfZ6:tEhDNzR8ARNdVsYGAF/ygH7/Nis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611887, "uuid": "573c6cb5-855b-4fe2-8a4d-ec59f60e69c7", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611887, "uuid": "6306607c-b885-4e74-b574-0ea35b616b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611887, "uuid": "ebc4f5a5-ff14-4cfd-8922-7989728de633", "value": "INVOICE 3435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf35197-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613530, "uuid": "f4d22d6e-18be-420c-9f97-7aac58e23702", "comment": "Malware payload (Dridex)", "value": "54b8d5544952612dd7d1cc784ae08c13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613530, "uuid": "13ac7cc6-2e7f-4d64-a107-7142f2e89740", "comment": "Malware payload (Dridex)", "value": "3eff257557691c4891af7d6edf6dbf667e74033a56dd17120d59a245d4c40ed3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613530, "uuid": "4fa113bc-47b7-4a53-bcea-6fe32076c11b", "comment": "Malware payload (Dridex)", "value": "4db05917156371032daa6b9a3565c148a0ed2fce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613530, "uuid": "1c863000-a77f-4820-bf94-e925b151da94", "comment": "Malware payload (Dridex)", "value": "ac2684ad58d97c09b11b61378bc0f588e725368c0c5303b0aaf63311aa21ec80ec9dd93e293fbca30b9f0567b26ec20a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613530, "uuid": "79d206e9-dce3-4f7c-8524-57b68c52cce4", "value": "2504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613530, "uuid": "dca4c3e8-788f-4d28-85b6-299bdc001ab0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613530, "uuid": "81aabea8-d089-42a3-bf3d-fecf1dc28a06", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613530, "uuid": "a9571757-24c6-474b-b921-bc068e6518d8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613530, "uuid": "6fb57648-b682-4641-a1e5-3014bee1cd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613530, "uuid": "75643aa0-4c25-4ae5-8ff0-983fbfb60caa", "value": "54b8d554_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f2fb25-ba40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607351, "uuid": "f9279e24-3d58-41ff-8f33-6e45b174324e", "comment": "Malware payload (Dridex)", "value": "70fa1ed91b2c805a3f4a4ff5ddcf930e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607351, "uuid": "e6cba578-ba76-4b31-b40d-5e52b8c19614", "comment": "Malware payload (Dridex)", "value": "3f1de42134685a7805b83aba77a641e1f9d26a12423bfc7e20401a25a83f1e94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607351, "uuid": "bbe15b45-d326-4308-a7a0-719d426aebc2", "comment": "Malware payload (Dridex)", "value": "a36f05cdd48f9442324cace279a341a870862d48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607351, "uuid": "1de914ce-c504-4136-afe9-d25cba2f3340", "comment": "Malware payload (Dridex)", "value": "f64f5ddbaa107ecf72f44d7d55291d01e79c648fb1180f3bb6c73620f452452665d038a763c97ba6ccecfabbc4fb9e51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607351, "uuid": "9559065f-dc09-4351-8b9a-d33a7902d420", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607351, "uuid": "20269be5-b177-4f9b-8caf-1a95371bc9eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607351, "uuid": "df32237e-e341-4103-ab22-c333b4b2060a", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607351, "uuid": "b124ddb6-916c-422d-b2af-60b32c75f735", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607351, "uuid": "1e8bf6c6-d8d6-4a6d-a6c9-ea8a6d8f205d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607351, "uuid": "aa1a908c-fbe9-41e2-b07c-3ab4adf0b21e", "value": "70fa1ed9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f718cfbe-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573015, "uuid": "1b8ffc13-4036-4f23-a219-fb91e2308b24", "comment": "Malware payload (Dridex)", "value": "17d9725cbfc307664cdbc00479305d12", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573015, "uuid": "7ae0d519-9bb8-45c1-9f2c-8e8d99534871", "comment": "Malware payload (Dridex)", "value": "3f3f72152cfd27d57c11d4535bf6a38fe77b8ed30d820b09b9db6fd750ad1e6f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573015, "uuid": "b14e9b79-342d-402a-a526-c575a5e5583d", "comment": "Malware payload (Dridex)", "value": "a3af1b9afca4ede532827106e08bd833d667c062", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573015, "uuid": "bcb6e00d-d12b-4938-bca7-95dbdde37e95", "comment": "Malware payload (Dridex)", "value": "f40a658695b4e39f909ee70c180af93febffd4af3afb3016df4e1707b1c2579c620e5f6b24b27e1194ba48c3899fe0f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573015, "uuid": "f9c433c3-beca-40b6-a327-f3f6c7a3dd18", "value": "48F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573015, "uuid": "7b692aa0-d6d0-46f5-be1a-f0be12d186ed", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573015, "uuid": "3754dc94-55b7-4f86-adb7-cd076600966b", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573015, "uuid": "8c48b6f7-b38e-4d70-bb36-80e2a75ae8da", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573015, "uuid": "25926c54-042b-4bf8-84bd-88db3e563c7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573015, "uuid": "91098ddf-d7d6-4e38-9196-bb1f1df7fb1b", "value": "17d9725c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03e6d68-ba16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621589324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589324, "uuid": "bc863ebe-8fb7-4a45-aee1-a2113e871d4a", "comment": "Malware payload (Dridex)", "value": "17851b6a201e9d5726e423c49a0304b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589324, "uuid": "715c470c-8451-45f5-acd7-80fc4fd39f57", "comment": "Malware payload (Dridex)", "value": "3f700f48f8da3a43ff294535c9407025dfd8e52d21072d261f11d171cbbb310b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589324, "uuid": "0bb5591a-c684-4ddb-8467-c5ddb712793d", "comment": "Malware payload (Dridex)", "value": "930d9cf5b2b3f6a8e1e31dffe3bac467fbca808b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589324, "uuid": "2e127b73-980b-458d-b35d-ba0b3316fc93", "comment": "Malware payload (Dridex)", "value": "443edbe2878c7c80955773b0171de076b37ae4055da6005ee197e027466f0fb13784254ba6ae6f52f83965a45a6b499b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589324, "uuid": "2d04ae45-e0fd-4938-ab15-eb2750ee9b46", "value": "9404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589324, "uuid": "c484dfe6-2665-47dd-a363-5fa21bc9439d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589324, "uuid": "069dbbda-9994-4050-b1ad-dd192e2994eb", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589324, "uuid": "15316596-c93f-4980-9063-e415d6e6e11f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589324, "uuid": "5d1c6bce-7159-4a5a-8500-b5d97150cbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589324, "uuid": "e2a11eaa-1a69-402e-827d-d3ef8758ef7d", "value": "17851b6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b13c2c-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570442, "uuid": "61c84258-ded2-40b8-bc1e-60412ea373c3", "comment": "Malware payload (Dridex)", "value": "b180afe81aab46e2df936a2f8930ae51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570442, "uuid": "fd03751c-bb9b-4008-b961-7410c032eaef", "comment": "Malware payload (Dridex)", "value": "3ff8fbc7d5619b95c8c0cf8a96e51751b10162e6492dcb779b135d8670577a96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570442, "uuid": "f5789a19-9234-4ab1-b46d-3aadef3fbb84", "comment": "Malware payload (Dridex)", "value": "c267e5c668c9bc989075f3bb32e32539eeb19813", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570442, "uuid": "11d70e19-1ea4-4de7-8eb6-3e0a2e4d7f84", "comment": "Malware payload (Dridex)", "value": "f81a18506a60363f1418bef0fdc31be32b8a069500b32cafe4084332e900f451a9c1cb5a96f55136ca1e16695c7efcc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570442, "uuid": "7056514c-efd4-405a-b001-8df82116f432", "value": "17F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570442, "uuid": "76354aff-f5d6-4463-a9c2-302f6d2de7d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570442, "uuid": "026ed900-f3e6-43f4-8993-d5245d6f5820", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570442, "uuid": "c87531f7-f823-4071-bad7-de71962c7ce2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570442, "uuid": "10a1deff-36c6-4929-8f7e-dbcec5ef9186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570442, "uuid": "1856f144-b000-47da-98d6-ef8a461a9c0c", "value": "b180afe8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810b2776-ba28-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621596869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596869, "uuid": "214db35e-afa9-4984-8dc1-a67bc9e643c4", "comment": "Malware payload", "value": "bffd9223570c1f33185c3f5cd6d484f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596869, "uuid": "9f6153d9-b6ce-4661-8456-bb56051e660a", "comment": "Malware payload", "value": "4043228586f0be74d06539227438d063127b5ee4538d5211bef9112ef6344089", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596869, "uuid": "db190e0a-c5fb-4294-96ea-fe7a551f866b", "comment": "Malware payload", "value": "8384464cebb311d27caa3a9bbc29ab01f6aac3fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596869, "uuid": "32203be0-bc48-413b-b391-1393c8f5d782", "comment": "Malware payload", "value": "44ff921a50887f566c77db68d4040835f9019eb0987b840eec58fee42185a201581edfc8d132a53c8f455eea0aedcb20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596869, "uuid": "f8304f21-908a-401b-98c0-f5430b3cf860", "value": "326423F211DF8CA7AEE8134BD4DC5222CF0A87AF0A95FC24E48498E65D5A9FF4D39054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596869, "uuid": "e82b2cfd-7111-48b7-b32d-01361b5f80d9", "value": "6144:KzXkfjLHB/itlPi67QADfHKiPUlRXoq3gNq+dL8LJXQvWiClJWxrmIa6JUrmr8j5:iSNIBHKBRXowgNq+F8LFQei+gpmDJrmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621596869, "uuid": "7a61c8a3-620b-4d8e-9cce-dbbba1943b40", "value": 326935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621596869, "uuid": "6212f45e-3b21-4d01-b934-9aa8fd873de8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596869, "uuid": "0427846c-cd61-4a52-bf4e-0f8225afd5d9", "value": "Cup\u00f3n2600306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb4f164-ba68-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621624166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624166, "uuid": "9f1c36ba-1fc1-4989-85e8-710e56bc9353", "comment": "Malware payload", "value": "a2cf3c1dbbde1ad2dc89784154b74b22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624166, "uuid": "c31e57bf-f082-4cc7-8e51-ca65bab13eab", "comment": "Malware payload", "value": "404c2c2d42e4af9639a42ffbad82f3ba7bdefe70f514a6aa0576aab4c4a95792", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624166, "uuid": "3267dc13-3d2f-488a-9857-dd283887c536", "comment": "Malware payload", "value": "4c3d0664d63e34834be242b1ae8e6f55e28b2d94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624166, "uuid": "08353fa0-12db-400d-85e6-7d26bb32cd7d", "comment": "Malware payload", "value": "ac62ae9d1ee15f985bc363135e7f5cfcab379de711893e224c958e8474582f5897d3b285b6d619a133c8726dafcf5063", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624166, "uuid": "89243bec-1f80-4c7f-a814-678469f30707", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624166, "uuid": "1781b769-3515-446e-ba49-aae3a9e92009", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624166, "uuid": "302b7f86-aa4a-4d23-8177-bab2470463b5", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624166, "uuid": "2565eeea-c5e7-451e-99cb-ef4a722774b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624166, "uuid": "840bc567-35de-47dc-9b18-621f21d5bef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624166, "uuid": "0d5ee48b-c1cb-4e22-821b-fd7a36fb1f96", "value": "a2cf3c1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5524fb12-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616981, "uuid": "ce1baca8-a2ff-4da9-a57d-1ccf12becfd7", "comment": "Malware payload (Dridex)", "value": "f6c8f161d50d31e9c2be53435f41126c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616981, "uuid": "558326f9-af14-4fae-afbd-00ea18bae332", "comment": "Malware payload (Dridex)", "value": "4057ab03399d2bbca5fdb061a221077728cdb525b1eeb0f324a87f3a51674bc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616981, "uuid": "dae8ee44-5dc0-4083-b0fa-f15ca9552dcb", "comment": "Malware payload (Dridex)", "value": "785070d264a5f8550e37ff203839eba92feb1b0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616981, "uuid": "39c4095d-cdad-4300-9634-13e10bae85c8", "comment": "Malware payload (Dridex)", "value": "c49b408d2c37d1e821d6e0e75fae0d02ae98ba9f639bcc9b5d98ea192b1faaccc4e5ef6bb7bc34ee2328fc91933b5d43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616981, "uuid": "e438f113-09fe-47e2-85dd-f2438d1794f6", "value": "3304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616981, "uuid": "11838eff-71c4-4461-96ab-60cb116d8458", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616981, "uuid": "c26fa03f-85d0-4fc8-a497-465d65446fcf", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616981, "uuid": "03ce3e2f-8180-4c98-a7aa-ff13941dc266", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616981, "uuid": "16f70351-1344-488b-a471-a4295947c856", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616981, "uuid": "ca637155-50b0-45c0-bc17-f43500175ddb", "value": "f6c8f161_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a574422-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570094, "uuid": "03365420-cb7c-4519-8a70-0eabce8df20f", "comment": "Malware payload (Dridex)", "value": "a645ea02758ec7874e4bfd38552022cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570094, "uuid": "cde1ce2e-62bf-4fd6-9966-d0c9b4347840", "comment": "Malware payload (Dridex)", "value": "40788053b10fbdaeda8b553639a9a3daf6ff4908d76b1d15a0e321bad43ec016", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570094, "uuid": "b4e894b8-6201-4d0e-99cf-7f322619e214", "comment": "Malware payload (Dridex)", "value": "9877103c0ab109d7c2a444b08cd4c21688c70504", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570094, "uuid": "92fba2fe-ca5b-49c9-9efc-0170db693112", "comment": "Malware payload (Dridex)", "value": "a678f78888f3f8e5533990837c7bba4fa68feb87f8075c0c6942026a57ce35b768c25a9ed441d2482f201dd47185d1c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570094, "uuid": "7b2d2a47-8f57-48f2-9fde-a9b964f074f2", "value": "B104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570094, "uuid": "bb310084-1c9d-4cb5-92c1-46a722c4806b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570094, "uuid": "d009b1fd-56eb-4a39-ad8a-a564d4bfe177", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570094, "uuid": "9e3e0297-e199-4041-a1c0-55a7108efc55", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570094, "uuid": "6a9b4e4b-8b18-472a-8d7a-b60c06b7ba22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570094, "uuid": "8e35a6a4-ebc0-46da-980d-50f18a86f7c7", "value": "a645ea02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29830be-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565169, "uuid": "355c2a01-8baa-469c-80f1-55e4859e324d", "comment": "Malware payload (Dridex)", "value": "3f4ba48a291c4680761c6959dc75d7de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565169, "uuid": "ef878681-4654-423e-b1d5-1a01a2005738", "comment": "Malware payload (Dridex)", "value": "408f5873adb7de505707695d704e96daf45fc71836d7cd88dd186e5eb6aeebba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565169, "uuid": "f13f1fb0-f3cd-4438-bfb8-83994629843c", "comment": "Malware payload (Dridex)", "value": "f16023ddb0e173da28827ba7c3aac8c38b445288", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565169, "uuid": "7717fa25-8012-43bb-8fe2-1517ce5e4c33", "comment": "Malware payload (Dridex)", "value": "2a1d05eacf83df8060a17539895df2df9c30cf25cf8466d7e33f46e58d1e2c7ffd15e43cffce84c4e94922d668f30f05", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565169, "uuid": "ad1f4f03-115c-4216-8a71-ecfe0e5135de", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565169, "uuid": "ad2d5d4a-4c37-4742-8098-df60d5bf43d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565169, "uuid": "47e3ea36-b556-4f72-b310-962a90fb5850", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565169, "uuid": "5ae7e531-581d-437b-a678-a052a536bdb2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565169, "uuid": "3a44f436-4dd4-4f9d-b35f-ef5ddf57bb13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565169, "uuid": "68697aa5-6e30-497e-941e-52a126bb28bc", "value": "3f4ba48a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53055a59-ba64-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621622561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622561, "uuid": "70cbda9a-5093-44fe-81e5-53589f11e17f", "comment": "Malware payload", "value": "3ea38625043b93f3260f6b4288cb2034", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622561, "uuid": "63ef1057-bbc6-4abd-ab90-8058eebd6bd8", "comment": "Malware payload", "value": "40ada360d7e27d6d9c9c80b81fad2b11008c460dd3c106859e5be163bb7cc523", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622561, "uuid": "93e1833c-b8e5-4b93-b1f0-e279a91882c3", "comment": "Malware payload", "value": "34d36cd630658002b5a01d1e4404c6cc6c7129b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622561, "uuid": "20f7a700-0625-4c3d-9ddf-3f6d8af279e1", "comment": "Malware payload", "value": "7e9d103fabc10b71dd8504db9a477a117760e5b8f36ce7a6f67843d27d563f5fb2ccfa371a1b17895d25a57d2546d87d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622561, "uuid": "f68d70ef-6f94-4469-9b2f-4946ddac30ce", "value": "9805335AF1037D760B927E75E7A7FB4A644A4C219294838141239FA3DBF91E07C2AF34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622561, "uuid": "fec4729f-e275-4fe3-9491-ef8de7e10795", "value": "24576:elO9e1UB4uEwdIz7t2eFAgHZIO1yTU/t4YJFhZTp0L:elZCrIN2OHZIO1Xt4YfNp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622561, "uuid": "a532e23a-e6d9-4c90-a090-971f5456a97d", "value": 809033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622561, "uuid": "ccca9439-b946-44ad-bbf7-9f69cd259410", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622561, "uuid": "9095a12c-dea9-44b9-bad4-fd047eca186c", "value": "3ea38625_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5b493e-b9ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572593, "uuid": "633b2216-fb2c-4d50-ac68-bf3400519194", "comment": "Malware payload (Dridex)", "value": "8a4d8b60fcf86ee4b3012af0420c9ea6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572593, "uuid": "3383000b-52fb-4a6f-b455-8f9a68037cf5", "comment": "Malware payload (Dridex)", "value": "40bca0e9e876c9f64318cdb6f5d948e633012f1ebcb86708df42109cd523d6e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572593, "uuid": "4c516d18-94a7-4f18-8885-deee6916c596", "comment": "Malware payload (Dridex)", "value": "9f3c37368d027350d45065b963e3a40a7aebeb7d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572593, "uuid": "61e10508-a47d-4fa4-8860-7ee51f55262a", "comment": "Malware payload (Dridex)", "value": "7686cc60895f742c2491131217622ecfefc1eb4c0a60216a85655de4d7d0898b770b31fee2b56ae72cdd81c7719e5bb5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572593, "uuid": "b1794afd-3c58-4a34-a8d0-8d35caf3a11b", "value": "D404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572593, "uuid": "dee18158-94bc-44f8-87fd-41dd59ba7d77", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572593, "uuid": "bda215cb-aabd-40a3-b57e-3c3a70a4499f", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572593, "uuid": "13c05859-7a38-4934-a8ef-41a206642573", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572593, "uuid": "d531046c-5d91-4217-9f88-10ec77f007bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572593, "uuid": "5b52405c-a83d-4ccb-a12c-005bcac8f314", "value": "8a4d8b60_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15bea89-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592735, "uuid": "170881bf-6f55-4e70-9be2-e887fbd202d9", "comment": "Malware payload (AgentTesla)", "value": "1b1090b20f6ee67167472a8c23e856e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592735, "uuid": "bcf8e309-8ae4-4e43-b608-3b566be9678c", "comment": "Malware payload (AgentTesla)", "value": "415bf06895e744fff7cd54f2c1c240824868ed8b45b7d9f5f2773ad77d3caa7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592735, "uuid": "56b01bd7-618b-4737-9902-a2acf1e3da53", "comment": "Malware payload (AgentTesla)", "value": "9d407abbf994d377352717f42c6d6b02e223f2f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592735, "uuid": "d3c92549-9905-45b4-b55e-29230c878e8a", "comment": "Malware payload (AgentTesla)", "value": "4608082c4fa4c19287e1f977567cd3f16aefc4859396b62a4967c0a8eef77b95c1b8e6806537efd824dac02ff6b2fc60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592735, "uuid": "4b36069a-7320-451c-b0c7-285935833ca0", "value": "85810BBA5E345C02DE56C1A39572F9A953E93A4145DE9588F77C18830B53350FC03C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592735, "uuid": "8422977d-c471-4109-b270-2941f5e8a10d", "value": "96:pISU8DhjONKglRAH63DQ90NVFpd9engM0WUU:pISU8DhjONKglRAH63DQ9eVFp7Mnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592735, "uuid": "5dde7321-1ab8-431c-97ec-fff405c8d39d", "value": 3903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592735, "uuid": "b9328c38-e2d2-4a1a-befd-00c12d29d944", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592735, "uuid": "e7a19f7f-0d2b-469c-83ee-2ccea1650ad5", "value": "PROFORMA INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637ef2d5-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575344, "uuid": "4463bebc-a3a2-4d5c-aca2-f191f06cc4f5", "comment": "Malware payload (Dridex)", "value": "65168809bf38bf0a015e1765dcc59e52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575344, "uuid": "819616bb-b526-4260-b2a5-9ae23b685e77", "comment": "Malware payload (Dridex)", "value": "4192766f8a6398c515479c83f83247513973e4a96ea4d94eaa20f3931c4c0472", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575344, "uuid": "b285b4a1-2a3b-4c19-bca5-5a369fb0e53c", "comment": "Malware payload (Dridex)", "value": "4aac9072ce37f7c63e4e859e950083209f8e3628", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575344, "uuid": "a0841ebe-4bca-45ca-9a0a-a2fc243be360", "comment": "Malware payload (Dridex)", "value": "42ceb91e6516317a1e5424a142991d3a15c0da58f3b37c970ba5b3ff8ceb9d6709561630d5835e9388641c73ea92bc21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575344, "uuid": "3ec5e666-d053-417c-8a86-eb53cde61f00", "value": "3F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575344, "uuid": "bf2ee242-538a-4dbe-abc5-33556dbb9e97", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575344, "uuid": "21764627-60d6-4061-a6a8-17178ab7a9f0", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575344, "uuid": "58c32de7-7f15-4c02-8b7d-612689546f38", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575344, "uuid": "abe66bb1-29d4-45ba-b8e2-4bc239d93530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575344, "uuid": "5c7ba7c9-c8b8-46c6-9bcb-32060c8d65c9", "value": "65168809_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c811228-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575869, "uuid": "8d458cfb-b9af-4fe4-b9aa-55c8dd5b692d", "comment": "Malware payload (Dridex)", "value": "2bf3e38ea01f7b4e35482c56d50b827a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575869, "uuid": "16a7d5d8-86dc-41f3-94a5-eed6fcf7296f", "comment": "Malware payload (Dridex)", "value": "419b2cbccbfd184f99a246a7e2c963748fac74da528a23760132f90c6e6fdc81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575869, "uuid": "b0e2448a-7c54-4992-b9de-fa11378976c3", "comment": "Malware payload (Dridex)", "value": "d9d956086e5fa067fd55995aaff2b27a3a31ad83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575869, "uuid": "b9b8d858-e0a2-45e6-b88a-2b51b138afaf", "comment": "Malware payload (Dridex)", "value": "4ffab19351f5456ea776021484b6590589e3884443a8d282ba4cec0dcb077be0fe7935c3ddcf9d0c035da8bb4da275b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575869, "uuid": "2d29b87a-3876-42b8-b1d5-dea9ac86c41c", "value": "2BF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575869, "uuid": "9c584403-8809-43cf-85e9-432049539e22", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575869, "uuid": "e37ffc61-67fb-4bc1-b785-5b6906802a12", "value": "3072:jIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575869, "uuid": "e0d7cb48-6f05-429f-baae-5464a25b6acb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575869, "uuid": "1b5a6993-b5c6-4b12-bd78-a393b58c5785", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575869, "uuid": "d2d5b48f-37b4-4238-990c-fa9577523e8a", "value": "2bf3e38e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3801ba-b9d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561539, "uuid": "e36fed4b-edcc-4e0b-ad8f-65d004b47d45", "comment": "Malware payload (Dridex)", "value": "7f2fee28b43b37623fc6fac3e8dbf2ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561539, "uuid": "c0c39e10-abbe-49ef-9348-127deda953fa", "comment": "Malware payload (Dridex)", "value": "41ec433f366432bfe57af0f6720a54b8fa4050f9b5c8d62158710b77001206b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561539, "uuid": "3fbd2582-78e4-42d1-b216-966b266ee2ad", "comment": "Malware payload (Dridex)", "value": "dcb4bafacf199b6acb56ed05575a00a44be9067c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561539, "uuid": "fd123b2e-2e79-4574-a354-9d5a9acbae0c", "comment": "Malware payload (Dridex)", "value": "519c35cd4007980182366492d393230493fbcbde553ef55d683a8f162e9e633c0eb1bd0c8ab308671b6d457d235ccbc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561539, "uuid": "56133bbe-7e76-40da-9b67-5d3f6b76c336", "value": "7204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561539, "uuid": "cc6eff3a-6d14-4a91-b065-72efd1f65d0b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561539, "uuid": "62238f83-45a1-4fff-983c-ded8907a9a2e", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561539, "uuid": "cc0b45d0-baf6-4ca4-b2d3-35545571dfdd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561539, "uuid": "a523b500-5d31-4705-bc4a-0f80354b2ecc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561539, "uuid": "6366820b-cf0f-4a5b-8988-e2114a4f26f1", "value": "7f2fee28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62064f41-ba06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582214, "uuid": "d1de4dbe-a256-4b21-9c12-5520e98849ee", "comment": "Malware payload (Dridex)", "value": "925c498895f07d973222c91662619c6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582214, "uuid": "046bb803-033e-4690-8d4e-e45fcf866202", "comment": "Malware payload (Dridex)", "value": "420f3bb8a6ef6f78d57796d9ff454c653435b7945dfa896b5156e763e1fe1271", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582214, "uuid": "b3f62b5c-72fb-41dc-a122-391ea3cacbf7", "comment": "Malware payload (Dridex)", "value": "30d04b84aec48073b5713ad3961adfa0c1c18dab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582214, "uuid": "8f6f094c-0354-4e6b-be98-1f06339ae132", "comment": "Malware payload (Dridex)", "value": "45e9e9f966c2caec28dc0f4d900d62a18fb50f371dfd19f61e701ec9d602eb1726a366b5d1168e5a8835dae9d8666249", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582214, "uuid": "992a3d0e-f215-4cb3-9643-f8d76cfc6848", "value": "EC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582214, "uuid": "d92abcae-6216-440a-9ac7-3e520ffd622a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582214, "uuid": "4513e96f-31de-4dda-abd8-4781d0f2748f", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582214, "uuid": "6c3b77ca-a946-4505-800e-d71a1b58c819", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582214, "uuid": "ef26af61-37ec-4bcd-88c7-7abac95fccc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582214, "uuid": "f5262036-7b52-4da8-a8f5-6946d1ccbc69", "value": "925c4988_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150ca0e8-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634483, "uuid": "0e83ee9a-f02d-47d7-9914-7c5e8995ccb9", "comment": "Malware payload (Dridex)", "value": "67d3a78006ea92a150814a927a48f5cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634483, "uuid": "b4f51a95-f4f4-482e-8335-86808a61cbcf", "comment": "Malware payload (Dridex)", "value": "4229ef011c6a97243dc5ee77542d4885160e26b8ff06ca481c42af037bf3b2fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634483, "uuid": "bac1dbee-418b-4e18-958d-b67742d079ec", "comment": "Malware payload (Dridex)", "value": "bc1b1c080ea9daac2731fa0175db8664b4c84c76", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634483, "uuid": "728f2e4f-5003-44e1-bd13-e254de3eb3f6", "comment": "Malware payload (Dridex)", "value": "88c7457f7fd74db80156e248ea13b01aad0e3433c8b99738fe127864b6645dba7dc5cd701e4d8ba70ac113af210a554a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634483, "uuid": "50c0dd40-a4f3-47a8-9b2c-85a08000444e", "value": "03F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634483, "uuid": "0d58fd2c-294a-4717-aabf-5c1866395531", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634483, "uuid": "ef5657d5-e12e-4c04-9298-769e680df76d", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634483, "uuid": "c96ca609-7788-4af7-8a59-d9b5bed9cbb1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634483, "uuid": "e16d2253-a3eb-4c1e-b19b-377381819475", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634483, "uuid": "d2040c78-9ad9-4c3a-94b1-557980192151", "value": "67d3a780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6d79ed-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575255, "uuid": "5824109b-cbf8-42a8-b520-49f120126bec", "comment": "Malware payload (Dridex)", "value": "4493d11abf0d036734674f7c46fac814", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575255, "uuid": "ddd41514-fcb0-4ced-ba45-5c1d11f6208d", "comment": "Malware payload (Dridex)", "value": "4258fe0a7087043c52f717199cc262de64cf38fc4dc5ab41947f21d59a3432d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575255, "uuid": "83c289b2-c11f-4b16-b7fc-f8019ee0c821", "comment": "Malware payload (Dridex)", "value": "95001dad96be7c13ea355c93e8bc2642d6246def", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575255, "uuid": "a1c99e3a-1a9e-4f48-82d9-a83af4cd82b2", "comment": "Malware payload (Dridex)", "value": "9c0bf6da78a377c92e5e00dd92f396decfe7c63e2cf5930f9f65f5f3dfd2fb95aa76ba188a39e8ffdc8585782cdc072c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575255, "uuid": "2dc2c8af-4a25-469f-8283-16828e76be3c", "value": "A604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575255, "uuid": "cd160d09-b6d4-43f5-86ce-6e8eaca3c1b1", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575255, "uuid": "6579c644-1e65-42ba-8773-a3feecf2b59a", "value": "3072:Xi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:XH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575255, "uuid": "a1b9b45a-d478-4ca1-9ff7-63178fdcbabc", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575255, "uuid": "9e148b6b-4037-4a35-b308-94c5fbbb474e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575255, "uuid": "7e24f46e-fe90-460c-bd1d-467e8057921b", "value": "4493d11a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60115541-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621611416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611416, "uuid": "914cfecb-0c60-4e25-8444-8b5e2812f5bc", "comment": "Malware payload", "value": "267a490785c46cadcd1a6c1ef9b907a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611416, "uuid": "b89de74a-6b22-4fb1-ae53-51d3649b8807", "comment": "Malware payload", "value": "426e6aae097b5efcb5c9ef111ab068bb94ae0d65c458a9eb1d20c4ac5928c085", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611416, "uuid": "7b45164f-31a5-4fea-acee-47e1dfafe7e1", "comment": "Malware payload", "value": "5ec767c3e227d6639388c9566271a7f0a5d2ae5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611416, "uuid": "641c537f-cbae-4caf-914b-78dc6b42d7d7", "comment": "Malware payload", "value": "774f0507f524a80e53d2a99dee9f48b3d807bb487e31d5b83ad83f44c55210876e455cbd28c130c8cff3da40ec2350f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611416, "uuid": "8d57df73-fb38-4dc2-913c-2b0f734f1e1a", "value": "18253B7A6CF9A677CAFE8F3E52733C1986A16953708440062663F7C45891F39FB0B960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611416, "uuid": "d834801d-4efd-43cf-bc4e-d894c74f3e1d", "value": "12288:0MlASyfzjXP3DDGj3aGs5CvkzGvxFC8HqRN0shRuTx/uIdbQSpn4qMmn1:nlDyfzjXP3DDKlC8QN0sh6/ukp45K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611416, "uuid": "e88d21ea-579b-46c9-a2cf-10ffabe72285", "value": 986680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611416, "uuid": "1a0648a6-8a71-4872-a3f8-c978e10f820e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611416, "uuid": "5908cd23-79b7-4971-a5aa-fbf094aac7c7", "value": "effdd582f1f0493797942f1f107db69f.css", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b8d613-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623861, "uuid": "83852920-7ca3-488e-a0b3-976358e0b963", "comment": "Malware payload (Dridex)", "value": "bb9efbafaff9cf65fcbfc7b0033c7959", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623861, "uuid": "c864281c-4531-4c37-a2ea-f5c86830d6ec", "comment": "Malware payload (Dridex)", "value": "42742cd00c2c4d0c4bfaec58e1d9481856b048e58b986bce565ac4068eae666e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623861, "uuid": "65898c52-1b86-4b01-b08e-95b2e46f4f0d", "comment": "Malware payload (Dridex)", "value": "26b43d1950ff294bb2ead820bb432345245c8d44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623861, "uuid": "1d53d078-9f1b-49c2-b217-8a4712523a19", "comment": "Malware payload (Dridex)", "value": "b3a169a59369f64d3c1e6c50ee7b613c78f62f7b71fa54cb18db285ac2098ebd993344f3dfaa14fd94f47a0e7c0fccca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623861, "uuid": "0c304bd7-4e6c-417c-8abb-0e3acc6f8a2c", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623861, "uuid": "48b249e0-d9fc-45b0-b5c6-db0554ace624", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623861, "uuid": "fc98a3bb-f6e2-4e11-af90-6b78947f68cf", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623861, "uuid": "1a0bfbe5-0c08-4107-a604-d7075d7a1f7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623861, "uuid": "1cbfaaa4-6805-4b2f-90f6-8e601ea5d437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623861, "uuid": "c1e026ef-e934-4eed-bc20-84610bd36cac", "value": "bb9efbaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d847eb-ba71-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621628047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628047, "uuid": "5b59615c-c15a-4466-a741-e410058d4a62", "comment": "Malware payload (Dridex)", "value": "192db12e365c7930f496a89250284d55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628047, "uuid": "52244503-81ee-46ed-b8bd-4204075d6f6f", "comment": "Malware payload (Dridex)", "value": "4297d33c5ce11db0849fc742275ef85572fddf22f6da180b97343d1ea0f562df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628047, "uuid": "6700abb8-186f-4a28-8178-575587c37bcf", "comment": "Malware payload (Dridex)", "value": "ac2eaec78e61443b9c4a0ea4a9bc67c958f23d45", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628047, "uuid": "c7890614-6db6-42bd-931b-99788f03e6a4", "comment": "Malware payload (Dridex)", "value": "e31bdd737e2b13dc13c6744aeceaea65207eafa9d18c27716ec55f472f7d667643d0b42f232298151ccc2319054447c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628047, "uuid": "75af4901-dc6b-4e36-b513-3291aa0589a2", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628047, "uuid": "013418b4-c80e-4132-9f4f-22f6e57c930d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628047, "uuid": "d69efaed-394c-4f2c-acd7-828bf48b2b91", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621628047, "uuid": "934b8476-24a3-48b0-8859-fafc6526a4d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621628047, "uuid": "d0775f32-7104-4d12-a9a0-792658b06104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628047, "uuid": "deccad6a-e923-454d-9117-ca67a72cc205", "value": "192db12e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36680af6-ba43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608340, "uuid": "186b776a-9268-464d-b98b-73ddc4b11b04", "comment": "Malware payload (Dridex)", "value": "102ff8b325bede420cb708713813cbe4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608340, "uuid": "357f5427-fcc9-47bd-8c28-f938f1db00f7", "comment": "Malware payload (Dridex)", "value": "42d1fe05794dce0c9b7dbffb2e9f6d523e2058841cd2d2dfac0eff9654b735cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608340, "uuid": "128a013b-da1e-436c-a35a-f636ade96e3c", "comment": "Malware payload (Dridex)", "value": "e60afc498866e57ecd1f27dc3291c9568ccaeb5b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608340, "uuid": "d71ec016-fb8c-4f6e-9956-2f5fc7f99caa", "comment": "Malware payload (Dridex)", "value": "6091fdb001f44dd9afd179de092ced002924d655bf321bd3be27358e032898fed927d9d4382dbe79069c62c77df9f8f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608340, "uuid": "8b43ca20-9a4f-4bd6-ad72-37fe6e54157d", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608340, "uuid": "2d6109c1-383a-46a2-8424-f72337feb6d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608340, "uuid": "988d6c37-87df-4c62-85e8-ebc2900c2bf2", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608340, "uuid": "c99c3e34-56cc-4a91-a960-3e3e6541a88b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608340, "uuid": "27d2a611-7b59-472c-bbc1-ae4daaa48797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608340, "uuid": "bb5cc0af-86ac-4755-9654-d5496d81553e", "value": "102ff8b3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8191739e-ba44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608895, "uuid": "4eae928a-ad10-4e1f-8b4c-02ce43a18b08", "comment": "Malware payload (Dridex)", "value": "6ee8790a822685ce12d117bccd705680", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608895, "uuid": "0232c23d-9ea0-4800-858e-9c95d552d4f5", "comment": "Malware payload (Dridex)", "value": "43498f86603f1a125539d592cbcd6ca7356b534de28ede00cb9dc0f8c0b96448", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608895, "uuid": "7359e577-e395-4bcc-8439-53059fff96a2", "comment": "Malware payload (Dridex)", "value": "1cb977ca4201f0d6746049a5ea0700f8fdbad67a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608895, "uuid": "1aa68ea2-1f44-4eb1-85c5-93fa9586e5af", "comment": "Malware payload (Dridex)", "value": "f9c0676f06d6b46ea86cb22cb24665dd3cb026d80d69c464c1fcc6594f0c4f5ec714e660aa326e976ebb47c7b014d881", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608895, "uuid": "d29c8c42-7a18-4f51-93a7-3d0d7c7a408a", "value": "4CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608895, "uuid": "6ae288ff-b787-4645-a40f-c446ae053ec4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608895, "uuid": "67a66a78-dfb2-44ec-929f-955a2a0571ec", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608895, "uuid": "94f55f7a-77e8-4fe3-970d-f22e8e9fb36b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608895, "uuid": "0de836c9-e4d4-4acc-8e4d-6ccf6aa100b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608895, "uuid": "70b8ff96-3947-4038-a059-8f4bf5a8e1e1", "value": "6ee8790a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dd140a-ba06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582173, "uuid": "9b284252-d6eb-4ba5-bda9-e90cffd7ce73", "comment": "Malware payload (Dridex)", "value": "4ca1336f96e216466139c4b18e96b5a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582173, "uuid": "efe4b0a2-496b-4fcd-ae01-ba902a21c45d", "comment": "Malware payload (Dridex)", "value": "434dbe30211416fcb85d06b9d149d296be954eecb8cf70a1bd7ff2df7321a7b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582173, "uuid": "eb0081c7-a39f-47c3-82f3-839cb90ea304", "comment": "Malware payload (Dridex)", "value": "954550e86627a956efa119a61694f1de3c660215", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582173, "uuid": "1eb1db67-9ff7-42b7-9d5e-5b1749d4e143", "comment": "Malware payload (Dridex)", "value": "92dca3bf489cb86a6b9a474570321b5556a8b0b1ce9667ce3616e63e96338ec2600f28a73dd463840b6d1097f2d6c186", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582173, "uuid": "c3649645-13b7-495c-9208-54246f521afb", "value": "1F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582173, "uuid": "7799840c-e31c-41ae-98d1-cef672d69c9e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582173, "uuid": "fb5227a0-7898-4f45-9a52-6d1914a6a309", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582173, "uuid": "a50d40a9-9b64-4680-b88c-2c857e87b016", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582173, "uuid": "60910b24-7239-42c6-b54a-ad83fad37354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582173, "uuid": "5f5e70d6-1950-415b-8a20-549f58f498a6", "value": "4ca1336f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366863f7-ba78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631103, "uuid": "b30e62db-8525-4a00-85e7-e21913c787a3", "comment": "Malware payload (Dridex)", "value": "9e181f86433a4f9ec17d61d34abbec91", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631103, "uuid": "fdd0933c-319c-4fdb-a249-e7767951c76c", "comment": "Malware payload (Dridex)", "value": "4365119351a9ec7ec64687a374b18a0a923c36898ba27688f0612440dd581b11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631103, "uuid": "ef009ef1-4260-4fd4-b262-0b094f318bb8", "comment": "Malware payload (Dridex)", "value": "23cbe2d293cdbd9988ba7382386377aa1918bb8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631103, "uuid": "b1260f20-0e81-4a3d-94f6-ca769d204474", "comment": "Malware payload (Dridex)", "value": "401e2f278ebd13be0e10603205cf21b9a10949d0cbc6eeeb03d47f7aab3abcf8b2c08154c3ea7c85c899704d2cd45a0e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631103, "uuid": "92f45478-1f01-428e-8710-f5c3704249a5", "value": "AFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631103, "uuid": "dfd67bb4-2f11-4a25-9709-3b220c7f1eac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631103, "uuid": "2423d3fb-1e9a-4d17-887e-a13ecc8c0bea", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631103, "uuid": "679f31ff-515f-4a48-89e8-cbdb02a5f105", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631103, "uuid": "1eac0606-7c8a-4f2d-a560-09e5fa41f325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631103, "uuid": "9beae849-82cf-4b2a-af99-e8156c305622", "value": "9e181f86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf332ee-b9d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560997, "uuid": "de7436de-10fa-477c-b3ff-4dfa73a2717a", "comment": "Malware payload (Dridex)", "value": "85554a3cb2a2720772038bc3f06bee47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560997, "uuid": "495af6f6-0f88-462b-883c-2270f50659ae", "comment": "Malware payload (Dridex)", "value": "43725f99d1307c3b7be85c90f333f049751947678c2066da4fdb09cc3c8e8ac6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560997, "uuid": "d30c8853-7eee-4197-9870-4d466659592e", "comment": "Malware payload (Dridex)", "value": "964cc64ccbafc163fe9a9ae0fd4b18ca558f7232", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560997, "uuid": "67f36a0c-f67c-4a66-b45d-8c4c0c0e0283", "comment": "Malware payload (Dridex)", "value": "7735cd3792b227213f1f76999c1854e38e04f29ac25b1d47a1cfd9b68f6bfd9165ca01c6ed3b209f2d46af15bbce6440", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560997, "uuid": "7e79b048-13f1-4a09-8d97-004b2d99664f", "value": "B204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560997, "uuid": "7a2a1200-476b-4504-a8ed-2447a38c49d0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560997, "uuid": "1451be90-670c-4b4e-9cb2-b5debba18ce3", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560997, "uuid": "707bac97-0f15-41e3-a756-7f1c8a799968", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560997, "uuid": "e5105573-f1cc-46ea-a875-a51bb36e7c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560997, "uuid": "06568b8f-5c74-4b5f-a918-d5a969c828ba", "value": "85554a3c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54c0076-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627961, "uuid": "3997f608-80c6-47b6-b63e-44857fedf19d", "comment": "Malware payload (Dridex)", "value": "d112e42b0db14121b704f2d89433754c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627961, "uuid": "70fd903f-8f93-42b9-84e1-c366e8942347", "comment": "Malware payload (Dridex)", "value": "43b7ce1daf169e19098c6703159c6db79944929848b0aca73be70c47a86187ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627961, "uuid": "71858a10-e721-47e8-9ed2-191e858cff6c", "comment": "Malware payload (Dridex)", "value": "9a8943769e5bc4fc00cfbeb02bad4a70eb8c5064", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627961, "uuid": "91bdc8a0-9eb0-484f-b76f-52311a3ae7c4", "comment": "Malware payload (Dridex)", "value": "4577373e2e60cc42ddea20beb04d9255d58a8630d7f141fb7a77090e7f7d8d4ffc0bd77930d7c12547d4d951d6d27075", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627961, "uuid": "569ccac3-4ee5-4f2b-97b5-983b97cb67e3", "value": "86F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627961, "uuid": "5c4ffe54-b379-4e10-8e2a-14df652f45f4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627961, "uuid": "7fd9d99f-2461-43c7-be4e-ea67feb9e14e", "value": "3072:vA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:v3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627961, "uuid": "4d0bd25f-f178-468a-becb-e864fb9e89c6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627961, "uuid": "13548c2a-16f6-45c9-ac8b-1a68851eaf83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627961, "uuid": "39f3f7b9-28d0-478e-9c85-01de3a4d8f13", "value": "d112e42b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a91f22-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570645, "uuid": "71fe5a56-8241-4dca-8162-cde7f7ccbabc", "comment": "Malware payload (Dridex)", "value": "fdb50071953799c3d1b51d5ba697bccf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570645, "uuid": "1b7333b0-e22b-4c23-85c5-2fea7b37e79d", "comment": "Malware payload (Dridex)", "value": "43b83ec9ae9bac19e6e7de8feea8e40aac5279300853321ae691f81eb549d3b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570645, "uuid": "6ff7d7bc-6b60-48f1-a3e6-53e29649404c", "comment": "Malware payload (Dridex)", "value": "59ded8f41c93236f64c9ffb0d7a94045b44a308d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570645, "uuid": "2dd6e270-9b36-46da-bc39-41ec154991d0", "comment": "Malware payload (Dridex)", "value": "7c112613e2b7c203843ea45e15363fa193f9da22e0f3b29dba5975474111a04a55d289da1a04c179f6129ed71a4c9131", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570645, "uuid": "519b5561-7490-41fc-95a4-2e20ebf0bfa3", "value": "0804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570645, "uuid": "422bc3c4-9916-489c-9f90-22bff8c9d2d2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570645, "uuid": "34397298-9a24-44c9-ac8b-6f957789e915", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570645, "uuid": "0553716d-df9b-4c9f-82f6-154d5979f6a0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570645, "uuid": "4af1c1c2-4581-40e6-97ef-f56162abd504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570645, "uuid": "e876e4a2-51f6-4a88-919e-1d32cb9a9bdc", "value": "fdb50071_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeb74d5-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574613, "uuid": "2dfbe3e0-f03d-4048-812d-818215a2db5f", "comment": "Malware payload (Dridex)", "value": "d042f83f1c76a225a4ce1646b3d6f36b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574613, "uuid": "0f6241ed-b515-4c3d-9dd1-b73785956eac", "comment": "Malware payload (Dridex)", "value": "43bd3691cf0571cff836cc4a0948a3e53124e3837327f12c3b01866d368f2946", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574613, "uuid": "c239fdf7-ddd6-47d1-bbd7-5e38a8a82e93", "comment": "Malware payload (Dridex)", "value": "3158d0d9bfefb6dc627c9315c35945e8da703f97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574613, "uuid": "d64ff562-b4b6-43a9-b02b-9265b0338979", "comment": "Malware payload (Dridex)", "value": "62680da9230298e8c079b6638b494d29671155173e15e2373797319156957c8c93505e9da7e1105a7848230240b94739", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574613, "uuid": "8d5b2891-0a01-43ff-a6cb-466c6fca545c", "value": "16F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574613, "uuid": "9cb52194-40e8-4ba6-bfd1-752693dbdcb8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574613, "uuid": "ea04408b-468b-48cc-aeb8-d03064d9eb2e", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574613, "uuid": "b1073ac8-981a-4133-beef-6047594a5a42", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574613, "uuid": "e906e9d4-e52f-4d04-acb0-7e063cce7b4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574613, "uuid": "1b2f7d63-86d4-4300-9d79-bb0130d0c9e1", "value": "d042f83f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9e6f3c-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609644, "uuid": "e49d4bb4-26e8-40e4-80eb-c64a332ad54e", "comment": "Malware payload (Dridex)", "value": "981040ef49d95eec0d477a2d3248bfad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609644, "uuid": "0b04967e-a05d-4f66-9003-81e46835c484", "comment": "Malware payload (Dridex)", "value": "43cc6e912e9989a645b5fe2ccb23c37a7dc8c0c9c0322bb506307841be45a622", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609644, "uuid": "28777d84-7d75-4d29-bdf1-26f7058f84a2", "comment": "Malware payload (Dridex)", "value": "a95b57a5361af638506588cf1ff30134cfacb529", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609644, "uuid": "910017c9-b525-4340-a9bb-25964ea89e45", "comment": "Malware payload (Dridex)", "value": "93cfebef92d126e52e6a3dd4b9e4fcc852c1e492ec81c79b204828bf01e2a4f123e2529c555b42999ca7ddf897385bb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609644, "uuid": "7c3db629-3109-435f-943b-7281ca57da94", "value": "DC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609644, "uuid": "56b8cf5d-96ed-4337-a468-c3d700f44f09", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609644, "uuid": "1a9b0d14-7651-4458-8c4e-8a737438a514", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609644, "uuid": "3e9dd84a-3833-4c4f-9b54-dd7448ee87ac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609644, "uuid": "af05a760-552a-43d3-b87f-16653e831b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609644, "uuid": "f3a5a5c5-0310-4a17-beb3-fd2a9b3268af", "value": "981040ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dc967e-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572791, "uuid": "6e4068a9-c74a-4534-b9a2-0993782e5173", "comment": "Malware payload (Dridex)", "value": "c9adef5bd197a291a8d58e48cc440027", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572791, "uuid": "a91b7524-da2f-46e4-b474-0a7e726d84a2", "comment": "Malware payload (Dridex)", "value": "444edddfa3617b1859fbe2898028391e255361d75ebab0072cd1afed9b19ce54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572791, "uuid": "858c940d-f2a2-4c38-9cfd-5ebce111fad1", "comment": "Malware payload (Dridex)", "value": "235bacb3a5c3840219a58a9b20eae29ec6c53820", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572791, "uuid": "223d52c5-92ce-42c0-81bd-dbd9b07c3633", "comment": "Malware payload (Dridex)", "value": "2818b6fa93dd4b97a086c4ee864bd7e41e23e1763f385d077314bfcba0811a84e3cc78d31261541e43faab80e68fa38c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572791, "uuid": "3d56a48b-0c7e-4dd7-b70b-18475ba7d040", "value": "0C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572791, "uuid": "3365c55d-5ad6-4d67-aba5-1dc869a9d33c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572791, "uuid": "86de9241-a92f-4177-8a9e-dbce9a0cd799", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572791, "uuid": "981d6984-bb16-4c32-8ca8-cd7b00fd799e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572791, "uuid": "7bf72ca6-9f9c-4c94-9dc9-73ad5c5eb50e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572791, "uuid": "72ca3863-1833-4c98-988b-b97f81b84337", "value": "c9adef5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffbabdc-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612463, "uuid": "049f6063-03b6-43ed-ac64-2a86917c6fb1", "comment": "Malware payload (Dridex)", "value": "0a9786bbd952618a11bb27e8085b695f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612463, "uuid": "7c2e9bc2-1322-417c-97bc-a9ec37e38196", "comment": "Malware payload (Dridex)", "value": "448e09e5dc5c44a4efa3cf4ad2c50deae09bc369811c3e75158867aa475a511f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612463, "uuid": "690c14fa-47c1-43b3-a878-c15b0425bd74", "comment": "Malware payload (Dridex)", "value": "3d06bc541a04a288a29f2a6cd2b5f942c7ea3910", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612463, "uuid": "c2e44536-f9b1-4a33-99ed-472c12a7a336", "comment": "Malware payload (Dridex)", "value": "0796e884f2b76a86cec5127d826efd724022c90ae04688fdee85fa56c5d0770c41673129a37cf7dc797ca03e4b38722a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612463, "uuid": "a6aeb811-d5a9-48eb-9e64-595c3812d03a", "value": "7204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612463, "uuid": "ed70bb7a-e90d-44af-b3d1-a101571361e0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612463, "uuid": "6d054076-c67a-4af6-959c-162c08a58853", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612463, "uuid": "925fd7a2-dbaa-488c-9c3c-e5cd0a407786", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612463, "uuid": "432c681c-e106-4a6b-abb2-b76d829ee68f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612463, "uuid": "028e4942-c1c0-4fb5-9513-5c110ab829f0", "value": "0a9786bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34168abc-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563239, "uuid": "5b314ba8-f0db-4e9e-a2a5-1cb658991a4f", "comment": "Malware payload (Dridex)", "value": "0f354b9f2f49c7d855648b1d3d7af299", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563239, "uuid": "0e3dc3a4-b82a-413e-b940-9c1df956955f", "comment": "Malware payload (Dridex)", "value": "44ca54b029afc3ab35e548358811a335578e61e12d6a0ea877ebbbecc3399fe2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563239, "uuid": "dc91af23-bdb0-4c42-844e-4394dd05563e", "comment": "Malware payload (Dridex)", "value": "f9d9213b9441177a247b74114c04a347d8a477b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563239, "uuid": "381db5c4-5a7c-4a26-a0a6-59017c39c2d3", "comment": "Malware payload (Dridex)", "value": "279071e8cc634a3b5ba6ca2e76d0a6cb909226cfa4bf59f3aeed6e9a17b33eeda7f35dffadb4d115e664ec8818598b5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563239, "uuid": "57a7ac5a-e34f-449d-b974-9cacb6211d48", "value": "9C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563239, "uuid": "e80a250e-8673-472d-be8c-57534a35f651", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563239, "uuid": "ad17df64-82b9-4f51-b25d-6d51b48619c0", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563239, "uuid": "50bc03cc-9e36-489f-95f0-45140dee41a9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563239, "uuid": "04a385f9-8ff7-4391-be22-d63a5d48d500", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563239, "uuid": "8426f639-234a-4a74-b944-edfbfd7f54f0", "value": "0f354b9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e9658a-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577179, "uuid": "9e076b05-9b68-407b-84b4-6f7145f61318", "comment": "Malware payload (Dridex)", "value": "7b71301c8417e618b84650d3fa56dc85", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577179, "uuid": "fe1cce48-215f-4914-b6d5-a89d728640d7", "comment": "Malware payload (Dridex)", "value": "44d49252a8619cbb8648bb49efed35c91da96be117d22fae1534618695507905", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577179, "uuid": "f5c75317-6b2e-49b2-9fee-33fc273992a0", "comment": "Malware payload (Dridex)", "value": "c33aa6ff94f86ace5b2ab1e799dde327547bc6d6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577179, "uuid": "6c362ab2-bdf0-43c8-90eb-d9afb783f39d", "comment": "Malware payload (Dridex)", "value": "48a9cdf20a7add24e11a66ca82afef77ae54c70c482aa4d9896584cb7ced650ea78589b848c800c53f38aad450c3c40f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577179, "uuid": "3c5944fa-6781-4158-b35d-737dae31e6e3", "value": "1A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577179, "uuid": "282427c4-c02e-4402-a602-5ce74a903b16", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577179, "uuid": "75d4f91f-ba0a-49b4-997a-e30ca8a5043b", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577179, "uuid": "2c265164-acaf-4322-b5d4-25e720ded1ac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577179, "uuid": "3710a43d-4119-4f82-a44d-60fc0ca1e863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577179, "uuid": "d9b8645c-5744-4fe3-a434-de05f7a6ac35", "value": "7b71301c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e141abd6-ba4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612921, "uuid": "176608d8-98ae-4769-a75b-8ff1cee829a4", "comment": "Malware payload (AgentTesla)", "value": "148a7676842f8b9334e663894859d903", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612921, "uuid": "2d557885-2cd1-4409-bac0-a5078b2be2e2", "comment": "Malware payload (AgentTesla)", "value": "44e99f3d82435d4aeff502ea40a494b4676f58d22c550e5d9745bd1f34aeebd6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612921, "uuid": "2180d8e3-1483-44e5-a0aa-3157df89e37c", "comment": "Malware payload (AgentTesla)", "value": "f28292c5718ec3fd7ea72d07b415bbc15a65e938", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612921, "uuid": "413a3d80-ee6c-4e68-afbb-f7d48865b7c2", "comment": "Malware payload (AgentTesla)", "value": "c9c03da2dd1393ad76cb0c644b8e4e3a0b98a076c821a2d0ccecc20930af053a86c5bc1e7829bedf30229b2f283bbe10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612921, "uuid": "6082e990-1edb-46dc-a5d2-08afef1ee3d4", "value": "20F423F0FFE29B51FA86F907FF31A9B953265BED050C504A4003BA9167C6B896B31139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612921, "uuid": "6bdaa016-1817-4041-a078-9f76699a8848", "value": "12288:WplhJVBFOr8C+s7XUTp0gLuSOAHBLPMsoPlgWVKUAmHPcSdCAxiuDT6U4NLs:ShZ0r8C+yUOgiDAHiHVBcSNP3zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612921, "uuid": "b413a028-7f41-4460-b173-2e29a4fa98e1", "value": 741609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612921, "uuid": "66d2b15e-6b1b-40d6-8c0f-95ede1508ace", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612921, "uuid": "e3ad2bb3-b3ef-4d9f-8e3e-0b2e4e8a9b7b", "value": "148a7676_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850752fa-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575400, "uuid": "4ac39e55-c1d4-4464-b58b-b76f93a133dd", "comment": "Malware payload (Dridex)", "value": "f7b6858c22d01d635530478a3ea0e64f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575400, "uuid": "16f41124-4c97-494e-bbf5-5d73e4e2cda3", "comment": "Malware payload (Dridex)", "value": "453f6021e2a08607098c218f2a21523463a912b0cb93291813ef51dee8f203cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575400, "uuid": "244579dc-e9fe-4f8f-9852-0c1dd9807590", "comment": "Malware payload (Dridex)", "value": "5477c65a2ef28d7fc045a91a74057f7eb0f51c35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575400, "uuid": "97c23548-f9b2-4fb9-84b1-fa5be5c86845", "comment": "Malware payload (Dridex)", "value": "caf72a1d7f4ec56664bb7856a86e574c294d7c9539b3146ce20dbf6c93d5965a2b58ec006dd133023a13e89e0a96b6fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575400, "uuid": "8863faa5-6c15-46ab-9889-154187c456be", "value": "6204BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575400, "uuid": "d92e8241-50ef-447b-8a2b-dfdf49fcb522", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575400, "uuid": "e26c96ba-d8e9-42e9-a88c-4c2cb9194808", "value": "3072:ui49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:uH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575400, "uuid": "2eb4c71d-6dc7-40e8-9263-0c758325956c", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575400, "uuid": "259646d1-2ce4-4f6f-aea2-c2ced8f43a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575400, "uuid": "df676b9a-1149-43fb-a8bf-adad9d68cf50", "value": "f7b6858c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0079423-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627871, "uuid": "d4aa7db1-df91-4e5a-a06a-061ec28b1dea", "comment": "Malware payload (Dridex)", "value": "e6315dc44a6595f3ecd1d532bd8b9e81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627871, "uuid": "943bcf4c-f5b7-42dd-9577-eafcaa18d31d", "comment": "Malware payload (Dridex)", "value": "458b4cdeef46008598a15c01ed789ddcfb43695f1d648534143eae96bd7ed876", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627871, "uuid": "dc4eed04-1b19-4fe9-a400-b395e49d776b", "comment": "Malware payload (Dridex)", "value": "aab68e284c2d4846d4f89474cf351d383d5e6472", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627871, "uuid": "f598408c-968b-4b95-a783-3ca5f38e95ef", "comment": "Malware payload (Dridex)", "value": "ee95a6bb78325a0ca217ede574b7184206bfdcec33059ca540fb23b49a153751cdd21728a188a4050a63b4a6fe8ca898", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627871, "uuid": "6a5535c3-d877-452b-85e0-c8bb85736a6f", "value": "EEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627871, "uuid": "40c86022-7a5c-4965-89e9-7cb890494574", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627871, "uuid": "0398b473-2863-4982-ab8f-865028a8018f", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627871, "uuid": "4065e157-4760-40fb-9b20-b1321865e52d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627871, "uuid": "ae9ea49a-9e47-462c-9299-f82ea1f53a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627871, "uuid": "c11373dc-53ff-44eb-9172-0009f0fba1cc", "value": "e6315dc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3d5f5e-ba30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621600407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600407, "uuid": "acc9c5b1-dd3f-4b0f-9dce-d931adc8740d", "comment": "Malware payload (Dridex)", "value": "882460fecaa74e8914457b6acdd874cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600407, "uuid": "6d243555-ca11-40b4-af14-e6d087367e26", "comment": "Malware payload (Dridex)", "value": "45c0d48dacbebccad4012d1095254cd83377d015d5818702f4c8f3df644255d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600407, "uuid": "6930bdc2-6a83-42b7-a910-24f30e850252", "comment": "Malware payload (Dridex)", "value": "f5cba763d02497a7a9659d5c4817726200207c01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600407, "uuid": "6085791c-1795-41de-9b41-5d791f4f6a12", "comment": "Malware payload (Dridex)", "value": "818485e325572ae4d1eb700a537444515cc6407b9ddc75992b12ee93d97be83fcaa3b856f2eba8f59d7109f5b3492865", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600407, "uuid": "4ea4d784-b8e1-45ee-a408-e007f27a95c0", "value": "13F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600407, "uuid": "153b6399-b638-4c8b-a6a9-8356416ec312", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600407, "uuid": "b498f5f4-ebbe-48b0-8ea6-f5d7fa977d61", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621600407, "uuid": "efd178b4-ec26-4732-8199-6bd0f2de4b9a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621600407, "uuid": "9ebff83a-5124-43a7-8028-05c4ba1abdbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600407, "uuid": "e952799b-ad85-4e02-9859-566f264e205e", "value": "882460fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fd0755-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621591891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591891, "uuid": "d6f7b5f0-50f5-4995-a0a3-ee16cb756631", "comment": "Malware payload (AgentTesla)", "value": "3f786afb46eb613a38967efdae6a0bf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591891, "uuid": "649cff5f-c925-4477-bb9b-a05127d98ab0", "comment": "Malware payload (AgentTesla)", "value": "45d86a49a0f6fd9f5d1714e9fe9fd3985ae593ec5bc36b74ca1d93ed275c57e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591891, "uuid": "b70e2416-bde1-44e8-b9e9-0c8fdb18da3c", "comment": "Malware payload (AgentTesla)", "value": "8ba51a54689993a7c7f39c62dfd15de9938172c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591891, "uuid": "60d9db87-c0ec-41c7-8c1c-36ca4fd21b15", "comment": "Malware payload (AgentTesla)", "value": "0c110ad7a504694b8c92adb6388c14fe06ee7a063076c7bffa675e54e66971e4bdfc1ec030bb993392c56ea3665d5a63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591891, "uuid": "592ac428-cffd-464b-8820-788624289134", "value": "3BE423E417A24712D7C6C3652F7FF4D6FD892CC46A48A6DF9054EEBE314BA88C0A6341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591891, "uuid": "7e9bb019-2828-47ec-924d-17b1453a4f54", "value": "12288:9jWrmxyIGYveyq1URimmPEs8uwMA9qda/EQcwbGmgUCccDbJrSlyzmwo:IixyEvNRimds8uwbMdoIwbG4QD6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591891, "uuid": "5264758c-f3ce-4080-890a-c690eb9233e8", "value": 707360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591891, "uuid": "a6a7ec62-b3e2-4456-b17e-478ac4d2005a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591891, "uuid": "90468323-8912-4c99-a844-aec1ac06f277", "value": "3f786afb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2489d2a9-b9d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561924, "uuid": "b94af9bd-2096-4fe7-82c7-69550ec33044", "comment": "Malware payload (Dridex)", "value": "493eee9bab0e95282cf91b5f25981229", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561924, "uuid": "1142f864-ea79-4cd2-af2b-86c9f34f95a3", "comment": "Malware payload (Dridex)", "value": "46178c38173662d6a2874ba225ba272e134b49f1d6e53362074a5a229f396e9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561924, "uuid": "bf9eea06-c48e-47d6-aa4c-3fa35053e0a6", "comment": "Malware payload (Dridex)", "value": "e262181062fc75e24e35f87528f9481026187b08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561924, "uuid": "6582ffe2-3df3-47e2-a43e-679b21b56115", "comment": "Malware payload (Dridex)", "value": "db469314e43918338c0dd98eeac42fd1f3a2d60011322c89d9e0048e035bae7765a6e5663d8b2b17453ca8d1e2c4b7bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561924, "uuid": "6265df75-5d22-4a3e-ab24-68da263be6d4", "value": "7E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561924, "uuid": "31881192-8732-4024-86b3-0771c09392fc", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561924, "uuid": "ab2f5c65-f461-49d5-b4c9-75aae1bb3205", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561924, "uuid": "2f4e8621-b294-4f96-88e5-4a0f1f5afbef", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561924, "uuid": "abe9013a-1a7f-46b4-aa5c-114e16796ccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561924, "uuid": "18f702c0-75a3-478e-989d-f421889e2b18", "value": "493eee9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c41997-ba69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621624767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624767, "uuid": "fb932770-a009-48f3-a3c2-1e747a0c45d8", "comment": "Malware payload", "value": "a1c34771d6ddb82568bb8ccdbce0c91b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624767, "uuid": "e0822c73-3329-432a-bc04-7b1c9e6aa378", "comment": "Malware payload", "value": "46796b6a20123b557414b58ca4418f756b6857366975b9bb98eac30ceb1c6ae5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624767, "uuid": "59e0e935-6754-4f02-913c-6b40a8d4a468", "comment": "Malware payload", "value": "bc76e4b91e32f38a8f56583c5eeeb6ccebe3968a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624767, "uuid": "6ee8a442-e94f-4da8-819e-7a44970a0d8c", "comment": "Malware payload", "value": "6948203e6ff82cf1fc5707e7f4a39d2eb2c559cd93c23a1af776f2bd67aaa108700daf3a737ae1a594eda603ce0412b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624767, "uuid": "8f1ab305-a1f2-43a4-b15a-e7cfe5d6fb8e", "value": "D855A535FD869475C0AFD6708A1E7D0C88A0B1D3D2E91C06B37C46C40E19FEC5F96988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624767, "uuid": "2396d537-1fe8-49a6-bc82-a5ed7e058de4", "value": "48:0bOyT+QdhTTYNtfr0rtA8zKdK9KK1KKKlX8K+mKKKKKKKa0KKKKKKKKKKKKKKKKV:wOyCYTYNt4rIVKdkxjzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624767, "uuid": "e0c9d557-7193-4011-978a-5b42a12ee78f", "value": 1353760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624767, "uuid": "4e753137-4938-4ba5-898c-1d58d10c296d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624767, "uuid": "e98f944f-f179-4e48-a39a-64792e117156", "value": "a1c34771_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c625b6-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616204, "uuid": "6a279cbf-db80-40f0-9c9d-c467079a803a", "comment": "Malware payload (Dridex)", "value": "bec29eef89097cef0e95fa3d32b67a9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616204, "uuid": "dabcd83e-2319-4528-91a3-d81be2df391b", "comment": "Malware payload (Dridex)", "value": "46f3c4797721dbae688111a5e1451efa9bfaf81a33f1b207d43de236a4745679", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616204, "uuid": "fce48f5c-292f-4cd3-9de6-c48364c1b359", "comment": "Malware payload (Dridex)", "value": "f4cb1ab31fbdfec66dae84dbf28000b9f1cbd1b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616204, "uuid": "210c5b95-1dc2-471d-bb00-8265ef3ef9d8", "comment": "Malware payload (Dridex)", "value": "851a63b743e9652853a6dc100e05bb70758b59007fb6633f703b487d6e4720193ad27a1ddcd7b94578044d77a557accc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616204, "uuid": "17e4404a-0cd2-4105-9f13-3211be4efdf2", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616204, "uuid": "2d9a8f68-6893-4d36-aa78-c0c47b7cb8c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616204, "uuid": "f0384d55-90d5-41b2-a466-9bd573c0ea6f", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616204, "uuid": "b066688b-aa94-48ed-8766-6843c052c78e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616204, "uuid": "b4d46ef7-6885-4e7f-8635-832cc8b71c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616204, "uuid": "dc051b62-89ae-4adb-8ccd-8a113ed2d614", "value": "bec29eef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c942101-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569400, "uuid": "3c8d53ff-5a2e-437a-8877-62a01b984cbe", "comment": "Malware payload (Dridex)", "value": "502bf0f63e4c9756937a0766396390ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569400, "uuid": "fa094efc-9b55-470e-9a86-021aaff6572c", "comment": "Malware payload (Dridex)", "value": "47628f833cd3a99ad187c82ee04771fd1e214b6451a3b93d18584e9b71d97165", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569400, "uuid": "5024c848-c160-4a6a-bb7f-449f90211cfd", "comment": "Malware payload (Dridex)", "value": "a6bce182a4c2808a2416e52e7f4a4850b4105599", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569400, "uuid": "44b772ab-9f25-4ddd-af7b-e35adf94b832", "comment": "Malware payload (Dridex)", "value": "94134645182759a2dc6054092f6fc2735d25439d93d79b13b164144180bb29ba0e62f968fedc37b8bb343bdba72cc51f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569400, "uuid": "edb4fa20-1cee-4baa-821d-8e6ae40167da", "value": "5504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569400, "uuid": "aaab5048-9736-4f13-9c64-37f37f9f8847", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569400, "uuid": "f73246ae-4305-4a46-b4c1-8fd22c330f95", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569400, "uuid": "39275ca9-384e-4333-aa1e-9989a0b64794", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569400, "uuid": "01aa9d31-88a0-40e2-9c2a-41ee971d9da6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569400, "uuid": "7d09b7ed-4c74-4593-9e91-0d4f1be35de7", "value": "502bf0f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979da6b9-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611080, "uuid": "754a2951-9da0-47db-bc24-08e6b54edb7c", "comment": "Malware payload (Dridex)", "value": "3090e372d1e0bd9fa03f180d8c27fb83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611080, "uuid": "73e588da-e241-4407-b5d6-183dd735c5f9", "comment": "Malware payload (Dridex)", "value": "47ef929857179f0df02b302f5686f54a5a17fa9bb075e0fab7787bfe40a9327a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611080, "uuid": "c19b2ad1-782f-43cd-a246-305f747a2793", "comment": "Malware payload (Dridex)", "value": "f3f41c643a7068e00f10d375096c779608f6406b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611080, "uuid": "4d912bfa-b034-473f-ae87-222c42ffb715", "comment": "Malware payload (Dridex)", "value": "3d5bc93d17b93ec8b70f8046a5c41c3414da3a1d8a801ebb79cbc0c803bc6a0bf2e66ab45a5864089c2ee1277b272597", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611080, "uuid": "198f599f-5d91-4622-8824-e1e17e2c96d5", "value": "2A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611080, "uuid": "1406c653-0a0b-44e7-bfb9-a5ecd619b8b1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611080, "uuid": "a35d8e2d-1cbd-4de9-ba5a-710cbca70d6d", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611080, "uuid": "dca2dc81-827b-4c37-9bc6-28870f7ce5f9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611080, "uuid": "f32d0e2f-fffc-4e12-83a6-b40cdb46b4f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611080, "uuid": "9e135809-7d6c-4c2b-820e-a24a24b09d17", "value": "3090e372_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1680f0aa-b9e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567914, "uuid": "229bc788-9488-498e-b43a-58056bec3f79", "comment": "Malware payload (Dridex)", "value": "a50d7f8c33e47d9993b57f02cb2a47a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567914, "uuid": "b9f33dae-e76a-4129-805b-5088dfef58b8", "comment": "Malware payload (Dridex)", "value": "47f1c0419f08196b13f81cb68dba4b4e0964e2e5e91ab87f80fa3bec6917799b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567914, "uuid": "f8755a92-edfb-4ec2-adcc-29e704800467", "comment": "Malware payload (Dridex)", "value": "0a9cce91324b184520e6de2705b81842857a88f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567914, "uuid": "13e00f71-f65a-422d-83df-3723f462ba56", "comment": "Malware payload (Dridex)", "value": "2c5b823d5eebc505d80c53ce19ae6cac9e4cb181b3595d2492a30c5c3331afc1bc28d81e727e9eb4a876df91832fe60e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567914, "uuid": "03399f0d-fa70-47dd-b15e-d65e70f04705", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567914, "uuid": "50b72055-d84f-4768-9d53-dc0bc9ed48e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567914, "uuid": "e4564dda-c298-49cc-9fb1-3f8380a006a1", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567914, "uuid": "62c5de57-0c34-4c8f-ad29-71c90aebd10e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567914, "uuid": "7164afad-2538-490b-ad5b-23ec70707d1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567914, "uuid": "8d31bc30-aa0f-44de-a758-09a7a2fc8c8b", "value": "a50d7f8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e222a1d-ba69-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621624727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624727, "uuid": "828cd810-3fe9-41e1-b932-c054700146cb", "comment": "Malware payload (Dridex)", "value": "bdb3e75e2983b885580d6984c485b02c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624727, "uuid": "42f3df6d-edad-460c-8eba-77475b97507b", "comment": "Malware payload (Dridex)", "value": "482c6bb3a44593d3fcf1f9e405206dccc8c8c1f9987c0c9da9f7c16ff567f9de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624727, "uuid": "d5e67dbc-9244-4300-b2ab-3e9f5dfb933f", "comment": "Malware payload (Dridex)", "value": "074fda029aa50cc796aa04ad4537a5998c588dc8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624727, "uuid": "23e6a967-f470-4685-a639-763ae4b3d117", "comment": "Malware payload (Dridex)", "value": "d65c5db411802b2bc4c8943882561c610237d587705d1bad2056b305740956d1f114111aeb9308ddbfe6cb07e78e5baa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624727, "uuid": "aeae647a-46e6-4942-b007-f243b7c70ad0", "value": "68F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624727, "uuid": "0547d5f4-fb2b-4f79-a6de-3cca771cfd52", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624727, "uuid": "2994281d-a788-44f9-84e8-c74b1e9f40de", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624727, "uuid": "81a9d870-368f-49d9-8e04-2719b8c69323", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624727, "uuid": "853804be-d898-469f-a944-6bd95e47cce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624727, "uuid": "a8d413aa-a595-463f-a70c-f5aa05942553", "value": "bdb3e75e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced65a62-ba0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584973, "uuid": "44a82922-846c-4cb7-a57d-6cafacb37b48", "comment": "Malware payload (Dridex)", "value": "5fa2b43d33a8982c6edc0229bd3d5d74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584973, "uuid": "064f572d-1e3b-4386-8bdd-6797a5cae8d4", "comment": "Malware payload (Dridex)", "value": "483d13424011751a1e6f01f6ef3cc582e3c51db8b0292c773d6d14cb563a9072", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584973, "uuid": "813dec8b-6e2d-459b-80d7-3f31e4a0ee0f", "comment": "Malware payload (Dridex)", "value": "22d261fb102b5e912ac7ac5cff48d65a01d84517", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584973, "uuid": "440046ed-9f90-4b66-b85f-984891b97b9d", "comment": "Malware payload (Dridex)", "value": "668a3480d305f690cd4736f21a813163ea47956f97ea917d8e780378b7c292414df173836e59db584e327334cbe048d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584973, "uuid": "3d2a9488-99df-47ec-98a8-ac93096cfb63", "value": "D4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584973, "uuid": "b7c8d8d8-9ae7-4000-b704-2702174c6bf5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584973, "uuid": "ee14579e-6d41-4fa6-8045-b339a694127d", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584973, "uuid": "b109784b-1bfe-4fa1-a5a4-59252abc1368", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584973, "uuid": "78ca5899-ba56-4111-9873-5dab9070d425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584973, "uuid": "6f41715b-5d84-4e1e-a204-134a164f7a63", "value": "5fa2b43d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac7589e-ba16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621589181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589181, "uuid": "c8773348-402c-4b4d-b468-f6ca535999ab", "comment": "Malware payload (Formbook)", "value": "4698417cad1f13f138c773b6547ea219", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589181, "uuid": "69ffec63-adb3-4b3f-8d97-2b9b3c07667c", "comment": "Malware payload (Formbook)", "value": "486dc976b07dc1e933d2c4b2e2b1440d0c95755ae760e99cce0cae7088d69de9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589181, "uuid": "d740a80c-2070-41c8-a5b8-f5e92254dfb5", "comment": "Malware payload (Formbook)", "value": "367e04f5142ede36bb4958329998714608e09c73", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589181, "uuid": "4b78cbb7-0129-42ef-ac7a-2d3ff0472cfe", "comment": "Malware payload (Formbook)", "value": "baaf529968e75bfa6b9730a776d6c8f0b3162fdb1d43e980912f519dde513369b361ab18e442c93b479ce621003dbe4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589181, "uuid": "aca91706-0d29-402e-87cd-4c128d9a28bf", "value": "7644120271D1D0E7D0324A315576FBBAABB7A7092B70245B372C5F5E5B231D39A023A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589181, "uuid": "e51daba3-6ee0-4f62-9e59-88c3cce0c22d", "value": "6144:Ss97yd4CXZ6snZGJw0hhEibflcZuKkJm8wy4:7ed4Cp6kIJw07Ei7+cJmZy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589181, "uuid": "550fd0a4-1f17-4ae5-ae78-5492cab492ab", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589181, "uuid": "702aeab1-9c3b-4510-9cde-aea563325469", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589181, "uuid": "9e45b3c8-547a-420f-b531-5dca5640619f", "value": "4698417c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60f9b82-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575026, "uuid": "6134659e-d81d-45da-95ba-b7699f30d984", "comment": "Malware payload (Dridex)", "value": "0e7510a143feab64e9e5ae4278461545", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575026, "uuid": "4873c4bc-5ce7-4446-adce-b03896a90877", "comment": "Malware payload (Dridex)", "value": "4888d688908e60bdfeb93587407f9a987e714cc9c5e580bfcfc08e94f8df35e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575026, "uuid": "23203fb2-b064-40b4-8d3a-f1e3c21be4e0", "comment": "Malware payload (Dridex)", "value": "c8bf54d0f590fa0c46d4a4c82d529a3af4a09a4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575026, "uuid": "2aa33405-2ba2-461f-96d0-6560382496a5", "comment": "Malware payload (Dridex)", "value": "420b49ab91dd30a1d63d4ee70409564ee899ba6fc4f0bd380fb399d862d3d68806f1b0ce39596b4dc8646ad4df30d934", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575026, "uuid": "e7aafd4e-6abc-4c63-bc36-3595ec226969", "value": "D304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575026, "uuid": "e3dc909e-297e-49b5-9e90-f316d1698fb4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575026, "uuid": "3fb44bb2-87f9-4765-afad-b02d56311fbe", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575026, "uuid": "fdc57d7e-ab83-4d26-aa64-63638a47d8a6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575026, "uuid": "65f92379-0227-40d5-8d8b-905ba5df3a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575026, "uuid": "d9b1e24b-4999-4d9a-905d-ffe788ae73fe", "value": "0e7510a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6b7f62-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562853, "uuid": "129886a1-bf1a-4dd6-b398-2bfa51869c84", "comment": "Malware payload (Dridex)", "value": "c94e6aabde66c12da2b3dcc076bd7a4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562853, "uuid": "e3951643-684c-4286-90df-1235b905189b", "comment": "Malware payload (Dridex)", "value": "48bce8a526c3dfa922a02a5c4bd3c2d27a91d74cd77fc000a4a40c9edddfae8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562853, "uuid": "8fc90ff9-fc48-4b3b-922d-fcd9dab25c18", "comment": "Malware payload (Dridex)", "value": "6cd81569c6e44cfd5a09e9040ed09a5758ee9598", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562853, "uuid": "ae44bac4-93ce-49e7-b796-4671b28429e7", "comment": "Malware payload (Dridex)", "value": "29471c21e4b30b72626574b1e8b54c1f3b99e77fb1b3d601e9b1204fbf3b5f986129a22be9ada6a92d8a1194e4767b89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562853, "uuid": "537aafca-aaa5-4a7e-8db4-bff5ea51cd7a", "value": "4204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562853, "uuid": "6ef82c92-2d65-4e32-9e52-357e43ab2f8b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562853, "uuid": "4ee2dc58-b6ff-4e9b-b5d9-6eb8ee7d3ad5", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562853, "uuid": "388d7ebe-6851-4406-b0c9-86970adc7b27", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562853, "uuid": "5180ead4-eb8b-409a-ae37-f0369250dc74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562853, "uuid": "5663520c-a079-427b-9420-e6223301e708", "value": "c94e6aab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b271649a-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622292, "uuid": "c47a56ea-e96a-4bf0-bd80-5885626c1d38", "comment": "Malware payload (Dridex)", "value": "f2722642124157191c5299e59b1ae5c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622292, "uuid": "89a4e888-e70a-46fa-ba11-e918eb00f6af", "comment": "Malware payload (Dridex)", "value": "4981e551c669a0492d403cf44c943dddc76e2d90d1dff899f081a140decd7cbd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622292, "uuid": "3a861c90-293e-4284-9d94-f23d057b9aca", "comment": "Malware payload (Dridex)", "value": "70d5a597c7e5bc0cb280d992d412e2da5b4274d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622292, "uuid": "30ad5b54-2f3a-4f00-ba3d-e3a5a0b289fe", "comment": "Malware payload (Dridex)", "value": "1908b159ccf996caac3db86e16238ff6a71a857fa418fb818e5bc70624ce747b075bae2aa80edd503ee5450768ae83a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622292, "uuid": "989e2cf5-9d28-45d6-a52c-a5c39e435114", "value": "55F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622292, "uuid": "1e473259-3ef4-4429-a495-7bcc767c1c98", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622292, "uuid": "449e8d86-aabf-4740-b158-53e3309abbef", "value": "3072:+lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:+lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622292, "uuid": "c3930613-5c92-4b4d-94c6-52cd7e646675", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622292, "uuid": "fdd4d3c9-db0a-445b-aff2-69fc025b0e10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622292, "uuid": "4e800a23-5fc2-4476-ba2c-41404d1add3c", "value": "f2722642_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a1e0b4-b9d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562159, "uuid": "0c28d339-138f-47d1-9156-604d4f3c6f47", "comment": "Malware payload (Dridex)", "value": "a7370727f39ee9f405bb5bc332b19d11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562159, "uuid": "a85417bc-ed51-4049-bc9d-b5c774fee2a4", "comment": "Malware payload (Dridex)", "value": "49ec9a88f7ded1e258293bc51294009ba382c89ae996f3867480bb58b6b9f1c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562159, "uuid": "eb26b686-23ed-4dfe-b546-61cff7cf5855", "comment": "Malware payload (Dridex)", "value": "d6d2408b1493f5ebb861aed3237605860a3b521e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562159, "uuid": "bb6b1a39-f12e-426c-ac13-53d5f2e24a67", "comment": "Malware payload (Dridex)", "value": "6419a0d24a6147dd8c8a8e2337a236b25bbe151c28484012b45dab876949994abfc08fc1114d8b464aa9be579e08d8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562159, "uuid": "ba1865ec-d881-4a2f-b65b-7df6749918a0", "value": "4804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562159, "uuid": "8936cfeb-e7a9-492f-8c14-3b5540260c51", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562159, "uuid": "fbe926c0-b19d-4781-b5db-973423cf0916", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562159, "uuid": "e2ace56a-1302-4884-804e-41f8909d556c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562159, "uuid": "e3d43286-35de-4a73-b594-4ed144cda2e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562159, "uuid": "910a6f84-8df6-4031-a939-83b2641190fb", "value": "a7370727_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb227020-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621613716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613716, "uuid": "41e5e355-4315-4983-a026-738ed9890906", "comment": "Malware payload (RaccoonStealer)", "value": "b494912aaad59ff8dc6e7b82f9784969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613716, "uuid": "41421858-d574-40d7-ad9b-a7e2e8330cd4", "comment": "Malware payload (RaccoonStealer)", "value": "49f9ea0a7a6263b177d90b604475e6b45e60eded31c5f78a299bc3f82f067c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613716, "uuid": "6f0a028a-a713-417b-97f4-bf3348ae0873", "comment": "Malware payload (RaccoonStealer)", "value": "b724b3fd85167dbdb6072509b91a6aa205ad35aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613716, "uuid": "17541b40-6c31-442b-8a6b-5d07eeac691a", "comment": "Malware payload (RaccoonStealer)", "value": "93588a0ef54c8852daf393dfe079922adf84fcfd8da24709923e71f766be0c511a26110719e6d94819d07b5b038e5c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613716, "uuid": "e269f60e-e741-4b5d-bebf-77fa281a77fd", "value": "10D4D028A6A1C035F5FF16F459B982B8653A7CA15B3450FB22E53BDE46345E0AC3078F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613716, "uuid": "73a31e39-2e6d-4afb-8142-7f036062a57d", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613716, "uuid": "3d67227b-abd3-48a6-b792-3b8628afd488", "value": "12288:Kv3uMnBDa1pQgrSCTf601mUdmcpTicKoniP+AFXsL:JMn9MR3TyqmsKoiWuXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613716, "uuid": "147a268d-2a66-4d8e-8387-25839d14f2a3", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613716, "uuid": "9a9e17d7-3c07-4691-8081-b48934750134", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613716, "uuid": "ad2d3e8b-ed8d-4160-9f56-bdc57addcfb4", "value": "b494912aaad59ff8dc6e7b82f9784969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a46142d-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621634921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634921, "uuid": "2cdc2bd1-3e39-4453-9b4b-58a64f78d465", "comment": "Malware payload", "value": "8c0d9727780fd40e16742ce4fde59c2d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634921, "uuid": "505876b5-7f18-4690-b73b-f5c26c425abb", "comment": "Malware payload", "value": "4a9f952b2bd41c11aa4c5e02f4036fc4e16135b3dd700cbc5f6d71f79ec972b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634921, "uuid": "941ae481-510c-44f8-bb11-20012a246e24", "comment": "Malware payload", "value": "b4f02f84749f27419fb294e3bc20baac0ebb539f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634921, "uuid": "659e080d-2ae4-415d-8ac7-a89edc5e4873", "comment": "Malware payload", "value": "1e851b946e66b66fbda0a429091237d3920f4155c7d107d09061fac06982d58b9026c3edee3d037151c96042c03b2862", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634921, "uuid": "1470eaa9-9efb-4e8d-9603-833dcc51d681", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634921, "uuid": "d272263d-30ab-454f-9016-88ffbfe26ff0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634921, "uuid": "9abbc34c-ab48-4438-bfd5-4a8a6e9c6216", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634921, "uuid": "0a7fe369-5c50-4b95-90cb-d28dba0ce118", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634921, "uuid": "8d81cfdc-9fc7-4be0-a03d-9e2640f3b7f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634921, "uuid": "890d2520-3fd0-42e2-aeb1-8dc072ad79a7", "value": "8c0d9727_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e9a735-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611668, "uuid": "baa92425-5d10-4b80-bf44-0f13517705f4", "comment": "Malware payload (Dridex)", "value": "0832eadef8c23ad54fc1074791e2cde6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611668, "uuid": "c6e1f263-d81d-4d6f-b469-e221ee4722f7", "comment": "Malware payload (Dridex)", "value": "4ad99133a54de531a379172ee4af88265c682bf9cf7ec1382e0a87a1db6c767b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611668, "uuid": "6fcbdc97-72a4-49b4-a6c8-9aaa89748691", "comment": "Malware payload (Dridex)", "value": "1aaf4cb57c84b859c0bfcee00cc249d72adf4e6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611668, "uuid": "1d5b993b-3d98-40b1-9c77-7b0613420786", "comment": "Malware payload (Dridex)", "value": "35ea17303ac474cba3f6e2fb00870626313114db88ffc43d96bc38ed5c6c678fe9a4b85ea50b2aba7cfe179c18d00abc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611668, "uuid": "a09a9ccd-43c7-411f-8363-31baa0a93364", "value": "AE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611668, "uuid": "7a8598c9-f578-4cc2-8bda-9964cf2a6751", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611668, "uuid": "ca5fe728-041f-4ee4-8bd8-0c159affa5b0", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611668, "uuid": "616545fb-fd5f-41e6-a176-fc814b33f8e1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611668, "uuid": "4bcd09e2-5790-47fa-99ef-cf2a14c187ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611668, "uuid": "4e32380d-6e15-4559-9899-9ea5fc1b4fe1", "value": "0832eade_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562b8024-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581335, "uuid": "6c8369b2-e7cf-49b3-b315-060b9d7135d7", "comment": "Malware payload (Dridex)", "value": "d7152d487eeb12637b75592e8992309c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581335, "uuid": "65c586b7-d02b-4d54-8d10-14690e101863", "comment": "Malware payload (Dridex)", "value": "4ae58fef7aefc15250c0f4e29011a07f51b440371c8d7cc2c38fb5a3a4edd663", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581335, "uuid": "5d5d1fb5-458a-4336-90a0-9913d8db3a93", "comment": "Malware payload (Dridex)", "value": "c378b2fef9255b2236f89ccb924851cc7297b98a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581335, "uuid": "251af7b7-4bde-4d1a-8aa2-968c9f343e2f", "comment": "Malware payload (Dridex)", "value": "20769641c14959323247b4f3d3c5ace42b42ed560763eda6a97f58e14edf21e97bde6414bc2393afe26240909b8ffe97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581335, "uuid": "1fb5a89b-04d6-4fa0-ba69-a78871434363", "value": "8204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581335, "uuid": "2b6b36b4-ea3d-45e1-8823-779af9450366", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581335, "uuid": "0f9ac8cb-0ed4-4109-b600-2850af88f04c", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581335, "uuid": "90224b74-c62d-4a41-89d3-83e3fce668c8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581335, "uuid": "124a276f-93ae-44eb-9be0-81ff41bc9447", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581335, "uuid": "790b95e2-ef41-4d50-be51-1ab6a41bf935", "value": "d7152d48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dfdf45-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616115, "uuid": "f946a0db-c843-4433-bc23-073cf306c443", "comment": "Malware payload (Dridex)", "value": "c48cb3928539305d65ca9f042efd228c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616115, "uuid": "a8a787cd-bc97-4861-93c6-8654e9c76709", "comment": "Malware payload (Dridex)", "value": "4b0c059def2187a0459981a2aaa21eac92822d51e6bf6a1f2f1a6c553c95827e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616115, "uuid": "6f24f264-479b-4f7c-aaea-f7e70ee572f3", "comment": "Malware payload (Dridex)", "value": "e5a4b8c7391e8946b8b6cff87b7f8dcb4fdf3e86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616115, "uuid": "ff625fb1-8b2b-4978-aca7-cc15bd10efe7", "comment": "Malware payload (Dridex)", "value": "0d93fb6da8f7d586bcba93167fc3fda67d26fe6e072980a673a04a874cde947e872ed6d98e41e6dd665813f26d943c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616115, "uuid": "64e1f6a4-155e-41e1-acf4-fd66e3f57924", "value": "28F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616115, "uuid": "192ba315-ff80-4092-b22e-892ffa44732c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616115, "uuid": "965cc3af-bc77-4757-9803-6bcd77d6e986", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616115, "uuid": "24bd9a29-a63e-4ef8-80f7-1fe2b10d89f5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616115, "uuid": "af7626e2-ab19-48b1-b5a7-f235fc2dda6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616115, "uuid": "c29f9a35-41e6-4944-9ab8-fe68114d84db", "value": "c48cb392_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176be9bc-ba07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582518, "uuid": "3450d8f1-50c3-4174-a434-933c7fad9454", "comment": "Malware payload (Dridex)", "value": "f115df2be0265378b187e88f8afa8bc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582518, "uuid": "14f61a47-ec13-43f5-8cc6-9727b7f7cb58", "comment": "Malware payload (Dridex)", "value": "4b5a09678b9b035bd89d86b0e65a39fc5f3b6da4b75365ade28bae6b417f72fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582518, "uuid": "38cab0a5-1bf4-46f6-b708-1a55bee321d2", "comment": "Malware payload (Dridex)", "value": "c50ab5b0c6775d85fb32d507660c4b38ee2b27e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582518, "uuid": "1002fe29-af7e-4697-b51b-7947b01e24c7", "comment": "Malware payload (Dridex)", "value": "024026ea2c5c8cc71fe6a2eb521ced0573d13ccfc38ff9a008cf9956a5e539e26e75549b1e233b59204ef67e5c146cb6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582518, "uuid": "865b5340-0d54-4619-9864-7b3200765bae", "value": "D704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582518, "uuid": "026a60c5-c447-4161-b7c1-b02aea744768", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582518, "uuid": "f96acc59-f3d5-4039-8e59-affed16abcdf", "value": "3072:UV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:UV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582518, "uuid": "472e15ef-6f13-424d-ad5f-ffb7cb98620e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582518, "uuid": "ada03613-e030-4d84-bfe2-462ab10636cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582518, "uuid": "9cf19649-0532-4a41-9ff5-4a9bc91f21df", "value": "f115df2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d0bf57-ba5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621620048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620048, "uuid": "114011a7-64f8-4ef8-89b7-74232ef55150", "comment": "Malware payload", "value": "1e9d1a0a6c99b33a3be6fdaf66afd0d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620048, "uuid": "f994e90d-38e8-408f-a7f8-abb5e0220283", "comment": "Malware payload", "value": "4ba6b010f4dc65c8298f59dab6ef213e5ba7fbb9e0c9768e5a47d8b424c29fcd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620048, "uuid": "15486adb-9e73-4406-a5cf-233ca93dc6c7", "comment": "Malware payload", "value": "402217d089b46da3bdd1f165130a11ad525dedbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620048, "uuid": "acfba797-f1db-476e-8ec7-a74bc8dda5e6", "comment": "Malware payload", "value": "1be8020c2196e22a15b284f7bccfee3e93589c031e6c5ce587698897e17b20d87abbb241304139bf399970cd57e5de12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620048, "uuid": "dc3b82fa-ebe4-4c40-841c-dc49dcaf60ea", "value": "CCF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620048, "uuid": "f7a4fb66-4a77-4f2a-84d4-8b8d3330022e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620048, "uuid": "a5ec0956-f526-459a-ae22-385e6b41846a", "value": "3072:9IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Wc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620048, "uuid": "0bbda07d-4b03-451b-917f-9d350b09c974", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620048, "uuid": "990496c6-c5ec-400e-a0e6-5f662939897e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620048, "uuid": "60640597-83cb-4644-af6e-bf9be8af0e89", "value": "1e9d1a0a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b217ee5-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577853, "uuid": "4c8a9468-50a4-4fbe-ae91-07d0d8965748", "comment": "Malware payload (Dridex)", "value": "8252056fd8efa4425c65e88ad7825e65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577853, "uuid": "d1729337-5d3a-4309-a548-3fc41196bfcd", "comment": "Malware payload (Dridex)", "value": "4bbea852f1651f2cfd3e7e30d490446a055320e43dcb51201c0843c1b3287093", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577853, "uuid": "38cc6a1f-d763-4be2-9167-3003d4601f3f", "comment": "Malware payload (Dridex)", "value": "1d4396a7671dc4ab1262ac7ef26046eea6545def", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577853, "uuid": "a9f38fc9-796a-4811-bcff-ca629452e6c6", "comment": "Malware payload (Dridex)", "value": "61897e036d7c711852437df12943647706a039510c8d7211201aa755a0f46928e4f6381c599f33cc005a1178273ddaa1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577853, "uuid": "8f62594d-fd77-43f3-bd3c-0b7e8afa8648", "value": "3A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577853, "uuid": "3f18a3bb-f21b-47cc-beab-4361132d7370", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577853, "uuid": "5904d97f-8daa-4386-b848-ccdc955e3916", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577853, "uuid": "42b194af-289f-4ac9-a9fb-e1456c7522f8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577853, "uuid": "1ee9f47d-e894-428b-ae79-07f70d9b5816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577853, "uuid": "d881c38d-0a99-4980-8187-db455f89c026", "value": "8252056f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca16186-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571252, "uuid": "a5f43c9a-4940-4ef8-bf05-0a8d79a61928", "comment": "Malware payload (Dridex)", "value": "fc37ce7ce4072a2221fffed924634d11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571252, "uuid": "ffc1bdc5-d537-4ed7-be14-b1df995c078a", "comment": "Malware payload (Dridex)", "value": "4be768e42df3ca08c1f6bf9d9a4f35ae0d0d1b668e28bd1973d228845cf3b068", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571252, "uuid": "5fc54cc4-5670-427a-90c9-ae3b720eb7c2", "comment": "Malware payload (Dridex)", "value": "a9c953bcb4539537d5f8064ffca08acf9c5479d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571252, "uuid": "f485e6b8-3a8e-4df2-be8c-329273866a89", "comment": "Malware payload (Dridex)", "value": "9233c417334b56c6d1c1045dbe691109b1bc56a0bbe12f83d876d4b1ad71b40a5822d5ab65887ee6ae93d63c5c704cc7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571252, "uuid": "f4b07cf6-0ca5-480c-8c10-47bd26bb321d", "value": "9904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571252, "uuid": "f2f2987b-1ea9-4f98-a5db-3bbab4ed312c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571252, "uuid": "cbff5559-3964-448b-aca7-26a998a1dde2", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571252, "uuid": "be11bfe2-ac83-4a09-ba84-a9c5ab8c85d2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571252, "uuid": "2974255e-6585-4b9b-b71b-799383863c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571252, "uuid": "88e198b9-1f10-49bd-b6d7-3bb623b2da8a", "value": "fc37ce7c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff9ed25-ba68-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621624194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624194, "uuid": "f64092c9-5637-407a-b098-bac1de78768e", "comment": "Malware payload (Dridex)", "value": "1fd04f5e293dbc68dceb4fb8b541fcf7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624194, "uuid": "d378097c-bb52-491c-b771-4666692bd39b", "comment": "Malware payload (Dridex)", "value": "4be87d1cf6cab77107a6b1ce947860f0895c66a0b689c3342ffd29220cdb1180", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624194, "uuid": "1ad5aee1-9f39-4637-b594-82396c845895", "comment": "Malware payload (Dridex)", "value": "7750bb77f42f973a8c66ed88234687932a1aff43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624194, "uuid": "ea960095-e4db-4bf1-8a12-2d7980722d0a", "comment": "Malware payload (Dridex)", "value": "a6dcaee7ca5efba0658ac0859c56a41b56674a42c1483a3b1d37ee6a0e67d59c2182ac9ffe8619efa93ac159ab090682", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624194, "uuid": "d8d764d4-782d-4f73-bc4d-aa7347675c5e", "value": "4EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624194, "uuid": "66eeb936-41b6-4ef1-b5af-6d9775702b3c", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624194, "uuid": "46b3c039-e39b-4c4c-82fd-4890e5c072bf", "value": "3072:aA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:a3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624194, "uuid": "d723f3d0-5571-42e9-a8ec-42c8a50781fe", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624194, "uuid": "45ed6e31-c4df-4020-9b28-367d8847f44d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624194, "uuid": "3e6fd947-ea33-4be9-8273-cc1c338a93a1", "value": "1fd04f5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adbe4d8-ba48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610522, "uuid": "5771df4c-a5ec-4b1c-b603-fc4f80373347", "comment": "Malware payload (Dridex)", "value": "a8e842a9d09e3b46e366cc0b7c2c033f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610522, "uuid": "bae87c00-4a5b-4125-a01d-690245a67acd", "comment": "Malware payload (Dridex)", "value": "4c04c8e1201df5ba1f371da046d66b6f921859929a5adefaf1faa55474d9b6e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610522, "uuid": "ff4bdc68-b386-42e6-89e6-26618275a6f2", "comment": "Malware payload (Dridex)", "value": "36454acdd4ebcc95b54b1cddb5c29ef0b7633376", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610522, "uuid": "68a2b55c-d55d-4f9b-9cc9-70caae70c31a", "comment": "Malware payload (Dridex)", "value": "5c63996ab37cf172f577c371ed62bc05b64c203245c2d6f8cef33e92c918c24d0e52fb8e9b88e9e1ea6fc1fdd9409e65", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610522, "uuid": "3b0f5a3a-4e46-4d10-8d48-11e238218cba", "value": "ADF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610522, "uuid": "55187ea6-e54c-4e55-9abc-b802fa0fb906", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610522, "uuid": "25497179-c94e-4fc6-a867-7cc54c9ee8da", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610522, "uuid": "3095a471-c58d-4c46-97b4-5d179920e563", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610522, "uuid": "79ca303b-1ed4-4b0e-8765-1e2f13be98fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610522, "uuid": "c260d7da-5335-4e80-b1ac-2045b985386b", "value": "a8e842a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371fcca4-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634540, "uuid": "81722ce5-010e-469a-906f-804b004f1e67", "comment": "Malware payload (Dridex)", "value": "af469455673f16495fc1a4b17499cb00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634540, "uuid": "c9ebec47-8c4f-4d4d-aba0-18fe4d27be06", "comment": "Malware payload (Dridex)", "value": "4cdde05b55d19a2a773112c68fc4b95064b9f01c44e06ea102801b42be2200ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634540, "uuid": "85628a18-b809-4700-8081-56641d50ab4a", "comment": "Malware payload (Dridex)", "value": "ed1573a72fc73084a956c75f742a9f29295a1f76", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634540, "uuid": "5232e16b-ff6d-42d6-a1d9-fcec487b4524", "comment": "Malware payload (Dridex)", "value": "2f20c94435190dec22845c2d9a313921b38d9973bfcff569417aa35c02636d17b5358a093163564975263d235e96556a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634540, "uuid": "c1e552c3-313f-48d1-a6be-1398495133be", "value": "2EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634540, "uuid": "09a4b393-0335-4c57-b664-6aaffd6a7c72", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634540, "uuid": "6eb108b1-c4a3-4b16-b5b4-173b6abb520c", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634540, "uuid": "de49079a-348b-4aa9-a6e1-2d8fbf51103e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634540, "uuid": "2b7fd15d-8d28-4761-803b-82c525b2e9b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634540, "uuid": "ad4e93e3-6451-4e32-9fd7-b88da73da4c5", "value": "af469455_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42840c9-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563427, "uuid": "1db7c26d-1977-4c39-8ef5-75ced70ee5f9", "comment": "Malware payload (Dridex)", "value": "e4e878469bfcc24d1cdc19e89b127dc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563427, "uuid": "162fbc96-19f0-44b6-a247-80da54d48c65", "comment": "Malware payload (Dridex)", "value": "4d20abc9d032260f31adbac5210563e022d410e480c7c7a091f6aeb3bdbea66b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563427, "uuid": "dcb21b23-c046-4cee-9f4d-37172a820dad", "comment": "Malware payload (Dridex)", "value": "03a601b0971d777f6feacca8e8715c5315be1834", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563427, "uuid": "f0564127-7e3d-4005-a046-17b764752b48", "comment": "Malware payload (Dridex)", "value": "3cf669826e2bf4a50abf3162c1831b66dbc2af061053b947785e8096989b4eb80b045d66ade6343ddaeb501d81b5a24e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563427, "uuid": "55c744d4-304f-47a1-ad9e-faba077d18c1", "value": "E804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563427, "uuid": "79076732-66fc-4554-b5b5-15e2d2d85e59", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563427, "uuid": "ed963fae-588d-4084-a5ad-e8c3c373f141", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563427, "uuid": "e8eea2bb-05f8-43aa-accb-bd91e007e4a5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563427, "uuid": "be6889d6-c7db-41f9-98bb-72ad2fa0c0e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563427, "uuid": "0f5e31d5-87d1-4b13-b5fb-06a34ee29eff", "value": "e4e87846_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b054f2b-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566203, "uuid": "6cce7f3d-7b0d-45c3-a1fb-f741c62defa4", "comment": "Malware payload (Dridex)", "value": "dec4877a98c9512d9b4b3fe35f396619", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566203, "uuid": "ff7cd6c3-7a32-4477-b283-b430fb9b988c", "comment": "Malware payload (Dridex)", "value": "4e3fc8d5e9db8820e06cc461e7f49ae75d4b3220d82df7e55c437fcd1251f676", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566203, "uuid": "92e97b49-198c-4c7a-93ae-e8a6f3a743ef", "comment": "Malware payload (Dridex)", "value": "41bb6cc85453d6d8cee13fbd665c82785b7c4eb1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566203, "uuid": "1568c97e-082d-4225-a6be-e37c644d3aaa", "comment": "Malware payload (Dridex)", "value": "cd1b1ac8fbcbd0eb5e34e407376faa7cbded280e2d05997d121179bfb6de79250a2264f04e460377f5ffeb22fe6935f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566203, "uuid": "7cec1de2-8dc5-4e98-a2cc-4de90459f3fd", "value": "39F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566203, "uuid": "23a0f4e1-d786-410c-b2d0-334222e35c98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566203, "uuid": "e09fc092-9933-4bb8-aec5-616407b8e716", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566203, "uuid": "83d3cdd1-c91d-46ab-a08b-a614140ff76f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566203, "uuid": "af4d4620-f50f-469d-a413-0454126d445e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566203, "uuid": "3ed6dc50-fe40-4562-803d-0bb8fdc06237", "value": "dec4877a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e4a3f1-ba0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621584910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584910, "uuid": "5ba89cc7-85da-4336-b94b-dc7fb5c5b0c4", "comment": "Malware payload (SnakeKeylogger)", "value": "47e2b2dc7a2c10421ae204ee74855128", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584910, "uuid": "f56fc5e8-ecf7-47dd-9924-2c8323dcfc4f", "comment": "Malware payload (SnakeKeylogger)", "value": "4e5163135decc7b0770c92d14029d198082062110fdf63b69e4905a2158d6357", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584910, "uuid": "27559d9e-5185-42a3-af43-51249a725ab5", "comment": "Malware payload (SnakeKeylogger)", "value": "17e5fe696b2ae79ac36864e411ca23f304f3469a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584910, "uuid": "e125b340-5e35-4ff5-aa77-5242aa95a862", "comment": "Malware payload (SnakeKeylogger)", "value": "50c35219842c51a1c0908ea910774199b3fd7cc9049e39f6dbfd25307935c4320cb948093182a7c6e9fc4fa6113482d0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584910, "uuid": "8a96325b-a640-4af2-9746-22e65164fef8", "value": "A4C49DAC329076DFC81BCD728A682C60AA2174B7571BD207905715ADAE0DBDBCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584910, "uuid": "2c0a576f-a853-4620-8f20-fc8a4bc94b84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584910, "uuid": "a177822f-b67b-48b1-8920-ff75e29aeb41", "value": "12288:3/QDElMvZ8fa3djyVz2eAeFwwlUSXtJDelw8yb+I:3/Q7vZ2+jyVTAeFwEII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584910, "uuid": "1562a04b-4fbc-46d5-9e77-78f4d2196eea", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584910, "uuid": "88238535-bcf9-4c78-b371-71d535c9dea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584910, "uuid": "990d4725-3a39-4069-b685-2ac6b2262695", "value": "invoice & packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54299d4-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621611130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611130, "uuid": "aaf3f7a8-e773-4c23-9a53-dca899edbfcc", "comment": "Malware payload", "value": "072499ccb457ef8f827ae1055f0fa919", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611130, "uuid": "c3a02eba-69b6-401b-8919-60f544e5b00d", "comment": "Malware payload", "value": "4e5f1f006ba6b2747c545749785f8e6d0467d24b602aa508e56122d9b1fa4543", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611130, "uuid": "8b56a091-4ee8-4ce7-9cb4-03b1fb575964", "comment": "Malware payload", "value": "fd8d33c70476a736dd4eca7e4daf3d21a10197f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611130, "uuid": "90e46c44-172c-49ea-b0be-91eee74a7250", "comment": "Malware payload", "value": "61614aeb285fc828cb03c8621bd8d5d6b6a831d91ee6acef97b9c31366b7407301338162188433cc62e724ce51ed839d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611130, "uuid": "c3c36324-55d9-4d46-a5d8-4a82b02cc2c8", "value": "8F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611130, "uuid": "901b478c-3131-4f5e-bf83-b08de314092f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611130, "uuid": "8c913186-18ca-4ba5-a095-db166a6fff19", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611130, "uuid": "e06d51c6-7dd8-4b3f-9903-dead6ed66953", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611130, "uuid": "80286a82-4ea2-4916-95cb-26aac7b25cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611130, "uuid": "9a4f0b4b-2445-4342-a9f6-300454b791ff", "value": "072499cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc36aea8-ba4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612967, "uuid": "d18565a3-f03d-4c0f-9249-c4a600def2e3", "comment": "Malware payload (Dridex)", "value": "b35c1793f5ce53d14be4022ef0189d93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612967, "uuid": "fdfd3762-9f68-4333-b332-674ee907531c", "comment": "Malware payload (Dridex)", "value": "4e606a78a29a0f1fa2ac8fb7971350a2679f18ea0a32111318fb695a7234b69f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612967, "uuid": "1aa8af76-b98b-4bf0-985b-4010a420d690", "comment": "Malware payload (Dridex)", "value": "73870492d1beb8907de3dd1f3669727afb0d2637", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612967, "uuid": "a6d3d4ae-8e21-42d3-9cbc-5ff16a413587", "comment": "Malware payload (Dridex)", "value": "6a74af422e8168fecead1b0bc5f4fba6ef4f62a263a26a0fe211d37f8cce936cc6438749c64603b3e4602d94fc9183f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612967, "uuid": "5c70e19b-519a-46f7-9bbb-1117f79714a8", "value": "7804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612967, "uuid": "8c980eac-ee16-4c97-a8b3-1de1cd9da46c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612967, "uuid": "a52ca91c-03e1-4be3-b6bf-099d0efbaeae", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612967, "uuid": "ac54d2cf-66f4-4717-8564-5df28d777781", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612967, "uuid": "01bdeb6b-1015-4d40-ac9f-5bbab051f032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612967, "uuid": "c180b23b-81cf-4128-97f0-2213a68cf7a5", "value": "b35c1793_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f063150-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573216, "uuid": "884743f4-0612-416e-9f1a-187d55c686a2", "comment": "Malware payload (Dridex)", "value": "b6513f675f1c88d96c74046e203ae313", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573216, "uuid": "6b945428-458e-46ec-ae00-5796f5342e8a", "comment": "Malware payload (Dridex)", "value": "4e696c3edb42cecae7731520ee9c48b6a55126762a03bf668f3a883f730111a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573216, "uuid": "2e4892d2-b5a4-4f3f-9d4f-e820f538dd89", "comment": "Malware payload (Dridex)", "value": "27fe258df2d54f2cd0c19c69fa8eb1a1748b9388", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573216, "uuid": "f8b21a8e-4f7a-4c42-94bc-d5fdd361a0aa", "comment": "Malware payload (Dridex)", "value": "f5c762d723c175517e62e6796f364242eaaf08f3ff777229d7527e742e2184cc22e88c58c4ea5ec47fb28cb251e48e38", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573216, "uuid": "0096a7a9-9d42-410a-8b13-8c0d8bb9e0af", "value": "6C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573216, "uuid": "d88c7b3a-83d7-4311-a0ea-929f6ee0894d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573216, "uuid": "b5badf30-2285-4f18-8c65-b490ecee7b1e", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573216, "uuid": "f1c113f8-d4e1-452f-929e-de8ecd93f96e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573216, "uuid": "7c597275-f90e-4b40-be43-0c25aa9c420d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573216, "uuid": "fbd82f29-daa0-433b-9197-ace12dc6343e", "value": "b6513f67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fe2d20-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621611825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611825, "uuid": "ace3c381-8096-4ef9-9b26-317bc5950186", "comment": "Malware payload (AgentTesla)", "value": "10fde2a7e9c599ad8155ac7d7d5c52c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611825, "uuid": "c2f8ce50-c426-4fd1-9e2a-163b95b498d4", "comment": "Malware payload (AgentTesla)", "value": "4ecd53e8ef1eb38bb0b95ca9c688b5479a3ee96e192bdfbe7e10b4026dc92a45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611825, "uuid": "7b87e339-ffe4-4a88-8c0b-90c3b052c5dc", "comment": "Malware payload (AgentTesla)", "value": "0ab6d00955c7996f47b8e8ade74f46c38b9cb683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611825, "uuid": "b7172726-ec26-4744-bd7f-fad55e0dd17d", "comment": "Malware payload (AgentTesla)", "value": "40efda19479bd12643b74abbb2dee65d3ab0c4ea49cad4866c1d919ef7189d4bcdd84137d0c6c01add2b6923e9c4365c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611825, "uuid": "664948a7-252f-4ea5-bf8e-75a275a7c172", "value": "0C15D02033A99349D03E5B35043289D023F27E26BB15DB6E7D94715C5E73AD38722BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611825, "uuid": "ff11c969-5a11-40d4-9f49-db8ddd33ae64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611825, "uuid": "159fa285-aa92-44f0-af8a-598fe575c08e", "value": "12288:McEhmMMKzNVHH6/gqBr3ls9id6Ad2j8cCXKu2YBgqZYaN0I7mnSRFHAsqq:7EhtFzNZiJs9QXm8cCXKiepAHAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611825, "uuid": "e0b69136-85e7-4b6c-93b0-5303fae19d9f", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611825, "uuid": "f67fe982-9e63-4fb8-96a5-8d56c450ad01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611825, "uuid": "312420c9-00d7-4759-aa26-67623588ce0a", "value": "DHL Tracking Record.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec2279b-ba3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621605857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605857, "uuid": "b76abc84-8f37-460c-89e1-cdab2e2d521f", "comment": "Malware payload (Dridex)", "value": "f6c8e85c916c72d9b1686c2c7f44339d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605857, "uuid": "bf11d244-60c7-40e9-9f55-9a57948ab55f", "comment": "Malware payload (Dridex)", "value": "4ee3b4aab5d0b239fb80c391b2765fe24e66c319cbb797b368f7c6d7acfab8a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605857, "uuid": "6f423499-2a6d-4a20-b5d1-1a1c7f46e1b1", "comment": "Malware payload (Dridex)", "value": "9e0e8da7a894f5a56886515b5ed8864e098c618b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605857, "uuid": "be9feabd-f6f9-4b47-8494-dbbe3c922b76", "comment": "Malware payload (Dridex)", "value": "2b546674ff3caf9e2c7ecc08c8d2f8a258c49e8f1eaf33d1d9a0daad35cbe71f70603f4bd8521074659383c7262d95df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605857, "uuid": "cf3c4c7e-ee55-4f96-b3cc-d4f9bf9871fd", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605857, "uuid": "7fc61bba-31c8-4414-8edb-37dda5c01023", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605857, "uuid": "6cb4e2b8-cd10-4f4c-8a9b-686c9a74451e", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621605857, "uuid": "e9681b01-d75e-4036-9598-3ace64ccc9e8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621605857, "uuid": "764e2b92-21a0-4a40-b435-1c0a44f94522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605857, "uuid": "6397409d-6fbd-4b37-b3cb-479b800a0a8b", "value": "f6c8e85c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e660bb10-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556236, "uuid": "11f3a2b2-23f3-4e04-9bbd-89b57cc8aa5c", "comment": "Malware payload (Dridex)", "value": "4eaf3b16cf1a1412725db864628504a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556236, "uuid": "243e8572-c755-48d8-b8ec-74e1c353e1f2", "comment": "Malware payload (Dridex)", "value": "4eee8f5e5d6edc010f428cc3a8ce7e65f91ac6e2de4818689b0b02400c6c6724", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556236, "uuid": "c3ae11a0-165a-4934-b82d-d055b57b84b0", "comment": "Malware payload (Dridex)", "value": "46fd222858a8eb4bb63dee4df9e6092645bd4524", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556236, "uuid": "cef0a180-88d9-450e-a6dc-7288de14b5eb", "comment": "Malware payload (Dridex)", "value": "5ee6923fa39b8e2f2c099700f7e643cd74a13fabfe7e475334402011a36420af91582ce849e1aedb0230e5a53331eef1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556236, "uuid": "3d241d2c-8328-4d96-9802-933fd8da647b", "value": "A004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556236, "uuid": "cc8239cc-4726-4442-995f-7e6372d42e90", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556236, "uuid": "2a65a668-3e05-4f64-906c-4458f76d5778", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556236, "uuid": "d438953c-9313-46b2-a4d6-588597d9e85d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556236, "uuid": "ce4363c8-db9b-43e1-aa6f-afcdd1db14b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556236, "uuid": "54d75a45-0c41-4c56-857f-da277379ecda", "value": "4eaf3b16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe04f8f-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1621613671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613671, "uuid": "c1202ac2-7e57-4005-b67f-3bbe03e7be8a", "comment": "Malware payload (NetWire)", "value": "bb9c19cc629396d0cfd7ab3072887ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613671, "uuid": "c70fe8c1-501c-4bd8-8245-4bc3aa0fecb0", "comment": "Malware payload (NetWire)", "value": "4effc832d17d1b4d00e5b98bda9954f7c2684795db2451d4c2f056c84a0eff18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613671, "uuid": "a1016b4b-0cfe-4c1e-889f-53c838679d3c", "comment": "Malware payload (NetWire)", "value": "0ede862c21205f17d01ec6b2929595393ba8d9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613671, "uuid": "fa865748-f5c7-40b5-ab40-7558efe521bf", "comment": "Malware payload (NetWire)", "value": "dad58a0e2eea28b64af5a7e9f81fa5ab389de0c371825dd7b6e7c368de1ab1f076a418b17e386a001b703f4bd70287b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613671, "uuid": "72e6b136-995b-42e9-a2cb-4a84d74c20d3", "value": "AE25ADC1AE8ABA1EC12E7770301151FCC3A36C6615DDE7EA1AC7FDCA97A724052907D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613671, "uuid": "a88e6f98-14f4-49bc-a501-b37b0a3192af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613671, "uuid": "4081dd40-37b9-4149-bbaa-6bda0148fc60", "value": "24576:Xqz4gwB0W319MeRjNCSkGXddFyUICfLc:Xqz4J1TNR4Sk0ddFxLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613671, "uuid": "e0206664-4f18-40a2-b02c-0dab469dcadf", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613671, "uuid": "ebad5ef0-aea9-4bb6-b633-163454f141ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613671, "uuid": "60e016b6-05dd-4117-891e-d9597885ec01", "value": "bb9c19cc629396d0cfd7ab3072887ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145720e6-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564904, "uuid": "cd166c06-d37d-49c9-92b2-d01f515dd65c", "comment": "Malware payload (Dridex)", "value": "60f161ef67a1f07859458edbb8210481", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564904, "uuid": "f371007f-dc8d-425f-aa4e-dbf9fa559144", "comment": "Malware payload (Dridex)", "value": "4f171c785b9afacbbfd6c852f11f614b3754d9e993c275b9798d2165f03e6452", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564904, "uuid": "611fd7ee-bb41-455b-bf62-58c743460015", "comment": "Malware payload (Dridex)", "value": "a2962c65860ba2974bd8b920bfbb4e44c8a03877", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564904, "uuid": "45212b2c-092e-4d8b-af44-86825e617aee", "comment": "Malware payload (Dridex)", "value": "be4626964bfd27bc6b4ad3316c366f5750b77481f5d323b12f2c02d869147f75c9d29d6c505874272d92849b5c41c7da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564904, "uuid": "f62fab43-046b-40e9-8699-62306fdeccba", "value": "6A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564904, "uuid": "6dfdfab9-999f-4464-b2dc-a072890a3795", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564904, "uuid": "b0180574-0c92-4778-9c42-26e456330862", "value": "3072:vV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:vV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564904, "uuid": "19c6c4f6-a2f5-4aa5-af67-861af40a404b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564904, "uuid": "f9254230-e452-4e40-ad95-6f3f52aac8e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564904, "uuid": "6058fdb4-d70b-414e-9044-6c77a56ab7c9", "value": "60f161ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c476c1-ba53-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621615533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615533, "uuid": "64a5ac76-fb6d-4329-b518-ca267801e210", "comment": "Malware payload (Dridex)", "value": "d43d997e5330ce3f8a7647ae67742824", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615533, "uuid": "6e176305-ed31-449b-baed-0e79381826cd", "comment": "Malware payload (Dridex)", "value": "4f2f584b8d5e7ab721c744e78f9f941974854706b958f70701a3208b9dd5fc6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615533, "uuid": "6ae32fd0-f2f4-455d-9272-d4ae6c4fecea", "comment": "Malware payload (Dridex)", "value": "c990ab8b4f88b3d3bcce515f3fa3fa2b8a6e46d2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621615533, "uuid": "c06d171c-bc31-4f93-886c-c4b145c945e7", "comment": "Malware payload (Dridex)", "value": "dfd08ba827999817f8f9541edef9be88b817401f2cdd17337a8c0fbc0214f52137ae01c3b9140e78d2b11ba41a852e03", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615533, "uuid": "b4e1324c-cc2d-497a-9f24-660131c4eb86", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615533, "uuid": "aa38e278-3a43-4ae7-9e7f-8f53f55d18f0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615533, "uuid": "b67808c5-ee54-4c1f-808d-392443403910", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621615533, "uuid": "cf8bcdfa-821f-4aae-afe2-20d658e283f5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621615533, "uuid": "c73d20bc-117f-4bff-96b4-1dbfa48f9895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621615533, "uuid": "c4ef7265-f6b6-4c88-bccb-9028c82a2779", "value": "d43d997e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac510043-b9fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577614, "uuid": "f84edb8b-3687-4da7-ab2b-aac325c52644", "comment": "Malware payload (Dridex)", "value": "e331d15e0a1c1f11ab5d9d3318758f7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577614, "uuid": "744e672a-9eb7-4d61-b81c-d1280d4e8136", "comment": "Malware payload (Dridex)", "value": "4f3c63b0dddb93e6c78c0fbd84f41a3dc8b052b1b5b71bb0c8c10f178fa55928", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577614, "uuid": "6b24b41f-5521-4e22-853e-044cf2304a34", "comment": "Malware payload (Dridex)", "value": "114032c9aeb7126fb8b9bb17ad9bd2177e845469", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577614, "uuid": "caa9bc0c-afa8-4e7d-b4ba-d7f626de6b10", "comment": "Malware payload (Dridex)", "value": "bebed6682226de453a16579696a3eda0fe61b3394c40a296ac3d0a87d59d6ff3b777f912b182c42c2970bb9a57a0c137", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577614, "uuid": "97b6d3d4-14c1-4390-8736-585045ee59fe", "value": "FDF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577614, "uuid": "d7c06742-5b30-4efc-9d2b-feee4e990392", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577614, "uuid": "8da50a34-7295-4ca9-b094-adf9daff6e7c", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577614, "uuid": "e080bb8a-e8fc-4fb2-acad-376abdf733ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577614, "uuid": "46fae677-59dc-4f65-a1e9-1146dbb9bbca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577614, "uuid": "7f3a8360-d785-445a-8e52-aca86f4f4c4b", "value": "e331d15e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd45c46-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573566, "uuid": "210f8489-39d6-417b-8a92-10d081cd20ea", "comment": "Malware payload (Dridex)", "value": "64d33284fe3e4a0290c1ccade077a2ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573566, "uuid": "2d7e0842-ada9-42c2-bf2e-1cd251473aed", "comment": "Malware payload (Dridex)", "value": "4f56c5babbc9681aa7b92699bd269fb985230001eeb2a16af47a9c33e7ffe742", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573566, "uuid": "a1a5a6ff-2370-4510-9467-5c7cea43613c", "comment": "Malware payload (Dridex)", "value": "b96d89787e792ad7d9f753955cd75499fa3a7703", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573566, "uuid": "dd5ae551-6f95-4e64-9630-b229cb51cd5a", "comment": "Malware payload (Dridex)", "value": "af3743a69b5f97f29a869fb4f363ddff290eda9355e4e763303523f6e6814c7ffb167d270cf821395fe1d0251fca04c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573566, "uuid": "0fea8007-689a-4633-8799-9ae10af7db54", "value": "B204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573566, "uuid": "0817ab4b-e706-478a-ba68-f6a44d6c616a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573566, "uuid": "766bb3eb-3eac-4679-aa72-5e63afe3998d", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573566, "uuid": "9555cd33-c29d-40fe-90b0-49ccbf8de11c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573566, "uuid": "252d9d09-2f8a-4382-9e0d-ca8a597b2901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573566, "uuid": "d8b40664-4a72-49fa-a10d-ee72dbd4b764", "value": "64d33284_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb9b88-ba8b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621639318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639318, "uuid": "904c2f6d-7a55-4d73-8a74-abf8e3c7ff10", "comment": "Malware payload", "value": "633abcad87c3371b47e2e8fb16669999", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639318, "uuid": "6afbcf06-1f19-4f2d-8e4e-c35cf08b9544", "comment": "Malware payload", "value": "4f61247facdb6621425c88fbae7511c0c3a20ef78c72b1d5e1e91f1a1a90f924", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639318, "uuid": "ca7bbe35-988f-4137-bec6-2c625434ae88", "comment": "Malware payload", "value": "a0951f7df4f0b4960c5d5e893c6be37aa54dc006", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639318, "uuid": "90de34bb-f6c6-47b9-b207-c83faecb64e7", "comment": "Malware payload", "value": "b6d23757827d3d604d35f17aad143185c5f86d7eb74bfde99135c1ba3f1dba26c519e1e025358430c8cb405be3e51abe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639318, "uuid": "cdd9e37c-7fec-478f-974b-da0dde534c5d", "value": "98F3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639318, "uuid": "58302cc6-1278-43f9-91f8-dd4a0a7a612f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639318, "uuid": "8b331d3b-2cbc-4dba-bc0d-b0340a716c8a", "value": "3072:yIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621639318, "uuid": "a04306b4-99dd-4402-b62f-91b76651c632", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621639318, "uuid": "f241299b-4709-4c20-a485-954f36028533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639318, "uuid": "d5687152-2731-4ed1-ac36-78cbbba7826c", "value": "633abcad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9105157-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621618545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618545, "uuid": "b236ba1e-5949-4eec-94cf-4976e18dc713", "comment": "Malware payload (ArkeiStealer)", "value": "7049ac9d2096d37d36ee0d1ee9048e95", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618545, "uuid": "585d4ef7-a620-41cc-ac4c-31de950b0f1a", "comment": "Malware payload (ArkeiStealer)", "value": "4f8fe2f14c19ae475f397f4ea62e59ef42adc7c5af1ced0fca00d8963c9fb6d6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618545, "uuid": "a875adf9-2b46-47e2-ab82-707e0183d983", "comment": "Malware payload (ArkeiStealer)", "value": "36def9f0c54a3c52bbf9953fd3928d2d02e04505", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618545, "uuid": "682659d5-a267-469c-b59b-49270fa28278", "comment": "Malware payload (ArkeiStealer)", "value": "63710e747634d771122cac3c55f6988c5eff585d4bb09dc9dc9cc12d485e760616e9e54bfe00010ad96946b7fb0360fd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618545, "uuid": "bd86806d-ff4c-422f-9ad5-ac0cc99b903b", "value": "6E64AF30A7A0C035F5B712F449B997A9AA3E7EB06B3491CB52D116EE4A347E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618545, "uuid": "71af74a1-69b4-4a3f-8821-62420194b8b9", "value": "d3fb0dee22f12d174c2c166e4d59a3c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618545, "uuid": "d07c8447-5df2-4aca-be0c-b733d82857d2", "value": "6144:GGUDKj2q5opTm2EXsoVnnFX197/+G81A3thsAAHWLE/0B:CKj2ZpTm2EXskFXHLhhlAHWg8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618545, "uuid": "9f955355-8939-4b27-92a8-0c9e15400aa2", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618545, "uuid": "14377b33-71a4-4896-9908-f065ac3dd051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618545, "uuid": "0efaddf6-a878-47d6-afa6-e9e7cf50f533", "value": "7049AC9D2096D37D36EE0D1EE9048E95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75204629-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569361, "uuid": "9fc756d8-27db-4918-aaba-384797787d94", "comment": "Malware payload (Dridex)", "value": "eac543f6db20d119897d0af733818aa0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569361, "uuid": "b4203ae8-7051-4fcb-91bd-75955fab42be", "comment": "Malware payload (Dridex)", "value": "4f9d4cfa0665693013dd55faa440719afb06c0b27be1495e99ac8538939a3bed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569361, "uuid": "dcc0588b-98cc-49e3-bbab-fc16e19f7e28", "comment": "Malware payload (Dridex)", "value": "5e9758990c295302ad2b098fd42446f4baf593b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569361, "uuid": "e8002cad-edf3-4175-9621-ed8cf01815b0", "comment": "Malware payload (Dridex)", "value": "372e5884e40aab18112e1496cf8c0d2f8ae26051b08e8f2fa3940dd73d9e2a7e13055bdc8590fca2ea960e9f6772b284", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569361, "uuid": "55230f10-f4b5-4953-83fe-0a2583b08d38", "value": "42F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569361, "uuid": "1b6963b3-5acb-451d-a31c-c7d0deba9439", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569361, "uuid": "7daee9e5-3a01-480c-8834-f0a31ab7cbcb", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569361, "uuid": "1a7615ba-4e20-4ba3-90f9-d3489955d196", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569361, "uuid": "20ab299f-a45f-472b-93f0-38f1274107ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569361, "uuid": "96622d15-9162-40eb-b3a4-b9b757745711", "value": "eac543f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691d6bd3-b9e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566764, "uuid": "babaa0e1-2fc6-46ec-b7af-4ea932b7863e", "comment": "Malware payload (Dridex)", "value": "c5066586a16c90f7b46ff2a473c55a1e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566764, "uuid": "d7467ad5-e67e-427b-8a4f-6f4411d28154", "comment": "Malware payload (Dridex)", "value": "4fba59012cec8967453f932d074a5222ab56306107affd4777ac48679a8e6be8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566764, "uuid": "426e605a-3ed3-4794-8573-cb93f2016e89", "comment": "Malware payload (Dridex)", "value": "970af36c8bc7212e525daea1abd1d8a7ae23110e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566764, "uuid": "66d72d5d-93a8-4101-9383-33802da6b392", "comment": "Malware payload (Dridex)", "value": "928b6ec7871d5ac7dff306c02747ce5339e4e631dc53017aeb0663af4f731acd9df01bacd2a6e142aff8555a33ab14b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566764, "uuid": "d62f7383-f8de-4c9e-a5c0-8695e50b9607", "value": "1E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566764, "uuid": "ba765b58-27e0-4937-b0c6-416214620177", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566764, "uuid": "57630529-47af-4d46-8b06-3407c5653d49", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566764, "uuid": "682d7980-e7ba-44b9-b549-7075b0865a76", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566764, "uuid": "e6590372-1a74-4477-9a85-715df1d794b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566764, "uuid": "bc6fe286-f0f6-4b83-8148-a05c4309ac30", "value": "c5066586_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e7e108-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581475, "uuid": "e20aff99-df3f-4628-9efd-d8b132ebbd2e", "comment": "Malware payload (Dridex)", "value": "05b89beecf79e890386111ab2aa9ce3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581475, "uuid": "f8ae7211-74d4-412d-802e-e340fd611d85", "comment": "Malware payload (Dridex)", "value": "4fbaf1bc1c9fe2cfe03c5b3decfef4d0edc2bb61014694895f19033f5b60a9a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581475, "uuid": "546561e3-c534-4380-98c6-bff5f7d1dea8", "comment": "Malware payload (Dridex)", "value": "20fb35a5b03404c0405bbe86b78f90751dad13b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581475, "uuid": "b1ca6d3e-04e4-4490-aff5-a15f32b0ebd7", "comment": "Malware payload (Dridex)", "value": "afba848ed14426a9c6bcfec2a9d4a5d8b61ea6638c3333db005ca140c170d518079b5a8e8188105dc6a1506fa1225a99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581475, "uuid": "a9cafd45-a9cf-4490-8c40-f6b21c6e4d8b", "value": "6804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581475, "uuid": "140f01ff-5f5a-473d-9c78-13894cd7aa07", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581475, "uuid": "7301c169-ba91-45a6-8f4f-2ca708f8a084", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581475, "uuid": "56464632-e746-45df-b25b-29291646fe9f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581475, "uuid": "fe6fe935-3fc6-4a72-b016-c0d682c36dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581475, "uuid": "2b8888c5-56d3-4a4b-9035-ccfbf6ee28c2", "value": "05b89bee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d23b790-ba89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638389, "uuid": "2121ecf5-bf7b-4239-90ea-1267465c7c10", "comment": "Malware payload (Dridex)", "value": "828234db1e93fed48efc62303c064c32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638389, "uuid": "2b5437cd-feee-4651-a2e5-c8de487092bc", "comment": "Malware payload (Dridex)", "value": "4fdcc9cc016a9a7812938b5625735886d64856abf10ff7dfb74a8cc141e92568", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638389, "uuid": "399a1093-adc7-4949-9211-636bcdb8cbb2", "comment": "Malware payload (Dridex)", "value": "038f7da281bb495542797a79d61278dbbc8232df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638389, "uuid": "da5226d0-59d1-486e-810b-79c1355bc11f", "comment": "Malware payload (Dridex)", "value": "5e7571e57bad912453a4d7b0cf16ab8f9e97002bb2680c0d5facef2e8272ef1a30eb3bdcf2a4dccc579fa39404caedb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638389, "uuid": "07ab07a6-22a3-4db9-998c-e22eea1e7eb1", "value": "B5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638389, "uuid": "4037edca-fc20-4df1-b2f7-7042865c0bfe", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638389, "uuid": "49ea8876-9f3f-416e-9924-cd5d552add01", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638389, "uuid": "5ad5df47-06e4-45b6-af30-44ab8a9083d7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638389, "uuid": "9d3d96ef-2c7c-4dc8-88e9-14673dede692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638389, "uuid": "6fbc2b9f-3cc1-4309-a564-1cfda822b2ad", "value": "828234db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c68df7-ba8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621639175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639175, "uuid": "e3d98de2-be59-4d23-9a60-dd4f50d303d6", "comment": "Malware payload (Dridex)", "value": "d2d0984429d0e47732f658f5af7501b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639175, "uuid": "827bf1c9-3521-4cfb-9d99-8c0537d212f0", "comment": "Malware payload (Dridex)", "value": "500411f0563c884e8f14ec6d252b782e385831bac22b4cbafb624dc207cd7ac7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639175, "uuid": "df080952-1297-42ca-8812-2cbfd275da08", "comment": "Malware payload (Dridex)", "value": "6cbeff46dcc49435e1bf56ea0c69ffc0f9a4c8cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621639175, "uuid": "47195848-2f46-437a-9cf1-9c4faf89b1fa", "comment": "Malware payload (Dridex)", "value": "b0eb58b6e9105ac85b6e60c048916671e2f478eaeceed5f9019fe3f215cf6e1c888aae95c0a326235191b26899b079b4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639175, "uuid": "fbbe6dcd-0603-4e33-8a46-12968d5688d2", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639175, "uuid": "7e12c152-e0c2-4b6f-a4b0-ee77de177018", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639175, "uuid": "ce03ed10-7596-497e-bf61-965485b811c6", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621639175, "uuid": "10376b9b-4c48-456b-bae7-f96937f791db", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621639175, "uuid": "66370504-a9ec-4edf-ba1d-2fa482680100", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621639175, "uuid": "41e6688f-c6b8-4a50-93d7-7e141a020759", "value": "d2d09844_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28290b3-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572927, "uuid": "0839e372-ee03-4328-889f-f04145a8376e", "comment": "Malware payload (Dridex)", "value": "d7761e0d5b2b77716615c624ab19b850", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572927, "uuid": "6c079474-a7fe-4e63-a4ba-95c018301ccd", "comment": "Malware payload (Dridex)", "value": "5050921f1df684d366af4c239fb4b26167c80214bb0b807c04a712ed82d25a6a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572927, "uuid": "3f61e399-df28-4c59-87dd-dc87780d82f4", "comment": "Malware payload (Dridex)", "value": "5727193b6f6e170b2956a4f18d4c09f2cb60a4fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572927, "uuid": "a9abb5cc-6e7a-470c-bd58-ab7243e089dc", "comment": "Malware payload (Dridex)", "value": "7a880fc12c0dd973a2f053e53fb334ebf8ea38c23799e36caace6beef1240120cc1558e518a3aca8c7b23343f98bc965", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572927, "uuid": "95d75216-5242-4b95-ac72-406cab8c2be0", "value": "F704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572927, "uuid": "b043669e-810c-48b0-8d0d-d2310f3ae20f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572927, "uuid": "499e1f64-4280-445c-8f23-a48c4e3fa3c9", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572927, "uuid": "f4bb27de-4aaa-4783-9061-6e6aa893bb63", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572927, "uuid": "f48af9a6-c199-4329-93f2-7ff0acc020db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572927, "uuid": "035e695f-4371-49d6-8c14-fe91d68cb822", "value": "d7761e0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b53c8b4-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621587893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587893, "uuid": "213f7623-e6b9-469b-adde-73c2e20cfa02", "comment": "Malware payload (Dridex)", "value": "7dfa3cc82870310f120954a96abda6d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587893, "uuid": "e10891a3-4069-4376-abfd-ca6b87cd2c30", "comment": "Malware payload (Dridex)", "value": "505fce87c9a049ccdb3556edf9870b1810d654c97a4d1ba11c14900f646b02cf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587893, "uuid": "d5639a95-8044-4ffd-9d64-cf4517e082af", "comment": "Malware payload (Dridex)", "value": "7f6c2902909b5b6200c92fc28b0f6ef14f10fe6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587893, "uuid": "d3e0086f-3627-46fa-983f-bd4fea7e79f4", "comment": "Malware payload (Dridex)", "value": "2ea4e95015dac737b17ce0b81a41d89999c008703bbe3f8a3442e5a16d7d68f9f73bbc56b4e41cf5d70b74481c671e4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587893, "uuid": "f4aadaea-dd7a-4a2d-8593-1ba114172eb7", "value": "9104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587893, "uuid": "55e2ffe9-8eb6-4a35-8a33-9d07d653285f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587893, "uuid": "abe89a46-9ae5-4b37-9733-da8fbd592b82", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621587893, "uuid": "108acce8-7013-4409-8ad8-7295e8bfc59b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621587893, "uuid": "72aa818e-2fd6-4527-b677-d8642e22dd2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587893, "uuid": "c1c510fb-414b-4b87-993c-a88b389662d1", "value": "7dfa3cc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31aec511-b9f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621576120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576120, "uuid": "e3e669b2-7d64-487d-83fb-ba808a96ab36", "comment": "Malware payload (Dridex)", "value": "dd32af2cec3d436c2c900ec0628eee69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576120, "uuid": "1b67064b-7229-4c6a-bd67-2bd75b7644d3", "comment": "Malware payload (Dridex)", "value": "5062ff2422d1a848713b02692c7c4c97dccd0af463464fc2e8ffd8e6b6eccdce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576120, "uuid": "3a2eb837-11c2-4fc6-ac1f-37126ef7588b", "comment": "Malware payload (Dridex)", "value": "bba5ad03ad7dc4b9ac2b12c13229f13c05f9fb62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576120, "uuid": "249a7df2-bfaf-44f7-8a8d-a3f94b98fe38", "comment": "Malware payload (Dridex)", "value": "9de4d1087ba2ac66a74f79ea612f920b7674fa5f089152562f2385dc02b70953fb351e7f9562cb8400446ed61dc7c052", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576120, "uuid": "1511d2d5-5031-48e8-b803-653c5de743d1", "value": "80F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576120, "uuid": "333407a3-02d6-4ed2-8c11-2ff5134ca162", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576120, "uuid": "5355bfec-3d3e-46e4-b0cd-018e2fc75ecb", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576120, "uuid": "2de60e6f-b8e5-485e-b249-e94e27131b4d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576120, "uuid": "ba85cb08-928c-45ed-a5ec-a369c39709f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576120, "uuid": "da4255b7-4e7d-4775-9caa-51af312e3859", "value": "dd32af2c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a22616-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1621577841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577841, "uuid": "5534b0aa-b2fd-48dd-bb5e-84e954629349", "comment": "Malware payload (njrat)", "value": "e294cac9c4835b96c9a8d3373cb955b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577841, "uuid": "cff918cb-d69a-4dd6-8e5c-b202d214d5ea", "comment": "Malware payload (njrat)", "value": "513698ec48c652fd7fd4e0b54f8b0050dc4f8efe2dfb71be71300850b3a4e049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577841, "uuid": "4132d1be-3448-450b-b5c5-69a49b579671", "comment": "Malware payload (njrat)", "value": "4eb646f16c15579fb9cfca4c0ab50595be67030e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577841, "uuid": "ac09eecf-7dad-43e9-8065-d3a4c979cc24", "comment": "Malware payload (njrat)", "value": "8e9955e4f7b79c231e01e3ba34d3002436f24d2f0288a41f50ef85097645e1fe3a9ac8e5eff8ba638cc95efda437d838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577841, "uuid": "7d973456-6d96-40de-acb0-3018ebc777a2", "value": "E6B22C4E3FB98856C9AC177486A5965003B4D1470423EE2FCCC554CBAFB3AD91D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577841, "uuid": "5f986cea-9392-48ef-aceb-2c67822e31d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577841, "uuid": "e5b09cbc-77b4-45ab-b0b3-7beb238fd45e", "value": "384:NsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZqW:2f65K2Yf1jKRpcnuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577841, "uuid": "1c09ba4b-6171-498b-ae26-b39c6f442796", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577841, "uuid": "e4430574-077d-42d6-96f5-69cc379c4b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577841, "uuid": "3d2c9323-da4d-4f85-ad87-1e6aa5cbcdd9", "value": "PNmmb1t7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fe34d1-b9d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560772, "uuid": "2dd8af74-74c2-49ef-80f3-6262d2d1cf73", "comment": "Malware payload (Dridex)", "value": "28afdd000246db2a34fed0290c49c18b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560772, "uuid": "e899f9a6-bae7-4fd1-be6b-72fbdb239966", "comment": "Malware payload (Dridex)", "value": "515091d1e7c9b67a87f8e7aaec8b7c2ab9b63c3bbffcc15c1f45a0cf33c00bdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560772, "uuid": "bf01eb15-5b6d-49c7-8f8d-8ab8cf539fdf", "comment": "Malware payload (Dridex)", "value": "c0c7afd273e49ef469bf9cf65e162a575f2e631a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560772, "uuid": "8e096b97-ee47-4d34-9d3c-85af8dcaa112", "comment": "Malware payload (Dridex)", "value": "01c2218bae41d628194ad527470a04f06dc525fc82205f3c69d11aa9acbc57d9235bc3f0707373e144f8857af5cdfc61", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560772, "uuid": "e6d105bb-f3a5-4810-991f-2771788e01be", "value": "8704B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560772, "uuid": "94516b51-89f2-4f65-97c3-75714ef919f9", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560772, "uuid": "20c18d4e-ced6-4499-8e3c-9455753a9004", "value": "3072:JWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:JWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560772, "uuid": "11826e68-b9be-4eb2-b551-c88dd9a48b33", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560772, "uuid": "0bb97c30-4689-4073-87f7-82709fbce769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560772, "uuid": "af613072-bc36-4e6a-9a1d-31d426cadb16", "value": "28afdd00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9694e5b-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609526, "uuid": "53d126f5-528c-45ce-a0a8-91f1659c407c", "comment": "Malware payload (Dridex)", "value": "9c0a86a837ed945a03984fadc52549b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609526, "uuid": "65d908cb-4cae-4cf2-b150-d1572a78b771", "comment": "Malware payload (Dridex)", "value": "51c4f542923398efef03e8e03283839f210b3908325696c104824b2304bac517", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609526, "uuid": "e5d496b2-a6d2-4f55-9391-6491d5a174f5", "comment": "Malware payload (Dridex)", "value": "f1c20d1077139388302c29255fbab9fd47c8f766", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609526, "uuid": "40d96224-07de-4b00-b517-2b7d6b2321ad", "comment": "Malware payload (Dridex)", "value": "448752b5e38d70ca558725e128552a745acafabdccf14aa2f6b59f01964411ec00325a4da84430c65cbd0cb616a442f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609526, "uuid": "3885cd26-c6ae-42a9-a193-bb29f462d160", "value": "6004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609526, "uuid": "a39cb27e-c6af-49c0-80a9-f6f2a6fb5ad4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609526, "uuid": "3a9d7035-6210-4a8c-b8c1-691bf99fc425", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609526, "uuid": "a378f261-fe6f-4111-a88c-5dd13f89dbfc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609526, "uuid": "cc23fb42-60ab-4cdf-8638-c1197abd9e48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609526, "uuid": "37c4ec29-cde9-4b3a-8fbd-8a024b1eb851", "value": "9c0a86a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b097ba0-b9d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560647, "uuid": "25c8dba3-de30-45da-a799-38fc56b1e3d2", "comment": "Malware payload (Dridex)", "value": "d0bb7e8da6c85cce96502ca78c1bfbdf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560647, "uuid": "c0f38881-54ee-49d1-a743-ad5d27317d2d", "comment": "Malware payload (Dridex)", "value": "51c5840e2ca7b5f30f68be15a5d08534fbde0de97dac02ceb37c67cd9ed396f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560647, "uuid": "09148cb2-8c40-4a76-baca-b92edaf50189", "comment": "Malware payload (Dridex)", "value": "3fdecaae9d4f3635468b21ec1722c1cc3fdf796a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560647, "uuid": "f3b2c96f-b78a-45f7-8100-8ea49dda7eb3", "comment": "Malware payload (Dridex)", "value": "ad44cacf6f3d4b3d2c49317ab6f45ffa23aa5ad025e66e0371c74a9c764eb262df03a734c31b76c05862a81f9d3fed5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560647, "uuid": "86fc0418-032b-40fb-a52b-99f9fb34aefb", "value": "5B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560647, "uuid": "d7e35f88-a882-4424-957f-57e2df7f7678", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560647, "uuid": "8f6b5f4b-7f0c-4df0-88df-42add2ed2ce6", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560647, "uuid": "9f00ea94-c7ff-461a-89cc-46173394594f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560647, "uuid": "b5416bd8-62e4-4357-8b0d-562eb0bb50a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560647, "uuid": "34a85445-c811-483e-bc75-8600059ba018", "value": "d0bb7e8d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f4dfd1-ba24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621595315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595315, "uuid": "b9b775ee-6d73-4219-818f-381ab1327832", "comment": "Malware payload (Dridex)", "value": "a69bbd841fb4def1d9f7ae01e756a241", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595315, "uuid": "d81d550d-aba4-45fe-a122-64ab62d19fae", "comment": "Malware payload (Dridex)", "value": "51ca9d1b0ef5b263aa83a3a4b88179350a19202bba171a449691006cac935992", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595315, "uuid": "f0e1396e-cd60-481c-8e6f-43f366baab7a", "comment": "Malware payload (Dridex)", "value": "706dccc377d06d26ac9fbd14be759745f883a68c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595315, "uuid": "59b459d8-3cd7-41fb-bcc8-39dfbcfc62c3", "comment": "Malware payload (Dridex)", "value": "c1bc5bc974e3f8564d12026376954e2e0868503618dd614aaeefb8926b0e3cb871220edae7b7d673b960866e57f8928b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595315, "uuid": "3f1a415e-647d-440e-98b9-290988b7c0f8", "value": "34F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595315, "uuid": "f65fa366-9069-4b18-a893-805623be6cb3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595315, "uuid": "24918a04-bfdf-43e0-a018-bf1501a8faf2", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621595315, "uuid": "0cce184f-f2c6-485d-86c6-8f07dfb08c0c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621595315, "uuid": "5466f6b1-7549-4071-95b5-9a38834684a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595315, "uuid": "3e8c2a91-94aa-44c6-a6a4-78c3cc4e13e7", "value": "a69bbd84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7b75f8-ba88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638037, "uuid": "3a2583c9-a7ca-46f8-bd7c-cda2c34da592", "comment": "Malware payload (Dridex)", "value": "1635534da0c418e460217cd28e8d988d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638037, "uuid": "b3dc9781-ac1e-4d3a-85d6-beeec3c8cff4", "comment": "Malware payload (Dridex)", "value": "51ddb4a09b1577012667df880129b6744f1173e118cc2b012c747551c7b3a9ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638037, "uuid": "43b48918-c6ad-4b6f-927c-3f1a5b8b8983", "comment": "Malware payload (Dridex)", "value": "9d1bff030aa2d654b63c81ae17ded6b830a4c78f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638037, "uuid": "762a3fb7-38e1-4681-9ea4-eb4dded811f6", "comment": "Malware payload (Dridex)", "value": "f8e9d7d866f7d7e16a9d6d86e81c98f97b52c59201dc45ff470c4d21862d59fc10f05ec809c48d9df44f78f96844aacd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638037, "uuid": "3b7dfeed-524d-4918-8e18-64dc514a18d0", "value": "33F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638037, "uuid": "0302a49e-13b4-4015-b15a-8a35a9e8bda6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638037, "uuid": "87347a1f-494f-4b71-bff7-fb92beb6a117", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638037, "uuid": "ae9958c1-500a-424e-a309-217e1baa2aae", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638037, "uuid": "f2baae2a-6dee-4287-8fa2-7243fae381bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638037, "uuid": "eaaf2ef9-740e-4158-92f5-b3df903ab8e5", "value": "1635534d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e183bb-ba6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627477, "uuid": "07658273-985a-43d6-8b11-1ee37d5871bd", "comment": "Malware payload (Dridex)", "value": "9635f7348122d68cd4e7dde2abd51d09", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627477, "uuid": "db097f68-b080-4c05-8431-c028a7946239", "comment": "Malware payload (Dridex)", "value": "525f1069019068011706d88093ba676f4d2224b6ae857c7b6a553ce715ddde27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627477, "uuid": "246af7d0-638a-424d-a1e7-4cde78f67590", "comment": "Malware payload (Dridex)", "value": "8d0ea68e7b64ec9fdfe8cd09cf66bdd02db4c582", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627477, "uuid": "d451ff36-6c0b-4827-9813-b0321cb713b1", "comment": "Malware payload (Dridex)", "value": "60322e54671fd319523ca4c180625a37173131915bac5059e063c4f43c158df29cba73243980c7b274957fc1ee0d4185", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627477, "uuid": "be1d7575-a402-4061-8a52-df9e11fcf1b5", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627477, "uuid": "ae178b0f-c8cf-443c-b7ec-ed104d5eba1c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627477, "uuid": "1305fa1e-a61d-4db3-a62d-2d8b04962d23", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627477, "uuid": "c93ea17b-c96f-4af6-9cfa-2b0c6a51378a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627477, "uuid": "0da9a852-70d4-4c3e-a261-2d40710f90e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627477, "uuid": "0ce2b870-c957-4d57-aabd-72e9e612d60e", "value": "9635f734_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7337bd1-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566063, "uuid": "4ccbeb34-423b-4ac4-96e0-bdb263eaf07a", "comment": "Malware payload (Dridex)", "value": "cd1a37449fa2fb35409515cff0d9e2c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566063, "uuid": "99682708-ea86-4442-b03e-c86ddc2b4662", "comment": "Malware payload (Dridex)", "value": "52fb537380de237b0103d558d3d7b573bda894162d29f615a7471f4e504a937b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566063, "uuid": "dd61fa18-49ac-4362-a4b7-b3eefa34d469", "comment": "Malware payload (Dridex)", "value": "f8dc47e26cdd088d207b7622698ca05972f78734", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566063, "uuid": "23daef11-bc88-4931-a39e-123edafff0f4", "comment": "Malware payload (Dridex)", "value": "6ee0eb54ef7257a2f8070dd50c7450bb9e8a62d5fa411743f96ddfa354c6bd674de8d2eca2bfa7566ea5e3a799d3fb81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566063, "uuid": "a66f8bec-eebb-4873-9fbe-9a32197303cb", "value": "E7F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566063, "uuid": "3ab92dbf-59cc-4f97-8b05-588da247186c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566063, "uuid": "a65e30b3-3a44-41eb-91a5-b4b267eef60d", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566063, "uuid": "ad54fd5e-158d-4ad3-89be-66bad6d64132", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566063, "uuid": "9c630922-cf21-45e6-a03d-de3403ca03d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566063, "uuid": "cabb3f4a-8a8d-4302-9183-208e63568648", "value": "cd1a3744_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d4e6ab-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610827, "uuid": "35415f38-b112-4139-81d9-c852970d2ee4", "comment": "Malware payload (Dridex)", "value": "3b58bf4123b567abd39d878b5c6c766d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610827, "uuid": "7408041f-ca5b-4f63-8878-dae30b53d3f4", "comment": "Malware payload (Dridex)", "value": "536a44bdca81dcc839469fe2fca480670f6bf771724065cb2fd8a452830fb989", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610827, "uuid": "e25c81fb-793d-40f0-bd90-83922dfa26a6", "comment": "Malware payload (Dridex)", "value": "1e455d5f3e33610b286bbd317862e628ef7498be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610827, "uuid": "22f9f106-70fd-4535-8045-491c8e71b977", "comment": "Malware payload (Dridex)", "value": "73ad78cfc8c7b886a23f2e2ea7f7e114308492d6e91b2f0f8b30d77b87eec9122a9274bd838b924c67d76d80bc707e48", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610827, "uuid": "90042ead-6d83-4d74-bfd3-6a0f4d72e264", "value": "1C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610827, "uuid": "ed7c0c73-4311-4b97-bf7b-a9af0077e459", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610827, "uuid": "357a1e21-378d-43a1-b4b6-218dd76ea458", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610827, "uuid": "0281de5f-e0f8-41b1-a219-571c05561a95", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610827, "uuid": "f01978f9-a3ad-4ef4-8356-78fc3ec96e7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610827, "uuid": "5b889445-911d-4c17-85a9-b34716a12b5d", "value": "3b58bf41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65360fd8-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616579, "uuid": "659035a3-feab-40e0-afe1-e788159ae0fc", "comment": "Malware payload (Dridex)", "value": "64ce94c88fb33ca57d443634fdbeecbb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616579, "uuid": "8eb487e2-347d-4ce7-bd82-c17b9c243652", "comment": "Malware payload (Dridex)", "value": "539b8087ecf326a662e40802f6ba9791f7abdf14b26a86f58d7e855c472dce40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616579, "uuid": "45ec6c98-c3a6-4520-9bbd-71b1185234d3", "comment": "Malware payload (Dridex)", "value": "f53de4eae47e44f82906c4be14a0938bb907de7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616579, "uuid": "b26d0828-5b98-4e93-ac5c-ff4fa82a7341", "comment": "Malware payload (Dridex)", "value": "149c0b935b03ebb14eb72c20e0d9d9fbaae981b88290a8585e99b30d0ee63b7fe855eeaa03057998f9dd40cde5f7b8ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616579, "uuid": "2045918d-3843-44a0-8313-37ce2902685a", "value": "F0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616579, "uuid": "97ef26f8-7871-4d80-827d-1f15897b11c0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616579, "uuid": "8bbcf8f5-4d97-456d-a7be-d825fc1a4b5d", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616579, "uuid": "f6b1a0f7-8214-4381-a91b-233062880c97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616579, "uuid": "52c0f2f0-d19c-4711-aaff-c727c32e1366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616579, "uuid": "09d6bb26-233b-4245-b055-40fc431c86fb", "value": "64ce94c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252a4b1d-ba33-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621601439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601439, "uuid": "4b54a271-bafe-4670-b20e-15349146ce24", "comment": "Malware payload (AgentTesla)", "value": "d8bceed11354da887fe4ad8f032957a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601439, "uuid": "46d0a54c-be94-4a43-bc15-237bb55e388e", "comment": "Malware payload (AgentTesla)", "value": "539d75f22db3ccc962683432784f32863230bcd123f5b545debbe51023ed1cf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601439, "uuid": "a5de1bdb-3e4d-421f-8ec9-9aa6ab640921", "comment": "Malware payload (AgentTesla)", "value": "ede72aa8d39f46442b34f7aba5141010b8fec713", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601439, "uuid": "b119a0e6-7058-41f6-8af3-8cd6ae9cba3d", "comment": "Malware payload (AgentTesla)", "value": "04ec99d3c6d7f1a3446793614a48724e8c2608bdc1bd24665207fa2f294ac0a8ccd22da1dba4757bea5d650b918540e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601439, "uuid": "f9859313-1809-4db5-8870-30269f768c7e", "value": "D515BF5F325C379EC52BC275B9780C38DAE07E678316910BB4E79CAD491C98AEF111E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601439, "uuid": "cb863dd5-ad86-436c-9b23-4693378f2713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601439, "uuid": "7a1d51c8-42db-47a6-8eb6-7351441428e9", "value": "24576:UzLfzixDk84e3lUn3b/gyhP/LQgJK8eHzbIGlo:Uzz/Be1Wr4mQgJDe/Iwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621601439, "uuid": "39de37f3-c961-468d-a858-b8f5fe558c0c", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621601439, "uuid": "a82851a9-97b3-4994-b0dc-b0f74c44578d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601439, "uuid": "2973d03a-b793-46d1-b715-ca3b0a51e362", "value": "Request Quote212021#P000001488.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022063a6-b9d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561866, "uuid": "4da1f8ae-e4d0-4129-9fb8-5286838163a5", "comment": "Malware payload (Dridex)", "value": "e7c582d10a24c55d0b2920cb52dc2b87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561866, "uuid": "877d2657-e03b-440d-8188-3691d2f8c6f3", "comment": "Malware payload (Dridex)", "value": "53fc50b9d83e8d623e6179e8d15d356f7e64809e61f639dc82aab193356636c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561866, "uuid": "dcc65dc2-8660-4307-ac91-c01fcd0d07d6", "comment": "Malware payload (Dridex)", "value": "39a5594bc9ddbf1b6d48a3cd1861f8e8f83e391f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561866, "uuid": "42f56a3c-608f-438e-9474-85b09b94aaba", "comment": "Malware payload (Dridex)", "value": "4947b5b08b1343a4d110c4259deddde3da220234e3b2f900e291389b1f22f0a76275b82c52072b419a3da2db5db630f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561866, "uuid": "41aae55f-e9d0-4322-8201-bd480d4db77a", "value": "7004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561866, "uuid": "96a7e37f-3664-47ec-858d-b8552782deae", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561866, "uuid": "a0de979d-c471-46fe-ad57-e1aecc9d3920", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561866, "uuid": "784fcb8e-de27-4f84-ba1c-da5a793540e6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561866, "uuid": "ced3afc4-dcac-4fe5-8a71-9cd49fb045db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561866, "uuid": "f7bb7b93-a6e0-4144-8972-207dc2e49be2", "value": "e7c582d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843952a1-b9cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557360, "uuid": "23c763eb-6ff3-4bc0-acc9-845af0e14155", "comment": "Malware payload (Dridex)", "value": "6c3e5b0fb7759a0ef000184c2574caa9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557360, "uuid": "20b598df-7430-481c-9f82-1c14e6c04d25", "comment": "Malware payload (Dridex)", "value": "540bf4571876208bddb51f5a16e603d28d45284baff042302a3f8f7ad933748e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557360, "uuid": "2f6eb353-b5ba-43d2-8efe-76792d4198d3", "comment": "Malware payload (Dridex)", "value": "6142c24cde53cfcd40a957d602fc4cc57acc88a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557360, "uuid": "b914fc86-5b40-4c55-bc03-51ced6b24f99", "comment": "Malware payload (Dridex)", "value": "4222c7cce0a47f5460790d789dc8d8cec0899c1ad5dd2da949d607dd9644eb412db9f568046f96ae154ff5e3b9d16039", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557360, "uuid": "cc95f0e1-ec89-415b-8043-d074242c389c", "value": "9304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557360, "uuid": "3e8a7d88-f075-473b-9ffe-b4c3ffd9164c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557360, "uuid": "1e2a0e6c-a29e-4dc9-9f92-6f589e4931bb", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557360, "uuid": "c055f244-b078-403e-a695-8013a826d3cf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557360, "uuid": "10e6e2a7-9dc3-4cb6-987b-78348f6ec77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557360, "uuid": "edc8d28a-faf4-4211-b888-c2b5a5f8eec5", "value": "6c3e5b0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff526aa-ba06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582291, "uuid": "7a49364f-efc4-4fe5-b8f6-6f53a7d2b844", "comment": "Malware payload (Dridex)", "value": "03089047497c6d81ff86044d5152e57a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582291, "uuid": "f1656416-a5b1-403f-9f02-e73b1ce775dd", "comment": "Malware payload (Dridex)", "value": "5424773e8f7644120572c1781312f2850b9acb85d9d669c514bfe1245810c5b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582291, "uuid": "1b62e23e-c16e-4cb4-ada3-15aaaa9ccb9a", "comment": "Malware payload (Dridex)", "value": "7e9e148904a610c3021326b74ecf3530e9ca9ade", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582291, "uuid": "20c8e66c-5784-441e-9034-ba50a78e2435", "comment": "Malware payload (Dridex)", "value": "3a27818f0d6a5c6b1232cbfdb105b894630f5b1eadf58f1b60f1de5183dd03ee0e9662da199fd44ae49db2bf18c73ddc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582291, "uuid": "98207344-d6a9-4940-8bb9-e72d8662371b", "value": "1104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582291, "uuid": "0f3a5757-a306-46f3-8a70-76f79a686ee0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582291, "uuid": "0f8741d9-0bce-4dd2-a630-9c5f7682af8c", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582291, "uuid": "8217727c-5d77-4156-8ca5-285d26034af2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582291, "uuid": "9258ee63-3c86-4461-a9f6-d10d98b17a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582291, "uuid": "915fea03-0f00-4857-b810-bfe19c80e46c", "value": "03089047_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea88f2c3-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574282, "uuid": "aa9ddca4-d95c-4ecf-b724-d6cfc5d87d28", "comment": "Malware payload (Dridex)", "value": "bde574ef0c31dc44dd7e154eea32c187", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574282, "uuid": "64168a20-d26c-46e4-8ccc-3087edacf3a4", "comment": "Malware payload (Dridex)", "value": "542badca324d693182afaf1bf94e43dc90eadcd04a1bf3e930088ea5dd91d8c3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574282, "uuid": "6bccc9dc-e718-4351-814c-7f39a004f096", "comment": "Malware payload (Dridex)", "value": "021cfa30d4f8acd56828bc50d626785228e476ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574282, "uuid": "3c7ad89a-7216-4196-97af-f47fff773eed", "comment": "Malware payload (Dridex)", "value": "8957a213d0414add4b6a797f3ba434bee541b8295230e7c760262af8c586d8423ac02e7f52cf5f4fe342815878c346bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574282, "uuid": "de1385f7-0f3a-4c2e-939d-cb2ef697f88d", "value": "BD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574282, "uuid": "6507c549-eea3-46b0-998f-1e5ccfd1449c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574282, "uuid": "48917e5a-f9f5-4885-93d8-44525e8b4612", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574282, "uuid": "16f01556-03c5-474b-b419-ddd8d2f153d5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574282, "uuid": "c4ebe711-0e8f-4c0d-b5a4-f9d0c6372efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574282, "uuid": "31f32d48-53f9-4352-9cbf-636797a70216", "value": "bde574ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2130a13b-ba06-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582105, "uuid": "4fc3afb9-77bc-4c08-a4d6-07640c40906e", "comment": "Malware payload (Dridex)", "value": "48565f00d55719d4dff100cab2fcd16c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582105, "uuid": "b44c997d-bd1c-466c-8fc2-2e04ede06edb", "comment": "Malware payload (Dridex)", "value": "544cda13cadae724dbbd148a8e535742a4efa15b60cc77f7552f63a80b232617", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582105, "uuid": "f242e28d-c83b-4a84-82ea-10a807486c07", "comment": "Malware payload (Dridex)", "value": "5617fa464dd840986148b698ca26276a40091071", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582105, "uuid": "ad269f8b-66c2-4b4e-b2f6-b98b485aa876", "comment": "Malware payload (Dridex)", "value": "4e3a050d905f88ec3dcc860869fb4f6711e42150c8a8635d768a0320195ea0bb1eb1f13577aa1ea212b06bee3c8c7673", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582105, "uuid": "ea5f8323-7ae1-47e6-95ea-ca52ec76a04f", "value": "F304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582105, "uuid": "418f32b0-526b-4ab4-8283-080b0774149f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582105, "uuid": "dba48729-3de0-4faa-a2f5-247dc8e248c5", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582105, "uuid": "0e0b3ed3-ad55-426b-bd11-29f613a861a6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582105, "uuid": "d6dc8cc5-d4d2-4661-a3fa-ade78bc52b12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582105, "uuid": "74b2350b-b66e-4a2a-87a8-a1ce849f1aa9", "value": "48565f00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715b95dd-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566348, "uuid": "d0047dae-2f83-4bb3-ba23-7df474edf566", "comment": "Malware payload (Dridex)", "value": "e8887e555ed646b44f889ee09cf76698", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566348, "uuid": "5d46d74c-5d23-42ac-bbd6-d437f87e19e2", "comment": "Malware payload (Dridex)", "value": "54a339853fe6ddb6b2cd3aa01ef0ed7fdb3060da10b01b135defeea568a12f7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566348, "uuid": "8432af77-b914-47f7-8c83-e1b011937a28", "comment": "Malware payload (Dridex)", "value": "144516365bad40df0e45e0683e2bea23a4a1caf9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566348, "uuid": "44e4e984-ddfb-414d-80a7-8ce9abbb1159", "comment": "Malware payload (Dridex)", "value": "0a5e783016d8a8b66e5658e6a36ffdee9643d39173567747ba5ec441efdfa89fdc62b85f050af1f9c383745c7a57ac36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566348, "uuid": "57adc73d-3ad4-426f-b7a4-afc5f6ddece9", "value": "4F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566348, "uuid": "3a96c596-6221-40de-9784-169c0008df0d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566348, "uuid": "9f82072a-0959-47ff-b780-39a24cf77929", "value": "3072:5V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:5V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566348, "uuid": "6d8162e7-074f-4afc-9dbf-87aca5a88dc8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566348, "uuid": "90037bd2-a554-49c9-a7b2-79dbd30ecdbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566348, "uuid": "4979033f-b188-4e4a-beef-9fa05bd2a251", "value": "e8887e55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566e4cde-ba6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627291, "uuid": "9204dfcd-1ab8-473c-8e76-a5054f9ac1e6", "comment": "Malware payload (Dridex)", "value": "0745a8f05e04df4697ea7f1825ff9b78", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627291, "uuid": "824ca775-9e45-426f-badf-cabf7805e997", "comment": "Malware payload (Dridex)", "value": "54db83648a81aa3bf7e136a70f7e1396342db602209042cc0fad3fc319adf538", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627291, "uuid": "24257a0f-c711-4383-b997-336670c101d4", "comment": "Malware payload (Dridex)", "value": "2f7739b65cec269516144db3cb47e6f5e7b4c8a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627291, "uuid": "610d5d70-a4c7-48ea-a0b0-6e733f14ad6a", "comment": "Malware payload (Dridex)", "value": "41dfd898c10c4680da88ac0c2cb3c46ef706d74d5a206f72c076d55751b9fa81eeccdff051c2bbabfc6b4d962de1be08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627291, "uuid": "5d3c55b4-1039-4dfe-8f3c-2853a0b9f9c8", "value": "2E04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627291, "uuid": "68afc5b7-ad2d-4b39-8fbc-762303267826", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627291, "uuid": "a7cc4499-1ae6-48b6-ac8c-23e1e1a32b87", "value": "3072:jqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:tVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627291, "uuid": "5ec0e7bb-2ed5-4fb9-9219-0724157dff0f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627291, "uuid": "188b75c4-a4bb-4f23-a2dc-734a372e2c97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627291, "uuid": "7e67d6c3-a492-4af0-b2d5-98b38ce2d92a", "value": "0745a8f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5edb8a-b9d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560463, "uuid": "b81c7fe6-706e-438c-af86-b4e454672a76", "comment": "Malware payload (Dridex)", "value": "cc176c13fb17ab818fa7621a68bcaa6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560463, "uuid": "5908a412-1df2-4605-bb97-e18f831b32dc", "comment": "Malware payload (Dridex)", "value": "552d201ac60795ac2e81b1c69b57cf18354078eb2ab66d369208d3d6680f1b69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560463, "uuid": "2f51422f-a214-48fd-9591-8603ea8500ea", "comment": "Malware payload (Dridex)", "value": "5f01d11f2cc1d2b7474111652ca8c086897834d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560463, "uuid": "6c3db4fa-dcaa-4ddd-8fd5-af2c86be161a", "comment": "Malware payload (Dridex)", "value": "f217e098dacb01ba0e936e3b7efda350bd74f711e397a9e5cb478a8d49ce976a62c806c42dd11c451ac5b4431efd79d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560463, "uuid": "317ed044-e42e-475d-a728-7fbc088e988e", "value": "0504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560463, "uuid": "e8327284-ac4a-440f-85df-ffa3e1934859", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560463, "uuid": "a9b36410-9b1a-4abd-819b-f20ed3423911", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560463, "uuid": "95845013-d510-4933-820c-7bb7de682930", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560463, "uuid": "addd1a6d-9b87-4926-9373-c1c78ddcb825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560463, "uuid": "0a81474b-4292-4080-9909-683f9c272636", "value": "cc176c13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca2e599-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1621618551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618551, "uuid": "53426057-2065-4e89-9ff1-583bc41a008f", "comment": "Malware payload (njrat)", "value": "80053ce75f7ef9ac68cba2c2d86b91bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618551, "uuid": "70247ae8-9ee4-44d7-8a2f-90d5e57fca06", "comment": "Malware payload (njrat)", "value": "5568ec9c3ef91fec41813ad5d8b723ef95cc1e18e3c08466e1f9794eaa1b7fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618551, "uuid": "a39ffcd3-c5b6-48b2-a68c-93352fd21ad4", "comment": "Malware payload (njrat)", "value": "f416c93b2e1a8e5b7ce5d984724b1906dbd4daa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618551, "uuid": "e617c287-52bc-48d9-97ff-9185838284bd", "comment": "Malware payload (njrat)", "value": "3cdd5b9ca10bdee22b1d241c446a80950c0810a22decb3ae5e33f35809771adac54701a9e114b11be3385297fe894193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618551, "uuid": "14f2b919-dbde-4ce2-ab9a-b9a1469a839d", "value": "E4E21BADFBE64466C1BD0AB60571950017B4D143E527F77E4ECB24A62B2B3C84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618551, "uuid": "000356b2-77aa-4080-8ae4-43a365f223a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618551, "uuid": "e5536eca-332d-4517-8213-160e7cf3d276", "value": "768:ZrorDL8pdvXyzx9uFaTa3XnW3Tv8tQmIDUu0tidIj:Yw68nQb4QVk/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618551, "uuid": "2be989d7-b9b1-4b7e-b446-b6981ca7731b", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618551, "uuid": "1e57e582-bd3f-45f0-8343-51129f974c35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618551, "uuid": "134134b0-22fc-4178-9ed5-9fd2e2ec16f5", "value": "80053ce75f7ef9ac68cba2c2d86b91bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421dc552-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621569705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569705, "uuid": "90fda350-6246-4940-9501-40a912f180d1", "comment": "Malware payload (AgentTesla)", "value": "7b90783471ab73e8de4ecc60a4f44482", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569705, "uuid": "12eea421-4928-45b6-a7e6-391f19bdfdd2", "comment": "Malware payload (AgentTesla)", "value": "5580e3008d5f3fa7f3dcdfff40f5d16e136bbb1c83ddbf5bfee9626abb46a9ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569705, "uuid": "fdbcd8dc-ecd2-4a23-ab62-2a313125196d", "comment": "Malware payload (AgentTesla)", "value": "996544afc6f3992924541258c04b2f0b1efc761f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569705, "uuid": "dccf1c42-8aa2-41f8-a795-43beaeeebf64", "comment": "Malware payload (AgentTesla)", "value": "8f751282b16e73dd04d5d4db7c0047f39782844f09d3dbd9ae601a51a7fd25fbae1a9505e513013fc465f15f195aec81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569705, "uuid": "2b21b7ae-1f10-4e94-bd7d-52bc146c64ee", "value": "E9F433EFE6790499C4342F61AF65A0111AEDDF7642E97304B0BE21705BD8316B15EF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569705, "uuid": "c45cf211-e58d-42b9-bec7-7f878d08d9af", "value": "12288:OzJqmynXQ92AxFDpp3lLKKoi7tZ5+YNuQsYGGQ87dN8S8LVlBJzmC3kZS8xCgGkQ:Oig92Arpp1LbP7tZbuQsrGQ87D8Np/Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569705, "uuid": "b1193da6-1f80-4114-a078-953b167d6961", "value": 746422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569705, "uuid": "23041279-290b-413d-aafa-7bc6c6601174", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569705, "uuid": "089b13e1-8768-4dda-9ea9-adef99e3d6fb", "value": "7b907834_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322add00-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622077, "uuid": "fd8c1208-eac3-4289-ba85-2acae807f43b", "comment": "Malware payload (Dridex)", "value": "5c425805812181b1c98335608307ccbc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622077, "uuid": "5fcebfbd-35b6-4777-a9f4-9c3324b11489", "comment": "Malware payload (Dridex)", "value": "559726bbd93a68e958c13250ecaf3d0402355b5d1d193c34109494242d7c2240", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622077, "uuid": "127e62cf-af19-4e02-af54-b290278604c6", "comment": "Malware payload (Dridex)", "value": "4af14ea374e1fcef408504a741cba7dbb8d32cff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622077, "uuid": "ce710393-50c6-46bc-b846-77db870c44ec", "comment": "Malware payload (Dridex)", "value": "145e716f08ec7c7a99d04393115a42e632d0d03348202e73642fde52ebc3d1ef607625f8d601be1562d27ae163f90cb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622077, "uuid": "092722d4-c2fa-41d0-b62e-be5ce5ed6aec", "value": "67F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622077, "uuid": "d6e06099-db36-4c59-a062-3017991a1768", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622077, "uuid": "e5ac7a1e-53f5-4c96-8679-23aa4bf07216", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622077, "uuid": "3247233a-ee26-46e5-b4d5-32f576b397e9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622077, "uuid": "87911ca8-6313-4a88-9a9e-9889cd250251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622077, "uuid": "8ac46f4e-6306-47c2-90ea-d204de60878f", "value": "5c425805_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f829120-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621611469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611469, "uuid": "8d447a3e-18d0-4e56-ba17-52ef3ed2b39d", "comment": "Malware payload (AgentTesla)", "value": "cb281073ae1d6f61d339a1b12d50364a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611469, "uuid": "8a239291-67f5-41fc-a3ae-68b9d618c04e", "comment": "Malware payload (AgentTesla)", "value": "559ba07809e7bb16a50c8872fef5f930d54662bb95147abacd01617180b419a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611469, "uuid": "bc5d8ac8-0a38-44b3-82a1-922b34f4b0d0", "comment": "Malware payload (AgentTesla)", "value": "57af0ef39fef9e6c9496fef936116216bb456993", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611469, "uuid": "20022edf-9b21-4784-b948-7ce3b08ca365", "comment": "Malware payload (AgentTesla)", "value": "f52263fbf259f049195436a83e68daa5f2beadf5d5828cc434e35c7b694e83e44273193db820ad989dcdd269f26b662a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611469, "uuid": "ba9a0052-08b4-4f3a-9817-f7275cb6c0fa", "value": "A464121BB647A3B4CCB261BA3822D0919233E3985D17176F74AF429D6E23BCDEB14315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611469, "uuid": "3f8e88d7-8759-4b36-b5b8-66794f03ad38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611469, "uuid": "a89674c1-8ab5-44ed-89a8-102595a477ce", "value": "6144:q62V79rQ23bZPDSwKXz5JTVY3cAOQaUqY0bHS+MI7zUZYn6QlLkUQ+h5fHCY2ZSd:0PrFLZPDtKV8HaUEbH5MI7COkUVh5PoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611469, "uuid": "10e3e752-6608-4552-82d7-ec30bd623ff6", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611469, "uuid": "02ad80a9-5fce-4c9c-8dde-146b0185f775", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611469, "uuid": "56d7ed75-8636-4015-b9b8-d766bd0e0771", "value": "T.HALK BANKASI A.\u015e. 01.05.2021 - 21.05.2021 Hesap Ekstresi.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91182d06-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621611928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611928, "uuid": "bf131c52-bfd6-41b3-8fa4-68521b7fb6bf", "comment": "Malware payload (AveMariaRAT)", "value": "019959ee5ce020ae98d3936096ac5236", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611928, "uuid": "58f769a0-a267-4560-bd13-d34f48295485", "comment": "Malware payload (AveMariaRAT)", "value": "55f6e402d458c2d35fca88a85bc8891d997730198cdfea1313bb66c3107394aa", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611928, "uuid": "d6e616f5-46cb-4848-b72e-c5b8dada2950", "comment": "Malware payload (AveMariaRAT)", "value": "748d678080173daebbd8e41858b38b67bcfbc462", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611928, "uuid": "ffdfcfba-fd65-4566-be6b-51229e375f6d", "comment": "Malware payload (AveMariaRAT)", "value": "e85d5ba0adc4eb7b820557429efabe525a7cc8ca380aaeb85b1115b10fdc84f853e3907921fa93f274a54661f5d9a160", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611928, "uuid": "06c7b842-2d2d-40b8-9a0f-9d604da9926e", "value": "3CC45AB8326077DEC46BCD76CAAC3C5D9A206466430BE247D24F077999CD6878E14AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611928, "uuid": "c1098787-16ee-4733-9632-b73240bc9f75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611928, "uuid": "1094144d-c348-46bb-9261-13d1313d20b1", "value": "12288:DihBBp44+CynByOfj0DMeU8FqTIOjxvJDa5oq5qORJk7I:+5W7r0Ah8gmgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611928, "uuid": "dccbc4d8-91b4-4365-9094-88b21e2d450e", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611928, "uuid": "63c447d5-4800-437a-a8e8-882dc1c4a553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611928, "uuid": "63b54549-134b-4e53-b0fa-e0d8435124e1", "value": "Order Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee987057-ba6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627547, "uuid": "e7c07eda-d540-44fc-b719-6cd193bfb1be", "comment": "Malware payload (Dridex)", "value": "09d1335cd05aa89d3d10247778bd5bb0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627547, "uuid": "5a60c7fd-2874-4e65-983b-d5ce8f9a9a4a", "comment": "Malware payload (Dridex)", "value": "56539cd4a7ef5508ed58f3cb004e79c7ecfad682a7bc41f14755560f475ae808", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627547, "uuid": "2cadc545-5e25-4189-943e-d06daae3cdf0", "comment": "Malware payload (Dridex)", "value": "e73d136b2fdcb36e996666df361264994d09b101", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627547, "uuid": "e232ddcb-fec1-4aed-9a11-fe3d02c8665a", "comment": "Malware payload (Dridex)", "value": "15296a8c70209bcca7414fff07614144e49bf3955fb597ceac0ef6a15de826969bb8d100260d9e42aa34923e9c51dc25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627547, "uuid": "ae247376-553d-48f8-8eed-94feb34113fd", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627547, "uuid": "b9b059c9-4cd3-44f0-8c22-4c05dc72bb0e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627547, "uuid": "e85f5401-e101-463f-b17f-4cc8ff22e917", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627547, "uuid": "9448566f-f0aa-411e-a596-14fad97a1eda", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627547, "uuid": "e4592d9e-6732-452b-ac85-ce65d40bec1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627547, "uuid": "14051ce8-25a7-47fe-b906-c0ce0b47a9e8", "value": "09d1335c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05ae60-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566554, "uuid": "14b0dfc3-21d1-41a5-8761-467acdf6957a", "comment": "Malware payload (Dridex)", "value": "73d308e5bbcebf029ad3612b7dc35d7a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566554, "uuid": "19d2bd6f-7505-4d34-af10-cdf026420407", "comment": "Malware payload (Dridex)", "value": "56652cf76fea83e21119e5adacefec08d560d99a5d6bc28f9db89ef17d8561ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566554, "uuid": "ee524e8a-63bc-4a49-8611-3a8cc920c38e", "comment": "Malware payload (Dridex)", "value": "1356c88097f07bacd9982feb75e91792889d666c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566554, "uuid": "5f63495e-6b05-4fc3-bc1e-b6f2c860c5b7", "comment": "Malware payload (Dridex)", "value": "ebfe6c2e6beefc380812bda639196d81ff2218cb96378c8e25d24aa83b44be1be4cf5ec77a39528a8799aad1848d3323", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566554, "uuid": "1d8dad0c-0f7a-4c5b-942d-7326f192191a", "value": "12F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566554, "uuid": "957ae6b0-9fa6-4a18-8037-cfb84346ad73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566554, "uuid": "2c74f5d2-79ee-4e9c-8c3e-7f0602f498b8", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566554, "uuid": "6d6b93d6-3ca9-43a7-9efd-280dbc1260f9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566554, "uuid": "9c104feb-3151-48df-b846-a808c76441f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566554, "uuid": "79068335-bff4-4153-ad8f-02ce99c45454", "value": "73d308e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab55e4c-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuasarRAT)", "timestamp": 1621577316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577316, "uuid": "94f1f2a6-56a1-4e8e-b8c8-c66d9f3d2c66", "comment": "Malware payload (QuasarRAT)", "value": "bf6e195eaa1ed6b0d9a1ae7bd2e54aae", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577316, "uuid": "eb780709-cb83-40f2-b6be-2cbb211e75a5", "comment": "Malware payload (QuasarRAT)", "value": "56855ec2eaecac2dc657e738098edcf0146b6a82bd84a5205b7f85072264c38e", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577316, "uuid": "6959493d-d970-4794-8ed3-0f8866151183", "comment": "Malware payload (QuasarRAT)", "value": "9012c69bacbdc540a87fa1f6a0ce224076dbe3ec", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577316, "uuid": "885fc4d1-0176-4986-a0e9-a4fc99e498c3", "comment": "Malware payload (QuasarRAT)", "value": "36871af1e44f39881f59c468b251e21046fbe52aa09d28b82d4af7ae47ae215e890049ed2029854f1bc96e26b71f5e75", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577316, "uuid": "eaebc6d2-6f40-4825-a193-5d3222b1787b", "value": "F744024661CDCCEBD48B1AB0A5EBD76092B27D894291131FA7E93F2F25250D3971E0CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577316, "uuid": "bd44e3d5-1d1a-4c95-a936-27790aa00ffb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577316, "uuid": "24afb3af-e81e-4a71-b8f2-81f09331b34a", "value": "6144:TsZaoiG+6qmfW0C9vLGMhG0zkqohstzd3wSJK/2h:qNi76qmu0C9TNhGMohmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577316, "uuid": "75b67b68-333b-46de-b98b-cb6e24b049c4", "value": 253653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577316, "uuid": "110266a6-9423-4bb5-9777-729a445af4f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577316, "uuid": "271652d9-a509-4a85-bd8a-683e780cbf6c", "value": "INVOICE0090000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c8e6e7-ba36-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602759, "uuid": "0ad716d2-566b-4e83-8be9-ec8fc2d3c04b", "comment": "Malware payload (Dridex)", "value": "a275276a476046f70ca4552696ea5204", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602759, "uuid": "667e9aa5-04e2-4253-9880-28348bb6f7ad", "comment": "Malware payload (Dridex)", "value": "56cf73153a3408eb6f6057b2006a7c99a0c91dadbc1638e45868120b1337d006", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602759, "uuid": "db95acc2-49ed-4708-9bfb-6f2d0b2af2fb", "comment": "Malware payload (Dridex)", "value": "ebe912176103107d904c235ab6ebc8407ccd0149", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602759, "uuid": "ee96451c-5900-4ca9-81df-61ec2fccf43e", "comment": "Malware payload (Dridex)", "value": "e57d647278bafe61250022d4e17e73034ed409eb83d4cad4eec943c319d3aa6e646e0508ef88fa77f1e31315619120a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602759, "uuid": "890457eb-fa17-4ee4-b48f-0522f6d2d6e8", "value": "9A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602759, "uuid": "ffe7b0d5-1b2f-427f-a4de-c4ed7e6fd405", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602759, "uuid": "26f0fc49-f05f-4c6f-a10b-b15faa60c94a", "value": "3072:3V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:3V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602759, "uuid": "6e388fc8-103e-46fb-8974-72901b400574", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602759, "uuid": "55fd27f5-6c6a-415b-8b81-9de0337bb710", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602759, "uuid": "8baa6f60-3975-46b3-b1a9-3f6c52db42a0", "value": "a275276a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2c0ca0-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580566, "uuid": "3ad074c6-f468-49d2-b99a-8ed2177fdad7", "comment": "Malware payload (Dridex)", "value": "2045d5f970ce8d4fcb2a0f91f445e83e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580566, "uuid": "29a467e4-2d75-4e7e-8b7c-ac46515aca48", "comment": "Malware payload (Dridex)", "value": "56d88677d4628fc0404e68665164c95dddf484260120f0530f0daee5d3866806", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580566, "uuid": "bcdb5b69-14d3-42ae-b4e0-fa33967de96d", "comment": "Malware payload (Dridex)", "value": "d1e4278d3a12b0d6d2c6c038413e76b41599441b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580566, "uuid": "03782b84-c397-4991-86d9-fb125347fdda", "comment": "Malware payload (Dridex)", "value": "2a6b3b076d75bf9e24fcea6dbe26aaed5ccb3daa9092cbbfc6ae9d69065cde5566092aa531472803583399fc5abb38e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580566, "uuid": "b98a75d7-1c5f-4c50-8465-a54a57013dad", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580566, "uuid": "f5d871bf-63f4-4ee1-9bbc-e893c625e30a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580566, "uuid": "24d9517b-9a24-4f33-b6b5-0f5e2d1ffe4b", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580566, "uuid": "dd40177b-b265-4676-b6ef-a5744ea9d936", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580566, "uuid": "12f2f89f-fd9a-47ee-a98f-1e30696b8f0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580566, "uuid": "e5297539-df8d-4c1b-a52d-be799e3f4269", "value": "2045d5f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b45ead5-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623729, "uuid": "861ff860-31f8-451c-8a06-41d0b812b37b", "comment": "Malware payload (Dridex)", "value": "012bb84eb2c5faaa6463b31866685046", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623729, "uuid": "67a87489-0efb-47d7-a7f9-297c255e6589", "comment": "Malware payload (Dridex)", "value": "570d9b85b9d51c3aa9a34ae8e56fe01c61f9e7e91c3040c7ca323ab751815c5c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623729, "uuid": "18e59140-d827-41d9-83d5-439df940a68b", "comment": "Malware payload (Dridex)", "value": "5040d0eb5802f17bb8fec5ea8f7def315ec4bef3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623729, "uuid": "49a34e82-c14a-4d2c-a178-0ecfb246540b", "comment": "Malware payload (Dridex)", "value": "e8acfa77cda2a6ce5fca753d5fbf204e7770bf9b4bedaead23e5bd66061e56e2323b1c82caf0f560bc23f55de1447d2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623729, "uuid": "03292da6-9371-4a42-92cf-23bb430f6e54", "value": "75F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623729, "uuid": "fe4aae8c-c2a1-486b-9361-e92cd2dab289", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623729, "uuid": "61ad9ec6-2c2d-4c45-bf89-9f34d152ac4b", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623729, "uuid": "279a3c84-9847-4e94-822b-3994ec7e5ab8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623729, "uuid": "fc4e8157-bd93-452d-aea7-e3f9e0b4946e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623729, "uuid": "acee91c3-0f8f-4453-8d45-70197c1aa2e3", "value": "012bb84e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5398f5e-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "f63f5bdd-5c12-4c28-b13c-e670012bfcb9", "comment": "Malware payload (Dridex)", "value": "b9c98e9b455c707ef110eaf24b917e26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "cfcebeb4-d79c-47fd-a7e3-f743575eefa1", "comment": "Malware payload (Dridex)", "value": "571ef20458fa7c30f25838247fd49fcf8c25ef95dd3d9c5484e270c393cba02c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "709e09cf-f5c1-4ff9-946d-c790bf46ce0b", "comment": "Malware payload (Dridex)", "value": "8fa81a872adb235b854e3934fe75c2fc1ea08572", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581897, "uuid": "4a9438a4-eaeb-4be7-89dd-03a351d71080", "comment": "Malware payload (Dridex)", "value": "732f8683fa530109a0c0ab4aa27d91cc67483f9a1ca0aa0d3a01611898ec4db672ddeeac07659821fc37af245c88eaf1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "0d4664bd-cb0d-4004-a858-d39eacb302f5", "value": "ADF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "05ab3b79-14e2-4c2d-bac3-f483e88b67f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "d3bf7aa5-8ccf-4247-8dbf-f45bb84e968e", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581897, "uuid": "626673d6-e4e1-410c-9016-946f5da66994", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581897, "uuid": "5ebb7361-95cc-42fc-a476-5b75526ca1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581897, "uuid": "4ad99c08-2fcc-49fc-82a4-4572672251df", "value": "b9c98e9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514e796b-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574884, "uuid": "270a5635-fc11-46f1-baa7-e8e49c3c0e53", "comment": "Malware payload (Dridex)", "value": "c82041bbc0281ba242e9eeb1a679f7ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574884, "uuid": "5716740d-9e45-4df5-8346-0366a0288e3d", "comment": "Malware payload (Dridex)", "value": "5763720afdf3980d5118e9ad7a2f154ecf17a010f1340dea523a439ca3a888ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574884, "uuid": "1cf16192-6144-41cc-aa46-911db3839e20", "comment": "Malware payload (Dridex)", "value": "cc345c750288ce17b66f819488cb47ba26e0c9b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574884, "uuid": "8f19bf93-cde7-484e-9de6-b5ef52711649", "comment": "Malware payload (Dridex)", "value": "6d4ee0d86eb1188b87b203c5ff7f0fc0a1e28c4ce2f688fa40a3db00a92ecf09eec90c2f0b90a38446a0f02079720145", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574884, "uuid": "89629c7a-7ee0-422a-a573-31e11fdceb7b", "value": "B304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574884, "uuid": "f5fcf1a0-347b-45f9-8395-0e32e28b7719", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574884, "uuid": "d8f22e80-06de-4660-8f93-8c7d0698e7ab", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574884, "uuid": "ecc46e9c-af6f-4732-a5be-fe5b1fd93186", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574884, "uuid": "caaeb62b-0a4b-4ff0-a4e7-b6e38441e322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574884, "uuid": "c3984155-6073-4851-ab81-4fd5ee96e4f3", "value": "c82041bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3902978d-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564965, "uuid": "794d1ae7-28fe-496c-a433-475c817d6247", "comment": "Malware payload (Dridex)", "value": "229ce9cd56ffb57135ecf77b0e77c6f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564965, "uuid": "7bb2a325-d296-4e88-8451-79f4bdb90de8", "comment": "Malware payload (Dridex)", "value": "57a894ac43decf20e5daefc74445916f5c0c1678bc9db120a0cd4917966fa8bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564965, "uuid": "74f6e5b9-2a62-40f3-a885-c182da11f075", "comment": "Malware payload (Dridex)", "value": "21d7d626b3b55039f38d56d380db5877956ed9f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564965, "uuid": "e833f3a9-4e24-4974-aad1-dd0b7006b951", "comment": "Malware payload (Dridex)", "value": "706709576ce80183401987a5ef676a727cde9b026aa0465258f0535801041a39db26e05ec99020e73f2e5bf6e4d81881", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564965, "uuid": "2291abe0-d785-4784-96f4-fdfaf83e7523", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564965, "uuid": "8d1eb3eb-5884-41c7-9fd2-a83b54c29d03", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564965, "uuid": "274c830e-1141-4f66-be32-9bd977ca2ee1", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564965, "uuid": "4141c648-0177-4931-a5ef-9a5eae1f54ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564965, "uuid": "d0fabab7-bc19-4ceb-bb36-ddad9d85b92e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564965, "uuid": "9d238d47-ed9c-40c5-9e19-e4d35884ffd1", "value": "229ce9cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d4367d-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570135, "uuid": "0529e7d3-7ab7-45bb-9b8a-06dec4592190", "comment": "Malware payload (Dridex)", "value": "69c19d0b4b21d3eca0b8b473ab66d4f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570135, "uuid": "652c7c1d-633f-436c-931a-256e6956fdf6", "comment": "Malware payload (Dridex)", "value": "57edfe1372dcf050664a7b08a642f4356eaa20cac1057e320d477285d9940d4c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570135, "uuid": "8f1daa9c-a11d-4c82-9546-2cfab1bafbb7", "comment": "Malware payload (Dridex)", "value": "d0787409b40b0b28c00aeb582db52bc79032980a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570135, "uuid": "79c7c793-d7ec-4cc1-be76-85a59cbcf730", "comment": "Malware payload (Dridex)", "value": "b2148705d0f359b1cb14892783c733580db221908b964868d2479a2503a540afb839c473535dac35a9e0463166f8222a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570135, "uuid": "2aa101c6-f5e7-4706-aea4-fa1c811319c6", "value": "3C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570135, "uuid": "f7c30dcd-ed84-484c-97ab-27e6a7bdc728", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570135, "uuid": "26460a1a-556b-4ac4-82f1-f6130b13568c", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570135, "uuid": "fbf94624-efb4-4885-a228-b525153fa0de", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570135, "uuid": "fc6272b4-adbd-43e0-b1c1-524fea0c08a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570135, "uuid": "1e19af40-4072-45fe-8408-cf884c24dfa5", "value": "69c19d0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3873d355-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556804, "uuid": "ca2b45c9-d58a-4c8a-af83-7454569488e6", "comment": "Malware payload (Dridex)", "value": "984d219b38c884940cdc7266af72cf75", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556804, "uuid": "34f469ec-385d-4c45-a9da-c5373369ec7c", "comment": "Malware payload (Dridex)", "value": "580ad649ad48016f7fa2d8fe61901b16bd8bbb53dc49fd7c9517b600d69fa0b6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556804, "uuid": "b6bc3b58-3124-4fda-b01d-919d52ccb159", "comment": "Malware payload (Dridex)", "value": "e77401eb472e9637c2f4bfcd6ab2c1a583256895", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556804, "uuid": "40ca8fdb-196a-4906-9509-5ee82379d962", "comment": "Malware payload (Dridex)", "value": "fd9c3ce8906becbf041d9962b50768bac8df446f918742b9f6849ccdc9ca954c9e9772cc0fdb04ea8beeeee384a8e30a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556804, "uuid": "5d35cb0e-28dc-4e8e-aa28-f701ab9ed786", "value": "0404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556804, "uuid": "837ee5ff-4da2-48a3-b14a-ddd2a374a498", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556804, "uuid": "b81c6642-014d-49ea-b52c-545ba7babdaf", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556804, "uuid": "04477423-a6ca-44cb-9ffe-ca348e26b874", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556804, "uuid": "01974a11-3450-447d-8049-c831378d1fb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556804, "uuid": "08ac2bef-121e-4848-9ba7-af1999de7c9f", "value": "984d219b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80c31c5-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570386, "uuid": "f3fea093-648e-4e64-b1ff-66f611ccdb83", "comment": "Malware payload (Dridex)", "value": "08def8713003ef86cb3f3be49015b93d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570386, "uuid": "6b75fb76-8edd-4bbc-af84-a16e9569d720", "comment": "Malware payload (Dridex)", "value": "585563b99167d6079a839ef28c3c557dec78cc49445fc371b6335808540ca88c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570386, "uuid": "414e4fa1-ad4f-4407-bb53-d01a7609fb5c", "comment": "Malware payload (Dridex)", "value": "5847636e3e7660bcabfee2388978010cc6059fcc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570386, "uuid": "4f08ab80-077d-4f39-8322-efb6255adfaf", "comment": "Malware payload (Dridex)", "value": "aca4d541a1304c924d7c2d7a8583566a13a6414539e13a1fb4fa2856aad55e2d83a0f206a3a2e3caf98293cf5937d214", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570386, "uuid": "40feec84-1c1b-4907-a8e1-69e022058d93", "value": "75F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570386, "uuid": "c102d850-94c5-4fa9-889e-0df9bee86d14", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570386, "uuid": "b1a3159e-4c55-43fb-bc31-67cf67e3a37b", "value": "3072:uIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570386, "uuid": "a7c0c072-b5c2-4cc4-84a5-e91cce483ea6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570386, "uuid": "84ef66c6-0c36-43d6-a09f-9604f110db0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570386, "uuid": "2b8bedb3-3f91-4882-addb-5dc4170600bb", "value": "08def871_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d49775e-ba0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583951, "uuid": "48a50c9b-d926-4c17-aa0a-3defa5e70362", "comment": "Malware payload (Dridex)", "value": "c65affc20881b71d442228efc0af9b59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583951, "uuid": "ea0b77fc-be94-45c1-82ec-4c9c6d6796f0", "comment": "Malware payload (Dridex)", "value": "588a79c1b4a99eaf6372088b8708038e5b91315ec912e4378e1f7f8fdc424726", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583951, "uuid": "24e63ea3-1f22-4c73-a985-e6f5a987325f", "comment": "Malware payload (Dridex)", "value": "e78e5faba58eb7ffbe2e28b74a82c79fb9c1e2d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583951, "uuid": "a5be9aeb-8eb8-40a5-8d54-c6d2f1142a1e", "comment": "Malware payload (Dridex)", "value": "dc4c22b50084ebc5452964485cf84e7d21aa7b7af0c3c58d10ed50e18b6c618da46181228da498fb7560befc01b68c46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583951, "uuid": "1272aa4c-4465-4b2f-8597-aaadf2fbce35", "value": "C904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583951, "uuid": "30b6f7a5-879b-4266-bda8-3118e6ddc112", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583951, "uuid": "b39a0743-9971-40af-bf60-57584085ab16", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583951, "uuid": "45dee30a-4b30-4b4b-a279-d4fc73ed1422", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583951, "uuid": "47ba289b-b4c6-49c7-9c8e-5878eaab0974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583951, "uuid": "83fb750e-74f6-4e4c-9d92-0574d72b6662", "value": "c65affc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a667af-ba5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621618571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618571, "uuid": "39ad8e66-6999-4ec6-a6fa-3295211c9e19", "comment": "Malware payload (Quakbot)", "value": "2f112637d84532a5f102d14ec33f1a00", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618571, "uuid": "a2e9a6eb-ed51-4ff0-9ce9-e197946beffb", "comment": "Malware payload (Quakbot)", "value": "5892ea1db1808b40f88d5f22113365a08dbc7c0c3c5d9fc549c7c7148ecd0928", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618571, "uuid": "9bf8262e-28ec-468c-9847-a3cda18bc401", "comment": "Malware payload (Quakbot)", "value": "a89d38796103486fba9606e1e6656813363998d4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618571, "uuid": "dffd3f0d-1804-495f-a226-c2a530e196e7", "comment": "Malware payload (Quakbot)", "value": "733509950e859178f77f4185afeb244f47d914f3aed06d36c4b967864ff7169b942ef9b98c11d44b51508282e46a333e", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618571, "uuid": "03d05b61-da68-4bd7-9ca5-73ddd4dfd918", "value": "5104123CD4224D5CC2B9447AD918C2496C292113BDF8A5BE25C87988EE577F31F6FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618571, "uuid": "10dc374f-04bd-4e04-856d-ef728df887e8", "value": "3072:71W/eXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGJb:7nE5SDvbXAyHbVt15wTQDeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618571, "uuid": "29b830df-92f0-4190-8f06-8712cee6efe1", "value": 178463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618571, "uuid": "5e465b11-b558-4bb9-be21-bedec098fffe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618571, "uuid": "70878ed4-111a-4b1a-8a0e-93b9a9341bd9", "value": "11512651194-05192021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b1989d-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566496, "uuid": "f42bd88d-2c89-4209-b427-39b1424fa03f", "comment": "Malware payload (Dridex)", "value": "d6ac84063acdb8a2b18a14551cbed7d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566496, "uuid": "df0115be-c367-43f4-b75d-1f4ec0fab2b1", "comment": "Malware payload (Dridex)", "value": "58e1bb6243047d22f9852c7da73fcc84730ab8c0ea7592911b4f576bcb7f1746", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566496, "uuid": "92df7fd6-cd62-4b79-96cb-2e91ddcb689b", "comment": "Malware payload (Dridex)", "value": "a6bba3c542610976d24b5588858dcd0b80e9c645", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566496, "uuid": "3d40dcbd-440a-44cd-889f-3bf52102e790", "comment": "Malware payload (Dridex)", "value": "6c7a82cc33ef1c9fd50421b9894f2f0c0d8ce9023c7f542ce5089d26dd3eb852715ed7e1375a7c4fcf8b9fd4394b6274", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566496, "uuid": "ddebc02a-8025-4fa6-b47f-7a6d030466ca", "value": "1F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566496, "uuid": "f6b8dd4e-1531-4a9b-9e61-55c38a9901ca", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566496, "uuid": "cea5b0d9-d155-4224-86d2-3f551a542b16", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566496, "uuid": "77c25047-d890-4618-b0c9-5f968f5efacc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566496, "uuid": "5b2d9d3e-ddbf-4cf4-abd2-5255ef5d5ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566496, "uuid": "15e5bc3b-5c49-4fb7-bd5b-3ee27b68a895", "value": "d6ac8406_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9969028-ba3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606520, "uuid": "51e318ef-d76d-4a91-b499-a225b30f694d", "comment": "Malware payload (Dridex)", "value": "cc20c9ec20e7be9207b800cd0b26a9be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606520, "uuid": "fa266c28-b728-49af-b5dd-983d3a608c26", "comment": "Malware payload (Dridex)", "value": "58eb330e1e4420a2e8581b75f4f1a52a3b4fe4c5e14bf96c17da253c99125d0b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606520, "uuid": "beeb1632-02e1-4339-a264-9791b7d04fd2", "comment": "Malware payload (Dridex)", "value": "dd1e44290662fc6bb7ec9676212a601b4d3fde53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606520, "uuid": "e6b28bf7-f2cb-44ea-be73-6b3ce9ca73b0", "comment": "Malware payload (Dridex)", "value": "70e047fa9b04f11015129091c807d763babc63afcdbe6cf8c593a3fc93b0ca55639db90eca80107c8cc15975f1e7ac78", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606520, "uuid": "db5c7671-e65b-46f8-a84e-3e3dbfc648f9", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606520, "uuid": "6461b769-1ab2-46d4-a74d-1da51bfe7aa3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606520, "uuid": "9a151f5c-e448-4c79-8d18-bef53398ad85", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606520, "uuid": "12439eb4-1ad0-4b15-95a0-f2778960ff46", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606520, "uuid": "58e3ce21-fb4e-4645-a133-94334238ebab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606520, "uuid": "f9dac540-5f2c-434c-8172-9594300ca092", "value": "cc20c9ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b631ab-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580792, "uuid": "a20e47d9-c60b-486b-812e-d949442048b2", "comment": "Malware payload (Dridex)", "value": "8df6018e45859fed58a4a5edb351bce2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580792, "uuid": "d14220b2-a1c1-4849-b5d8-788bd222efd2", "comment": "Malware payload (Dridex)", "value": "58f5d3d25d8b45acf81ceda5d5199c4f8456014b51b9bb588db6fff09926987f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580792, "uuid": "b66f4587-a04e-45c3-b651-cbe6a8c99b9e", "comment": "Malware payload (Dridex)", "value": "0fe0e3555f03102123116a8aafec1fe80d787122", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580792, "uuid": "56929dba-474e-49e5-a5c5-db1549a9a2ba", "comment": "Malware payload (Dridex)", "value": "ab18299033832725738e975edab178183a80ef142a480b98e4b8e5e89feb2f62a384c60d5acdbe85993eb494c661994b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580792, "uuid": "c84c305d-d202-4346-9012-c2a17df3ab22", "value": "BC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580792, "uuid": "6aeefd1f-90dd-43f3-866a-287f30ada887", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580792, "uuid": "0e621d72-19ff-4925-a1d1-01e9a4c63496", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580792, "uuid": "b62b6084-56e7-4b5f-b1d4-ca7affe544bb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580792, "uuid": "ab61f394-91c9-44f4-8a8c-b34ab6c2f8bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580792, "uuid": "37ad5fe0-2cdb-4b93-adc2-3fd1c1ede04c", "value": "8df6018e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668a452d-ba43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608421, "uuid": "a18f663f-eefc-4242-b373-866c70913d41", "comment": "Malware payload (Dridex)", "value": "6e8cdcd300c584c51c4a661d5ed8fdfe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608421, "uuid": "dc8f3a3d-69e5-4547-84ae-94d11508b8a4", "comment": "Malware payload (Dridex)", "value": "5970e2d991406be59f0a4786a45d304d6db10c937b6a34c2122743a4dfcff792", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608421, "uuid": "6e9da67f-5db4-48d6-8a68-a84123a5191e", "comment": "Malware payload (Dridex)", "value": "1ed1ef4e3884c86ea119493571f721a23495d1cd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608421, "uuid": "28d0be06-d53b-4dfe-8b74-94d9330c26b7", "comment": "Malware payload (Dridex)", "value": "486c72c12a1d3a1999b0853009b63330a0158e30b58d29388a5db8e922b867b0ca681733616a1b1fd97c6f860f0eacd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608421, "uuid": "eede339a-1d8b-4085-ad96-780484b66614", "value": "D704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608421, "uuid": "c36e32ff-d1fd-4a2e-a028-99dd852774e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608421, "uuid": "2eee6f0a-1cae-4e3c-9ae2-cad04b3f125f", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608421, "uuid": "05f09111-4140-4bef-94cc-93a7616f3241", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608421, "uuid": "13332de8-c4cb-4e38-aa17-95e49128042a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608421, "uuid": "b07f934f-5181-45fd-8f18-21213ca9e4ea", "value": "6e8cdcd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a8bd53-ba00-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579755, "uuid": "0ca40633-f300-4b6e-aafd-ed1ae0b0eda9", "comment": "Malware payload (Dridex)", "value": "704c05d204a6734e75bbcdb2aa538e26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579755, "uuid": "f5743652-6d24-43e9-9fdf-97d1a793d520", "comment": "Malware payload (Dridex)", "value": "597bfdf4d933fcbe623f2e165ec43c82ba065cdc038a44b6a6c8d47c1fc0b559", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579755, "uuid": "60379d12-1207-4d53-94d4-9a3067d95e84", "comment": "Malware payload (Dridex)", "value": "c0a13aa389d9fda5608c931a06a30ccc375c3887", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579755, "uuid": "9c56d0ed-4777-496f-a827-2d634b20b935", "comment": "Malware payload (Dridex)", "value": "28930caf2a2ea63341315a11888a80419c76b399c4a7e4703c18f1d168c65d335946f353deb48f537cd4d67a8db32b60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579755, "uuid": "0d1aa1f8-26ac-4c4d-b9a6-f26fdae658af", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579755, "uuid": "d6f08565-cc36-478b-80c6-5c9ca113ecf7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579755, "uuid": "acdb8f08-c732-4fed-9c35-bd9d3325cfe9", "value": "3072:38V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579755, "uuid": "756a299d-9ec3-4f3a-b5fd-8aa3dfe3f9bd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579755, "uuid": "3290558d-be75-4712-ab88-92b26a5a60a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579755, "uuid": "3e48540c-3c5b-4219-b4b3-d6eb4f23c970", "value": "704c05d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a853ce1-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581020, "uuid": "4a3af0e4-c351-49e7-af58-0d76f93c3dcb", "comment": "Malware payload (Dridex)", "value": "12fa8ba2322a251b198f6e0e1b5d9366", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581020, "uuid": "498e348b-84cb-46fc-ac9e-54aa23d28a18", "comment": "Malware payload (Dridex)", "value": "597e6ab5d3823221406826976f4cda5c22cb7ff01e9b7bd100d741d14f5386ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581020, "uuid": "dab42d20-958e-4a67-9ea3-4fc083a50d78", "comment": "Malware payload (Dridex)", "value": "62dce3cd09cfa3d048cb84cf8bb944c872fa12a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581020, "uuid": "1940bbb0-3fd2-4b82-8a9a-d2dbf58783ca", "comment": "Malware payload (Dridex)", "value": "820cc2f035c6df8d0f75147e1f0896666e3297f73d87d95cf25e80da982c61d31f054645651957b70e697fdabc5c4cc6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581020, "uuid": "bf3381c1-a413-4fec-80fc-f7d2e9b7c7bd", "value": "CE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581020, "uuid": "235379b3-f182-4a95-a898-89e7d12fe981", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581020, "uuid": "cd69cae2-0687-4f29-9ee5-0a915c0c97aa", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581020, "uuid": "5f9bbc3b-7097-4d43-93cf-ea2c20400824", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581020, "uuid": "d89b2244-d8f4-4cfc-b514-70c0bef7699c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581020, "uuid": "5832ad97-b690-44f2-b5e8-b7c49115577a", "value": "12fa8ba2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01840b84-b9ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579045, "uuid": "0614233a-8798-43b4-86cf-88c965eda077", "comment": "Malware payload (Dridex)", "value": "ef0979f4b76edb456d329ce0a6174171", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579045, "uuid": "2a4a91d1-c31d-42da-a6ea-ee4868eedaf3", "comment": "Malware payload (Dridex)", "value": "59afe54130ae10cd5d96af62b2c055a3f1ab1bb08bb6c2568c5cd48e3eb78821", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579045, "uuid": "2fa9f656-1552-476b-89d6-d6b83483265c", "comment": "Malware payload (Dridex)", "value": "39ec1c69e1fb87c59380b4a9ebdb85bd8d8b0370", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579045, "uuid": "efc6072f-2ee9-4014-8113-0c06be57daf1", "comment": "Malware payload (Dridex)", "value": "4d30d6aab8cdcec3e48c3d0c8fe2af6b28f1b695365a6861898d2b92a392958405f48484dd9ed95fedeffb0b64a268fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579045, "uuid": "d3ee24c7-5ef9-4895-aabf-68bb70751a9c", "value": "8804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579045, "uuid": "2a7255f4-c6f1-4742-b8ca-5261e88963af", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579045, "uuid": "4e64abac-e5fd-41d6-a0e8-3f11432dc334", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579045, "uuid": "1c42f290-f26a-43bb-bf6b-55884f1865bf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579045, "uuid": "434f6a5d-7cfa-4914-b79d-fb9e25117004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579045, "uuid": "3a799589-3c39-4adb-89be-f06872b0ecc1", "value": "ef0979f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe2efc5-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562749, "uuid": "d4322ff0-e3b1-4a03-8cca-4ba2c70cde51", "comment": "Malware payload (Dridex)", "value": "38de98cbed59779e8a4848b8cf72797b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562749, "uuid": "eacb6b0f-f125-4203-b2ec-168ecfae8859", "comment": "Malware payload (Dridex)", "value": "59de73b3271c90cdacbd16308eb85c2a15adab2182bb32e384e8e51b29d6aeda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562749, "uuid": "131b7322-e565-4a54-8133-eb565316bd32", "comment": "Malware payload (Dridex)", "value": "cdc34b2604370e7bebaa7da44138983a5c4d1596", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562749, "uuid": "76e7b487-f984-4f95-a873-62eb82646886", "comment": "Malware payload (Dridex)", "value": "ea6ad523540b0d042c489d4840bcd617e3b8aee411af0bb50ad008fae23f73275d61c9420cd449304f2b17388002ba5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562749, "uuid": "c0eafccc-05c2-4aec-9ac0-c9d9f24a487d", "value": "DF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562749, "uuid": "8633700d-f0e6-4712-8f14-fcc4f5a1d8e9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562749, "uuid": "c23d20d3-9738-4d37-acd2-33a7ec5a8498", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562749, "uuid": "249c76fe-a051-4275-86da-42ce8371861e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562749, "uuid": "2bd8cf07-b8ba-40d7-a740-22e7ab2851e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562749, "uuid": "6eaa021e-6fec-4988-a575-dc4d1d6b052c", "value": "38de98cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5749a2b0-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612260, "uuid": "1aec787a-2794-4d6a-93d1-37c51a409121", "comment": "Malware payload (GuLoader)", "value": "f51a228acb529b78a2d92704b629c7f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612260, "uuid": "b0960c7e-ed91-440e-aac8-daace9deee18", "comment": "Malware payload (GuLoader)", "value": "59e2ae18fae10822e5363cb8866f2327ecb3b0107d4f13e8f8b8eb58568a2b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612260, "uuid": "335db9d8-583b-46df-a1c7-13a069ac39b6", "comment": "Malware payload (GuLoader)", "value": "78008955537877ab3b87521bb10ea34dcf44f907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612260, "uuid": "3eb5de3a-3076-45dc-b743-012bf5ae7051", "comment": "Malware payload (GuLoader)", "value": "c06147cc9a044a8be3d681821d0bf2381b3d42661f338ec6826c64abf7d03ac11267885406cbf9ac7ab907a729ec7f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612260, "uuid": "f779b09d-27c4-433e-8095-52240fbdb4ec", "value": "AF349586B952E56AE885D1B4F436C61F08A57C7371854E07BF832F67B030047AEF8A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612260, "uuid": "bc7fb8c5-b263-4f9a-9064-193373096bf8", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612260, "uuid": "15614041-c807-457e-8a0a-2472b4ccb656", "value": "1536:6YTEvVbJks3fMbAYvB2aseMqemrPmIKgCi615RYojPw4k7T7AU1Q8AG637ziMb9v:6F+IOAYYas5qw8Nm6T7AU1AhPF3NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612260, "uuid": "6524a548-0fee-4d23-b57b-324c342c08bf", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612260, "uuid": "f7a3fbaa-a599-4bad-84c6-d44183637914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612260, "uuid": "847ceeef-0d46-471c-b861-619b0abd309a", "value": "Zam\u00f3wienie 20211147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92ced20-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622330, "uuid": "4b2f4586-eecb-4359-a5c5-b3fd9c82088e", "comment": "Malware payload (Dridex)", "value": "57f32b4ba9f936751213cd2213415e53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622330, "uuid": "4c0f9009-0d3d-4a14-9374-cd30040167f0", "comment": "Malware payload (Dridex)", "value": "5a1c23db1304517d9ff5662909d63fb60d158198991dc4099e594d1657051861", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622330, "uuid": "c7a16304-9957-4168-8c92-7e34a5e4ab53", "comment": "Malware payload (Dridex)", "value": "005e5375b0be963535f848ed582aae0d628a9bfd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622330, "uuid": "2f53f5a8-3dbf-43b4-ad4e-cf29f9274dca", "comment": "Malware payload (Dridex)", "value": "1c75e6e6e8cbe97fdf414c5d6fbf1fff3e219c4bf8d614fa200a4603722ee8dd31a2782eb36b00e71995038fc9d7f1d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622330, "uuid": "9603299a-cbbe-4b58-b156-95c9620937b8", "value": "48F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622330, "uuid": "8354e91a-b6d6-45ff-9fbe-044952189b06", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622330, "uuid": "40e6c809-35d6-4f8f-860e-0326a4f3bfcc", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622330, "uuid": "5e69828c-3e59-457b-9f4f-5f04d44b33f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622330, "uuid": "e9d8dd11-0dc2-4451-bcf1-ee50b19d7dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622330, "uuid": "8d35f7cf-a1aa-4c6b-90b0-9424b987e6b3", "value": "57f32b4b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ecdb42-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621612290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612290, "uuid": "133c0da8-d3b8-48e4-891f-0e49825d6122", "comment": "Malware payload (AsyncRAT)", "value": "a34d12a21d1d99f9c5a7adcc8ede8ea3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612290, "uuid": "dff6a216-e6f3-4a8e-a12f-0de2c688d839", "comment": "Malware payload (AsyncRAT)", "value": "5a350863147326d5aca1b05ff6a8721d360271751ec7f32cee1237d40f84d804", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612290, "uuid": "86ab197d-8d1d-4f7b-ae5c-b12ff58802c5", "comment": "Malware payload (AsyncRAT)", "value": "94a96bef85d4ee0b0073f95b2e7a5bdd0dbfd39b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612290, "uuid": "c817817b-2132-42c2-9768-f126362d5d8f", "comment": "Malware payload (AsyncRAT)", "value": "059d30840853fa18e13abc0a3747e6ccd7eab148a1f438f2f35005793f50060afd38c9ba8ce1862fca8a6aa8e5b863fb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612290, "uuid": "c3fa6af9-3264-48b4-99dd-5fbcb3517029", "value": "D524AE0437293E67E6B497F9017560A027F82CAD3AA0F5CC5C9231EA25F1F999943F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612290, "uuid": "b7b774b9-e16e-4823-a383-0ce1cfa69491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612290, "uuid": "bf3dd1a3-61d2-47f8-a982-4271bf6ae0d3", "value": "3072:VYhZkYrvzwV9srecIYoRdpI+RJBWkilk80gr44yZLSzsZSh1aeg1SORC94:TYv9OYoRdp/LZLSIZSSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612290, "uuid": "978be1cd-8d03-49c5-9cbf-234a0d5f4baf", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612290, "uuid": "fd880b0b-0255-4dfa-b88b-4605c78ecfc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612290, "uuid": "e5f28cce-1c25-4ad4-9184-55d03f288ef5", "value": "Purchase_Order_Form_4667ROO3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd61919a-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577213, "uuid": "bebf867e-a9e5-43d4-8039-5f52ce1352c6", "comment": "Malware payload (Dridex)", "value": "6b0a090904accb64ab40b6d07b85451a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577213, "uuid": "7bf65e91-480f-4270-adf9-8ea7a508d901", "comment": "Malware payload (Dridex)", "value": "5a367e501f3ad0a4f6f2b03c2f6f83e5521db28c0f5ec878d1529176f3ed7d07", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577213, "uuid": "cf6135e6-b44d-4bf1-a51f-6a14cf74fb2a", "comment": "Malware payload (Dridex)", "value": "d152e145fd2afcfdfe4f491984d00a047ee4e0bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577213, "uuid": "87c470dd-3cd0-4d79-a78b-522a7c6cbdd3", "comment": "Malware payload (Dridex)", "value": "f45ad462493b91186061d5ff5b00ddf28ada135236bf4ca32a7f0535dfd0ad912cb5bfaea49f6be12777ea25a66156e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577213, "uuid": "d3abf8a3-b899-41e1-ae30-5a254172fe2a", "value": "5604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577213, "uuid": "265e4d35-613e-44f0-aa46-0559cdcf9d8d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577213, "uuid": "bcca5987-5975-47ca-a905-bab7989b94bc", "value": "3072:bV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:bV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577213, "uuid": "417528a5-f564-4224-bacb-3df0e2628ff1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577213, "uuid": "fcab1360-492b-411e-8e47-61f1d5c99078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577213, "uuid": "b19f36b4-34ee-4622-bd3a-4e361a279820", "value": "6b0a0909_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2b9075-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627677, "uuid": "87beaa22-856d-4816-a16f-d44e84431eec", "comment": "Malware payload (Dridex)", "value": "36892ddc15422e4c73f659679d91c87a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627677, "uuid": "6772cbda-1014-4104-a1de-8e7f1d2dae7e", "comment": "Malware payload (Dridex)", "value": "5a7e4df4afa1a4d93aa3681137ef6ea8ee1e4b9826d5f16d0167f3a0be32a54e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627677, "uuid": "7dbd666e-273d-4267-b9bf-f1dca45e444c", "comment": "Malware payload (Dridex)", "value": "6e2964aa8a92fb640aeb6750ace624b1ba3bb6b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627677, "uuid": "1854ea4e-7706-4151-82d2-6c2256f6c766", "comment": "Malware payload (Dridex)", "value": "31f4035c72363315b53189972dd89c6cc3e66a03f6299e25bb2dc062a437f6199375ea287bb6374e4dae6f2483dca289", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627677, "uuid": "425f4ead-f6ff-495c-8642-d6da5df328b2", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627677, "uuid": "a37254c8-191e-4307-90a3-cefeb025f780", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627677, "uuid": "2e38f85a-2e12-439c-b31e-93c79b246030", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627677, "uuid": "7e60d725-1365-4784-9a0d-f131278a569d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627677, "uuid": "8a3ad7d8-4599-4a80-a1f7-7e86456958b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627677, "uuid": "9c2e4ee1-38f7-47a4-9779-12d2caf60b5f", "value": "36892ddc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292f5c5b-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621623780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623780, "uuid": "57f230a5-f758-4268-91fc-070cf1e982df", "comment": "Malware payload (Dridex)", "value": "4a263ca2a97128534deb9a8104339ea0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623780, "uuid": "1f6def7e-5a3e-4496-9c0f-f4363dbdb1f3", "comment": "Malware payload (Dridex)", "value": "5a9377b1833a437c9dee18e506ab044ecdda9e67ba956db0cf380872b14f6353", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623780, "uuid": "90393fa3-2872-41e9-b013-0451106a9bd7", "comment": "Malware payload (Dridex)", "value": "69108208f9c2b7facdbf5d47f34d23a3a6605773", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621623780, "uuid": "dfa9a41c-f5c6-4d8f-8f01-cd3a563b11b7", "comment": "Malware payload (Dridex)", "value": "176664a85ec1bd9d1c24b0af9fabfdd28bb0624f604ee025e712184aa092485d3d7aebe5583602e48fb3fd58521f8ab6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623780, "uuid": "df16a1f9-7d4a-47c5-8389-d98a786c4a34", "value": "2AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623780, "uuid": "5787c812-3aea-4355-b5fa-bf75b75f8d61", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623780, "uuid": "f07f6b49-9238-4011-a1d4-e36d2b2e46c8", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621623780, "uuid": "3a1bd53b-9ccd-4fad-809d-60741b6378ac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621623780, "uuid": "cb055fc4-a7d9-4b58-829d-782c926de3c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621623780, "uuid": "9e8a37c2-20f0-43c6-a6ea-aee383a217b6", "value": "4a263ca2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d580a02c-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610325, "uuid": "9f9101b1-f155-4dd5-b199-16bd7daea4e5", "comment": "Malware payload (Dridex)", "value": "7d21d1a7784c28021786228d777a3127", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610325, "uuid": "856b8bd1-d065-453b-89af-91396d5742d5", "comment": "Malware payload (Dridex)", "value": "5a990197e104f7d704c87158f1835553d1f15a1f0c06803aa9d4158c489d327a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610325, "uuid": "82c47a94-4693-4da6-a8e2-85d5264bbc26", "comment": "Malware payload (Dridex)", "value": "a97b382212ec46b0713aee303b4a5ef1aae958d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610325, "uuid": "ae500b73-862c-426c-9f6a-c6c86fee6509", "comment": "Malware payload (Dridex)", "value": "36085d43d7c8d4514ed7fb59778d3351dce1d8278dcd210e81d98ab16e957efbbdd2078fec97e1fb05740dc7d40c58f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610325, "uuid": "3b1773bb-d9c8-4597-aafb-7163714dadab", "value": "5904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610325, "uuid": "cc420b35-0b8f-432f-a66a-edbcd6057d90", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610325, "uuid": "c0a5fcd2-46fa-49fc-aa69-6823554d1e12", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610325, "uuid": "41ceb412-7ce5-4543-9659-6641cde5f86a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610325, "uuid": "a13c0a68-26fd-4ff5-a228-cd734a5a0e42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610325, "uuid": "acb6382f-659f-4fc1-b06e-16d4015e9ff9", "value": "7d21d1a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4bf04c-b9cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557802, "uuid": "e3865d2c-b2ed-44a0-a9da-bb4215a5469a", "comment": "Malware payload (Dridex)", "value": "56d21c0d9ae1e10331f638eaa545e7df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557802, "uuid": "61ad6683-817a-4724-b895-e4f25731d1f8", "comment": "Malware payload (Dridex)", "value": "5a9a1341a7b81dd83274005079e3547ec7c265f61c609fc85366ab7387c74a41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557802, "uuid": "6fb41870-3bb1-457a-8a8e-17640b7c1a97", "comment": "Malware payload (Dridex)", "value": "b67ad6b31d8501a3da58d0b672d761cb14f23e1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557802, "uuid": "9f68eb99-d56a-48e6-b33f-2440966a4aa7", "comment": "Malware payload (Dridex)", "value": "d8c62a71c5d6201325ea3bee2c4706511f50c7db7eccb297552ca1e2df3ae52f668ce0b83a23bde75fae5c6eb0a6f3d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557802, "uuid": "b5a1a736-c19a-44fa-b5d4-158294fbb7e3", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557802, "uuid": "3a2c7b74-387b-4aac-b869-b969dbce1935", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557802, "uuid": "9cf80999-f202-461f-9bb8-349b2ac316ca", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557802, "uuid": "2a7cc24f-0c0a-4961-affa-3dacf6b0c1bd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557802, "uuid": "7bf50f6f-14c0-42f9-95ba-f9a5abadbdaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557802, "uuid": "36bfdd78-fb71-4fe3-ba16-df65d1ba1974", "value": "56d21c0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c09cc6b-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616993, "uuid": "79a5378d-88f1-4b96-97ab-8683120676d5", "comment": "Malware payload (Dridex)", "value": "aa1db1e3a1ecdbd752b917deb48fe48b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616993, "uuid": "8c84248b-908f-47b1-91ba-0605014aef2b", "comment": "Malware payload (Dridex)", "value": "5abdb15d98b80b2fc2b0b9b9dba207b29653cfc380898e11a52eb038b8b4dc63", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616993, "uuid": "d3c92a24-358b-45cc-b896-a4bc2864fb96", "comment": "Malware payload (Dridex)", "value": "223c76f6b8f08c237647540057c2991fd539b9b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616993, "uuid": "cb6bcf7b-2217-4706-9820-0e76bb2f1948", "comment": "Malware payload (Dridex)", "value": "0a60837d7516c3d2c049b3c1942995bfa98c2b726adecdbc85e3132ebeedae3475b72d95c0430491e295fa2ccf9bda33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616993, "uuid": "8119c17d-8a75-4384-a5e0-26f9ef44c44b", "value": "45F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616993, "uuid": "d1a4bdc9-a788-4ed3-937f-b41a5888c01b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616993, "uuid": "7a2d9c1e-af6a-4827-92ea-5fbca6c9c71e", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616993, "uuid": "bbd978c0-0e25-4006-993a-d7c6f2e7f44b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616993, "uuid": "6be176c6-4bca-4d38-bf5b-a06354361c80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616993, "uuid": "a77c3ee5-4d8b-48d5-8f27-6ece1d086600", "value": "aa1db1e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9e4bed-ba61-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621621205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621205, "uuid": "9a9d9048-5176-45f9-a0d7-afd93753b563", "comment": "Malware payload (Dridex)", "value": "19cbd926d3a184f33dc4e892ffbfdac5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621205, "uuid": "66a91c57-a29f-436c-8f88-86d079f0e946", "comment": "Malware payload (Dridex)", "value": "5aed393d91a611836c5e1f182cdd4e025d23a95fe052b2348e9b9e2f900b4f94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621205, "uuid": "ed788d4e-0b5b-45fe-9a0a-63091da74e16", "comment": "Malware payload (Dridex)", "value": "59168406636ac535ef6311118c7f1b65d1674b04", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621205, "uuid": "7e3f8448-6bc5-4481-862d-df8715fbcfdd", "comment": "Malware payload (Dridex)", "value": "e63a6efdfa2d282c8b625fd6c5ed4bedf020268f97895ddb2fdca0b19082ffd3099327ac3db6c0876cc763698c0462b3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621205, "uuid": "edfe15ac-ee09-44f1-8565-061a49fc51d1", "value": "63F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621205, "uuid": "15978a15-6d8c-44aa-98d5-2c81ba99b3ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621205, "uuid": "b3639179-49a1-4d11-9184-07f8638c1937", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621621205, "uuid": "c9237185-487d-45e7-b1a5-ac23932de191", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621621205, "uuid": "ee09c4fb-12e8-4ce1-ac68-8b337a2c82bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621205, "uuid": "bfc7d348-fd3b-404f-a19f-ec21f532f552", "value": "19cbd926_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b276d49-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567143, "uuid": "26376558-4c0f-4a53-9d0c-2c429fb85adc", "comment": "Malware payload (Dridex)", "value": "2cff478932feefd51dcaef281fa97f79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567143, "uuid": "8410f828-8747-4d6d-b54c-3d3536667201", "comment": "Malware payload (Dridex)", "value": "5b5ad4b5ccd6d1e6c895ca74c0c1e0e18e85791c9302e6bd75d3ac61e04992bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567143, "uuid": "85e27f0f-7c0d-4a0f-b170-355539529140", "comment": "Malware payload (Dridex)", "value": "bb7809e55561118b6de2d73c3e9094906543ce0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567143, "uuid": "079cd16d-bfce-4241-8cf5-23aa79f2b24f", "comment": "Malware payload (Dridex)", "value": "24f007c2198be4ba56e807fb3c4f32e9b1fd79cd29cb75a58c9f95594446d20de2aaad6b2a21d23375e74efd20d9b363", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567143, "uuid": "55f0caf1-7b50-4392-9ddf-825d582cd40a", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567143, "uuid": "ad609fd3-ffd6-441e-a652-9705194a4fe8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567143, "uuid": "d28778b7-0b6a-409c-8cce-3c03aa2c5377", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567143, "uuid": "acc2d075-6444-4cf9-85ab-e74755255f25", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567143, "uuid": "62152e83-cd23-4840-a89e-3d4e4ad73ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567143, "uuid": "e5af8a84-f37e-4dcc-9afb-311fe417f457", "value": "2cff4789_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18f9096-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621617163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617163, "uuid": "fdab7180-1113-494f-b999-312ed522b7fa", "comment": "Malware payload (Dridex)", "value": "66e7771b94683b6cbeb3157c9902d11b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617163, "uuid": "4aae7638-429e-4150-8af0-4476446ce7ba", "comment": "Malware payload (Dridex)", "value": "5b72f66979adf6493e485fc1a836dbbc6a58560480f77da53e6421ea076d4f13", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617163, "uuid": "3734fe52-6fcf-4c1a-ae08-279f9b8df90b", "comment": "Malware payload (Dridex)", "value": "8d742c27901c1356d64b329b2ea397ea07b033d2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617163, "uuid": "900254e1-52d4-40ed-91f8-f9a036c7803b", "comment": "Malware payload (Dridex)", "value": "5545af65d31dbfaf4f35eda00fb09279059bd9dc155f5d8d18f236fad696613b36acc25d242f43aba0fb947e1d475612", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617163, "uuid": "e5b351de-c863-4bbc-a1fc-89d671952388", "value": "67F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617163, "uuid": "8b7b88b9-6c4e-4cb3-9396-4d2278fe609d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617163, "uuid": "88641045-5930-41a8-8838-3407c08f580b", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617163, "uuid": "203c4034-5cad-49b5-9517-f8ddd4011a2f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617163, "uuid": "0973dfa5-61f2-4329-af1a-cd4ea25cf5a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617163, "uuid": "08074a34-cd0e-4486-bfa6-aeb6871a48cc", "value": "66e7771b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8975ef0-ba00-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579889, "uuid": "f4935098-f102-43b6-8f8b-3877ff4fd9fd", "comment": "Malware payload (Dridex)", "value": "5439c2da3a542c71389d80612c443926", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579889, "uuid": "4c426c76-352a-4da5-bafa-ce8ba6c82b91", "comment": "Malware payload (Dridex)", "value": "5bd5b440ec7981fa080dec365ceeb63753c510cb4dd7fd11c64f52d128c46db6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579889, "uuid": "0121d37e-5bf6-4ebb-9235-0996798b621f", "comment": "Malware payload (Dridex)", "value": "725c3a4078fa75df8217e43b194874e5c45c350b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579889, "uuid": "b24642b5-e1c7-4260-ac2b-1b6cc6bd7263", "comment": "Malware payload (Dridex)", "value": "b881638cac0821ef1c45bce399ec9e054ee2549fd4caef4d9be97dac376575795023c4f7041ec12185ab182272fd43c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579889, "uuid": "a35b4183-8936-465f-96b8-0890b4f41891", "value": "D004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579889, "uuid": "3d3c7979-1ff6-451f-9152-cd20872e2536", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579889, "uuid": "2bb973db-aea7-4b92-8726-a56589d0c914", "value": "3072:E8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579889, "uuid": "42d18b53-48ce-4359-bb76-6eae1e6ea7ac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579889, "uuid": "c2477682-0747-4c23-bab1-5926840f48b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579889, "uuid": "f0181569-6c70-4bb0-8116-3fb3688fe728", "value": "5439c2da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ccfa46-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616652, "uuid": "c0778ded-d7ce-4243-81d4-d673789cb34b", "comment": "Malware payload (Dridex)", "value": "838ad0f13a22c700249d639e4c542d3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616652, "uuid": "37ea1bfe-9406-4bdd-a535-c788150a7271", "comment": "Malware payload (Dridex)", "value": "5bde6efb22612411a051169ba652c0b8ff1fe701fa4df01aafed5fb44db41c79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616652, "uuid": "dfa64eef-6f68-4c95-8bf4-ed81f736d4e7", "comment": "Malware payload (Dridex)", "value": "d9b47866f60dfaa79255693f3590ea8239ef3732", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616652, "uuid": "c2fd68b4-037f-44ac-ad6a-77317508ca28", "comment": "Malware payload (Dridex)", "value": "dd9a2b055fd91320da1cb5bad74e08dd0a7ca41ba7ef3045352fd1a2f9c1944d2f10dff07ee2ff7dc4bd48663ca79c10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616652, "uuid": "faf9bc3c-8253-4f13-8eaf-a9885b06b089", "value": "6BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616652, "uuid": "62c08720-9cf3-4916-b6dd-edc2d34d4f6a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616652, "uuid": "050ff187-5cf0-4e4c-92a4-458cdd6b7168", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616652, "uuid": "2fa3dff7-0fa4-4b52-afb9-c1c4826bf2d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616652, "uuid": "c08e0c36-957e-4a30-9f04-49697243b932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616652, "uuid": "1958c43a-6e19-48d7-b38f-507cea35349d", "value": "838ad0f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa08a21f-ba7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634438, "uuid": "949c4b2a-2847-451c-b6be-8e0bb1eac06b", "comment": "Malware payload (Dridex)", "value": "d1248622995a7be7358c5c62b7d1486a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634438, "uuid": "bcedd63b-f53f-4c30-807d-9b4a97bf17cd", "comment": "Malware payload (Dridex)", "value": "5be76c33e894d968ba3a53e11aed5ef6b287302c5469ff2460a34c8cba30f69c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634438, "uuid": "4bdcd75c-064d-4a85-b875-3fcc82e8596c", "comment": "Malware payload (Dridex)", "value": "a27d83f4541114dd3aaf742fb102879c7ab1d308", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634438, "uuid": "b8924e7d-076c-4f7c-9ce9-3098b2bb1399", "comment": "Malware payload (Dridex)", "value": "0d63b0a3ce2ef63cb202cc399f406fa72e1dd443b419d442c49c52b062618c3aea6d7b1e659513c047d3a0a7768bf3a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634438, "uuid": "d0551755-29e0-42df-a052-38820546a76b", "value": "C5F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634438, "uuid": "c31afe3c-b31b-4d2b-8fbd-9a016d440ec8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634438, "uuid": "326ac677-36f5-4412-8f7f-837e4e5256b6", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634438, "uuid": "6063c5a9-c2f2-4a4c-b073-ab21c9054c7b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634438, "uuid": "30aea7bb-f273-4c90-8d97-d163110de373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634438, "uuid": "d39d43f9-3d57-42b1-bc81-f7a0d4e09b4f", "value": "d1248622_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ac907b-ba30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621600212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600212, "uuid": "3cef67dd-2b7d-4272-a2d7-ae3004681321", "comment": "Malware payload (Dridex)", "value": "201c7f7dbabcba9e31a51d58c00b0890", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600212, "uuid": "68a99cad-6492-4387-9814-201b1167d07f", "comment": "Malware payload (Dridex)", "value": "5c33a2c07aba6a32567e5b6bc3c36c7a61081521a8ef25bf2c2f18ebf013e87b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600212, "uuid": "69604d89-fc19-436c-af47-7fd7c147d3a1", "comment": "Malware payload (Dridex)", "value": "50a708cce596f0516dfb4828de772af70c2bc75d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600212, "uuid": "61f20673-d4fe-418c-b2bd-36143ec6a8b7", "comment": "Malware payload (Dridex)", "value": "504a53290e22f9490c6d3022e5ef5cee39c3c14334e1a780c8bfe473978e79565a8262508a9453422b3b6f6e94457c2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600212, "uuid": "bf059d11-20ae-4be5-bb52-d6400781f628", "value": "E404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600212, "uuid": "544abc87-854c-4642-8427-32bb9be80041", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600212, "uuid": "5a8dd687-6d44-4283-912a-4529a7b4e8ef", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621600212, "uuid": "d8224ca5-14b8-499d-a2c5-a29692995273", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621600212, "uuid": "197db8aa-b085-40db-8df1-e7cd857a33e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600212, "uuid": "0adc71e9-955d-4905-aca8-52688c892406", "value": "201c7f7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed40593d-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621618525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618525, "uuid": "2b175b73-712b-4a7f-9f36-953ed2272904", "comment": "Malware payload (RedLineStealer)", "value": "1c341b08254170161630fe3a752d0dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618525, "uuid": "1781f3df-4cd8-41ee-a8c0-f6fe698f7fd0", "comment": "Malware payload (RedLineStealer)", "value": "5c3dc2ccf29259771d3c0d9f54021f044b8e85baa9d831ebe8cc77e8de251204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618525, "uuid": "7623f9a6-619e-48d1-b068-c9b2333f06f2", "comment": "Malware payload (RedLineStealer)", "value": "19ed26bc37f85cc0924a35556abeeede3099fec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618525, "uuid": "f8a774e4-aa19-4d9b-95a2-4a8316141f4e", "comment": "Malware payload (RedLineStealer)", "value": "b9cece007286faf4827d2ab38f2c27031b3683d78e75554c63da4be3f3b93ed656ec47b0e27fa0bafd9cc65d8b9aefe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618525, "uuid": "5d211d9a-7b6e-42e2-ae2d-5a3c6f7654c4", "value": "E0F4AF3036EA520CD8765BB41D7992C5477A7F6A7B00CB1E2895328DDE33A138B21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618525, "uuid": "7839e5ae-ad50-4b4f-b05c-f6bd2fe1701e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618525, "uuid": "28ca8628-1845-41f8-84c6-bc603cdfd28e", "value": "12288:ExETG52+CYd7cYdZL2Q2tLbYf0cn0fLUyt2MY:EWkCg7cCZCQ2tLUccnKt2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618525, "uuid": "747f9e53-0eb3-4a75-908d-fc6b0a47ac1f", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618525, "uuid": "61593f89-b784-4a1d-87fe-8b6f08641812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618525, "uuid": "a0b0f127-621e-466d-9c79-f661889ee7c2", "value": "1C341B08254170161630FE3A752D0DC0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f36fd2a-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621611898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611898, "uuid": "2ea9ff4c-100a-408a-9f37-5b620c611c0c", "comment": "Malware payload (AgentTesla)", "value": "3f7e29122820e8550c1e1e441a9ebcc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611898, "uuid": "36967d33-7366-4648-9ba8-015e8daaf181", "comment": "Malware payload (AgentTesla)", "value": "5c442c7f830671c708a71e6e9dfe8f403b3e04f1b0cfc69123352032c8fbf306", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611898, "uuid": "75f9b31f-ae86-4bda-aedb-647b8ab99a9c", "comment": "Malware payload (AgentTesla)", "value": "f9c0bed11e68a63e79695b6d80a8b2183a997288", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611898, "uuid": "9a5ba115-63e3-473c-a8f2-ad61a74d2099", "comment": "Malware payload (AgentTesla)", "value": "071fab06ee2b0435a480c028c5834728f11e87a8db2a1e04f53c3836447b7652e975c184dda17c1ceeca2a5ac630bd03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611898, "uuid": "75186027-0a20-403f-b0ba-9573d5a33879", "value": "1615E03033999255D03E5B34183690D163F3B617BB15CB2E7D98528C9E73A938732BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611898, "uuid": "2691cee4-b66c-4b67-8cdf-d90410d76d70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611898, "uuid": "68ff7c19-f33b-4f65-b263-163c0d697d3d", "value": "12288:M9EhWFoMfKzdrhs/pEV8ouh3aFVQ6+cOG2UB8/3cQ26Jwx6sAVDTnJ:WEhITizdNseV8oYyEY8/HhvdJnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611898, "uuid": "5f5e57a9-b2f7-4e8b-a32f-c9bae7df253a", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611898, "uuid": "da62734a-82ea-401d-8cbc-21c7287218ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611898, "uuid": "d3f64a66-0070-4a14-ac8a-7c9296cb1343", "value": "from-iso_SWIFTPAYMENTREF07656.PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84b91d7-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563112, "uuid": "c0e8829a-a329-4dea-bbed-de131080df7b", "comment": "Malware payload (Dridex)", "value": "7c0bff9d9be23ceaba4e79644e0f35a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563112, "uuid": "902f7e79-6731-485b-8f6a-d8740cf0e698", "comment": "Malware payload (Dridex)", "value": "5cc7e3a3f8f54a14c797bfe99896924a387be74ce681a496f48d4d17641af9fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563112, "uuid": "f2ec59c0-8a5b-4855-9783-2e03f347a74c", "comment": "Malware payload (Dridex)", "value": "11357cc19d3a6b6c30e49a96b46adf31f9383de4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563112, "uuid": "ddf5689f-5572-460f-a695-337a1c1e5339", "comment": "Malware payload (Dridex)", "value": "8b586927a4680a7e3b65ee9e9a9177ead8e27749d2e7be3d1698682ed11c818fd989e9ca9600b9b7532fbffbdb733786", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563112, "uuid": "23fc7423-8419-4555-862e-58e4f7f04677", "value": "7604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563112, "uuid": "e82cac5f-d3b7-4d32-96e1-d2c623b84c15", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563112, "uuid": "9ce8f2d6-16af-4d71-aa42-61718db94ce0", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563112, "uuid": "1aa6335a-0f6a-4b7f-8bea-71fb280253ba", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563112, "uuid": "48e0f84c-cd8b-4dcb-a070-572e43c1e82f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563112, "uuid": "46dedd77-51df-46d7-b677-fdf8b1236175", "value": "7c0bff9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f290b0fa-b9d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561411, "uuid": "088d9d30-b111-4ac3-bfdf-98ad08c3027b", "comment": "Malware payload (Dridex)", "value": "f4fe54ffe35d2c95cdfe33b5e53375cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561411, "uuid": "bd974bc7-1c7f-4cad-838d-fa17e7b4bbaf", "comment": "Malware payload (Dridex)", "value": "5d026b494e64046c0a8f6b400f322784178dc215a0e882ea43f478b48c7bdefa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561411, "uuid": "6bec816f-f67d-46ff-87b6-4bde008a1bce", "comment": "Malware payload (Dridex)", "value": "a759e1d9ce52e80e417329d0f1b87f7f0193b4b9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561411, "uuid": "effec79b-9158-42ee-92c5-bab40de9ff70", "comment": "Malware payload (Dridex)", "value": "6567149234cacf33332c6d9b7fdb3617c2d5da45b0d862452402f75e5f9c5f6a510c659dfe1d86d3b7f0423562479741", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561411, "uuid": "25d21d50-3f46-41ba-a21f-73edfff9015d", "value": "F7F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561411, "uuid": "4ef55065-e546-406d-909d-7b413df86b3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561411, "uuid": "5904c993-aa41-4e8b-a741-fa21802dddf5", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561411, "uuid": "ea287543-18a0-4b79-8701-978a6b1ae3a2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561411, "uuid": "40cf5a73-fba5-4210-93ad-c17952ac2d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561411, "uuid": "483165c4-c29d-4f05-b1af-f113b605b7bd", "value": "f4fe54ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cc3296-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573682, "uuid": "2780febb-d0ce-4a71-af01-aae9e081e4ef", "comment": "Malware payload (Dridex)", "value": "20826a3fd52bdc46f1e7b2f41a4047c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573682, "uuid": "7d64ebb4-f246-4f3c-be85-565c0ab373fd", "comment": "Malware payload (Dridex)", "value": "5d16b8ab07e77397849d917c052eeb6b1ca8623ff1590f37f160f2f36f8480ec", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573682, "uuid": "ad903022-2929-41d8-b07d-0cf736f25c5a", "comment": "Malware payload (Dridex)", "value": "2de450451929469082a83f7f5e9223594ec4bca4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573682, "uuid": "4253593d-8c85-4ab3-8a32-ff8f96520460", "comment": "Malware payload (Dridex)", "value": "e161d0719b0ec2b5262bb4b020957f8ad0958a980b307987522baaa4c225f04f515d3e028cd973e2e3717e2912341eef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573682, "uuid": "3ec23284-5bbc-4a29-b7bb-825542980899", "value": "8804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573682, "uuid": "7cfe85a5-dd11-46c0-abd8-1a1ba93cf856", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573682, "uuid": "47cc0f6a-7cfa-47b0-8acd-772dec5b98ca", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573682, "uuid": "bb5b3820-a07a-4d1b-9d15-9aa0841902c7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573682, "uuid": "f2716759-d434-4a67-9235-bad98f834943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573682, "uuid": "517a454a-a7cc-4930-93f4-65c318923203", "value": "20826a3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a68806-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621613192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613192, "uuid": "55c8355e-04e7-4cd4-aec5-db15a24bfba9", "comment": "Malware payload (Loki)", "value": "edb386d29730158b61b5212b9b922a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613192, "uuid": "b859caba-17a0-4c13-b9ed-0cfc1b170566", "comment": "Malware payload (Loki)", "value": "5d191a5eeb7648a1806c9b42c64acd816678a3ce04d52a7cbc7da649b1902a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613192, "uuid": "81c1a976-78d8-4df8-ac9b-9ea968e654b0", "comment": "Malware payload (Loki)", "value": "617178d376930f89c263d853835a96fc26b9acea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613192, "uuid": "52450044-d029-4fee-b62a-6268fab90fa7", "comment": "Malware payload (Loki)", "value": "4c11ed6bd0854d2ccd521e9c932089831379c7f2ab26360b15e4b6078cd1deebfcccd435f613bf2f091b2a002add1528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613192, "uuid": "33b75b23-7f7e-471c-b159-3988ed7fe536", "value": "41747C21A2A1C035E7FF12B449B98279693ABDA15B3450FB12C53AEE5634DF0AC3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613192, "uuid": "1e1ec322-2061-4256-8afe-094108735ceb", "value": "abbec4d8cc3408f46a61cf49a256a187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613192, "uuid": "48b127a6-135b-4f9f-a77e-b267f53b77ad", "value": "6144:hj1BmMVfZgDQym1mtMo2N1cxPKv9P7582dGx4gaOgP+OMSnXsTRV:hjfmMV+DVmuG1zNQsPFnXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613192, "uuid": "f277183e-1a04-47c7-9c8f-843bf283dcfd", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613192, "uuid": "88878160-eca8-40e2-9f74-6d5381c8175b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613192, "uuid": "a0b9ca8d-8cee-4cb9-ba51-44d3881913da", "value": "edb386d29730158b61b5212b9b922a5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd2c4c3-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621575308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575308, "uuid": "c50e2ba6-92bc-4fc8-bc3a-50c3af863227", "comment": "Malware payload (SnakeKeylogger)", "value": "0c7a75515421bb74795049d7ed7000ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575308, "uuid": "b2a224fb-ce06-4195-b129-d244796b56cc", "comment": "Malware payload (SnakeKeylogger)", "value": "5d682752f7d6be29263d214f2b04f2db8371f42afd05852f5a32d54a135cb437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575308, "uuid": "8c0245ef-168f-4be4-83b7-7a2bdf055cce", "comment": "Malware payload (SnakeKeylogger)", "value": "228a124fa31987628cac27a74933b14bb3230ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575308, "uuid": "33e02e0a-2b0a-4045-8f7f-1322f8f5420f", "comment": "Malware payload (SnakeKeylogger)", "value": "bd4be5760e9c6ba6c94a77ab0500f851851233f1512126577e035beea14531906e21ccbfabbf1c11cb7ec6688f13ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575308, "uuid": "44202d34-e050-4635-9acc-53881f4e32a5", "value": "57F4C0AC325875DEC53BD279DA681C28EBF07077831B920BA127109D9A4C9C7EF615B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575308, "uuid": "d1a1a25e-ac65-4c29-b13e-271ab9c82044", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575308, "uuid": "6c68d613-bcbd-46cd-b444-66cc307ee56e", "value": "12288:gKzaKkXsHSfK8CvnaPXoh+OVFxo5DBGkKgUF91g+kxG81CSsrbYD/r9n5E3kgvYE:JzaKwPfqvaPXH6F6NVKgaY+n81srb64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575308, "uuid": "bc8eba13-da39-48a6-b1aa-ac5d773c0a60", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575308, "uuid": "fa3c3917-70fa-4909-85cd-b9c9595fdd2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575308, "uuid": "341b0c23-2078-4a96-a0b8-46f4ef080bf8", "value": "o32vigf1n35lQw8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f901c8fc-b9ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571730, "uuid": "c0756e58-6baf-4c04-86f6-3de43226c8f6", "comment": "Malware payload (Dridex)", "value": "3059e30f59794f82874842a95ee62233", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571730, "uuid": "2f08759f-28da-4868-a818-ccab204bcbe4", "comment": "Malware payload (Dridex)", "value": "5d9d2d4054269686f1a7992f3d1cbe7137aefaa83a362d89e8aa4e375ff39245", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571730, "uuid": "ad119593-98d6-4395-8acf-26f7c196ce5f", "comment": "Malware payload (Dridex)", "value": "7eb9a408d10180ccd2f61461023187190defce75", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571730, "uuid": "afef8385-0a72-4aa4-ada7-d5850f670abb", "comment": "Malware payload (Dridex)", "value": "a6327a6ac83272a4cbf6629b8c89dcb1a15a9c082475d1ad623fbf7c56cac514a956ac79e4030aedbc932e8ea664bb13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571730, "uuid": "2736b1e8-252d-4694-b432-1a776c96c0bc", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571730, "uuid": "422883f5-af8e-446a-88fc-1c60e0e0b52b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571730, "uuid": "d5d59c2d-07fe-4504-ac1e-741d470e6e1c", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571730, "uuid": "7d71c936-c71c-4c56-b924-bf17bb4d4e04", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571730, "uuid": "7bc386a1-026b-43a3-a986-0da62b741745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571730, "uuid": "aa4a6b4f-0082-44a1-a453-5fb8e4f31de8", "value": "3059e30f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6475092-ba43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608528, "uuid": "5d660bbb-62ed-4c83-bf27-0ab271a406f8", "comment": "Malware payload (Dridex)", "value": "04d5534fbd361ed590b34ee24380c667", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608528, "uuid": "71827f5d-749a-421c-8455-02f84301dd44", "comment": "Malware payload (Dridex)", "value": "5da95c3d7ca212fb5843f9c8b91c3f97acc1ced8a81a12533b890769cf363fcd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608528, "uuid": "1ebffdd2-0a0e-4945-a4f7-678e4ddaa2ea", "comment": "Malware payload (Dridex)", "value": "313f76b160029d1c555b29376be59ab02815a955", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608528, "uuid": "46a54fed-702c-4605-9577-852698804b97", "comment": "Malware payload (Dridex)", "value": "a8633284502df6b8899a0727a1a8e0d3d85d70d05d09c4aa49a7b7d3f760c7536023da2cc6cd7eeb4653e41e4722024c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608528, "uuid": "f0814642-8a6a-4e3c-b228-f2cb91cae810", "value": "3AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608528, "uuid": "401b047f-477e-40a0-9424-f8ce8ed6d233", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608528, "uuid": "723e747e-8777-4225-b9f9-dba912dcc962", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608528, "uuid": "ac6bf965-3893-46ff-8228-25c29526ae13", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608528, "uuid": "01a21c08-ccaf-4b3b-9eee-1a1ea2c4372a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608528, "uuid": "bcf3a5d0-e8ce-46c5-b251-7188cceeec13", "value": "04d5534f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f097d9-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609139, "uuid": "149b7ecf-99d1-4d6b-a957-36b2918e0e14", "comment": "Malware payload (Dridex)", "value": "5597eaf0fa53ec1a28fe366081b71741", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609139, "uuid": "d611e1be-5ede-482a-b985-3d3f69ddf491", "comment": "Malware payload (Dridex)", "value": "5dc5158eca02218cf48ba83e4509f62eeac25597be173f20142aab3d308491fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609139, "uuid": "5d7c5a23-c4ab-4a63-81f0-499af23bca37", "comment": "Malware payload (Dridex)", "value": "9d3ab9402b3aeb08e8b385f3bbad43629f192b14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609139, "uuid": "fcab92b9-33a5-4d21-a3a9-af8fbd6524bc", "comment": "Malware payload (Dridex)", "value": "1c6ee58b12d556a3ca0ed61a453d2461e11bff6335306862bc5bfe747fd48423d65f3baa4949e6e6800a6c963b9e030d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609139, "uuid": "6fec5d6b-4516-4aa3-93ac-b57676f605d6", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609139, "uuid": "2f45bc1b-d133-4043-b3c5-a58cd3bb3e0a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609139, "uuid": "231b515a-49f4-4464-ba3b-c29160edcaff", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609139, "uuid": "21aae0df-1048-419e-84f5-9f74fa2ee20b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609139, "uuid": "48b245bc-5c92-4f03-80ec-f442dc806741", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609139, "uuid": "bfa50e96-8f61-4c33-841a-83c4fae2c10b", "value": "5597eaf0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3dfc6c-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572728, "uuid": "554c604f-c4b4-4b91-8e84-97c7aa92033e", "comment": "Malware payload (Dridex)", "value": "224e2db013ee1a82161bbafaad0e81d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572728, "uuid": "288f7b3d-9acb-4463-81ef-8c0ae582738d", "comment": "Malware payload (Dridex)", "value": "5e2243fef33bf56d8a7cd6a5d1319c16542a30cceda3189c33411bfbeaf875ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572728, "uuid": "d0848708-1568-44dd-b2c7-b3c6ffbdc19a", "comment": "Malware payload (Dridex)", "value": "ab464d37c57a83228af4604c8bd8d12a08b98e00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572728, "uuid": "3068a6ea-e972-4828-aa8e-e5545d17215e", "comment": "Malware payload (Dridex)", "value": "89ab32a9f937bb303d8a2d96c11da98f86611b4f1b5e89a1ede21b068fb8812fa1bdb1ba9dd3085208a14406691b47c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572728, "uuid": "f26f3ef2-12e4-48f7-96d5-a46428d68fc5", "value": "0004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572728, "uuid": "07c6aa1a-7101-47b4-922c-6ddad2701af1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572728, "uuid": "26b184e8-aa81-4ee9-aae3-1cdd231033ac", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572728, "uuid": "abff46f5-1f87-41ed-9537-2be645a9038a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572728, "uuid": "00eba64a-3bd5-4e8e-8cc7-d4f03be8dce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572728, "uuid": "67a4dbf6-1aaa-4883-8bd6-962ea4ef7861", "value": "224e2db0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecdd158-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621612407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612407, "uuid": "86511c1a-572a-4994-93fb-5f3ddb155377", "comment": "Malware payload (Formbook)", "value": "f9e718af8187cce9ee82034ae17cee0c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612407, "uuid": "0c1bd311-1182-4919-a746-b662f53f31c7", "comment": "Malware payload (Formbook)", "value": "5e2d9b3536977961e44f32504185c28b766c9a1c0cd01aee0c19591f6f3441a4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612407, "uuid": "7acfc2ff-6fdd-4f77-adf9-1767e19f17cb", "comment": "Malware payload (Formbook)", "value": "1cb343adf7f9e108c82ebba42ceca51a80f7bcbb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612407, "uuid": "241719ef-cf03-4911-a88f-1d5406b45a02", "comment": "Malware payload (Formbook)", "value": "9a5662d9c8bae565db2b520aeda5f6b8f3aad3f0f4417970670307cd480d8728d77439433436553bcf3c58e38cab0972", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612407, "uuid": "6651c035-a385-430d-99d8-982426e28d6e", "value": "B725D13027698214E97D5778083290F123F77D16B714DA5E6DE43D4C7E72A828B23BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612407, "uuid": "c1637200-812f-4977-9fa9-d25e12644a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612407, "uuid": "1366a1b7-a814-43e8-8dd1-3c3d2cf27763", "value": "12288:kUEhi3M7yRaFHI5NoiLwDaigJLYBz5RyT/WbD+oiwoLftbkf9AOZnj0E4pwRE+Ki:vEhicNlooiMDdnRU+H+oTobdyA5Exqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612407, "uuid": "f1c78cfd-293f-4c34-9169-a2817323f525", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612407, "uuid": "3bffa6f9-7f71-4168-9db6-8d81a8437166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612407, "uuid": "1ec768b4-e94e-48d5-bf7e-48cf10f8e1f2", "value": "DHL_AWB NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9977e79-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559195, "uuid": "ed117f47-b486-4539-8090-db1e93b922a0", "comment": "Malware payload (Dridex)", "value": "b50634be30ff7d6456497683a44f5644", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559195, "uuid": "c4a56ae4-741b-49b4-8980-0e9491eee882", "comment": "Malware payload (Dridex)", "value": "5e7bbf757a62788ab8ac25fc742d3098bf832267f1481d5dffb0e85dd8beeb3c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559195, "uuid": "1d3f78e5-f482-4a22-8ca4-4924e8fe9082", "comment": "Malware payload (Dridex)", "value": "feab8af299710058c33f1694ba0a91d3fcc701b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559195, "uuid": "25b77088-fbb6-4506-b161-a0c0ed3efd88", "comment": "Malware payload (Dridex)", "value": "303496fa90dd08a7812917a7176b8abec41346136155122e157d68ebee2a28aba9846ab483dd6901513092957077c7e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559195, "uuid": "30430f6c-6691-4836-817d-baef42c755b4", "value": "7804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559195, "uuid": "33eb6524-bd0c-4e6c-8cb8-4ed04c8e2cb1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559195, "uuid": "d970a7fa-7232-4fbe-8d0a-fec8782602ed", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559195, "uuid": "120b1fd3-68d2-4d08-9d5f-d80d89d0a942", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559195, "uuid": "ab69df55-6ec3-4481-a314-c98d3344e0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559195, "uuid": "377aae26-1de6-43fa-a1bb-675e1c76b764", "value": "b50634be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032bcd90-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558862, "uuid": "58d237c6-7c0a-49fc-b72c-91badff92946", "comment": "Malware payload (Dridex)", "value": "c90ff925ea12297e66ac8b2ebc053a7e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558862, "uuid": "cb1a0a3d-a124-4877-a4cb-bac63513f2c3", "comment": "Malware payload (Dridex)", "value": "5eab40058bbb0989f7aa8f8bfda71329ad4503d0bc232853a23203a9eba0ca0b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558862, "uuid": "70211d6a-be72-4887-ae45-0dc1d472de64", "comment": "Malware payload (Dridex)", "value": "3dd77e6854358c712356114ad86a83291ec616bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558862, "uuid": "561ab9c1-dd80-493d-af6e-9d7a0f171a24", "comment": "Malware payload (Dridex)", "value": "d5e313e4c8982ef2c0dbaceffe64b5c550209630555f0e3c814dea8c4b7f168a8af9abdc53aa2e27b613977de60424dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558862, "uuid": "08fc01f9-c7b0-4830-8bc1-daef549d8734", "value": "3A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558862, "uuid": "54fa0947-81b1-4f03-b83a-7906d4c60b0e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558862, "uuid": "12689259-be53-442b-ac2a-36fed592b2ce", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558862, "uuid": "45466e04-1a47-4933-8b5a-ef8494994665", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558862, "uuid": "b2b7c956-d95a-4572-a53f-cacb4f749727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558862, "uuid": "c19bae2b-872e-4da0-9c8d-e53a51774de2", "value": "c90ff925_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7302508-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609469, "uuid": "ecde4463-e9f0-4ba8-a29a-a09c502749e9", "comment": "Malware payload (Dridex)", "value": "ca6c39c2f6a5df73b43570a4a3763505", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609469, "uuid": "3b1147a2-0482-4575-bafe-7542740aa7c9", "comment": "Malware payload (Dridex)", "value": "5ef02cbf7080b0874eec08a569e1c0e53e2435725b8307a9582decacba6fdfef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609469, "uuid": "c4309332-bfa9-4274-af3a-00e52ec5bdbb", "comment": "Malware payload (Dridex)", "value": "35dee869476ce9f240d0f1efe9afcf17e0f52b0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609469, "uuid": "a9e3d914-f4fb-4738-9794-21adedb1ba01", "comment": "Malware payload (Dridex)", "value": "4048a00c49ed9d8f27e69a6bf359b988f8398767aad303ef97bfd58ba7f38cc6420dd1d9e0acd11674982be045463895", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609469, "uuid": "67d3e377-1b71-45e7-9971-f9710c87d516", "value": "DB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609469, "uuid": "644c3a46-ed41-4fb9-b060-48b3f5ed2236", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609469, "uuid": "4a325998-04fa-4dc0-8b8a-8275d185bb79", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609469, "uuid": "ee9d980f-f847-4708-aeac-62e77dfd8337", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609469, "uuid": "3237cd3f-54db-46fc-ba68-c6a945ba160a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609469, "uuid": "b5488e30-5237-49ab-a0f6-c2feb0442736", "value": "ca6c39c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f03481-b9ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556424, "uuid": "c54b3273-f6c3-49b0-bddd-4b37e0df6ad9", "comment": "Malware payload (Dridex)", "value": "b50cfb36a03386a343d454c1171a7789", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556424, "uuid": "c643432c-61cc-4b1c-99d2-fd7a9128dc6c", "comment": "Malware payload (Dridex)", "value": "5eff472c7e610f7b821a0b8b1fd8cd2c242490e39a4236e4b16f79305e3cc33e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556424, "uuid": "8104ec19-81dc-4fac-b8ce-c7d627608aae", "comment": "Malware payload (Dridex)", "value": "2155803c05bc4cdd5849a2a46fec4d15cf64e606", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556424, "uuid": "8632158f-1e28-4556-b029-946e35e53aef", "comment": "Malware payload (Dridex)", "value": "dbd36747f1df5f68e903c396cabfe0ca7dc96c677042b564b405f8177b529f35771c94e5cc82a774c900a4f287ecb059", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556424, "uuid": "67984d61-d94f-440e-afee-0ecfa4b249e2", "value": "93F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556424, "uuid": "d1b20702-9448-4826-ba79-2cb6273b3033", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556424, "uuid": "aae7ddcd-1557-40cb-89e2-4515caf85ecd", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556424, "uuid": "9d3c34e8-2a83-4ade-a643-5dfee238372e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556424, "uuid": "ced15062-cb69-4c03-9aee-a9beb28e88de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556424, "uuid": "a150587d-42da-4549-8b64-85177b421d9a", "value": "b50cfb36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ffa006-ba48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610649, "uuid": "058f32e7-a310-489a-8cd0-e8cfaa75101a", "comment": "Malware payload (Dridex)", "value": "433d03085f2ff5d355ab2e8d0a3ca20b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610649, "uuid": "4b8d06fe-3c3c-42eb-b2ab-f4c7a1896e12", "comment": "Malware payload (Dridex)", "value": "5f06998cc208768dd4eb9a1526bb9003b86ea577880441a436e23d72ae89db06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610649, "uuid": "3d0a6b98-3b2b-413d-abe8-44849bb0634c", "comment": "Malware payload (Dridex)", "value": "24ce75139f560a1e165bdd59292b5a54cf13894f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610649, "uuid": "83e16f07-974c-4137-99ed-b6f3c85fca77", "comment": "Malware payload (Dridex)", "value": "5e0f8e8e8b2aa177fd78c37649d0466ebc27dadb71d957d85870b30b8fb27c0c2f5cf1b3f2a13bb0bc968494886af0bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610649, "uuid": "c319d710-e190-4388-b153-788313a8c6bd", "value": "7F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610649, "uuid": "2475f8f8-156c-4b80-a8d5-9c4c728b7e9e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610649, "uuid": "19b9f77c-ac79-41b8-ad9f-034609b86d45", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610649, "uuid": "457ac1d3-4f33-4afd-8d64-733c03bc1e4b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610649, "uuid": "395799f6-6b5c-4e3c-b372-d9821186b0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610649, "uuid": "bcde6e1d-1f0b-401d-b375-a3d1264b0522", "value": "433d0308_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bc5a34-ba14-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588426, "uuid": "e5ba2cbb-fc8d-4f72-be76-4d49759d287f", "comment": "Malware payload (Dridex)", "value": "171c0f1143cf2cf3bbd5d61a551e6a8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588426, "uuid": "712e901f-1d30-4e78-a6e4-e3e307a8fd12", "comment": "Malware payload (Dridex)", "value": "5f1ec5a4e43b3caadd2f68025392f719174994d4907c03916334ad73f057de32", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588426, "uuid": "59c10a56-4b68-40e6-874f-8a013e0a432d", "comment": "Malware payload (Dridex)", "value": "761ef6ae5c658895302b208d6e683a7cb19e9248", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588426, "uuid": "ef5b95de-1d28-4a45-89df-8ce0a717bc06", "comment": "Malware payload (Dridex)", "value": "1e1d4166b3b568e1a8af376d0208ab8e00181ce9350912d0dc6edc25b4c802dfb5937c6683f64db7b9402713db4257cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588426, "uuid": "c9027ae6-38cc-422b-835d-a54094b9fdb0", "value": "A404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588426, "uuid": "c8baa419-da9a-4893-ba6b-ee6eb6b8681e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588426, "uuid": "bf5cfe67-20c0-44f2-bcbe-6a271d76c6ec", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588426, "uuid": "af0d9ea5-e8b2-488f-b8e2-fac14c2b1965", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588426, "uuid": "a83498b0-f98e-4a3b-8fca-9d519c1a4c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588426, "uuid": "53ebe120-256e-4eae-a8ba-bd065147efc9", "value": "171c0f11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a5cd7-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584416, "uuid": "48d07f07-4e33-4111-8c34-b7e49f20c1f3", "comment": "Malware payload (Dridex)", "value": "0308d34de7f6ed371795c9ab01f44971", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584416, "uuid": "5848b51b-38bf-49cb-a4b0-4f10b6939b01", "comment": "Malware payload (Dridex)", "value": "5f4422b6e7083ab94aa1806d3280c610cbf2f004a673d55fa18314a02f0e0bee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584416, "uuid": "94871796-80e5-477c-8807-6725f092e868", "comment": "Malware payload (Dridex)", "value": "5c96fd00410b0f3929894d65e18e55cfdb75c44b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584416, "uuid": "5aa63af3-f2b7-439a-a389-b81f088f3961", "comment": "Malware payload (Dridex)", "value": "2ea9d31d3fd63c2feaab576961ef0fe973fd0f5acac6d5fac91532bee39b5c883a21363ab292e23c1b592bad31006641", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584416, "uuid": "523271e9-7464-408b-b776-e856d59e851d", "value": "68F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584416, "uuid": "0bb77b6e-d0d4-4bb0-8903-5ee610b43bf5", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584416, "uuid": "58f4fcd7-aa2c-42dc-b414-45a128a71e4e", "value": "3072:DA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:D3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584416, "uuid": "1697559b-6716-4e27-9067-b05a7278d163", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584416, "uuid": "19aed8bb-ee3c-4cc1-b849-89e566d315a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584416, "uuid": "c7b3446a-e10d-4412-b402-506f4852d5a8", "value": "0308d34d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf87452-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611894, "uuid": "331fdce4-6c24-440d-a57d-0ff5c291c253", "comment": "Malware payload (Dridex)", "value": "75e765ba5bd306e72e331ca26a70fb15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611894, "uuid": "fb87c4dd-6195-4bdd-ae3d-fd7ccf4d3def", "comment": "Malware payload (Dridex)", "value": "5f5b3bee7b25d3354656323aa9e17819e2684e5f7319e402187fc316024785fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611894, "uuid": "4d348cde-4dcc-45ac-8a74-b8540071ecbd", "comment": "Malware payload (Dridex)", "value": "537b80d2d13530761f56c8acc6625fab7df1a40c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611894, "uuid": "c946106f-3cf0-4195-b4a4-abfd92f983dd", "comment": "Malware payload (Dridex)", "value": "5406e6995695c8fd843cee6de63ba286f7fec64435ca960d5f6a7034771e376de4772e4e7fde017a2caf7feb69775cb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611894, "uuid": "cbd30eba-5420-46b1-bd80-25034ad5b365", "value": "84F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611894, "uuid": "0a7f6747-ac2a-445f-843f-a4ff18867568", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611894, "uuid": "c7ba5174-3eae-4f74-adb4-30a267ebc080", "value": "3072:6iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:5eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611894, "uuid": "7ffcd72c-7f17-4390-a9c6-a05ead9c1838", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611894, "uuid": "8c72fb2b-986e-46ff-ad31-df4b1c0b1bef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611894, "uuid": "653e1248-93d3-4fd2-be3e-352697cc02cd", "value": "75e765ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f906c13-ba00-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579606, "uuid": "db56defc-de27-4445-b913-4e4eb15e2c54", "comment": "Malware payload (Dridex)", "value": "84fc56737776f1de8dd7dec588a774aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579606, "uuid": "4f54d4b4-53e6-4dbf-9239-7dde63754846", "comment": "Malware payload (Dridex)", "value": "5f61cfc7eac3e5acbb10bbb273ed60802deebbd6b04d6dbc92cf506066860da3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579606, "uuid": "cd873556-942e-469c-96d5-a622f41490c6", "comment": "Malware payload (Dridex)", "value": "c610883feedca57b75234e844703a3373442e5e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579606, "uuid": "4c042143-d02b-4c76-8685-89864cbe8a37", "comment": "Malware payload (Dridex)", "value": "44c02c7880013b8d860fd8eeea220d2f9941b5f9200484534a47d8212cf73bada46385f56197a4eff6a7bcefdeedeef0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579606, "uuid": "a591658b-d081-40a8-882e-4c187bdc39ee", "value": "CFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579606, "uuid": "2bfe9d46-3ae6-418a-98e5-65cafa47ab37", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579606, "uuid": "5b3e8a65-5934-4c1e-a156-b4f22ca295ee", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579606, "uuid": "fefa73d7-3633-462c-8c15-c09b0995b8ec", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579606, "uuid": "23c7f998-e1d3-4ee4-ac67-eefd850e03c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579606, "uuid": "9a3aac3e-b1df-43a3-ac46-18e28ccb556f", "value": "84fc5673_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25aeed9-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592737, "uuid": "dd5ff6fd-880b-48cc-b465-6300340f43d9", "comment": "Malware payload (AgentTesla)", "value": "00525b56c6371a2c375bf1269d9b30c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592737, "uuid": "285d910b-de50-4ae0-8522-1a5f6daf0fb9", "comment": "Malware payload (AgentTesla)", "value": "5f7886a3c43bf64cb457e226c1ef26d52ce63ffff2eba7dcdb005ea04bc15b8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592737, "uuid": "e2d5a43b-21b6-455c-a0d7-034b095ab467", "comment": "Malware payload (AgentTesla)", "value": "35dff14d53e105700835bbd18061d4a0eba8f3b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592737, "uuid": "f52c31a1-89c2-4975-bde2-319221aa4cea", "comment": "Malware payload (AgentTesla)", "value": "d44592391248d24dd085d69cbd8b7b9ddf30ebaf9d3ab90c74102e72e6cf10050c97121f5594adbfb78eec3161fed4c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592737, "uuid": "8b47ac55-942b-489a-8073-249235c34568", "value": "1B91E872623C0C43EF8385AAAA36FDB301C7F2A556C71ED0729CFAD1175F7111562551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592737, "uuid": "78f05a26-de04-44a6-8ac6-349f13968f0b", "value": "96:3hGg1kDYufi6XqJy+eGyzdpZsJLdLrO3tLvZl+uxHaXTPumWt2oIHDO:5jgb6LdXO9jZltHajP1WtTsDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592737, "uuid": "f5b05c9e-eedb-42cd-a7a1-16b89bc89d36", "value": 4352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592737, "uuid": "cc7a0ddc-5610-485a-b43a-d5b5aaf38a66", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592737, "uuid": "6a9742cb-e7c3-4b55-8c92-27cf63f1d23b", "value": "current price.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4cf324-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1621618522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618522, "uuid": "765f5ad4-e446-4873-8c14-39d8c6d41cd5", "comment": "Malware payload (Amadey)", "value": "2563ee29afcbb1fd11ccd5c4434c4902", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618522, "uuid": "284fbce3-b2c9-483e-a45c-90b0ae15f901", "comment": "Malware payload (Amadey)", "value": "5fa5259f186ea249622f17fa179e8b3c9a9cc5928914a8f1cea5a6665af62460", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618522, "uuid": "41b512f3-9be0-4ce2-be90-b7c745051430", "comment": "Malware payload (Amadey)", "value": "3f2f7840427ec8a358cd9a6d83c5a704af452f35", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618522, "uuid": "1468fe1e-63d3-4988-8355-4538fd83a452", "comment": "Malware payload (Amadey)", "value": "cdada8e27218aeba55a75a69b2824a84b8a9ba99f07f4c39d56a78fe5cdb78bcfa00b9d9a8e4841d0821a081396e2864", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618522, "uuid": "49869f95-008a-4172-bafa-66cc236a120a", "value": "2F74E14FB7A84536E00346712E52ABA4436EF839965ADA07E3816F2D3EF1FC15863317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618522, "uuid": "f2717b0e-8250-444d-9c22-79addfe9625a", "value": "6930eddef69ab61e6824340dff912310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618522, "uuid": "25018018-0f91-4bb4-9cbc-75c8c5f9d1c3", "value": "6144:vh5BZxMkcUsUzLjroA9C+6tRcKusP3xly4D0yioAlnG0LKVOQpxVe2qm9OdQVqnK:vh5BZxMkcUsUzLjr2RtRGsP3xl54lvlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618522, "uuid": "42dd03c2-0326-45a4-b510-87f460f34c5c", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618522, "uuid": "97e96b0b-294b-4b89-850c-52e4bf582678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618522, "uuid": "bade1be1-fad1-4e4c-ad54-9923cd03623d", "value": "3f2f7840427ec8a358cd9a6d83c5a704af452f35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e086743-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556732, "uuid": "f6781f62-8ea8-41c4-9563-20d3d3de4b5b", "comment": "Malware payload (Dridex)", "value": "17fad85b6a205ba910457e82564c6d95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556732, "uuid": "c7201908-9f83-4350-9d96-5280ca209feb", "comment": "Malware payload (Dridex)", "value": "5fcbdb796f4c0b6f38c7dde10c9beb0dead82c1d5423e5249baa215890e7f7e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556732, "uuid": "09fde62f-c5cd-448a-96aa-14e891890b3c", "comment": "Malware payload (Dridex)", "value": "d104cb0c0d57da3faa874bfa3c5dc61e389fed2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556732, "uuid": "9386e0e8-7238-4579-8b89-7ae02e0b86a7", "comment": "Malware payload (Dridex)", "value": "9a5bc104c339cda2fea79af3487e49ae3293a5554e1953f6c0fc472403685f4c8867a81830121dbd4f1a4acc6444e30c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556732, "uuid": "bd76c126-955a-4c44-af81-440528aa6207", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556732, "uuid": "eb3a5cdd-eb4b-4c40-8d30-d9768c7baf78", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556732, "uuid": "354859dc-c861-4f4b-bb8b-b5ebf0f3fe29", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556732, "uuid": "da42270a-d55b-4dca-9c82-f18aa95f71d8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556732, "uuid": "9d07a62f-5dbd-4a53-a7cf-f04f872bf3f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556732, "uuid": "bac43595-603c-47a5-ae41-982ee463fa78", "value": "17fad85b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca742193-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "f25432ce-c073-4580-8b5b-0b1a07819aff", "comment": "Malware payload (Dridex)", "value": "85bd2c408e4005d30cee47d513e2902c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "a4302ade-fb4f-4682-a355-aa3fedf4f3b9", "comment": "Malware payload (Dridex)", "value": "5ff97f5924e46223fb8f8335e91db012501cd94eb9d8643fce2d80f0b7fe1728", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "b269deb4-191f-444a-a9b3-cacef56fae19", "comment": "Malware payload (Dridex)", "value": "d3c0114ea7d8298bf6adbf4993e41001bf254c29", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "ede5cd54-cf27-4f72-a9ff-487e2d204412", "comment": "Malware payload (Dridex)", "value": "2d79b537f11e13336a709f3f340f58527ca7b3d59fe9b70fd047b5bd096ae34b02d42d6fa8256a8a8bdac8f58e51d4f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "16a50ee7-17d4-4fbb-bc4c-7107ce487550", "value": "A8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "ca51eb61-ee2e-4d72-aae2-491d255d2d0d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "74d5d1fe-f7a3-4aa9-9b1d-14aa6c1eb4f5", "value": "3072:Qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562632, "uuid": "b6ae5436-f647-4507-aede-da3ed5b4dd66", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562632, "uuid": "49ffeac5-418b-4a52-a2d3-dd9dda52dd6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "9e762f5a-0a01-4dd8-ae69-4597e2da2d23", "value": "85bd2c40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1a1948-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1621612453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612453, "uuid": "c212a842-d9d2-4327-b800-3e85ab0cbc15", "comment": "Malware payload (BitRAT)", "value": "0d5cc2050d5bb575053f5a68237afaaa", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612453, "uuid": "f560650e-b1a7-4631-9e69-917a586ec442", "comment": "Malware payload (BitRAT)", "value": "604a7c2d1362f5bf1f7258b0e3f7d946f629de3f52155c1ae6b6bf6ba661f95d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612453, "uuid": "c5077fee-35cb-4826-a461-273dfb4b59ef", "comment": "Malware payload (BitRAT)", "value": "e8cddc23d0f1d3640a3bb7c8eba5e496a64b3413", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612453, "uuid": "1c2490f5-9c92-464d-aea5-5994343788c9", "comment": "Malware payload (BitRAT)", "value": "1a18dfd0f32dce8795890ea70c7e4226f7453ca3f4aa27482b255bb87484738a04ef9b04abb3bfabc5954dd9d09cd5b4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612453, "uuid": "65eab986-c894-4c44-9cba-8047879d53dc", "value": "ADF4AF33E1B28877C15715799C075B44A93ABD30291869E13BF93E985E3E7813A1F2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612453, "uuid": "d6c4c565-a83b-4ae9-adf3-0bc4b54a8fbf", "value": "ee65274bc19b4d848f45a22b7523accb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612453, "uuid": "3c811b46-e12f-492e-8a15-b6194ae525b7", "value": "12288:2+9Eot2ZQwPHyDc2sATUbJh0vgpz4KKoz5BW6QINs4:2+2oCPHyQ0TCyvCzXW6s4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612453, "uuid": "eab371c2-c54e-4cce-b0eb-b4b625fd8622", "value": 755344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612453, "uuid": "e5850364-7d05-4d92-a32f-f3f3750544a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612453, "uuid": "3a51dcfa-7354-47e0-b89b-cf9a4dcd5bd3", "value": "DHL_774431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f8fdac-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584448, "uuid": "60ab0814-2cdf-4ada-bb1a-6df24f785505", "comment": "Malware payload (Dridex)", "value": "63ad6129213e24198def875934945925", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584448, "uuid": "fbe3fbcf-9dd9-4e98-b3de-7a2f3ae12741", "comment": "Malware payload (Dridex)", "value": "606b0ca52051f8c5758b8d2a0bf2f20fbba0efab8589ebf3f792660e802cf994", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584448, "uuid": "4b7a85b9-1082-4053-94f2-4d5031ef37c9", "comment": "Malware payload (Dridex)", "value": "7483cb3dd3d722c715f2de5853af70c462f2358d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584448, "uuid": "69c698ec-bb28-4ffd-92c7-9b01d624ba0d", "comment": "Malware payload (Dridex)", "value": "7dbf782f0329bd7a8223c11c970a3216fe3598c16dc26213cf05c9a3f59ef0a14434b912c89abe79e59908af6264de13", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584448, "uuid": "3bfc2ecc-70c4-42d4-8d5b-4d7b060750f1", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584448, "uuid": "aca2b6aa-8c73-4193-b918-63526f548001", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584448, "uuid": "2a18f350-9d4b-4408-8714-4111041b9479", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584448, "uuid": "de501dd6-04f1-4766-bbc8-5cbb77fd7473", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584448, "uuid": "25d7b03a-e0e3-49b3-84c1-de6b6f3b8589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584448, "uuid": "f3518ce0-9bdb-4368-9d20-ee8985aee0a1", "value": "63ad6129_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771ba806-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575377, "uuid": "d10be2db-ea1c-492b-b9e5-e8a65dcff6da", "comment": "Malware payload (Dridex)", "value": "bfc0a98839fdf63da59ba43f3acba5a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575377, "uuid": "38a94921-8b17-4d32-8ef4-54550da90aee", "comment": "Malware payload (Dridex)", "value": "606e424fa9c868f25f2adddbc6f4d24af6e2d559e8f7709790d08114f35e801b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575377, "uuid": "2e6b617f-1a16-4e33-891a-43e6d80e005f", "comment": "Malware payload (Dridex)", "value": "88b5b7e352864e6d575018ddbfbb9555faf13384", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575377, "uuid": "cef0361a-9177-490a-b8f7-3e4ea4c86ad7", "comment": "Malware payload (Dridex)", "value": "f1b9603509f7050f30522f3d62ccb9910ca3cfce975a6b2458db9fba7175e5f571aa3f09e842edcbb7bdf9a36ae8b58a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575377, "uuid": "6468552f-0787-4d1b-a1f9-9785d11d3ea7", "value": "1604BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575377, "uuid": "da604dc5-78cf-464e-a952-395a857df5fe", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575377, "uuid": "53b244d3-7e01-408a-a8f7-e7483b2d345d", "value": "3072:ki49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:kH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575377, "uuid": "642fe8e6-5695-4dd0-9cb2-ec4cb387de63", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575377, "uuid": "0144f20e-ebb7-40d1-817d-19bc07de3d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575377, "uuid": "811ada7d-02de-403a-ac84-0c78fd571e22", "value": "bfc0a988_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08bf7d8-ba41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607739, "uuid": "d9179987-232b-4c21-adf4-8b92ff082082", "comment": "Malware payload (Dridex)", "value": "17867e3691ae375849de75ed9615a787", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607739, "uuid": "9ceed769-47ee-44f3-a73e-e660b4da2224", "comment": "Malware payload (Dridex)", "value": "60e4cda2784ea943dafa5773ffe9e7b4b6b23846403999ef5dc7add14c1ab798", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607739, "uuid": "1881a14d-0964-4b3e-b70d-2b84dd3a1164", "comment": "Malware payload (Dridex)", "value": "8546568c69eb93060ceb42c3eab3ee290c80ec97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607739, "uuid": "0094b17d-6881-466f-93b8-f6c4d4ceb1d4", "comment": "Malware payload (Dridex)", "value": "e3a2f5ad3fc7287859df247a9d1e0747e58947c07c8bc1df30f0bfb4b4d8a82d90bcd45d19e30e430f47d469c2aad6c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607739, "uuid": "e07ff5c0-b14e-4159-9def-c7f8cad4cfbe", "value": "2104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607739, "uuid": "ac6b480f-b0bc-4a2a-a977-9141f3a562b1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607739, "uuid": "1ff82b5b-77da-4846-a970-13428d433cbb", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607739, "uuid": "846485f9-086a-4db9-b882-57ce3ad1d613", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607739, "uuid": "92b2383f-ffe7-43dc-8623-5f2860167a4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607739, "uuid": "e5c80751-1d7e-498c-b279-da534c487bf5", "value": "17867e36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafef9eb-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612428, "uuid": "fb896271-a10d-41d6-b5fe-2890c2023dcb", "comment": "Malware payload (AgentTesla)", "value": "5b118ffab74d800e38b018030862a3dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612428, "uuid": "a7b6a880-6e5e-427f-8629-cae912947973", "comment": "Malware payload (AgentTesla)", "value": "60f30b1169f4aa727c1b5e192556225902f651f0820a0a5212b43ce0fedd7b68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612428, "uuid": "3b57fa50-29c6-4b66-9f1f-b4306684a6f4", "comment": "Malware payload (AgentTesla)", "value": "c6a00b26570d757d7fe14a7ee10d27a78cfa2f0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612428, "uuid": "202eafd1-ee52-43f4-bd21-4db9bb00aa5c", "comment": "Malware payload (AgentTesla)", "value": "1e982ba6a7fee8caa284e099e33458ad82c23763b224b9ab3f4a2ae0ca99683ae41a9903513316341771ad8439ef2cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612428, "uuid": "4397c1a1-902d-4b4b-91e9-911feae08408", "value": "6E35D0302765D255D27D4B340862E5A413F27E66FB14CB1E3DA8328C9F73B528B22B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612428, "uuid": "1e74aa59-8f21-4dba-9778-ac8c7461db5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612428, "uuid": "68585bcd-7c48-485e-a532-bd2a8aa328e3", "value": "24576:O0Ehg9zKvZr7f5fDtm5GMeU8h0qK6RpbvE9I0e5pbBFn7vLe:OUzI7f5JQ2U8h0MeWb3n7vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612428, "uuid": "f2f3f955-4b94-4e99-aaec-a423199fd5fa", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612428, "uuid": "6ce60e1f-19d0-4332-82b7-dc48f453d8de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612428, "uuid": "43171008-b74d-449d-ae68-28e55a86b0b5", "value": "Pedido De Cotacao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f03d455-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612327, "uuid": "3988744d-fcc3-4f30-8dae-5e113c3d7558", "comment": "Malware payload (GuLoader)", "value": "98d399da4704f4c371d1bf592b05de93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612327, "uuid": "a5a6e33e-724b-4d83-a23b-35dad4fc4cd6", "comment": "Malware payload (GuLoader)", "value": "60fb9b3472711c847815b8df184109291146866f24d93c03497836c0adef96a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612327, "uuid": "3d72b628-5b27-47cf-9780-8947eba84ccd", "comment": "Malware payload (GuLoader)", "value": "eec625f3ceb480f115d2647fdefc6498f1b51392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612327, "uuid": "51c336dd-5b0f-4ea2-829d-398daf7eed29", "comment": "Malware payload (GuLoader)", "value": "28061545091061fda4a13dc572c099707be9741799f6c5c0c02a62c42a232beeee79674b0b7a9bde095ac02c9d5caa99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612327, "uuid": "ef9881ec-7c72-4ba2-a4eb-c95a6663e93d", "value": "F134848AB952B469E8C69174F425C61F18E67CB332804E07BF837F67B0340476DE9A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612327, "uuid": "8dbaa7c5-d2a7-439f-a176-14350c0d02b2", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612327, "uuid": "5d75742e-1397-4411-b372-66c4f3e3cb93", "value": "1536:PVJuTEvVbJks33otkYjl8lbfbU4pVBW9c3amYd0U7XDKckLvwwEYwEuo44CrcgHU:T+I4tkYB8HVUuT/VLvwwgEr+mbNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612327, "uuid": "06a02603-106b-488a-adf7-40e131c65f72", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612327, "uuid": "036f7b46-d119-44d6-976b-8cae9abea5a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612327, "uuid": "1a471c42-c909-44c1-a7d1-89adf48c3cbf", "value": "RFQ00106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac35b691-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621578043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578043, "uuid": "cf50f5f9-0392-412b-a4b3-dc8df4148676", "comment": "Malware payload", "value": "bca2d46d1c7ffa8d2087925376a5c885", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578043, "uuid": "329daa37-c959-4ee3-a216-fcc21a3d534d", "comment": "Malware payload", "value": "611b8adc3d2149e6c3635c10e10ea21882ee50486b83f48c6540b24c8ab8ab23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578043, "uuid": "36226dc6-4660-4f06-aabf-912c415db35b", "comment": "Malware payload", "value": "0e36df39970301e6593ed59a46df3b02652fa649", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578043, "uuid": "dab52e75-afe4-4ff2-b453-a6dd1a73612b", "comment": "Malware payload", "value": "c044963cb6da2d32fb9548c1a923d109e12e675fcbb3cf0ef71d40cd12fc41f2a3e13d54e9ad058deb094dc720f4f076", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578043, "uuid": "c4716ff1-be77-403e-88a0-1968e261d38a", "value": "E5F423C7CF0FEF987874C5153BC92A19C02A277FFF43286210A2392656517CB6DA066E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578043, "uuid": "ee7e7cbd-374b-4134-84f6-273efe3116f6", "value": "12288:B5P58sptP7lCWwLTo/FspIXecbq8TykOYGXgWSBklhfqbcfc/i:v5XtPBCWGo/cp+1pGJ6klFqwfCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578043, "uuid": "fc683174-717b-4cf0-a03a-d191509690b4", "value": 723309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578043, "uuid": "38925ed8-440a-454c-a3b6-fe14393b7733", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578043, "uuid": "039e841b-75f5-42e8-9e94-c970d599c5fe", "value": "ORIGINAL SHIPPING DOCUMENT.PDF.r04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3edeb9-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616945, "uuid": "391f8ec8-b3be-4dde-8710-e62a30bb9ed1", "comment": "Malware payload (Dridex)", "value": "b99a6d6cde19a71b845e56f9a0c1ac38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616945, "uuid": "a7249643-eeb9-4112-bee8-8405d2230cd0", "comment": "Malware payload (Dridex)", "value": "61335d99ca6de124ece1d959c07984630603a4da8f5eff3f12f0eee34dd7114b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616945, "uuid": "0c681fd9-1d9a-4648-b9f3-5f3ce1eec7ad", "comment": "Malware payload (Dridex)", "value": "78635661c2cc5af5a7c0c76258b8f667d9cbff53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616945, "uuid": "041def8c-471e-4553-bc17-a0f95acdf0b8", "comment": "Malware payload (Dridex)", "value": "28ae9aaf639f084b93b6164e5fe56fb3d2f244b5748c258332e0d3e1342b4c76b22496b5b4570020c3dbc8d2a0c3348c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616945, "uuid": "fe923027-cad2-4d37-9858-59a6517a9d63", "value": "C504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616945, "uuid": "d1d31df7-d9e1-4025-a649-0e6172999174", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616945, "uuid": "db8e934f-7d03-41cc-a989-83332801dc6f", "value": "3072:VWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:VWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616945, "uuid": "d24e9aa6-dcff-44b1-9c53-82bfb47e7fe4", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616945, "uuid": "649ef7ac-7209-4274-ad42-fd130ba4ac03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616945, "uuid": "0be98bcd-cb47-4de8-9d05-19bec4131192", "value": "b99a6d6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2c6dd8-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562585, "uuid": "36e30157-24f8-4bd3-8663-bbe41e5abe6c", "comment": "Malware payload (Dridex)", "value": "472557109db91e61deaf3cde088efade", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562585, "uuid": "2b8eb61e-9085-4dfa-addd-89bc2afd7dad", "comment": "Malware payload (Dridex)", "value": "6142906e0cc76c1647cbcbbc7056e1d78843569428986294774fa83a88af4f09", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562585, "uuid": "78e67ebf-a24d-4e3a-82a8-5192e27be06e", "comment": "Malware payload (Dridex)", "value": "2fafdb96389abd31ec10f6362f01cddfccb43cd8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562585, "uuid": "90983037-ae91-4b04-821b-43ffe126c06c", "comment": "Malware payload (Dridex)", "value": "4db3ad8c541b7a77ed75f1271797e5bc9cf535940a16c5d7e5b7e010fd2e5eded27c8a2f74e203b7ac04714e88c07998", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562585, "uuid": "323df5c4-b161-445c-8869-24b78cfd8b9a", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562585, "uuid": "04ab3b9c-6e94-48ea-893e-0c49c8a2f55a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562585, "uuid": "1f397f0f-116c-4291-b007-ab49e5353d8f", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562585, "uuid": "2e640567-2d95-4985-8753-e5915271b75c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562585, "uuid": "564019de-faa7-4f5c-9105-4e6159866188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562585, "uuid": "57bf53a7-ce46-4d82-98b1-9c0d110104c2", "value": "47255710_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bec74f8-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569748, "uuid": "aa37597d-5dd2-4610-9b82-e68b5e8ad546", "comment": "Malware payload (Dridex)", "value": "e7254cb99204ec08c7b5bf37bb8477f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569748, "uuid": "423f4bd7-f67a-4c37-820d-3da381af2274", "comment": "Malware payload (Dridex)", "value": "6184b1d877fd27e34554db098c365e75ab5feb2e299d71285bb58054bcc73150", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569748, "uuid": "d8f0f099-56ca-4159-9681-7cc06ba0290b", "comment": "Malware payload (Dridex)", "value": "e2b7b6cbfb1184903a5856482b0d85487cf71b67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569748, "uuid": "25c23d9b-6fa1-4b52-9f79-29b9a7a31d46", "comment": "Malware payload (Dridex)", "value": "ecdc95ebab6a3b09baaf96c45da097c96cbff10862f4d5fe88fb5aaa6c7abcbfffc9097e1ea6a1d38f77c1cde8b1c50e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569748, "uuid": "dffd803b-7c65-4ca4-aac4-f6fec56b3e3e", "value": "5D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569748, "uuid": "9ffae96b-f643-4918-96f3-1f4129c09169", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569748, "uuid": "087821bb-46e1-44b5-95de-870d7536f862", "value": "3072:FV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:FV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569748, "uuid": "321706ba-1e9b-49a4-a629-973f4d8081db", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569748, "uuid": "847f15d2-471a-4362-af1d-4cdb24d4fa9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569748, "uuid": "b9a95a96-5180-46aa-8641-ee6c7ca709a9", "value": "e7254cb9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f000d93e-ba17-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621589753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589753, "uuid": "17da96cb-c4e6-4b95-a1f6-9502be516dc7", "comment": "Malware payload (Dridex)", "value": "c2aea30afcd391ce69c69d13363df42d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589753, "uuid": "12e095e4-c0df-4e21-938b-80da601acfdc", "comment": "Malware payload (Dridex)", "value": "61ac05c3b742dbd90594c1403bbe551fdb511aa6e656c3798f14fc256421014e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589753, "uuid": "8f2dcd1a-ae2f-45a2-b393-c8f464409253", "comment": "Malware payload (Dridex)", "value": "18b55936e62eeaf5b31dea9d7bc4f2903d9e6284", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589753, "uuid": "2f1c880f-b3c7-45d6-9127-d4120702f114", "comment": "Malware payload (Dridex)", "value": "f5ee702ade3598d5c847e341a5d304f8d1334570ba8261eb8a2837272c888278e4949fcc02d41beb440a7b4e17c60624", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589753, "uuid": "cce81c16-64da-431c-81c8-5cff1cb343a9", "value": "AF04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589753, "uuid": "50fd6e52-6564-48a6-bbb4-3e6616889a4b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589753, "uuid": "0b86da4d-77fd-491c-8ea4-ce9af2193ba4", "value": "3072:pV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:pV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589753, "uuid": "f61d4d0d-1fbe-4eef-82b2-12003a1b6e40", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589753, "uuid": "005024f0-77c1-4eb0-a90b-0d2f199a647c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589753, "uuid": "96e8249e-7847-4bb9-bb65-c5552cb85155", "value": "c2aea30a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0533886d-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621612123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612123, "uuid": "dc1c8b33-3968-4163-9e42-2f0a49eb2511", "comment": "Malware payload (SnakeKeylogger)", "value": "6d3857b96339022a3f57042a42048f5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612123, "uuid": "0ea3c0b6-f95b-49e2-b5d7-3b9f190eb299", "comment": "Malware payload (SnakeKeylogger)", "value": "61e4eef02ccb74efdce232896b64df01a02a750894a335a99012eb81093478c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612123, "uuid": "0becfea6-55fc-4b06-bdc6-70d23f344529", "comment": "Malware payload (SnakeKeylogger)", "value": "65e663b92343f5608e8d4bbc38c3af295d5386fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612123, "uuid": "7b8de16c-26bd-4d46-bb0b-397c6926328f", "comment": "Malware payload (SnakeKeylogger)", "value": "d578ed026763187992f82b3ecf4e2bbd9a7570db20977b45b0f66ae979cce731ae1b0d3ace29177f158d2ced51926139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612123, "uuid": "8014682d-ec5b-4cec-bc19-18405dd5477b", "value": "E015E030379A9358D43E5B35083691D563F7B12BBB15CB1E3D98414C4EA3A938722FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612123, "uuid": "9c8d27f7-5bee-486a-bed5-0ac2ea34ca81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612123, "uuid": "d78dd833-6005-471a-ad6e-ea49be31d070", "value": "12288:pEEhnMHKziRHBhc7EKzd7aJIhHuF5JpN5VcWBRcemP9MAFfUhv5xuiP1nXDEC:iEhMqziJBHItu3xwymea9/e5TvhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612123, "uuid": "6b95e1ce-b097-4025-9431-347c804dbb94", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612123, "uuid": "ecad258a-8b4e-4df1-9e8c-f4ebe6edff92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612123, "uuid": "2c9049e0-04f2-407b-8fdc-3176ccea1b4d", "value": "nKWG7SKfE6lDIEk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4f95a9-b9fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578981, "uuid": "6963099d-8634-476e-8402-f54c25b9111a", "comment": "Malware payload (Dridex)", "value": "6d07565ec88a4b8f22919df63a72b1fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578981, "uuid": "f5fc99fb-a8af-4d61-a12a-212a045b3534", "comment": "Malware payload (Dridex)", "value": "6222747b6238d7a108e9fb594afb845a6b6bec230676c1d7c2c6792abf096ceb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578981, "uuid": "23d0698f-fb8d-4476-8a1e-8ba1f400556f", "comment": "Malware payload (Dridex)", "value": "075b7f145a4f26ec908b8d8a79b62f83dd0c99b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578981, "uuid": "dbccf7d7-26f7-4f5b-a51d-6051b38cbf1a", "comment": "Malware payload (Dridex)", "value": "0fa726d075d3d764ec680a035e8107c0d5218192be3bb65050175c340b6d415f46a5d105a681e72ea5ab15a63bb690b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578981, "uuid": "369e5fef-65a8-45a1-9947-face2cdc990f", "value": "3C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578981, "uuid": "d9aa3fb5-bb85-4b61-a1e0-324b965ffa48", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578981, "uuid": "873fb8ae-b22a-4e31-a049-a5f7b726c85d", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578981, "uuid": "7bd56af1-465d-4e3c-8d32-42af5bc9dc22", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578981, "uuid": "c4a3cb8a-7bf2-42a7-9b76-434d61c03319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578981, "uuid": "652ebb42-e90a-46fd-ba3b-b9783c90c02b", "value": "6d07565e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7f5c2-ba1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591391, "uuid": "5cf650c0-9501-4fc0-b28b-f3b5f29ec233", "comment": "Malware payload (Dridex)", "value": "2e0ad01573c45d2aa0d731e9c703d9db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591391, "uuid": "265b396b-2ab2-46ca-a261-b41231ba9d5a", "comment": "Malware payload (Dridex)", "value": "6249d0272167d0c2abdbf789c6cd8429fb1acaacfbbc41a1496ffa15077d5582", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591391, "uuid": "803311d6-02e0-4650-bb61-c575149134f5", "comment": "Malware payload (Dridex)", "value": "14be38cbba82657e974ee5713a1510ca897b1245", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591391, "uuid": "c5509b3b-dcbb-41ec-a904-bffa607689e6", "comment": "Malware payload (Dridex)", "value": "aa64a19ec50f2ee795ff516777b7a8f67b54de9f4961e4e37397587a83311ff3eee5dac27d7bb9e2c43c9591da02a2e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591391, "uuid": "be8c0c55-0a70-4f24-a3a8-3065022407f4", "value": "4FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591391, "uuid": "3a05606d-142c-4fa5-b8c1-3448f1167751", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591391, "uuid": "b634e410-a158-4180-8a56-1d225c0d2232", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591391, "uuid": "46d5a70f-bb9e-4116-adad-4e5076cfbd56", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591391, "uuid": "13a6e49f-1370-47ec-8016-3aae50f0899b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591391, "uuid": "8d9c8357-10ae-4279-81da-685dbbc3a119", "value": "2e0ad015_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35262e87-ba58-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621617357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617357, "uuid": "55a839f8-518e-4999-bfb9-f5a0b3f3385d", "comment": "Malware payload", "value": "85df5f2905a302ae4c1b7637734f4cab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617357, "uuid": "f5b3b36c-6311-4b86-a2dd-146f8a61a7c9", "comment": "Malware payload", "value": "627b337b649892741e0e903c144bf0223f53b4dd40bbe8b7dc8277a5d9ea0e6a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617357, "uuid": "3d9885c5-e32b-4518-b189-b21e6c108fad", "comment": "Malware payload", "value": "b70e5aff6978671e00536a37e9e643e4b59de4bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617357, "uuid": "2d7008a2-6486-4aa6-82a3-b79a4c6e19d8", "comment": "Malware payload", "value": "b3b8254aa1c38607f62739918175cf002855573d2f8e4ad78f11c559c5f6d1899fd5732b6eb1abb85ac7d187610f620e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617357, "uuid": "9407d562-73e4-4c6b-8bcc-74e566cc4fd6", "value": "D00423787CD7F8256B3A1C56B18497F31BF36B2307262D90270F96E872B54675300AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617357, "uuid": "412169df-db67-43e4-8568-7b576ece4862", "value": "3072:a7O/xyMx+jNv8cQS+mHIjBasCFify7x0Xz49T1vgvT10OHPZv:a0yMxYv8cQS+mojBXC061k49yT19vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617357, "uuid": "4a067def-d62a-4e52-98dd-8e77f5360bd7", "value": 176409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617357, "uuid": "d0bb9551-90ff-440c-bba2-d1aba990575f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617357, "uuid": "b2f00309-ef10-46ee-8d04-13ada90b5545", "value": "85df5f29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ada291-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557015, "uuid": "63957a86-22c2-4fa8-b92c-da2c8f358e09", "comment": "Malware payload (Dridex)", "value": "f503fc0f56a2bd2d59f7aab0d1f4bd5e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557015, "uuid": "aa7ada79-5e03-49d1-8cfe-488e6c804356", "comment": "Malware payload (Dridex)", "value": "627b5fa0b6d624aeb76bfea46a4ba9db041617ee9d126ff98ff3dfed0c7b7745", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557015, "uuid": "c8763e1b-467a-41e6-a620-32a39908f457", "comment": "Malware payload (Dridex)", "value": "f43f008191081041348f4d093900ac056b124863", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557015, "uuid": "2892c03d-2235-4ede-97b8-e90621250a98", "comment": "Malware payload (Dridex)", "value": "5a8c0af46622826a8d0783f766ba3fd9d7ad29f6cb3af20f99194c066442b5ab0c4ef2a8b65b4c97b8514506adf73706", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557015, "uuid": "c009518b-38ae-4f9e-839a-c55c853c12cd", "value": "6DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557015, "uuid": "351c01e7-157d-42dc-b544-f3ca52e9dfcc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557015, "uuid": "07ee6a72-1635-456a-b40b-e60ea1662646", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557015, "uuid": "cb43c21e-9bc8-4395-b18d-1dce5f5c045e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557015, "uuid": "0f10ec32-d6a3-421c-90b6-7fb4db6652f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557015, "uuid": "a26d7ae8-4df7-4b28-872a-d4e32717dc2d", "value": "f503fc0f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ef0485-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555863, "uuid": "0a2753cc-2252-4c16-840d-33dd9844db70", "comment": "Malware payload (Dridex)", "value": "a357fffa112ed71ef89670e5171fdf9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555863, "uuid": "bc802f54-c7f0-4755-b593-e3e4d340298d", "comment": "Malware payload (Dridex)", "value": "62b331f002764ed79dbc3cfbb8fa1c3c217d3446354faf974ec617c2d6beb673", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555863, "uuid": "00b73db8-9d63-411d-a2ca-531fc3ae9b69", "comment": "Malware payload (Dridex)", "value": "f49623cc7f9fdf12b99c0902277780b212d5cfb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555863, "uuid": "368b868d-6c6c-49ad-aa0f-20dcfaf67c67", "comment": "Malware payload (Dridex)", "value": "31763a37d920de9e1b26f054e19455258de3e2f56ce3baeb5c631ecdfc2490ef3c2ff4e7f959add24cd1571dca3f0139", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555863, "uuid": "0b02ff42-3039-467b-a77e-40cb223f0d44", "value": "2D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555863, "uuid": "4f5798cf-7bda-4b8d-b6fb-0a7d227c0db5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555863, "uuid": "a2f6b871-beac-4317-93fc-d774a32fe692", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555863, "uuid": "1bbdef09-fb3e-4816-ac47-b3ddc91ae984", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555863, "uuid": "a250d698-fabe-4538-b23c-c8b75058766d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555863, "uuid": "ff798c29-85e6-4d52-89ea-166bd3e2a4d6", "value": "a357fffa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38dc3c4-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616791, "uuid": "74f5cef0-6560-44aa-b2a7-c75df6d68839", "comment": "Malware payload (Dridex)", "value": "1a21c90da9db61e8fe626ad2f31359b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616791, "uuid": "6a2a8aad-7f01-4cf6-98d9-3f9df5975b29", "comment": "Malware payload (Dridex)", "value": "632c7edc2b020f07633f6981badbac5387c1c60f8a72b23c809c85f89878f1bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616791, "uuid": "29c3d4ad-98a3-439c-9a50-303ce3068a3d", "comment": "Malware payload (Dridex)", "value": "b417fc36aec55f383ddbfed660f000b5eb096d40", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616791, "uuid": "b1413ef7-0325-438e-899b-2f50079df2cf", "comment": "Malware payload (Dridex)", "value": "fe8e0ee4f2139dcb39de646b5039b4a7ce556b98c63bb2687b8998bb4c11012ac149e7972115581328200d1540cf8e68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616791, "uuid": "9eb07ba4-90cd-4b10-9e50-a3837fcd5b38", "value": "81F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616791, "uuid": "e8c82f71-22b8-41c3-9c1a-a55cb3268ac8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616791, "uuid": "c95664c2-0eef-475c-8278-3132a6276fc4", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616791, "uuid": "2c9d0f47-bc51-427f-9279-3f6d6e4f5569", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616791, "uuid": "da26c1d2-e1b7-40ae-830c-3ecded90e3fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616791, "uuid": "d0d76e76-68f7-4f4d-a478-3dba8f84c3a1", "value": "1a21c90d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01149e2a-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581192, "uuid": "42550fd0-8ea0-4898-bc96-159af892a1c4", "comment": "Malware payload (Dridex)", "value": "b17e21641d8a6f363f5eeb446f0d0439", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581192, "uuid": "eb238e1d-f863-49c6-9919-dd30f5b19bfa", "comment": "Malware payload (Dridex)", "value": "633d8d8db5d5736b57846e483c4ca700b511bcaa3f74c20804249f8b5f907e7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581192, "uuid": "760f5ca8-1017-4b1b-ada0-9aaab9477a91", "comment": "Malware payload (Dridex)", "value": "757d2ced36ff01a07652472ceacf2663b150ebe4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581192, "uuid": "73311ede-eeb9-490a-98d7-030d8c34ac4b", "comment": "Malware payload (Dridex)", "value": "f30a5bad18f785c16185be7f48bfe9630b7d650fda0ce9591f9f36f8abdb8cac8806868d817d2589ae27ce2daf650487", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581192, "uuid": "5a3c2787-96b7-4bec-84f9-7fd8299df68e", "value": "8704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581192, "uuid": "b4a0b6e0-fee5-4062-9213-9621c665750c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581192, "uuid": "ae68fe8c-79d7-483c-9d69-584a42bfc92b", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581192, "uuid": "cd827eca-555e-4a6c-86a2-8794e0e4994f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581192, "uuid": "b0ba9de5-8f9e-40ca-bf31-942d19f1fe16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581192, "uuid": "4494a4c9-99a8-49f8-9fa4-026d58160201", "value": "b17e2164_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c69c12d-ba35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602337, "uuid": "8b02342d-cfb0-4699-9385-64c2da1006bd", "comment": "Malware payload (Dridex)", "value": "3cb5a61266a48c27cb85fbee979ee38b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602337, "uuid": "51a7aca5-afab-4a91-8d09-30657f1c046f", "comment": "Malware payload (Dridex)", "value": "635a85b4e64c965a5cefa411cf62aea157217c47cee9eb359f2f648b3a9f1d44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602337, "uuid": "c9c0bba7-40d9-409c-a557-62e2bcbe87ea", "comment": "Malware payload (Dridex)", "value": "93c9d48987af88d255f8f6f3990b565095830220", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602337, "uuid": "b9251d0a-3f72-42fa-95b0-a58491a59581", "comment": "Malware payload (Dridex)", "value": "d41112025fde78bf48a04f80673b0d360a8a3f067b6f2df4a5bacebf10fc689cc8534d105a8801633b145ee4b697ceb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602337, "uuid": "168567ee-9c65-4f7d-8c78-2abc04c6c61d", "value": "EB04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602337, "uuid": "ce6fcc9f-680f-45b5-88cd-7165e4484ffb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602337, "uuid": "4b21fd53-6370-4fe0-81e7-dadb0eef2cba", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602337, "uuid": "ceb6670a-238e-469c-ad8c-d026044085c5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602337, "uuid": "e1d0d888-7a56-4cc7-9370-475efe1d5dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602337, "uuid": "443c2f93-331e-4eb4-9811-2ab117565318", "value": "3cb5a612_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5855db9f-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580479, "uuid": "3ee8449b-f1f8-4ed7-90ba-31dcf9af4162", "comment": "Malware payload (Dridex)", "value": "4b77b34455e8ea20d70dee6f9644bee9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580479, "uuid": "264ad9b7-43e4-4aeb-9ab9-1c3976d68b40", "comment": "Malware payload (Dridex)", "value": "6389d77719df1a07f359f6ffc15a6b3ae571cb9e7580837a530308e555f7b6b8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580479, "uuid": "0af89236-4fc6-4aa6-9e5a-00d1d36ff5e5", "comment": "Malware payload (Dridex)", "value": "6ddc9947dbc73be873da58175fe127f2824b7554", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580479, "uuid": "3625d41d-65b4-4d7a-a5e7-65ca160137a9", "comment": "Malware payload (Dridex)", "value": "d7376ee33a006c4be240691be850fbf1b5c67237cc7c08e915ebf6c15d5bead31631288902eda47cd8500092423e47b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580479, "uuid": "23fe18ae-70c6-47ac-bca1-e1a0911b67e7", "value": "6504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580479, "uuid": "97f78685-ab3d-4dc9-99cc-ad60f5e2df82", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580479, "uuid": "8c08efe1-4a37-4df4-985d-f3322d6d2e0a", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580479, "uuid": "ad26f186-8913-4b43-82c2-1aa6b19af3e1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580479, "uuid": "e2d9095b-1d30-4b4f-9916-ea30fe3a9bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580479, "uuid": "6bee600a-594c-4ca6-9cd1-cfd441ff3a4f", "value": "4b77b344_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6c8129-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570875, "uuid": "36ff1ee0-947e-4005-a815-ae929a53db5e", "comment": "Malware payload (Dridex)", "value": "11a8db2d03fb73acbc342160046c66fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570875, "uuid": "3cac0174-a01b-441a-925f-64ad723c7ddf", "comment": "Malware payload (Dridex)", "value": "63a67bfedd15ddb06914c965a42a56e05da352f69279900a4b5d9664f7947e18", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570875, "uuid": "4a30b11c-e091-48d8-bca6-a7dc3233338b", "comment": "Malware payload (Dridex)", "value": "6be462c973fc983b39b3b988d09beb0468061621", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570875, "uuid": "b3198751-8849-4291-be7c-3fe362c8c542", "comment": "Malware payload (Dridex)", "value": "ca7c6c21d113eaff3ca34dacf1ecd238ac988f36e025ae82edf8959d0a95ab22f4aac06e70da29d293fee5b4505beb93", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570875, "uuid": "c1b2aaac-511f-43d9-82ea-3c53925547ec", "value": "2A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570875, "uuid": "02358634-f07e-4c7c-9d85-4d92ed04501a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570875, "uuid": "150a3281-bcae-42c4-b989-33d0e32edbfb", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570875, "uuid": "46fc8a78-99e3-4e9a-b681-2a4482373076", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570875, "uuid": "0a701951-82b4-4754-92a0-e7d692bff300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570875, "uuid": "9badb3d4-793a-4fdd-be6e-e44e97ba73ff", "value": "11a8db2d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4830845d-ba08-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583029, "uuid": "544aae1e-fbbd-44a9-952e-c12e42fd51fb", "comment": "Malware payload (Dridex)", "value": "d4fe278080a3b5813951e65ed33be5c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583029, "uuid": "e5c2e912-48d5-4d83-8809-9d254543baaf", "comment": "Malware payload (Dridex)", "value": "63afea4af682989a12f057a461b3d08fbdea4a9fb007aa2a6cf1adb1f95917ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583029, "uuid": "a2b17295-b12e-4bdd-83d7-3c908e3fb3cd", "comment": "Malware payload (Dridex)", "value": "76c916998aa0424727594275b1687935b8d56d1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583029, "uuid": "6210c7d3-255e-49e4-aa5a-837854ec3151", "comment": "Malware payload (Dridex)", "value": "6776c91e13c3f650c14e0f0602e59a98ff408c56af48a7b0cb2dabb7a88cd939d8f298f297c36f85f8379bac3f0393c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583029, "uuid": "da81fcdf-b5e6-4672-abe7-d5b371d50e13", "value": "9B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583029, "uuid": "55b71dee-b26e-4e71-8bad-e7b2e0489896", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583029, "uuid": "256dcf2d-5d13-429e-8648-4001c2fef008", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583029, "uuid": "e2b1826d-0499-4092-93e7-2031101c525c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583029, "uuid": "cb7297d4-5a9f-4803-978c-47e8a1cad585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583029, "uuid": "cad53215-0364-43c0-bc06-377dcaa68fac", "value": "d4fe2780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acc2b46-b9f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575222, "uuid": "e065174e-abee-448e-a762-f0322bc6b407", "comment": "Malware payload (Dridex)", "value": "3bb779f70ed3d395596ce3ad9bd9fe20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575222, "uuid": "558e60fd-55de-426c-b22e-f15f14455742", "comment": "Malware payload (Dridex)", "value": "63c118f1493f5de9a295d0a2fbe754edbf539fd909abf140d82d5134c2a006ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575222, "uuid": "4683c1b5-497c-41e6-afe2-a98a1f46a705", "comment": "Malware payload (Dridex)", "value": "615609fa04429bac696751bb74e8b21f22f580ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575222, "uuid": "dbd65472-2c73-4488-96ff-568cc5aa729c", "comment": "Malware payload (Dridex)", "value": "9a76ab8fe0f301bb48ecd47ad4eebbdfba471ed0e2fc909894eeecfe05f3d2e144f59ab7b9ee10bf779aa4ec80753aa3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575222, "uuid": "9a8af643-2581-440a-b7e8-edf046c2f2f7", "value": "F704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575222, "uuid": "db523668-917f-48fc-a942-8dddab5d0b4d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575222, "uuid": "75956d55-3e31-4439-bed0-57e4087241c0", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575222, "uuid": "56158ba9-c293-4c27-87a7-6416e98444a6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575222, "uuid": "c4653e47-d824-4723-83b5-7bb1d46781ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575222, "uuid": "1859d979-ec94-431d-91c8-eee54d259ea6", "value": "3bb779f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b8711b-ba2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599537, "uuid": "e98e3600-9619-4349-91a6-ea13ddded974", "comment": "Malware payload (Dridex)", "value": "5933b4a06531cd0c01d59fefd478e7f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599537, "uuid": "3d3bcf21-67f5-4c6a-8fdc-8c0fe602c20a", "comment": "Malware payload (Dridex)", "value": "63d2502ed72cfe78b18f79f8d62848931ce15242c4bb38ce7779ce0cb59207b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599537, "uuid": "ec088276-6770-4251-b23a-a780237beeff", "comment": "Malware payload (Dridex)", "value": "1424466b2dea811539a39e2939283298d91881e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599537, "uuid": "734b107b-2aff-409c-9d55-59b6a426ca65", "comment": "Malware payload (Dridex)", "value": "7db8fbf8460e701d578d3028a628203573739f13f468dd4293ede33198db4f7baf19dbddd2c156287e2e965c165b454a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599537, "uuid": "0272e431-b2cf-49e0-b7fa-9d7b81404e22", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599537, "uuid": "abee44cb-4ce8-42bd-a807-cd11ab9cd15c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599537, "uuid": "af900049-ab75-4500-baf2-3e5bf28db0e8", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599537, "uuid": "863b7b57-df30-437d-9a35-5031d0a9e28b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599537, "uuid": "010e5219-3c53-4e17-8945-c8b686089cb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599537, "uuid": "0b448047-6e5e-4ff1-95fe-5a8d30d12f0e", "value": "5933b4a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdb1375-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621578311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578311, "uuid": "92cc79c2-ef5f-42d9-a237-4fab0178ba8d", "comment": "Malware payload (AgentTesla)", "value": "5c6385eb66b1af6192389d6d6392c459", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578311, "uuid": "dfd5de9d-cde6-49f4-be89-84e4f9188231", "comment": "Malware payload (AgentTesla)", "value": "63ddba90ee6655292c831608df2b5b8fd1035566d2c43b95ce37aac8ddd873c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578311, "uuid": "d8a4eb61-9639-4a6d-9699-587df1bf0414", "comment": "Malware payload (AgentTesla)", "value": "cc90fc027d31567eca1780540789a20078db9d7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578311, "uuid": "2b081414-d126-44aa-866b-33dfb7464e71", "comment": "Malware payload (AgentTesla)", "value": "4ec7f4ba39131bd23ae36f4d386b41f891e033e86e3a86331a6c2bdd942f786bf9120e039ee2b35c6cfd8ea265095bde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578311, "uuid": "881f0a0b-f860-4e7e-b5f2-b6af0f8f2bc9", "value": "66811A1485B809F1CF062E1E9675FC35C5D7B3066DDB55CA70EDA64503F7724B621E01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578311, "uuid": "986e9e24-94bc-449c-a3ae-c627e69c494f", "value": "96:OkYgUyxdj/6JBn7N1sqgHQcGqkPQ303ulPxrW7:OuUyrj/S7NS1HWfeZ5W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578311, "uuid": "8b011c8f-d158-41f9-83cd-06e55659592d", "value": 3995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578311, "uuid": "c330cbd0-2474-4c29-9661-bf3ef86e94b7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578311, "uuid": "4a472412-184b-49ea-acdf-f4b81e3071be", "value": "ORDER CONFIRMATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7c7038-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612321, "uuid": "157ab706-ecc4-43cd-bdb1-77ccf2656885", "comment": "Malware payload (GuLoader)", "value": "a0d1e3f852f6e6ffa10f180ce772d74f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612321, "uuid": "29ed8fd8-d0f2-42e6-813f-c6acfe3f2b0f", "comment": "Malware payload (GuLoader)", "value": "6407ccfb541f544c29296abdfb990a57131ea45e45e1ae2a0d947b6fe62d49e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612321, "uuid": "4e284fea-c072-4237-8c63-1a4138b46de5", "comment": "Malware payload (GuLoader)", "value": "b59622aaa81aa32ce8d8a05378eb9fa7c79ea3e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612321, "uuid": "7f63ca4c-1a47-4c26-b9c1-bf3aaeb83bc3", "comment": "Malware payload (GuLoader)", "value": "c80df79a478b2df6f2a1967b4afc1ca94b66a710f817b01987bce36d1feee5b8e2956b75712ef1b507dafac8f5c74810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612321, "uuid": "d1644ab6-2db4-4736-8765-87f05896bfde", "value": "95347286B552E0B9E98591B4F426C21F18E53C7372814E07BFC32F6BB0301576EF9A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612321, "uuid": "65c130f1-a297-4445-9588-9dde2e6a8f8c", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612321, "uuid": "57a64203-b307-4bdc-9b13-ec6bd250d86e", "value": "3072:G+IWbYIbAGmuFfWtyOHIf2/k6vrYpTzN89NX:GCbAwfWtyOc2xzqN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612321, "uuid": "09a92e95-ada2-4c53-9fae-aa23a86f811d", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612321, "uuid": "576e6f9a-e27c-41ae-a932-c632155e3872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612321, "uuid": "e81f7816-220a-4b52-b991-8173a6f87b49", "value": "PO-210521.109303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbe294a-ba1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621591280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591280, "uuid": "cd310eef-d06c-4123-8788-6bb044b9001b", "comment": "Malware payload (Formbook)", "value": "a449cc1217825d248a10080e9af584a5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591280, "uuid": "fa027892-4207-49d5-be99-2ab5dd670f8d", "comment": "Malware payload (Formbook)", "value": "6421a877340afab7934556dfd4d8ce52f187df24aa621242e65f3ea14f07c541", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591280, "uuid": "83c9db01-bed4-4124-8065-371d1c97aeda", "comment": "Malware payload (Formbook)", "value": "9d577daacea5ed0dbe3bc5e27c165c562db83d0c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591280, "uuid": "27a08ff6-faa6-4a1c-9b1a-ec289c6cfba1", "comment": "Malware payload (Formbook)", "value": "a3d9e4c0fa21a289a00f28867a81001b9f2afe201140a5aa4b9afaecc50d7d926ac56e8d0560b59c07038fedfbe4a444", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591280, "uuid": "0f44a1ee-4c2f-4b07-a16b-b27fd4944f25", "value": "2A440165F8C485D2F84726B34AA3EF92A2F26F1C95BC4563F7F27D2B62320C64548D48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591280, "uuid": "137009b6-1a2f-46f3-8bac-a4165fb72534", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591280, "uuid": "c96d817f-47ca-4b3a-9900-4b32d311460e", "value": "6144:WsdW7qKqm7suDccFcvmHyjVd7g8AGfGR96m1XGPbht:r0q+sugpmSgRsH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591280, "uuid": "7467b50c-8bda-438c-896b-11fb55b8d604", "value": 253470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591280, "uuid": "222dee5e-165d-480e-a9ce-149430c41720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591280, "uuid": "c091ead1-5519-4c50-bfae-a6bd341f5e5a", "value": "a449cc12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268e52a3-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559351, "uuid": "82e63592-f40c-4ca2-9135-2424c95840c5", "comment": "Malware payload (Dridex)", "value": "70ca790fa795954064bc802292e4ff94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559351, "uuid": "8ed09f5f-9b22-4c6f-bc6b-8a082cf96317", "comment": "Malware payload (Dridex)", "value": "64cdc27cde6f8cbc095dca99f3ab0a937a6add2da1b5480c042e85b4619a8ff9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559351, "uuid": "8da7b405-fa69-4c50-9bef-7516f0fe2b61", "comment": "Malware payload (Dridex)", "value": "342e6f9fe5cfa4967471029398282301140e2934", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559351, "uuid": "0de61c56-6e2d-4830-a3ce-80994d6c1d85", "comment": "Malware payload (Dridex)", "value": "0ee7110ce5c52038be2276446cd1301fb47ed4bfcaad6e1950d2948c597f6d47170e3199879a716cab190d477b58f0cb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559351, "uuid": "2d72b6d4-eb69-477a-9c15-20e7c6593db5", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559351, "uuid": "6c93fe78-ab19-47ea-bad8-fec50f61e0fb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559351, "uuid": "9b5860e2-f273-4440-8943-253fedbecab4", "value": "3072:NV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:NV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559351, "uuid": "fbfd2b53-950d-42e0-a8a0-72b4659483ea", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559351, "uuid": "897d3051-54bd-4fd0-a3a1-bb8469b2dbe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559351, "uuid": "2e434e54-6e40-4bd4-b39b-35431d786303", "value": "70ca790f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec87028-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563230, "uuid": "8bbc5b68-bda6-4d32-8160-4b8c007d8b62", "comment": "Malware payload (Dridex)", "value": "5baa28ce127b5a71f7c5fc267dc374b3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563230, "uuid": "82b8cfbf-08ff-471a-acd7-ca62d524c677", "comment": "Malware payload (Dridex)", "value": "64d29c64beed5acee87ec4c204e909cea77d8214de1231b7958530627364a40f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563230, "uuid": "75a0e6fa-feb0-4d51-96e1-75558acfa735", "comment": "Malware payload (Dridex)", "value": "11000486d109f838ccb8c386e6a5646193fa8ee0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563230, "uuid": "f7665101-acf9-4452-a254-d476148ac148", "comment": "Malware payload (Dridex)", "value": "89260a8f43987fbccc9e46b2f54d242384858f02558ed48099aafecd9b21b842952e5b93097cc5e6c969c4eb31d370bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563230, "uuid": "854dfd0a-e0db-4533-889d-7bbcc622bc33", "value": "66F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563230, "uuid": "4b436298-6ee9-453f-adac-b4caad3c9edf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563230, "uuid": "94be068f-2fbf-475c-a856-829464992d21", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563230, "uuid": "822dcc5a-6832-4523-a922-2cf8a7f8781d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563230, "uuid": "56778fca-f7bb-4a89-9ab3-287db4fe5c5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563230, "uuid": "fb5d9755-9dd7-465b-adeb-abcb79c91d4c", "value": "5baa28ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb32668-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581646, "uuid": "a8392595-9f97-4f49-967a-75a55405dfca", "comment": "Malware payload (Dridex)", "value": "3f39f05801b0917d5ba02e06c88cda4e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581646, "uuid": "5d40f743-8e04-46e9-ab45-744f05afa640", "comment": "Malware payload (Dridex)", "value": "6516992c86f2d21c038ef356d8adf64614b072a87105377954686ff4ca7c438d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581646, "uuid": "f615b975-7d58-4dbd-bb7c-5cfbd1414c0e", "comment": "Malware payload (Dridex)", "value": "08d064a8de293011183cfcbedad0df1a51d2db94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581646, "uuid": "84e0eb3d-e38f-4cdb-884b-9cfb485b01f0", "comment": "Malware payload (Dridex)", "value": "c645f12b35423bd0502da21d92ed4592c24f72798cf47214d6824c8d7f46fad5e073e85c207f6d99c378a475a1ebcb2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581646, "uuid": "7c533603-563a-4257-85bd-dcde30614075", "value": "0B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581646, "uuid": "dfabaea2-f969-4b67-badc-329951a33908", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581646, "uuid": "67ec08a3-af76-43ca-8345-1ae9a969c2ab", "value": "3072:BV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:BV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581646, "uuid": "4cafef90-ae64-491c-ba14-e57c280572ac", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581646, "uuid": "6af8ef13-bbee-41ca-b239-10dbd92afbde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581646, "uuid": "b8bcd9aa-6ae1-4908-a7fb-921a89ea65e0", "value": "3f39f058_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c015921-b9fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578741, "uuid": "35ccaac9-5ee1-4c5a-be2e-0c73aacf1804", "comment": "Malware payload (Dridex)", "value": "4c701fa3996cfa828cff34726c3d9518", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578741, "uuid": "b7de2058-46f3-495b-b090-cccf9d222b6f", "comment": "Malware payload (Dridex)", "value": "65a114f9ccf808b0a319c301cfbffc1da11fef8043a42eb4155ab22664555604", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578741, "uuid": "80f7746f-3222-4283-90fa-39c8b92367c8", "comment": "Malware payload (Dridex)", "value": "4586cc5195bbd86e62abd8e4392ab41155a50741", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578741, "uuid": "4ef6bbf7-e5a4-48a0-9fb5-192721df0e72", "comment": "Malware payload (Dridex)", "value": "667510a508f349a3e11301f5b96fa42bd9737b6d2bc300bfada8a15dcc73925e344ad73c2f8e4c488cf7507bdfad9aba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578741, "uuid": "da469ef5-6eab-4b67-923f-55f56ceea31c", "value": "7904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578741, "uuid": "9a898c27-c50e-4d77-9466-2ec64c044a72", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578741, "uuid": "95a45a94-6cd5-4a2e-86ab-401c7d5366f9", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578741, "uuid": "bb70b53b-3947-4546-b9bf-9d4d9fdca53d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578741, "uuid": "968de97d-abad-4230-ac4a-1a4f9bfd5967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578741, "uuid": "c4118101-4feb-44b7-a74d-42858092dd02", "value": "4c701fa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d751ac-ba1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591419, "uuid": "a689f7bc-a729-4c50-92bc-c6d481ba89f8", "comment": "Malware payload (Dridex)", "value": "45fa4e93d18a7c9c8b35870c062fcdfc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591419, "uuid": "fb5aedc8-3bd2-4d09-be2b-bbcc4f5d8abb", "comment": "Malware payload (Dridex)", "value": "65a7f7d8bb478d65357e8a5ada334891a11e41ab1daeaff7ac1c8104553b7720", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591419, "uuid": "d5ece7b7-5920-4e5c-9e9e-7431d1d8f30a", "comment": "Malware payload (Dridex)", "value": "d43115c83f8b461d450c6c2c57abd31672912210", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591419, "uuid": "c8aca924-eb95-4488-a16c-39e4a1845efb", "comment": "Malware payload (Dridex)", "value": "44afc46ec28beab21c4fd6aac872ccbed995c6b8e8f23aaa237f406e321592a58d45bea64c97560d561aa02a6837c1f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591419, "uuid": "82edf97c-8996-42cf-bc5b-3bc04af6f397", "value": "3004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591419, "uuid": "311bb8ba-21dd-4fa2-b003-eaedf0c206a8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591419, "uuid": "5cc39a13-0be9-448e-875a-e8ec470c8327", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591419, "uuid": "a1a17d6b-338a-43a9-a8f7-233df20924ad", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591419, "uuid": "cd0b4521-1379-4084-98c1-5431333a15d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591419, "uuid": "eccada7c-faf6-49aa-b724-391abc8eceb4", "value": "45fa4e93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa79fe2-ba15-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588733, "uuid": "7157e5b4-c764-42fd-b203-b381c2d67ce0", "comment": "Malware payload (Dridex)", "value": "ce79f79ab6d807677af768c7db1e56c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588733, "uuid": "7e87cf3f-cc73-4acc-aefb-a100686fa098", "comment": "Malware payload (Dridex)", "value": "65d368f399e0cc262c317c0037fac678cc99a020254111197dc7fdc72d470d98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588733, "uuid": "91f1584d-cf60-440a-b685-a78e04dac0f1", "comment": "Malware payload (Dridex)", "value": "c85567fb8b85e95977d8b4d6c07abc3b37dbf723", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588733, "uuid": "55deec98-d805-49ef-8683-f18337aacfb8", "comment": "Malware payload (Dridex)", "value": "2816b8ff0c7b45034a0d3f05a04295a32259d1608cb620cba53c55243208c8dd94afbea9c5d4288caf1d30513078fc53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588733, "uuid": "d6b1f962-5e5b-4b90-b40a-733afa36748e", "value": "3704BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588733, "uuid": "f5fd2972-1536-43db-a753-bd42b3e82be3", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588733, "uuid": "eff807f0-727a-42ac-b9c0-3c5601245f80", "value": "3072:ri49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:rH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588733, "uuid": "36ae5aec-aa8e-4ee6-b80b-1ba192f5104b", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588733, "uuid": "aa66ff87-d8ff-40c3-a9e5-b653d1cd7c71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588733, "uuid": "083f2bfc-58dd-4ca7-9e01-1a34580434e8", "value": "ce79f79a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc8dbbf-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563312, "uuid": "c1612e13-f5bf-4d04-97c3-a9e3f3b95866", "comment": "Malware payload (Dridex)", "value": "db3feeb3e4c3ed2d4c714d016fc8b003", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563312, "uuid": "c13b0774-d761-43fd-a1bd-f7813347a72a", "comment": "Malware payload (Dridex)", "value": "662db50f41a82d948f6b054f9162ff8428c5ae90b4d4c72f620fd0fe9909dce2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563312, "uuid": "7c2e5bfe-1d76-405f-929c-211281b40be0", "comment": "Malware payload (Dridex)", "value": "ce842765929f01ed9c0e65139e06f936f33622bb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563312, "uuid": "384a9fd0-36f8-48e2-9d98-96327c99ba54", "comment": "Malware payload (Dridex)", "value": "4360be57b01d9bca69c1201d8ac04b824292f0a1d940d736b484fe184d21d3921665f270a75d6f5bb00bc34800e341ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563312, "uuid": "99721e4d-499c-4673-8873-29112c016b0f", "value": "36F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563312, "uuid": "f5419933-b65a-4840-b3b1-251b14341257", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563312, "uuid": "a1443f99-c15f-475a-ab17-2f5b43db2508", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563312, "uuid": "52b1664d-4d95-44a2-9b48-4bdde5a4428f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563312, "uuid": "73d6c851-99c7-46de-b453-bbe9aaab447e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563312, "uuid": "b5618fa9-8234-4345-b856-dba33f5ef468", "value": "db3feeb3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d179df-ba41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607510, "uuid": "746a93ec-16e1-47b0-9af1-0f37e692143b", "comment": "Malware payload (Dridex)", "value": "374938c32761273417f189da07420540", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607510, "uuid": "cb6823b8-d9af-4acc-b609-4dc51ca89dc6", "comment": "Malware payload (Dridex)", "value": "665e4f8dcfbd62d5f957b6892f0b0c1a05b1967f9c8c12bd540ed9f9812897a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607510, "uuid": "d08cda09-d0b7-4210-9bf8-13a17aab76bf", "comment": "Malware payload (Dridex)", "value": "53928a67b06d6685cfe974c423151d58c2be2295", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607510, "uuid": "d70be34f-aa63-4e6b-9987-d39f0b5c3080", "comment": "Malware payload (Dridex)", "value": "924526de5c7eb729d86ef8a2c252f74798eb9834d261cafdc2c755142709c1da2b3153f49021c2074baabf59b9dab2d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607510, "uuid": "48e56c10-c86f-4602-93c7-1c7fb7f004af", "value": "5C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607510, "uuid": "f34b9e96-d313-409f-85fb-cf426beeb4b4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607510, "uuid": "4ed86c2c-3267-4a88-b123-4f925f246919", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607510, "uuid": "3d734e3e-0305-43ac-acb5-8b8aeffb8599", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607510, "uuid": "69b6f565-90f8-4207-acc2-a908a8ecede1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607510, "uuid": "ed762b6e-6c9f-4791-8255-445ed5930720", "value": "374938c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faa2d0f-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569754, "uuid": "a32017b1-f83d-4d67-92ef-1815a34e7beb", "comment": "Malware payload (Dridex)", "value": "a969341d9af9e575facdf4454b7d11d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569754, "uuid": "1cecd0eb-3c84-4332-b7a3-56808a140b1a", "comment": "Malware payload (Dridex)", "value": "665e5a0a375a663b667ac0e206ac9f136910216f54446806169e41af89bd6e81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569754, "uuid": "edbb817d-5490-4e54-83a4-8d8f83a1f1c1", "comment": "Malware payload (Dridex)", "value": "b79df33cbf5375aecfd86db28ec2e07582b63fa7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569754, "uuid": "86fcd755-f149-45bc-8454-2367e91c00f3", "comment": "Malware payload (Dridex)", "value": "974367c3998038e7c0977599deca7ced2292ec494866bdb7da1c76b63f60a81bc15d5cf24fbaca91ee1ebaaf5723b7b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569754, "uuid": "4cd85d12-a8fc-4e46-a92b-76c9ef4dda04", "value": "8304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569754, "uuid": "fbb22dc0-8cf2-4fcb-ab71-59d941cd7a08", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569754, "uuid": "01c4548c-be78-4995-bef5-dd3f7e3eefbe", "value": "3072:HV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:HV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569754, "uuid": "08d22ed5-1403-4622-bf92-f37638c76904", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569754, "uuid": "b70dbfed-5ebf-48ed-97c5-0c8fc189fd92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569754, "uuid": "36aee96d-6336-44b9-bc01-c9080f17d78f", "value": "a969341d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76011257-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621617036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617036, "uuid": "21c4cc40-3285-4e85-8e0c-0d42836c6e84", "comment": "Malware payload", "value": "0939f8138107261a5abc7911a138221e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617036, "uuid": "52dda446-41eb-4a34-8b9a-dce0a9bf703e", "comment": "Malware payload", "value": "6685082490baa1ef2fcdb2d73db0acaf8dae804d8a97e96b73ad47a669bfa4dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617036, "uuid": "743c6df8-3f1a-4c29-b839-6b91aa8bb803", "comment": "Malware payload", "value": "f4dde2f239c458296a635d759ba723c176881eda", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617036, "uuid": "c19a832e-6fe1-41f4-8328-2361f6268793", "comment": "Malware payload", "value": "fc756f99f2500ddbb8c4b26e25b9c2c2037db3c859a9e5b1b9b435043e2c9793cef5d0af76e3e6f4d66c3eb36517a8ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617036, "uuid": "cad4153d-6cfc-4562-8abe-a8f147d1433e", "value": "C4D2D03F21B4E94DD652903FE48C96EABD89A8940C73F0AD088ED9EC57157E38ADD170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617036, "uuid": "6a6361ee-acc5-4573-bc71-279c23f3750f", "value": "768:bgCKzhgKkl5IPyWoZHLnXdeLn3J9Nt1925M:jqgKUMuzXE59bWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617036, "uuid": "474ed727-58c1-4c8c-903f-593e33a83f2a", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617036, "uuid": "4db97e1c-d8ad-4ce8-a0b4-e94d628e767b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617036, "uuid": "53b021c8-7b33-475b-8cf0-7599d200e4f7", "value": "0939f813_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fba731d-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581727, "uuid": "98c4a78f-55e0-48af-ba0d-a2cab84e7bd5", "comment": "Malware payload (Dridex)", "value": "411939e5328ff8943e3db1de203e11d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581727, "uuid": "bdc14ce2-8e1f-4d76-b9f0-a2fe5a7af61c", "comment": "Malware payload (Dridex)", "value": "668d4e4b6b49ef5cb06fb7d60d1add1cb17350e7c082a39a52145d52a07adc58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581727, "uuid": "bc40937f-c94b-4f36-bd07-5e8a682ce717", "comment": "Malware payload (Dridex)", "value": "5d03282d2e903c042473e38fa27a6b9b7b8fb134", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581727, "uuid": "905b2018-d3d0-42ed-a855-673ea4cf3a15", "comment": "Malware payload (Dridex)", "value": "b29c23303e9cc3e4a61f1512b95587c9b003a1f993a491a3cf354a6a61400d457b67e374591f7ec570322be7c2569082", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581727, "uuid": "db406be7-22b7-4756-92a6-51a2351ca20b", "value": "E004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581727, "uuid": "2ea10b31-aee6-4689-8ed0-4c5b0ac95f25", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581727, "uuid": "609d8193-6fe0-418e-8319-1203d15e2b3f", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581727, "uuid": "d55e0661-b20c-4a81-9854-d6746a6e4a2e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581727, "uuid": "2af86116-91e1-46c3-bc1c-d8218a767adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581727, "uuid": "c9b3a07e-11c4-44a9-87ec-7522541991cf", "value": "411939e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d1f792-ba78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631421, "uuid": "be1e0aa2-1c10-4bc2-90b6-f2a5724efbf6", "comment": "Malware payload (Dridex)", "value": "0de4eb650842ea97103d6f8ac82c8eb9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631421, "uuid": "bbcc2cb2-c5e6-480a-a414-ef637acbb59e", "comment": "Malware payload (Dridex)", "value": "6791a129d692c8c4d6e67b75f6ac88dbd78144ba6dccb96a8f029797a9137b97", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631421, "uuid": "a72e39ef-c358-4a6e-8eab-0ac4d20a0a71", "comment": "Malware payload (Dridex)", "value": "a10b1d9b771e13abb1f32381c78f980c724303c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631421, "uuid": "bd2d25e1-6e62-42d6-9a4e-557bbfb6ea6a", "comment": "Malware payload (Dridex)", "value": "101fed699ab243107b3786a1508389ecc9f09c680786e3cd57f705fe546ffebb4156824a6e955eeaa76fd3b44fb9b029", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631421, "uuid": "91a7eefd-9d68-4a05-8234-ed1234201e70", "value": "1B04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631421, "uuid": "6cdb2626-3ec9-4fe0-8a19-c23cf6ed61f7", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631421, "uuid": "32cc9ef4-2d85-4569-a833-88be424d05cb", "value": "3072:CWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:CWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631421, "uuid": "258fa3ee-f3f1-444e-804f-1775d510bdaf", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631421, "uuid": "210df6de-e573-49ab-9f6a-64fb5f36f0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631421, "uuid": "4a3af4fa-18cd-431d-8f6a-712077cacb6c", "value": "0de4eb65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a6ad59-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584480, "uuid": "7ac10e36-f5db-4ff9-b31b-96a595150290", "comment": "Malware payload (Dridex)", "value": "881ae0e47aed755b8eb5b2ad13dabb83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584480, "uuid": "55e2dddb-62a2-4e62-a71b-c3f3b963a366", "comment": "Malware payload (Dridex)", "value": "67fe40f6ad78515eaf94bb9d3f076b6fd4d66af943430e794145ec2fcd0253ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584480, "uuid": "e493d602-0415-474c-b29d-014caf1947c4", "comment": "Malware payload (Dridex)", "value": "4b0db75b92b4cf25f8ff3d6d3c094a8b29b39059", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584480, "uuid": "bc9547f5-3f0c-4319-becd-cd8801540ead", "comment": "Malware payload (Dridex)", "value": "96256b19ae27ffaf4588df6e588691d8426e889f75da4c10e7bc945a07e2a980964b13b2bc227f8c29cb723e36f8376b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584480, "uuid": "aa39b4e8-a193-44d1-8808-0f6aab927450", "value": "2604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584480, "uuid": "b186d5cf-f882-43e6-872e-2124f980fad2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584480, "uuid": "7f1d9d0f-37c0-4cfe-8527-8d1f59416671", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584480, "uuid": "8daea52f-a537-4940-a087-0bf64926e3a2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584480, "uuid": "a9b2ae99-8b15-404e-8c02-d5518a5c9b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584480, "uuid": "5afeac47-e6ba-4201-b15a-1c69e831291b", "value": "881ae0e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e199ec10-ba42-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608198, "uuid": "e3037b90-bb2d-4ac9-942e-916474e2dbb0", "comment": "Malware payload (Dridex)", "value": "9d0ebc7d951199a2d0aa0a6569638729", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608198, "uuid": "f39f0687-4765-4e12-8526-86720cec4d76", "comment": "Malware payload (Dridex)", "value": "680e56c2996abc7480f1cd2cb187e48bf1fa6098c261502064fc065823fc9ad0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608198, "uuid": "5d010eed-3bfa-417b-8cac-d874c2899a4f", "comment": "Malware payload (Dridex)", "value": "c17830e36e16d52458e2cb9042d22bcb732469e7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608198, "uuid": "64557104-6530-47c4-8983-baf964d93c3e", "comment": "Malware payload (Dridex)", "value": "a0f7537dc5a7ac68c240dd7cfe716559be6872f354db65414f515867e6df0c14e3daae7583ec512a2f7135718859987a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608198, "uuid": "55282001-74d9-4443-9f68-ad6b2a421efe", "value": "8604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608198, "uuid": "919b55a3-09f8-47c4-bf06-5b466b6f35ea", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608198, "uuid": "ffb787bf-4ce2-47c3-8da5-ca61d3847e20", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608198, "uuid": "4f33e723-3a8d-4b40-a2da-3f7f8461c5a4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608198, "uuid": "1ffc23df-aa62-4655-9a36-e70a75c0cbfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608198, "uuid": "978869d1-9a30-4615-af0b-252ae6df0a54", "value": "9d0ebc7d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544b9ec-ba09-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583669, "uuid": "061081e1-8a52-468d-97ae-ec9aa12b9ec7", "comment": "Malware payload (Dridex)", "value": "b8bda52072ae0aa0feea39295e185661", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583669, "uuid": "aab2de97-6cb1-4688-b8a8-fef990b92d51", "comment": "Malware payload (Dridex)", "value": "689fd492778be17a35980a871f2bf0cd8b6ee7b7ccd8134165ca516ffc256c0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583669, "uuid": "f233c1c5-a210-43d7-941f-04205b1cc5ea", "comment": "Malware payload (Dridex)", "value": "7e4726b632f8bd102795722bd48adc15d2d7246c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583669, "uuid": "0509da54-236d-43d6-8e30-afd7c54ecd96", "comment": "Malware payload (Dridex)", "value": "83863950b8de15b54940b380ed68d4ce721fbbbabb4b0d55f80217493f71c501d53b4158f6a2a2e6b6c302876f9065a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583669, "uuid": "e1e63540-fd87-4794-9437-5cc7b6e31063", "value": "C904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583669, "uuid": "940c1c95-22f2-4459-856b-1f5dd9cbb64f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583669, "uuid": "de9192bd-e700-4c12-b9a6-17851997c245", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583669, "uuid": "67dde8be-44b9-4df0-86f9-c3b9986c3dd8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583669, "uuid": "48ef3038-3b73-4e73-9d2e-bf69a16f4622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583669, "uuid": "6e6dfa14-f9f7-4073-9b8d-05e4ac7aa6b0", "value": "b8bda520_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46e1708-b9f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621572930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572930, "uuid": "106339f0-221d-4b59-8393-bf5ca7c5232b", "comment": "Malware payload", "value": "e3300ec2f31f5730970c5bb066d2f0ed", "object_relation": "md5", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572930, "uuid": "9891bb16-49ac-4b14-8a08-de88c2a73b94", "comment": "Malware payload", "value": "68af250429833d0b15d44052637caec2afbe18169fee084ee0ef4330661cce9c", "object_relation": "sha256", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572930, "uuid": "e65ddf7d-a4a6-4075-ac99-a36f4521c8f6", "comment": "Malware payload", "value": "c768882e102a5dd3d1c17d306698c5cfc3d9d8d5", "object_relation": "sha1", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572930, "uuid": "c16f06f2-2f96-4504-afad-8fa561697b25", "comment": "Malware payload", "value": "0d19354073a6e4c0708cef84ecd929489b63119ea18cabe901c93f95f370c813012942f0db762ad6159667704cbbc235", "object_relation": "sha3-384", "Tag": [ { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572930, "uuid": "f03ce37b-59d9-487d-b5ee-8f4279f5defb", "value": "36F2A343E5AE50D6D8B5C036A1667A3BF8F13C954138AB3EAB904B5B1763730F91E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572930, "uuid": "d5063634-69f7-4de1-9f76-9a5d2dce9ebf", "value": "6473877da5764bbd5a9b16892ef13b69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572930, "uuid": "62022916-b3e6-486d-a85b-c9f688637dcc", "value": "768:zp2FXczP/cpWyB/3RtUcGOqEMIcqfz/YghUx:zp2FsTcB/UcGOqEMIcqfz/Yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572930, "uuid": "8dc74ad4-4b41-49ec-8ab0-f9dfa55e1dfa", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572930, "uuid": "4d607e20-31e0-4c78-9ec1-ded7bc4ab92f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572930, "uuid": "cb1cc32d-1b45-455c-8ac7-cc6cc1aa8962", "value": "sender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86525809-ba26-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621596018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596018, "uuid": "16a4c6eb-ce79-4907-a725-9038f070f900", "comment": "Malware payload (Dridex)", "value": "9c05955aa4fe4bbb11c1d441fd2e6b46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596018, "uuid": "bfc4a27d-5e27-49a0-97f9-e00415e0334a", "comment": "Malware payload (Dridex)", "value": "68ffb5dc20abdfaee3b3cf6189f3dc71e1f49914fb64ae38eeb95817f412fcd1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596018, "uuid": "6bdf0d9c-8b47-4bc7-945d-dca86b3b3cf6", "comment": "Malware payload (Dridex)", "value": "5008e7d58bdc61dc0fbaa2327f0dcc83320aef6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621596018, "uuid": "421e38b4-078d-43e6-9b46-245b9b8e4dba", "comment": "Malware payload (Dridex)", "value": "ecea3b7dec96aba57bcd91e082e846539bdf95265aba5f5c3be5f7a62a2092d7d06a9ebee82cdea8132b4a9b6e1b023d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596018, "uuid": "6fb72d66-da3e-4d78-949e-b6ed26b14eeb", "value": "7CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596018, "uuid": "47c157ea-790a-4acf-83b0-925e490eb840", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596018, "uuid": "6221b77c-066c-45a5-81b9-fdced8a1769f", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621596018, "uuid": "475a2891-ca08-4ef6-8420-576cc3e33f49", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621596018, "uuid": "4c2599f0-23ba-4b8d-9e6f-f5c4eac2236d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621596018, "uuid": "2213dc10-4256-4c49-b0e6-83ea11d02bc0", "value": "9c05955a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdadb67-b9d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562051, "uuid": "02fefe4c-a6ee-439c-8684-0bab5ad49b10", "comment": "Malware payload (Dridex)", "value": "a9b162770bb77cb4da9b7bcac0244017", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562051, "uuid": "e8ead717-b19d-40ab-834e-273e10a01c20", "comment": "Malware payload (Dridex)", "value": "69040722e973b258d57755caa35ce59b9b95fb50a45c5b9270e22357e4f7a7aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562051, "uuid": "d7b09d4f-fb5a-4251-b863-b526c74aa07a", "comment": "Malware payload (Dridex)", "value": "3a56b630987b5f809393fca45fe231b5d6057b00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562051, "uuid": "be7eb9ad-f04e-4aac-9967-50c13c6f0036", "comment": "Malware payload (Dridex)", "value": "5e5c48b3c9fabb7b0b9b8ca979312c3e0ad9328fde0be69614b0865c7e428cd1a2e1dc08cc77b1aef65740a8371c76b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562051, "uuid": "a6becada-ec40-496c-b691-89ee29f58821", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562051, "uuid": "8589fbff-443d-4cd9-8090-6fc86ec35f71", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562051, "uuid": "a8d672d7-ee8a-4a39-b680-8dae1d347c68", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562051, "uuid": "379bc3e2-5fb5-4097-b07e-236bd0d07c66", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562051, "uuid": "c4aa4e8b-e596-4e0e-b3bb-df1eb4824759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562051, "uuid": "e4b2fb06-5d42-4e67-b314-c0a6f4aa015d", "value": "a9b16277_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8c76d6-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634653, "uuid": "b38a6da2-57c0-434e-86bb-8d110a334ef3", "comment": "Malware payload (Dridex)", "value": "05c12f34bf87eed88b51b02a0a98d0c6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634653, "uuid": "13d9fb46-062b-4461-965e-a48b1052c10c", "comment": "Malware payload (Dridex)", "value": "69088eed10ed2a132140eb52801c8d6af5df430325e77561c71b4505c8b4128a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634653, "uuid": "234da946-f5c9-44ac-8c16-f200c9faec48", "comment": "Malware payload (Dridex)", "value": "1b49136679b290d617681460594a33811d381a97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634653, "uuid": "3c73c7c1-ef42-4dc0-817b-c59e5b3ed85e", "comment": "Malware payload (Dridex)", "value": "c39c96e7bc602bac9c3226d20f1a83ffb52f18e696e69c0d787379f6c68d0b17304a22aa3ff9dc308c611a202aace3c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634653, "uuid": "8a381fa1-3aa8-4d44-8ca8-371e48ca725c", "value": "BB04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634653, "uuid": "e75963a8-41cd-451b-95f1-fb3757027f36", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634653, "uuid": "b0bdb798-8e5c-4431-88fe-227a31d3f667", "value": "3072:HqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:RVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634653, "uuid": "fc880932-2976-4a38-a744-9ec8bd8a89d9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634653, "uuid": "06ec3f0c-04d4-4c86-b54f-3b65abe97bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634653, "uuid": "e2506cfc-6549-4905-9980-2d7f32e6abc9", "value": "05c12f34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac2b1a4-ba5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621620212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620212, "uuid": "e3737846-1bd2-4588-b827-f3b3df6bd8c0", "comment": "Malware payload (Dridex)", "value": "aa4dc7708d0cbbe89004abaf8148f1fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620212, "uuid": "bac5f557-9bf4-41e7-beaa-e16052602de3", "comment": "Malware payload (Dridex)", "value": "690fde70e19a57a64c1428215da090a1186e9566622ace47874a20125c15a8fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620212, "uuid": "a52c642f-d22a-4e3e-aeb2-f12975cee132", "comment": "Malware payload (Dridex)", "value": "32b954edd3de2c03865278b907734beea6701686", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620212, "uuid": "de0ab043-c328-4827-8211-5c3b227d66ab", "comment": "Malware payload (Dridex)", "value": "9dfaf58e8d29d4c061d554a517a0705b2265ea99123b8b77115add2b140b85aeeb7f54e16aa353b00600c61832fd3b68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620212, "uuid": "2599488f-3ef9-4f05-be5c-8835d0af6db4", "value": "7BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620212, "uuid": "3083955c-c472-4d8d-89e5-f344629a8204", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620212, "uuid": "85b0e9f0-7518-4188-8019-c6dea7b1901d", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620212, "uuid": "32123860-91a1-4685-80e1-2e9f34203cba", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620212, "uuid": "507ae643-1d7d-424f-bee9-ccaba1b9228c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620212, "uuid": "1d891d2d-42dc-4165-ba5f-8d30a6b0db4a", "value": "aa4dc770_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf33119-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570766, "uuid": "3fe0bf47-2348-4508-901e-06081c82e276", "comment": "Malware payload (Dridex)", "value": "3292b88660cdc0262d982198e5a29f3c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570766, "uuid": "469b2b2a-ba34-42ec-bee1-7fbec08f9559", "comment": "Malware payload (Dridex)", "value": "6915f147b9a169bc5c51c4d19efe5d8c8d39b28af3fedeb18813a1a46eda555a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570766, "uuid": "32751513-491b-4ca1-90f3-3ba8af16a38b", "comment": "Malware payload (Dridex)", "value": "5621b4625fac5450eb6f90b554f609dc35119817", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570766, "uuid": "6f33c54e-7c6f-4f28-9774-36f11befe850", "comment": "Malware payload (Dridex)", "value": "70eeaaf8ae32e4ed338398ac5ba548d6dd6d7faf9560c37f84f5e37d94c6b494a31acb8a0fb6d8fad6d36b9ac849ed63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570766, "uuid": "9fabc5dc-5484-4562-8d10-3c4621544401", "value": "C204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570766, "uuid": "f6f4446b-67d6-4b06-b79e-fb92ce9ad772", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570766, "uuid": "0e307c3d-bbc1-4a9b-869d-8b32aa22b3de", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570766, "uuid": "4ce66c2d-87e9-4cd8-9151-b17d8cd0b01e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570766, "uuid": "acaa7b7f-2d15-4631-af3e-3966a87059ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570766, "uuid": "f67a59fa-8a7a-4d26-af16-7a198709fa46", "value": "3292b886_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af3c883-b9e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568512, "uuid": "fa97525d-5601-45af-83c4-ef807c2fed2d", "comment": "Malware payload (Dridex)", "value": "830d2a4cf7b443770cb174266d13d3cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568512, "uuid": "67ed4566-6a61-4ecb-8fbb-9b1f0f7582d6", "comment": "Malware payload (Dridex)", "value": "6964cffa7b5c19d4bb6d9e3c09fa48d390c26a9222adcd2ac6bdd3feaca72baf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568512, "uuid": "2094d5d4-ef3c-4b10-b776-9a4049ce12ba", "comment": "Malware payload (Dridex)", "value": "eb9935cf006cecbb4fd40760a20d644a579d8c4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568512, "uuid": "b56d37e1-c431-4100-998f-8cf2b95e9b2e", "comment": "Malware payload (Dridex)", "value": "2a823255aef1cc9645cebc8ad90960df49acb79d54f765672915016b69906768cefd1a142e4385e3d34eda9eafe6959e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568512, "uuid": "d7219274-f156-4e7c-9e62-4c49fef21331", "value": "C704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568512, "uuid": "d17dce13-40f1-401e-818e-0de86963c138", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568512, "uuid": "c693faa0-095f-418b-b019-c68180322b4d", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568512, "uuid": "3853cf01-d8ef-4d8b-857c-19154ded3d7a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568512, "uuid": "1031b47c-7cfc-43e0-9a1a-80a9303d6755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568512, "uuid": "5dcdea00-9609-485a-9794-610125878a75", "value": "830d2a4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b2bfa5-ba07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582670, "uuid": "d553fa37-e2bf-4dc7-8f97-7035b2119835", "comment": "Malware payload (Dridex)", "value": "7e4858e4605fedaefc694a5fd25fdaf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582670, "uuid": "2521fbac-077f-4921-841f-c3d56319a3e4", "comment": "Malware payload (Dridex)", "value": "6a4761aaad46b78e421a6d25af21a1d67ac882d96b1bd02ec1597e469cb6a0a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582670, "uuid": "57556aad-7f02-4743-ad5b-8fd57b3c1b5e", "comment": "Malware payload (Dridex)", "value": "11bf06f6e5f47eecd783e80da36f68073022be5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582670, "uuid": "f4647794-811c-4b23-843f-a4b2df1e0b3a", "comment": "Malware payload (Dridex)", "value": "821917880efd580c9c22949dba9e2408cb15da9e1569ca1c8431b3a09331d02280056bba8fa6dcdc61ebbcedb78feffe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582670, "uuid": "ecccfe1c-c0be-4276-8e30-21d47b320309", "value": "6A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582670, "uuid": "6a4d1b0b-8851-446b-a008-6c7cadfe20d5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582670, "uuid": "60766211-069f-4181-a452-19e6d4c8180b", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582670, "uuid": "2dcb062a-4830-4fb8-a4a1-3e22cd35485f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582670, "uuid": "64d5378d-4042-46a0-9a68-2e61f81e07c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582670, "uuid": "3cc45fdf-224b-4063-b214-a2ea206dacaf", "value": "7e4858e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae2ee3a-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555439, "uuid": "17e85d18-d40e-4641-863a-28eae7b20fd6", "comment": "Malware payload (Dridex)", "value": "a5260eb8fc7d089db4971d42ca26e05e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555439, "uuid": "d1bf557e-a329-435e-9662-d84eb259436e", "comment": "Malware payload (Dridex)", "value": "6a58c4909fbeedf89c60d0f9a24047216686e042da4575d7b629f1e2f7d416f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555439, "uuid": "0a778a00-b7e4-4415-9395-a401b16a7e58", "comment": "Malware payload (Dridex)", "value": "a0e4fdd713655a65c27238be3ce92fa67cfe6edd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555439, "uuid": "723176fd-6791-4c59-95ed-87d046daa62a", "comment": "Malware payload (Dridex)", "value": "484068fdad722add5114808a48bd403838069bef883383e3518ab9355e991385ae41c715d82f5bda98413287aac1f5e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555439, "uuid": "63778218-2714-47c5-8a9a-c39a6f525915", "value": "0BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555439, "uuid": "abf658b8-e9a3-41bf-b907-fdc90252eada", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555439, "uuid": "50232d4b-8759-4d0f-a03b-a0ff43eccb4c", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555439, "uuid": "6e854976-aa64-490d-9f5b-29ce3ae8933c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555439, "uuid": "40f0d933-4be0-474c-80ca-44915cf20cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555439, "uuid": "2c94409a-3ace-406f-a869-770c54eeb464", "value": "a5260eb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f634f0-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559514, "uuid": "bb050aa2-e508-4456-b978-1db8360b8f42", "comment": "Malware payload (Dridex)", "value": "14cbb9cae4f3e127cf2ba471133ee77c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559514, "uuid": "d505811e-a288-4512-be5d-fcc39f21a948", "comment": "Malware payload (Dridex)", "value": "6a8febe0999d148aa9ddbd2333928a45c204f1e6450ede8914fcee80256d37fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559514, "uuid": "5a1b28cd-dd3f-4274-b73a-423da9d38b5d", "comment": "Malware payload (Dridex)", "value": "46eaecbf52c9d0b21f389b1ca7ba3f7b7a635f57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559514, "uuid": "a06f79b3-ff05-4e85-9441-fbdbd862377a", "comment": "Malware payload (Dridex)", "value": "0387a236444a8227b9f6a17558a5ab80f596598ed373e6998f91eb51c8baef9bba2f5928ad338e9148a65ff3500a652c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559514, "uuid": "6d021391-45d5-40ed-9988-f01a7a4133ad", "value": "73F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559514, "uuid": "b89c606e-31a5-442a-8e86-4fc0cf11d56a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559514, "uuid": "e95ee56c-647b-4871-a391-57bd6f283ff7", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559514, "uuid": "0744834f-393b-4d4b-82a0-7b3ec3d863e1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559514, "uuid": "9e55b5de-aec7-4061-bef3-c52509949aef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559514, "uuid": "e37d322b-5798-4d63-b58d-00871e0a109d", "value": "14cbb9ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2b5a80-ba64-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622635, "uuid": "2eabf77f-c164-4037-a022-b7b7859ade63", "comment": "Malware payload (Dridex)", "value": "d3544cf2cbd7080836f875dc1c64838b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622635, "uuid": "db480634-1285-4e4f-9539-834e55e7b027", "comment": "Malware payload (Dridex)", "value": "6afc0ce6b21617a2e211dab722378da68f96e4dd7ec8ffa4611fdb83766b143b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622635, "uuid": "19f87843-88ef-4013-a542-b5fa0a1cfdd6", "comment": "Malware payload (Dridex)", "value": "919a4f78983729e07997f0b2130b754360ca78f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622635, "uuid": "2f71a579-b332-41e9-8290-7c2712917666", "comment": "Malware payload (Dridex)", "value": "0d551fc1646ce04166cb572a717f6e85df9d423dc5578e18c928ef27a00ff27d94edf1478a42276e060dcfd454994374", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622635, "uuid": "12402149-b16d-455b-8ccc-5d6c63973b41", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622635, "uuid": "fb1bc485-3878-4a5f-96dd-d7e8e4fdb800", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622635, "uuid": "d447058e-9696-4cac-b9e9-8ce6d0c58fbe", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622635, "uuid": "a68a7ccd-25af-4900-acfd-f5784d5d52a6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622635, "uuid": "b87424c0-0344-41ad-b532-2ed2c6cb75e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622635, "uuid": "5cbadb79-f8da-44b3-afd5-2da53012ca58", "value": "d3544cf2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a79f34-b9cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558488, "uuid": "dc36c4aa-977d-4fa9-b2ba-2a241e8f1025", "comment": "Malware payload (Dridex)", "value": "2acd5685b3efd801583dd40418e73378", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558488, "uuid": "fd41068b-1537-4bc5-8c90-f81c6ef96582", "comment": "Malware payload (Dridex)", "value": "6b34259419a9b4b41b7005cb90a48352bc204dbc9a20face7ecba98b0add8793", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558488, "uuid": "4b3f0e29-c7d5-4adf-88ec-516934828090", "comment": "Malware payload (Dridex)", "value": "587f799a08c0e0fe424744dcc643caac0b892198", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558488, "uuid": "1b8329dd-0e88-49a4-b816-588afcc8b83f", "comment": "Malware payload (Dridex)", "value": "34665d6f8bc48c2ed13fcda95eb8c369bb73fb99434f487987313aa7c84af3873467813f6602d8e31c30e77f9ca6b940", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558488, "uuid": "2c9b888b-8802-4cfc-b975-b4bd91e3e2ab", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558488, "uuid": "80af1f14-1f85-4907-af76-3fcbea5091b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558488, "uuid": "8c7fc814-156e-45a0-808a-e8185c647c84", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558488, "uuid": "d4444e2a-cfc5-4670-95bb-c679201cec56", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558488, "uuid": "3824224e-6796-43f9-833c-35a364f185f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558488, "uuid": "b296aeaf-f0ef-47be-b3b1-da79a794ea2f", "value": "2acd5685_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2271038-b9d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559612, "uuid": "6947b1f8-e636-412c-a1c9-102f0b90704f", "comment": "Malware payload (Dridex)", "value": "90a3ac311d1e93b6f6af0a5936a394f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559612, "uuid": "a14769a5-66cd-45f2-b66a-6022cb1235e4", "comment": "Malware payload (Dridex)", "value": "6b3ee427818fd42e38912fb35e668ccc6416e1a622007f3b568efed5da01c377", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559612, "uuid": "248530c0-667c-4c3d-b3d3-384b5c58954f", "comment": "Malware payload (Dridex)", "value": "3042b55eb1244aaa600ae7594f0c9c1240f4aa99", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559612, "uuid": "48ab76e1-1885-4162-8cfb-e60f984bb56b", "comment": "Malware payload (Dridex)", "value": "88ddb3a5f19a4727881d1cd31d3e2c1f6a2c35880ab593a82603ce0edada6a14844dda288f9f5aebefebf326d93714b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559612, "uuid": "01186c8e-93d6-4bb1-a4ab-78d74cd7fd5c", "value": "F504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559612, "uuid": "c3cbad3c-ea8e-4c4f-abb8-a53fc06dbb58", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559612, "uuid": "998a3820-29c7-4816-b1b4-847b64e707e9", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559612, "uuid": "0b8a946a-8154-4a48-8d9e-50d4529d3f6f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559612, "uuid": "4a2b2509-ebe5-40c7-8806-05523f72c690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559612, "uuid": "a8db1fa6-4d12-4331-89bf-d0e853ac4fea", "value": "90a3ac31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d555408f-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570811, "uuid": "6bc3452c-f907-4b62-ae91-015d31e31d02", "comment": "Malware payload (Dridex)", "value": "006a6e9f1ea0670e3504fc0825148905", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570811, "uuid": "17d82d80-c45f-4670-b5f8-111d258c38d5", "comment": "Malware payload (Dridex)", "value": "6b54c99487fb1a85f59de2ba6fe375c5f1d24dc2c73a6f915e431b59c2444875", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570811, "uuid": "651e2741-6fc9-4112-97ad-62db9963e00c", "comment": "Malware payload (Dridex)", "value": "62a7d873f4241d2e09f9dd96dea23fa659a5d571", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570811, "uuid": "38aba775-1416-4287-9482-561de8240b70", "comment": "Malware payload (Dridex)", "value": "91c92fba9a2b1c5d9d9ddd9ced2d0f1fb87216e790b8494624684ec21d410b656dd657a31379f131a0ad6c4877efce42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570811, "uuid": "d4a7d243-7acb-4734-b854-bd00df5d4cc3", "value": "8B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570811, "uuid": "a6a53428-be47-4116-8606-52c2bae9ee6f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570811, "uuid": "e176156a-b360-4998-9a21-6ac16e879734", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570811, "uuid": "d243abc3-c82e-480b-a270-63fb62d9a8c2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570811, "uuid": "62da73b4-05fe-41ac-a6bf-d36954648418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570811, "uuid": "2bd54929-9944-4e5a-9917-5ca6e4fd80e7", "value": "006a6e9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c0285f-b9db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563857, "uuid": "1e8c0dbe-b4d8-4007-b325-e6b759d4e558", "comment": "Malware payload (Dridex)", "value": "38dd3b6d42e9fc8d9e94700ea6dbf681", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563857, "uuid": "2a0ba3bc-5225-4350-8c02-66b8be60158c", "comment": "Malware payload (Dridex)", "value": "6b7e20e915c621d2d5b631aec35baef78d67c9ce0fb16d11490e0bcddf38ad2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563857, "uuid": "974c8506-2d3d-45f8-b9f6-e8479f974e54", "comment": "Malware payload (Dridex)", "value": "94092ab2a95924f1685e8be1ffb2c49da1a55d03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563857, "uuid": "70f26499-2289-4477-9dc9-4209b1bc261d", "comment": "Malware payload (Dridex)", "value": "21683179825ad2ddfdade7d9f8a0b3e6d72f1f59b30a143a0a99deebd1385fbf4b492ff8854e5e32726c0443fb2fd673", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563857, "uuid": "2a71b70a-90af-4547-ad2d-1b36eab887db", "value": "E604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563857, "uuid": "3558323b-e73b-4c80-97c2-03ebe9efb612", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563857, "uuid": "811b21f9-0bce-48e1-83f7-4aaa547833d5", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563857, "uuid": "8252dd6a-1c44-4556-aabb-66028cf0f6c2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563857, "uuid": "3d883de9-bc06-45cb-9ba4-f85e63a78c7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563857, "uuid": "795cb7a0-96d5-4d56-9103-5cde0ff85357", "value": "38dd3b6d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14a0590-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611579, "uuid": "f7a1f4ed-c251-4eb6-a31f-826fdb8a86d6", "comment": "Malware payload (Dridex)", "value": "20174437c594030a3624830611e7f3a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611579, "uuid": "6f7db584-75af-4cd1-9f31-e9b2a0ef465e", "comment": "Malware payload (Dridex)", "value": "6bf275bb49a9a5c5f723a44ca4b1814989e1fb5677956dfe2d0cda7b492e1ff7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611579, "uuid": "27892736-7cc6-4a7b-b491-30155be3fba6", "comment": "Malware payload (Dridex)", "value": "a36781a567820ad0210d3562c48c9c3a2209f75f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611579, "uuid": "677a2b29-7caa-4224-a932-71b2bbe62692", "comment": "Malware payload (Dridex)", "value": "3433bff013a9ae2d7410174117f2ecc334ca737777982d4e3573177e6d711cbc4349dad3bffd84692cc4cdfa7187f079", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611579, "uuid": "e41b3f3a-ed06-45bd-91db-b61976bd6c05", "value": "9504BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611579, "uuid": "87e23528-fe9a-43f4-b300-f1fac175fe75", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611579, "uuid": "7881959c-762a-42ef-8316-b51ca587fdd9", "value": "3072:qi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:qH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611579, "uuid": "84813d6f-d778-4d7d-ac1d-d6666ff9cbd1", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611579, "uuid": "1d5654bf-47d9-4917-b114-8587577b3ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611579, "uuid": "5808e6e8-f9f2-4c28-b7db-56b9637d7d8c", "value": "20174437_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aca21d-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559002, "uuid": "87938631-93ed-487e-a9d3-0248dc76664c", "comment": "Malware payload (Dridex)", "value": "ccb48ed186d89eb5ff67d5c2376b77ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559002, "uuid": "dfb5f31b-11e8-4641-bd7c-3d4d6a7496a6", "comment": "Malware payload (Dridex)", "value": "6c285601e581952b99078016136e7b4a61a05ce76d7698812f27ee6b2b2e6b93", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559002, "uuid": "574e3851-f87e-4a90-b219-a81d464485fd", "comment": "Malware payload (Dridex)", "value": "dda98704f987269b14b6c79b9f60eeef03d8ac89", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559002, "uuid": "1a620ae7-8ac2-4a8f-a494-b8929a011dc1", "comment": "Malware payload (Dridex)", "value": "abdd53b5e884ae8a4f85273d645d5ed2686474af7e6243afe031d347260d53265091848f026ac636745e7cb92c86af3f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559002, "uuid": "d716b4e0-0bf7-47dc-911e-29aa792e3488", "value": "8504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559002, "uuid": "a4ff4057-d603-40cd-a7ad-8019cd5efe8b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559002, "uuid": "a5a9de5a-3f9c-4bfa-b031-215a51476644", "value": "3072:rV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:rV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559002, "uuid": "4e6b3a1e-ac26-48ba-a62f-d5ea1992daee", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559002, "uuid": "87015ca7-a361-4bbf-b0e0-7cc0171ecd11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559002, "uuid": "5fe1004f-45d3-4aa0-aa01-538896f7acd6", "value": "ccb48ed1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a380a8-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580713, "uuid": "3d6395a0-c300-4bc7-8c09-e3a25e68d620", "comment": "Malware payload (Dridex)", "value": "8c10b00ae9ba0aa7dbce4c0ec0fa345d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580713, "uuid": "e2e1c2af-f721-4262-87cf-366ab4e9d40c", "comment": "Malware payload (Dridex)", "value": "6c4f0083f32b1202cb61b54738846f4bb102f37d88096cd845547923e6726e06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580713, "uuid": "07dd2100-ac1c-4239-a54b-faad18898013", "comment": "Malware payload (Dridex)", "value": "fed19c56448ab6608a53cf2fdc0ce07f8b9555df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580713, "uuid": "5370b428-4e3b-4c6f-8a77-5909f66665ef", "comment": "Malware payload (Dridex)", "value": "7b725c86e6b4ffc0fca9579fa0c99de9656a510a9f6ea3f51cd5c205a8cd462fe122629376a8628d179b4a301af908b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580713, "uuid": "1775e2b2-668d-46fa-9442-4e08b17d4119", "value": "8C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580713, "uuid": "d3d617e5-29a3-49b7-b69c-7da815dea2a4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580713, "uuid": "29981857-6a83-47cf-afde-2973faaeb3d3", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580713, "uuid": "de4d330d-af31-407a-b91a-ef16f54897b0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580713, "uuid": "63684645-6391-49eb-a109-542a4181f389", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580713, "uuid": "0e23a887-5dd9-49a7-ae3f-b0af70160ab5", "value": "8c10b00a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dc8704-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565119, "uuid": "7350dd7d-5650-494c-8122-00ee4fe8e309", "comment": "Malware payload (Dridex)", "value": "d1afd946bd0082dce95066706f046ede", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565119, "uuid": "3851a914-a4ea-4256-a017-d64529c9be74", "comment": "Malware payload (Dridex)", "value": "6c7258be87b34d67a3f7179ce2bcf7981f5bd2aa17eaf35084df6caa14613287", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565119, "uuid": "0be1d8d6-c14c-4379-bb47-842fb98c5944", "comment": "Malware payload (Dridex)", "value": "eb951769556bc2c3d720798a147386ac482fbc92", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565119, "uuid": "c168394d-d048-4005-9cf3-f5f0b381a209", "comment": "Malware payload (Dridex)", "value": "557de4203e890884f6aad1111a15edc7a14b87f6262d8beef8a2d75e0c0eceb4c04bde62d5127c12657abeb1956275b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565119, "uuid": "51d8e173-cec3-4225-85ba-004f24ef437f", "value": "02F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565119, "uuid": "0c89ff0d-300e-421d-b1f2-70993d5169a7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565119, "uuid": "d55150b3-8af5-4f7d-8aa6-5d7e4df9ebd5", "value": "3072:DiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:geAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565119, "uuid": "b4228043-ef38-4a0e-a1c4-7d382c5072ef", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565119, "uuid": "7b79f147-cb58-44f4-b2ff-3f7167e57d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565119, "uuid": "6a2df814-13b0-4890-822f-9e2e7fb17bcb", "value": "d1afd946_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833e7555-ba24-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621595154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595154, "uuid": "fdcaa92d-b760-4047-81c1-20890f6eedf4", "comment": "Malware payload (Dridex)", "value": "000ba4aa8abf695d75259af909000e21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595154, "uuid": "4d7d5305-a71f-48db-bbb4-db4ca4d1c990", "comment": "Malware payload (Dridex)", "value": "6c7631cf2ed59b323f800bca6de322fb06f24b158970fa2c163a4f38c0977640", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595154, "uuid": "f8bee771-019e-4c39-b63f-09de75667685", "comment": "Malware payload (Dridex)", "value": "e6a6c59d457e2104c7866d95edc0212f96d4959e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621595154, "uuid": "16924e58-5bad-4ce1-8142-8ee7157b9ef5", "comment": "Malware payload (Dridex)", "value": "bb6d86f2c12ffda135a15b6dc00f177180ac00b07f65de395e8ffab5a5c06597d2784563fbd9a5c153cb333d10db848b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595154, "uuid": "efc68eba-b7c5-46c5-a499-686e16f211b9", "value": "6004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595154, "uuid": "6b2c83be-7cc7-4b51-bf2c-6882910f5c89", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595154, "uuid": "e5efeb64-ae69-40d2-8ca1-3b5f438c600b", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621595154, "uuid": "280e0bb7-375d-4a21-b845-06c773309832", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621595154, "uuid": "315f265a-30c6-418b-acb2-4a172a3f030a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621595154, "uuid": "50bd19a0-17bd-41fd-91a0-fc4ef80eb771", "value": "000ba4aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9651f6-ba5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621619197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619197, "uuid": "c87f5f23-6694-4bdb-9e4d-9a3af0989b9f", "comment": "Malware payload (Dridex)", "value": "7370edc70717865ace4f587c99133def", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619197, "uuid": "18d54286-54ef-4d36-ba61-a863cea5c33e", "comment": "Malware payload (Dridex)", "value": "6c8bed1833e311d71449e1dcdf40c9fea156c9c14432be0cd5731bd14fbe593e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619197, "uuid": "60f7734c-ec46-4d2b-8c4e-f92562391486", "comment": "Malware payload (Dridex)", "value": "f12a2ee9601dd7b622ceaea6fccf2a1327248e35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619197, "uuid": "0ee99c69-aab9-4958-bb1d-169cd575ae80", "comment": "Malware payload (Dridex)", "value": "39ca3325cedc21b1217d84d88e2ba232f6499a7a34cf7252a676bbb16d3a2ae8c50e16339ce78e80a787459a4b483f66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619197, "uuid": "58154d8d-642c-465a-ae7f-25b0de05dd86", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619197, "uuid": "1ccffbcf-be44-41e2-999d-e47e66e9222a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619197, "uuid": "af73502c-9ca7-46da-b8ce-d48451709629", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621619197, "uuid": "1bfff5a2-f258-446c-a669-afc506c1bbbc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621619197, "uuid": "606786e4-9d55-49fb-9411-0046ebde87e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619197, "uuid": "e11ef74c-4a1f-4fc9-8a15-f0aea8a9d2d3", "value": "7370edc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb4f2fa-ba41-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607570, "uuid": "7210df3b-279e-48e7-9c3c-1691a628cf6f", "comment": "Malware payload (Dridex)", "value": "5dd0dc397b32b5a36e38c95bd5683e59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607570, "uuid": "47c75e7d-7f31-42ab-a2af-abf54b469789", "comment": "Malware payload (Dridex)", "value": "6d0dc042ca6d0744159d6663888bc16a96730a0285141bb3b1d65cf2807e39ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607570, "uuid": "27a0d8c5-5b0f-440d-848f-0a90bebf56a1", "comment": "Malware payload (Dridex)", "value": "add67e1e798c994b4d656ee7ee791fc44904ae26", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607570, "uuid": "f71416ca-6e60-4ac1-8ec5-c54dcb32a1dc", "comment": "Malware payload (Dridex)", "value": "66e0dae385e16bd3e539042963b0d42231f0eb7332e5fc898506f840338322c9976c47c78c0b8d7eb3631acf9f334fb3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607570, "uuid": "ea1505ad-5118-4a50-83bb-f633fc8725ff", "value": "8904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607570, "uuid": "5ee46a15-e66d-43e3-9393-c0a709ab0cb7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607570, "uuid": "1cab75e1-0e2f-47a1-8bfe-7cbbc7ab7d1c", "value": "3072:eV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:eV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607570, "uuid": "f16193a5-96a8-4bb7-ad74-84e3950cf17c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607570, "uuid": "9760175f-c33e-4b27-a294-27b5988b716d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607570, "uuid": "83de0e3f-ced9-44c4-b383-6a3451642e6a", "value": "5dd0dc39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082587be-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567031, "uuid": "1df1a9ce-f675-401c-b1b6-80d8dcf9b569", "comment": "Malware payload (Dridex)", "value": "90c0c0f489dbd9020cf81276828a58b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567031, "uuid": "4916ebd4-2920-4a10-aac8-7b533b3d1fa9", "comment": "Malware payload (Dridex)", "value": "6d26eb683b5083af089d6fd71c8c108ab52bbe37baa17cbe73756a8d332d9204", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567031, "uuid": "ea9d5790-937e-4c94-afe1-60f5fb4d9729", "comment": "Malware payload (Dridex)", "value": "5822286e6ce75eeaa90b19b7f1475c6f5a5e6a9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567031, "uuid": "e985b1d0-2b59-44e4-9411-26c0ebeaefb7", "comment": "Malware payload (Dridex)", "value": "97788f1e47de0e905850ee78b020c4366174f6abe7b5627b20cd064b8a97b67b66ea8278bad4470c8a0688402ceda472", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567031, "uuid": "333486ff-f275-4068-b520-18f0ca0394c9", "value": "E6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567031, "uuid": "a8c354ec-3ed5-4cbb-b31e-cb69e9014962", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567031, "uuid": "6a6f8c1d-c583-4946-92f9-5c2fa57d2e2b", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567031, "uuid": "3fa313b8-45ad-4322-8fb5-61f6811db821", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567031, "uuid": "6df5a230-33b3-4d31-9057-2044f9b6aa5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567031, "uuid": "b5dd3bad-a80e-4501-b8aa-a7b58d907c13", "value": "90c0c0f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5cdaaa-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609751, "uuid": "9f62bbef-ea65-4ceb-85d1-d05b28106f24", "comment": "Malware payload (Dridex)", "value": "8857850970afc3889f8c3a21c8ae8d73", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609751, "uuid": "f6d1ebdd-b77b-4f33-860c-bb44907577d5", "comment": "Malware payload (Dridex)", "value": "6d3c589195d6cac04c27e741f89877f0ed347f690d1336c18d7b21387979f004", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609751, "uuid": "37d39e2a-dc80-4080-9c14-1c69c2481335", "comment": "Malware payload (Dridex)", "value": "72de03d8590e27db6c94debce1457bf9ce2b8dc1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609751, "uuid": "1e159bab-2ade-48b5-8dbb-808297764870", "comment": "Malware payload (Dridex)", "value": "3fb32caafdd48de8c4bb0f312ef342da6cd444f0c5e99d911e1d87d63fb333092d92452b9f8dd89b45d22f8bde3893c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609751, "uuid": "62ac6c58-a9df-4ed8-923d-88d160b78788", "value": "8104D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609751, "uuid": "92dd0147-4b5e-4f8e-ae38-afce350f00f5", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609751, "uuid": "6e4103b6-7683-4134-bde1-46afc4a6fb21", "value": "3072:XqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:hVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609751, "uuid": "bf0209e4-e513-4993-9d24-009ce9b10df5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609751, "uuid": "0ebc6a01-d970-4890-b459-7598ac35cc03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609751, "uuid": "6c847f39-f2f5-4ad1-88c4-89fc0b5df36f", "value": "88578509_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7827aa71-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570225, "uuid": "d638d6f0-bc82-4dfd-82d7-ce385cd199f5", "comment": "Malware payload (Dridex)", "value": "161646fd674a29ebaf3b718087000626", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570225, "uuid": "1e45139a-3e58-4d2a-8e44-181d5ed1ae5d", "comment": "Malware payload (Dridex)", "value": "6d69e4003a3b9e20f62971c5a1aa617eee7337c0bdcfd5f7402847edeaff2923", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570225, "uuid": "22df8bc0-ab2b-424e-9abe-f33205f67063", "comment": "Malware payload (Dridex)", "value": "d336e63884f557955887fb718e35e838595ff4ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570225, "uuid": "f0bbf271-fac2-46da-8a05-9c9a4ebfa442", "comment": "Malware payload (Dridex)", "value": "adf1a6919f01025c910364231a3171c7e9ab7c2237e4fff667fbc2fcb1d155cd6ba8eeec71b2573cf06d2129b05d7c41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570225, "uuid": "80bf47c1-4b33-4d64-9725-f38e965974c7", "value": "A204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570225, "uuid": "39b80014-f04a-45b6-84e3-03c9c354a8e7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570225, "uuid": "8fcc9fed-d593-4296-be10-ade5358dff7d", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570225, "uuid": "3c18f3f0-5768-4251-81e5-31a8a8a5c2c5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570225, "uuid": "a74d5b48-1c9b-402d-b22f-ea05db80625f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570225, "uuid": "b4dfe51b-3627-4c35-9a3e-107a6656a648", "value": "161646fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3006073c-ba69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621624650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624650, "uuid": "f97b6b07-1df1-495d-b861-1959f4fc81ef", "comment": "Malware payload", "value": "42c31f71ff0c16c46847a3f877e7aad1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624650, "uuid": "e2c33449-c305-4cbb-a308-6cc14a27d96a", "comment": "Malware payload", "value": "6dbee4619ad921ea2e6466b224c937dc4ea0d9bd492b8194c9db20c003908f38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624650, "uuid": "e2e23668-dab9-4e31-80df-ec97eb7336ec", "comment": "Malware payload", "value": "cd7a7de4991504b165f84b1a6fd118e9964d82e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624650, "uuid": "bfc2418e-e50a-497b-a794-acf1e0144472", "comment": "Malware payload", "value": "2a16848aa0e8ba36026a7964342a37fa95ef3056bcda4563b57efd60e4692c7db4a69738c93e2b291361c34f73637640", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624650, "uuid": "aab77980-f539-4b0c-997f-30e86739b93f", "value": "1E51876E6555C243D1F35B91100B64C4F73C62DB36A1FD7CC8848163680BFB9509D6E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624650, "uuid": "100d27ac-72ab-4834-b451-bf3f7e878861", "value": "48:kEpxFITFITF/ehIcWTtPXspaGSXy33v31k4fCAbI9bKrboC4zLI1nZ30vE/kpIeI:tFuFuF4IcWxPliv13I9wsFI1nZk/IeJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624650, "uuid": "87c78ae9-88dc-41b5-8eb1-ac3b8fd83ee6", "value": 2608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624650, "uuid": "fcc03a8d-0046-4997-a638-93e17637593d", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624650, "uuid": "66ab2209-d71f-410f-bee4-24f643c48df0", "value": "42c31f71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc44082b-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616725, "uuid": "90d6af13-919e-408c-86b0-4b3b0afdc651", "comment": "Malware payload (Dridex)", "value": "c28b2134def6fd33d5f699a4019590d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616725, "uuid": "f631da47-69d9-4309-92e4-0601a485097a", "comment": "Malware payload (Dridex)", "value": "6e10d0750b0483e41f8e697259d76afd717bac19cc9c5a81ec668355cd451d44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616725, "uuid": "04009906-8647-4b63-9580-c541ae2d12f2", "comment": "Malware payload (Dridex)", "value": "22bb96e68ec06bfdd9786b595d83dee3a337b01d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616725, "uuid": "90c972c2-930d-4eab-85f1-b8f7012fee87", "comment": "Malware payload (Dridex)", "value": "df5788b2eaa03ebc8f6d6c7384290a84d41358a600ffa5e710b6e967b7d49a062bb5d740689b7c0b51a49774a725d5d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616725, "uuid": "0223908b-61cd-4661-aa9b-b7c176d0221d", "value": "DB04D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616725, "uuid": "8f86f009-5e10-42e3-9b58-dea2a1ff91d1", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616725, "uuid": "c9bf33b8-e562-4f05-9330-bdeb8155aff4", "value": "3072:MqWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:6VqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616725, "uuid": "a2ad8f0f-d910-4640-8342-5661a3d1c26f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616725, "uuid": "d443a45d-d304-4431-835b-294db4fd541e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616725, "uuid": "90b9d85e-9a05-4680-83d3-cbe6954d52a2", "value": "c28b2134_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f300279-b9d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561486, "uuid": "03f229c9-6257-4a79-b309-681db81f8096", "comment": "Malware payload (Dridex)", "value": "2af8821f6997ea650a9ae3c9a81e1375", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561486, "uuid": "0ac95cca-4454-4288-8502-e698719180b4", "comment": "Malware payload (Dridex)", "value": "6e85fb6caa55efca8ad1467bda227bae1720ebcc62a4bd51f81adcf581efe7b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561486, "uuid": "d7105852-9f01-45b5-b4e1-b79551d01ebf", "comment": "Malware payload (Dridex)", "value": "7b637e2c4c63c98c151438cdc33ac67dceccea5c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561486, "uuid": "03635a6b-6d0e-45cf-980c-dd0feffddcca", "comment": "Malware payload (Dridex)", "value": "3ea8f030e734fbbb44336a540507af95cc595dd0697c5a08739f3487980143220b0976e7359c7ed00cd23faade1ed8f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561486, "uuid": "fd5916b2-93e0-467f-a351-820fc23a699b", "value": "4BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561486, "uuid": "4d5586c9-5d4a-4de4-9de6-bc309e195fc7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561486, "uuid": "5fce5ad9-8664-4882-9431-ed7b580b8adc", "value": "3072:KiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:JeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561486, "uuid": "2df88f61-494c-44e5-9908-a546169291e4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561486, "uuid": "cfde64da-e559-47f9-8282-ed0f28a378bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561486, "uuid": "e01caf1a-4634-4a27-a873-3e1f993101fa", "value": "2af8821f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc2af3d-ba35-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621602606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602606, "uuid": "007238f7-a528-4c31-8f06-31a2682bd30a", "comment": "Malware payload (Dridex)", "value": "ec5b851c5d5acd2305033f9747cce336", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602606, "uuid": "8e8aff47-ad60-43d1-acfa-d603d51916f9", "comment": "Malware payload (Dridex)", "value": "6ecbbeae3113533cb0a606781ce2f15b5a3360bb123eaca1220fb107b37499cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602606, "uuid": "906b19a8-abf3-4973-bb09-88e8a55ae58d", "comment": "Malware payload (Dridex)", "value": "958de7d3a740f39af79f062388f135524a103370", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602606, "uuid": "87a44a4c-02ca-44ee-a2cd-365bb041c936", "comment": "Malware payload (Dridex)", "value": "d82d41a1d63bab8cf94170ae5a3ba11241cf0db344021767b45e06124f7bcd27a7342590f981965150157e4b3f679137", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602606, "uuid": "e748f837-7751-481b-80e0-226c735a75fe", "value": "3104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602606, "uuid": "6c105203-e972-4f56-bcf2-5b7248c99fc6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602606, "uuid": "d16c800e-5341-4d19-8eca-ff20137e8e9c", "value": "3072:nV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:nV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602606, "uuid": "31d91adf-6e3f-4aed-b54a-8b6be1e74c63", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602606, "uuid": "e44c3ac7-4b8c-4cab-bf90-43a885353990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602606, "uuid": "fd3c8dcc-822c-43bd-98cc-49c81b99ec6b", "value": "ec5b851c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9d4d72-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610983, "uuid": "d28a4658-d2ae-413e-8ee1-1a3480ad3cc3", "comment": "Malware payload (Dridex)", "value": "6b8df109048f39735263a2508bf9da3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610983, "uuid": "2fdd4c3b-04b7-4fe4-8008-2b3db3dbcb10", "comment": "Malware payload (Dridex)", "value": "6f296a34bf3356eca8b19faad0503bc5975d469c2550cfa9725e6b1b85467cdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610983, "uuid": "78d23ca0-e5c3-4287-b106-eebeefcda4d9", "comment": "Malware payload (Dridex)", "value": "3cb549b9e3c8b64cd5a226f5ef06f990398834ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610983, "uuid": "554dca4e-1990-4f07-a48f-a3d444b2fc25", "comment": "Malware payload (Dridex)", "value": "0b7f7b2c0d4ebbb3cd81a06cb3586513a1a2cbc6eb64e9fbfeab09f419e41bfd89933268f33152b814d8ed97154e9c32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610983, "uuid": "07401802-0cef-45ad-bf69-ec263dcbc1ff", "value": "34F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610983, "uuid": "207f616c-dd8a-4241-8dc6-453479e71d24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610983, "uuid": "a4122672-fe4e-4c8d-8c0b-8991477e2494", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610983, "uuid": "d106e72a-6592-4589-ace1-e7d059e7e1f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610983, "uuid": "9bf5cb56-60fb-4818-bad5-0212a8281a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610983, "uuid": "e7c220e9-ab23-4616-aba0-b6a202c10d82", "value": "6b8df109_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10ed5a7-ba3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621606881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606881, "uuid": "e9a33c9f-b909-46f8-9f21-cdcad772458f", "comment": "Malware payload (Quakbot)", "value": "3a6eb56138a4aaa699bfee226919a0ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606881, "uuid": "950cd35b-399f-4e87-b48a-0b7d89119dbb", "comment": "Malware payload (Quakbot)", "value": "6f391c0fac71f822909016563aff4dd8754158b28c9eaadb76794f6b9546833c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606881, "uuid": "637856b5-c504-4ff8-bb3d-ad4bd2d82c5b", "comment": "Malware payload (Quakbot)", "value": "1e290b1ba40525b561d1bf43c9ce627cd33d6e1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606881, "uuid": "0bca4bff-a8f2-4a8c-b3d7-57b29a89b565", "comment": "Malware payload (Quakbot)", "value": "5f964397b757c26b0a39328d9f86097a1431032a42f205285ce8aef44f661d0b56ececd10c00153a333a64494f2fc6ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606881, "uuid": "947cf62e-1507-4bfe-80d0-a0b7a3b7f53f", "value": "72156B67A7DEC552FB331FBEB1839A4406F2EC932032513D05E03A19F976A7428A6774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606881, "uuid": "2cc60fc8-fc6b-43b3-8a21-5fe3b1c219af", "value": "3ed7f74ccd1e2bf3bd69362a05383e50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606881, "uuid": "d557b563-8515-4c25-b047-23de8a67134d", "value": "12288:SlMOkOaC1K9dC9XSlxxUf1udJJOVB8FWNX:4MyPIGVSRdfOVB8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606881, "uuid": "302f264c-5186-4bb6-8b73-6b1c4b239127", "value": 876515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606881, "uuid": "45d25fa3-edea-4555-ad14-80a592e243a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606881, "uuid": "ebd67f04-3cdf-4791-8a34-ed84a2b0c90a", "value": "filter.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7654e0-b9d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561694, "uuid": "20d1a8cf-7982-4bc4-8dc9-dc4e1620fa1c", "comment": "Malware payload (Dridex)", "value": "bfede08172cd92c38532810a8730ba87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561694, "uuid": "f4f23803-e6c8-4b1f-b81e-5e6a03290717", "comment": "Malware payload (Dridex)", "value": "6f55dd53cd88a4784cb9a6ccc6814cf56e000548de5522ffeee10eb79cf44309", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561694, "uuid": "01395879-09b2-40c8-8044-cf0f18825cce", "comment": "Malware payload (Dridex)", "value": "c267329992a8e217a6cd226a133c731abbbcac54", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561694, "uuid": "932f3fdb-3510-4958-a18c-6fdbef15e14f", "comment": "Malware payload (Dridex)", "value": "d6ea8f519fe287cb7d241f7c3a1c1b9973297c145db4f34eba10d1922fbf13da55b99dc5c026e53b3161e0acd308359d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561694, "uuid": "c18af557-68a2-4b6f-ae28-bc3b1ddd9149", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561694, "uuid": "cb5cb166-7023-4bc5-8592-a9902e24ae50", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561694, "uuid": "d48ee64d-4b61-4065-b8b1-737c3013c0c6", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561694, "uuid": "3f37472d-ec7c-45a3-9025-16534582690d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561694, "uuid": "f86e56db-a944-47f1-ba59-03cf33f474db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561694, "uuid": "68e6f763-f40a-4f15-80dd-1015fa5085f4", "value": "bfede081_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0b3cf8-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621575149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575149, "uuid": "1e87db8a-fb16-4129-8800-e4a1782c341d", "comment": "Malware payload (AgentTesla)", "value": "8c0e5635337112fea5e438ffc9df7159", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575149, "uuid": "d1c6f965-92ec-4ce4-8c79-898f879bde4f", "comment": "Malware payload (AgentTesla)", "value": "6fa6547ef5a7c0392647c4dc9538818fe0c18b2e209cf297a26059249aa3c7d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575149, "uuid": "b2ba54c6-465c-4ef1-b8ed-64efbfaaa0a9", "comment": "Malware payload (AgentTesla)", "value": "cc66bbde9e3cde3b35b5d1f58b536efa4939eab1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575149, "uuid": "cc1f2412-7022-4f17-be95-4b2716c3b07f", "comment": "Malware payload (AgentTesla)", "value": "c9867ccca525ee1669719d27db1142de36661e2c32616c1440a8c4f75fe4f989896dd64147ee399eeed7b3df9ba2f50f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575149, "uuid": "6e378120-04d5-4809-bbe5-46e9cf5c4d24", "value": "EAD4AEAC32A075DFC86BCD728EA82C60AA217467470BD2479457119DAE0DBDBCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575149, "uuid": "0e5cc185-3406-4a06-96f8-3b0e40d1aa15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575149, "uuid": "3c83156e-ca69-4906-bc92-294ef8e5dc56", "value": "12288:20oYTV1Temsru6sicvQGL5tacg2YqEUAZaFKj+HAMQI:20oYTVHX6s1YqtaZ2YRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575149, "uuid": "7411f5b0-fc92-40e2-9a45-98157123daaa", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575149, "uuid": "f4d9dd95-a64a-4ef3-abce-83656d078df7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575149, "uuid": "d62031e4-0850-4b69-b3be-8fd438824ab4", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e799ddb-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634714, "uuid": "c9cf1871-17a1-4ab4-8b0b-337ffda7afde", "comment": "Malware payload (Dridex)", "value": "c507450f46373e2e7f7a1caabbf415e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634714, "uuid": "59c4fbde-2e8a-4d1b-a67d-4275b0195e4c", "comment": "Malware payload (Dridex)", "value": "6fc08acd7497b24f41d9a1759c64d51e827951e48065a878a6e7093ed38564ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634714, "uuid": "ba7f0bdd-8721-42a6-bc27-f15afa645883", "comment": "Malware payload (Dridex)", "value": "956fe984d015025f76289d571c1708abbf92b340", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634714, "uuid": "d6b5818e-de8b-4489-88d9-e0befa9de118", "comment": "Malware payload (Dridex)", "value": "e6831ad1b4aec9c3514a855c4c49ab3d122ad3564ac1f6661e01df5be1573cb74d6726bfbce9abf9d372f706f72067db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634714, "uuid": "393812a1-f2ac-4271-afd2-44e7068d9df1", "value": "30F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634714, "uuid": "4faf3724-5d14-4091-bd15-bccc3ca85b8c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634714, "uuid": "b4515122-c685-434f-83a2-a3eb3e5ccc87", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634714, "uuid": "6e986395-943b-4389-a7e9-b95cd8ba1b3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634714, "uuid": "a21be104-def4-4c57-915d-911d02887151", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634714, "uuid": "4ead3272-f5ce-44fb-a250-d6d4061a9ca0", "value": "c507450f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f905d3b-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575713, "uuid": "93c3abcd-c155-4b77-818a-5f2e74f874f7", "comment": "Malware payload (Dridex)", "value": "430e97fa18436d39b52ec29c4fc7cecc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575713, "uuid": "4c15f47f-0b94-4822-9008-62ed6ffadcb3", "comment": "Malware payload (Dridex)", "value": "7084cabb7aa9db8bb10225b5d51a88c90893d4bcb7924deae22aae48b24bafa9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575713, "uuid": "218e0a96-06cc-423a-97ff-3eb9c2a8e01c", "comment": "Malware payload (Dridex)", "value": "2d961ff60f2146fa6746c48c57f5555a3b280cac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575713, "uuid": "040e997e-a186-433f-aeec-58317c300c6a", "comment": "Malware payload (Dridex)", "value": "1caf2cfd26a32e181c7f8c92ea4046cc97e3d7c8e8ac2e58f16d025a250e8ae3d1f2dda06e14cd3dec419b88350eeee9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575713, "uuid": "45c8b9c9-14ea-42b3-8ec9-9fdce479f9c1", "value": "ED04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575713, "uuid": "e2834ba4-b3c6-4af6-b7d3-8dc47965cfa8", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575713, "uuid": "75542bc6-a081-4785-9b66-0f15a8c69d6b", "value": "3072:6i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:6H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575713, "uuid": "250c4a3d-3a48-44b4-9f9e-d308121fb4f2", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575713, "uuid": "d589d609-8663-412b-ae04-5560ab7454d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575713, "uuid": "0fab8c43-f92a-4d64-ade1-c1b3072e60d6", "value": "430e97fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0ee561-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621592780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592780, "uuid": "48a9814f-0e81-4cd3-935e-a3901f2bab5d", "comment": "Malware payload (Loki)", "value": "96850eb70d4309605aa866d572bbd82b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592780, "uuid": "2a262964-9528-408f-8bf2-f8e1a7f88635", "comment": "Malware payload (Loki)", "value": "70acbfd30dc88c3cf1c3f8106f99a4cb3a735e353832af3ac6dff9937ad4968f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592780, "uuid": "f06a2d98-eda9-40ca-be2b-33421a688adb", "comment": "Malware payload (Loki)", "value": "d30fec8b3b1bde1bbd5ab761b7fe1d6675ac21fa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592780, "uuid": "e023cc62-ef06-4720-b06a-1e5f9aacdb63", "comment": "Malware payload (Loki)", "value": "2b957a7b955c1b57e59c26cb10f8df2f831ddd5d22760bb04d9b2b5b945ffeeb25ded28a94d5bb9b492d240f401aa978", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592780, "uuid": "44013267-31a2-4ebe-b2ed-6b156610cd9e", "value": "595523176DC58F0BD68353F0131748BC0769ED24B309D489391ABBE865B773A8A8F0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592780, "uuid": "9a2bab3f-f681-4c55-806d-960eba249808", "value": "24576:MWCw+KfxntgZHZHp+iaFYW4gtRjCbsr9VtRIw7urT9lIfNDwm/:bTnyHZTaFfvt75RIw7uv9gNUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592780, "uuid": "371b94a6-52f6-49c1-9c03-c1e616acaff3", "value": 1362432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592780, "uuid": "05b2bbe5-9e99-42ef-baa6-2375e933a942", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592780, "uuid": "4dcac6db-c787-4075-864e-fffd0e5adccf", "value": "Arrival notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76470855-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621611883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611883, "uuid": "3330ee8d-3320-434f-8777-614a2f7b285d", "comment": "Malware payload (Formbook)", "value": "2afd65df7d64ec413029194e8c3b258e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611883, "uuid": "29d0f8a0-8aca-4ee0-8a62-600557133b6b", "comment": "Malware payload (Formbook)", "value": "70fd882cc398bdba539098c530093e45b505c386223b6ec376eff38113624d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611883, "uuid": "3f08c3ec-a933-49cd-8900-7882fa4d9769", "comment": "Malware payload (Formbook)", "value": "6075ee5e61101fff00d32d9e6f2e9768a8550b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611883, "uuid": "8998ce54-5bd6-48cc-ab20-578df7769537", "comment": "Malware payload (Formbook)", "value": "5a161baff33e3c5b6e44ed7883b91d699a600d8eefbda359a1ded40df3ec1b64d02eb35c2ff5e46535f28055f6ab07c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611883, "uuid": "3d5d32dd-d250-4ba0-b2e2-78ec06940e4d", "value": "1034126B37D2CCA3E6976D365436B8B6FBB23A01BDA1120F4B646F2614172CA304D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611883, "uuid": "b299a995-f0d4-421c-a4cf-18f9fc01f57a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611883, "uuid": "b3a59971-26af-4d2e-915b-d1ac2d66843e", "value": "6144:Ds963zgfqAfDzsQr1G85sEPpxMhGTnnu4449TD/Yh:yB9oQJTRx/n144B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611883, "uuid": "a0f7bde9-f84f-4e8c-a8e6-a1974d126c12", "value": 235314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611883, "uuid": "7764f1fe-2ec8-402e-a62b-95150da03d9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611883, "uuid": "814d2407-60a5-48d3-ab8b-73cb18eb9019", "value": "Delivery Note - AWD 200038485852- 234920300002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c949e6c9-ba3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606009, "uuid": "9f063f5b-ca1e-42be-b7b7-a2541558c920", "comment": "Malware payload (Dridex)", "value": "ba21ef80e8129641ffdf9cd579d5ce0e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606009, "uuid": "7ecdeb5a-f244-408d-9be0-8840dca89f79", "comment": "Malware payload (Dridex)", "value": "714a19957d545971aa09a3005fa88cc24d87d1eff09d22ff75ba6abaf021dd55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606009, "uuid": "370df0aa-43df-4fa9-afac-b9cb95222566", "comment": "Malware payload (Dridex)", "value": "b9d91aac0e0e534b6d5ec0acb609a2e89032e3e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606009, "uuid": "07aae2ee-439a-4681-a21c-19566e75c8f0", "comment": "Malware payload (Dridex)", "value": "d7d93befdee52469c277daecbc2a2d59ca463b2284ac7138a64a61451e7fb92ac81dc21a4ac27b75c53fc30c41318c64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606009, "uuid": "81b5da79-9aa5-4aba-addd-019d9eadd2c4", "value": "25F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606009, "uuid": "ecb3e77d-68fd-4bcb-9f49-d202bce95b26", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606009, "uuid": "8bb60a37-5375-480e-8054-1971b4d1e173", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606009, "uuid": "7015a388-d286-414b-8d6d-1d52ee9f1c8d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606009, "uuid": "da8bc653-9518-43d6-9f54-95b3fd50b0ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606009, "uuid": "c78434ad-ded3-400b-a3a0-580ddb61a760", "value": "ba21ef80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b144f900-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580629, "uuid": "6fdcf7c4-79dc-4ab8-8228-93c1a6bc25c1", "comment": "Malware payload (Dridex)", "value": "7177366fe642e309c98acae2835c332c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580629, "uuid": "c7cb2661-10ed-415e-93e1-52ef462f4c36", "comment": "Malware payload (Dridex)", "value": "71558444be6e11daa430c54393c50d6e4abc0b953444fbfa2809f00eb72e2f91", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580629, "uuid": "f4cf4baa-0efa-43a1-ade0-0216d38e80cb", "comment": "Malware payload (Dridex)", "value": "f90fa1478337a6b922c5d6eb64a07668ada3a2f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580629, "uuid": "38c15d1a-5f34-40b1-a988-ed60217f9b2a", "comment": "Malware payload (Dridex)", "value": "47560db14ad326fea489bcfd29ab7ea20d613d81ffe0e4d85c53ddf7775a189e59703cd8c8280f4b7dea2caca7602e3c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580629, "uuid": "cd142a80-25b8-4bf9-bd68-3c3a8d764116", "value": "B004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580629, "uuid": "f5c0f1b0-ea10-4cfa-935e-c684bc962fb2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580629, "uuid": "989a89e2-8622-46a0-bf47-9d480d595068", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580629, "uuid": "edefc4a8-502c-437b-acef-ffb1927d0452", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580629, "uuid": "dc0b6e2b-9f67-41d8-a2d8-7856c9dcaa60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580629, "uuid": "ece3c8d7-0968-470b-b2c6-079b51f66872", "value": "7177366f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44284db-ba6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621627449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627449, "uuid": "68de9846-23ca-4b55-a96b-70aa55d9e309", "comment": "Malware payload", "value": "e8139bbda1ac070be4c7035c0fa37d15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627449, "uuid": "1f6072d8-a8e3-41ed-a68b-e0b2ace6b018", "comment": "Malware payload", "value": "7156387ad7bb9d7ad12f16ea542790d63283abe8d72072730d43aba3696bc05e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627449, "uuid": "21a48e86-d93b-4f0d-9f1b-43ceb3a20ee3", "comment": "Malware payload", "value": "23bd1658cda614dbcd94f5c8245442f89fdae6e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627449, "uuid": "c10fc0b5-0de6-4eff-8f83-59027c592d22", "comment": "Malware payload", "value": "59ba7a8ff65baf8ee61e26eb94da3ad2f2aaa547cc1f9fb5d1a691f943331848796bc425e783e067f55853da94ad2060", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627449, "uuid": "92050604-2896-4d0d-95a6-9d430e1b1eb7", "value": "99F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627449, "uuid": "5395fa54-89dc-417c-9c82-8e883dc10c83", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627449, "uuid": "a340ff65-3a04-48c0-b5b8-078056575402", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627449, "uuid": "7a6d765d-b685-40d6-9987-638e7809a129", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627449, "uuid": "e8e5e363-cc1e-4f3e-8493-c1f17a547014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627449, "uuid": "50da5531-42d5-4d72-b2cf-31ea0ceb0cd0", "value": "e8139bbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd16ce71-ba78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631356, "uuid": "248eac42-16c4-472e-9cff-6a5783086604", "comment": "Malware payload (Dridex)", "value": "6d379d4825f40a84354eaed49cb5ffc7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631356, "uuid": "3b76e39b-3eb2-42a4-bd51-65aed751b25a", "comment": "Malware payload (Dridex)", "value": "71979664849f7ae8d95aa5abededc90ead98926344894091751ba9fa863376c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631356, "uuid": "716290ee-18fe-48d2-9d24-b50f369b1c4c", "comment": "Malware payload (Dridex)", "value": "018384b488a4bb3ea46f4f4305c0d245404f3c53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631356, "uuid": "ba24b02a-a6c1-41b5-8de4-c997121b9c3a", "comment": "Malware payload (Dridex)", "value": "fdd748ffc3a9a2e77239892d922303f30cc323647b418a246464909239f005cd917787961422504e500edb6b2d1c51bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631356, "uuid": "d7bdc2f9-3003-46c6-98e9-5c572225dcf0", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631356, "uuid": "ba90ddd3-f862-4471-96b1-9ae4b4e76b7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631356, "uuid": "f65a53a6-8c88-4c66-a754-4d2e39bd5c20", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631356, "uuid": "b6f327bb-a7b9-41db-bebb-976d954f264e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631356, "uuid": "8eb77876-de17-4b4c-b0e8-19be3b1e9a44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631356, "uuid": "75bcc026-509b-45d2-ab07-29280b10aebd", "value": "6d379d48_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51daf717-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609245, "uuid": "ed56295b-3991-4686-b1b8-7f0ee8e662ef", "comment": "Malware payload (Dridex)", "value": "46618cdc2d80c191e784a39b32221e7f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609245, "uuid": "19fd3607-a3ee-4e3c-a904-1fc3406021a0", "comment": "Malware payload (Dridex)", "value": "722236f668902b0a0e2ee4e10bc1a457519fc6ea1a36dda44182be31aed03b28", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609245, "uuid": "f0565420-59f9-4cb3-8dd8-0eea832746df", "comment": "Malware payload (Dridex)", "value": "8462e546c8681f0d636df5b9c474e1babd54cbdf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609245, "uuid": "b4443ee3-3255-4d88-9495-778b7224a509", "comment": "Malware payload (Dridex)", "value": "f2ca1ff4688638b12763c59daea056aa4df78e56355f1914d81ff8349d474fa7a4f469b8763096e86f16295f69142a7c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609245, "uuid": "ccbe0ac1-8184-439e-9499-3ed290552ca3", "value": "46F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609245, "uuid": "a801afaa-4246-4a93-913b-2210e163cac7", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609245, "uuid": "c83dff98-3db4-48c0-934e-b9b72b8881ba", "value": "3072:u9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:u9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609245, "uuid": "143b5d05-2a6b-4444-b379-9c0f10f2669c", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609245, "uuid": "f6cdd5f8-69f8-4c75-acb9-3d61357a2056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609245, "uuid": "9d0e2286-5146-4330-8dd6-c50896902bb1", "value": "46618cdc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9044b2-b9cc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621557245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557245, "uuid": "b2abaeb1-fad5-4bd1-8fe8-b76879e7ff0c", "comment": "Malware payload", "value": "d0ebc7ac2870db5105ad66efedff98c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557245, "uuid": "b0b13ce2-db96-4e01-bdad-424efcd20b87", "comment": "Malware payload", "value": "723270764860d5869742e6621d801497696529357030f3943311febdc6a56471", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557245, "uuid": "a83d645a-b962-44c4-92c0-7b1265f09d1d", "comment": "Malware payload", "value": "9df7f2013a7caf342890d5664057840157fc7d60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557245, "uuid": "2e78c1c6-d200-4ced-ad47-99060cdd812a", "comment": "Malware payload", "value": "43cdbf062cc31dae69480a87d0f753dee353d60501723d0e527743346e2371b1893cb190013c503ff00f21248ded95fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557245, "uuid": "1d781ae5-db67-473b-8e06-aaa399c27989", "value": "17E2F103A9936461794D1EE71B480C0328A8600F37B7B864F5F856BE23BF1F79496A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557245, "uuid": "c1063f0d-0a82-4b06-bb4b-d811128468f0", "value": "768:clag6UHfQbV3fZJpXOIY57Re76K8U2AfulYjIlq2P6zCr:clnFkV3fVY7Re76Kh2aaqg6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557245, "uuid": "0e7374a0-089f-4656-b818-798f09fc6e98", "value": 32550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557245, "uuid": "57911a21-5ff0-4d06-b5c0-552e9b2900e7", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557245, "uuid": "971e5d69-5a94-4d1e-9fc5-b618ada2de7c", "value": "d0ebc7ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076de265-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621591511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591511, "uuid": "46ac29a8-c049-43b5-b23a-a942cfe751dc", "comment": "Malware payload (Formbook)", "value": "bd729c3615da51985b6152e6a698a527", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591511, "uuid": "6205355b-a841-4c17-b76b-925c8d5499b2", "comment": "Malware payload (Formbook)", "value": "7256b8519136bbe02f9ff0ab9706bd9710de5fc4b6c0c3b82ccec398d86fe3ea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591511, "uuid": "c0d25464-a1d5-40e4-a1be-4631f71edf99", "comment": "Malware payload (Formbook)", "value": "96057c67410d8eca54a6b8de4f9a5915c3b693a2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591511, "uuid": "b8ac2674-5b67-4358-8e23-3ee9fd5aca1f", "comment": "Malware payload (Formbook)", "value": "7f5b1456cd5e86d5a71a7b8eaba4d3a99a458118e2d3b784294c71ef027a9b262dc0b995ffd577d505de13256bbfd7e6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591511, "uuid": "d34109bd-3816-4d54-81cc-869d02ae8ed7", "value": "A715B022F251403BC56A1A349C0756F49A3E7E30AD2469573AF93E0CBF356917E3A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591511, "uuid": "58ba56b6-facc-4898-b688-fbc543809849", "value": "3e8a518ae58159a44bd8bc83008aa8aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591511, "uuid": "3885a445-3db8-40cd-ae98-d89dbfcc4215", "value": "12288:mS80SbYOAD65QF6ofEwawyWCqGjUwudw1239PadHiomSD1zmEyCiomu88888888v:m3VbRAQQF78waJqqtGoOAHaCys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591511, "uuid": "f329ecea-5891-426d-8272-313f918de45c", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591511, "uuid": "a78b5a8f-45b5-4c27-bd57-43cf36d6dfc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591511, "uuid": "2a681fcd-50fc-4790-9f9e-9503180e5563", "value": "bd729c36_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd1aafa-ba79-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631629, "uuid": "0349d7ab-d43b-4af3-8498-f5dcbf5366bf", "comment": "Malware payload (Dridex)", "value": "1587e4bd12622c5cfd12d03735c39e1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631629, "uuid": "9033cad7-50d5-4c53-ace5-e443945ec133", "comment": "Malware payload (Dridex)", "value": "7274a74ad71c7307f611146ed20d1a595e33cd610d62b8b52325212226f499ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631629, "uuid": "34a19452-6efc-4464-902e-e9c96f290d8b", "comment": "Malware payload (Dridex)", "value": "47b1729baefe3449a295cb26b81a03afb26285ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631629, "uuid": "ce251dad-9668-4ea7-b25a-4b9adb612079", "comment": "Malware payload (Dridex)", "value": "88dab7ead3fa7953c5641c3ef515ea646768c9e1518bbea97bbd134281b6f51842ea4bd1ec969805b332ba8845053f91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631629, "uuid": "02ddece4-46bd-478a-9628-7300a92b5ed6", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631629, "uuid": "58d2ce1d-fa66-4366-84c2-a6320765c3b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631629, "uuid": "cdbd0a4c-a4a6-4463-8de7-65d4e3b7bec1", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631629, "uuid": "b54671c9-0ee8-48a4-8b1a-60378d83c001", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631629, "uuid": "3b82413b-b9d5-4071-8901-4de0edad46b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631629, "uuid": "a12d01cc-7691-499a-92bf-33bcb72739e7", "value": "1587e4bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c91f53-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574063, "uuid": "857af5cf-71ff-4083-8562-90577402ac30", "comment": "Malware payload (Dridex)", "value": "89d6fc2a25a98af4524013d5bbe5e81c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574063, "uuid": "2d5409dd-8a56-4197-8c29-3566f8531670", "comment": "Malware payload (Dridex)", "value": "72865dfa2d1c73d0ff49bd60e11fd6d481d5484be79e247c28fd0e0f0e4ca00e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574063, "uuid": "17ec40a5-ad86-4189-9de9-70b895c72e63", "comment": "Malware payload (Dridex)", "value": "72394a510e3978e54f9b281f850b5d695fd3a026", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574063, "uuid": "c015ae0a-358a-47ba-bd0e-df50e2074b02", "comment": "Malware payload (Dridex)", "value": "d16d8c3e35c35e060712c078d9271c88d7ad0f77d5c56dcce67c24a6692500972396446bf7fee64ac7c614fd655fce35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574063, "uuid": "0a2b4f22-7172-4c9f-ac64-292a8d19f999", "value": "BA04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574063, "uuid": "43b67282-87b0-4093-8841-b3490d42d363", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574063, "uuid": "5d44869d-c583-4d57-acac-73c87046d723", "value": "3072:NWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:NWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574063, "uuid": "e59930a1-b4c9-41c4-910d-7efb66e235b3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574063, "uuid": "5f43b1e9-d1b2-4b27-a08d-11dff8fbb915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574063, "uuid": "4e0bd190-054b-4c08-ae8c-dbc2f88244bb", "value": "89d6fc2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ce85c4-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572152, "uuid": "8480068b-4968-4eb2-a66e-e42aedc14a23", "comment": "Malware payload (Dridex)", "value": "3107a01529ab9b3f38a41ad58b72e9f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572152, "uuid": "ad775092-62c9-4fda-a3a7-da2284637a7d", "comment": "Malware payload (Dridex)", "value": "72b1bfc8ffef7e4dde0711562c7b87484495a33ae7646dd3cd9c89a7104d24be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572152, "uuid": "0a86287c-3a53-4885-a109-08e7a48a3656", "comment": "Malware payload (Dridex)", "value": "a1a45773d3fb03b6746cda4e66bc72df65c4e98c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572152, "uuid": "2d31cc39-9a74-41fb-b019-6c9614513a92", "comment": "Malware payload (Dridex)", "value": "61cf0f4e1c8512e0d160d16c1aef12665541530e9b29b4fb04079be0e7ac64a25929eac2fefec68dde15edad8af5f6f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572152, "uuid": "a3ec1c00-d641-4244-853d-bbd41f2de583", "value": "8304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572152, "uuid": "336b5f71-e0a4-4b65-b300-e9f2f5dbe436", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572152, "uuid": "98bd2cba-8651-420c-8f9e-99c0b8edba05", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572152, "uuid": "d9434fea-62fc-49d2-86e5-a8a6ef43b4df", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572152, "uuid": "d0c7f9f8-5419-4ec7-aa14-c1833078c825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572152, "uuid": "bd4c1567-dccc-4f00-a445-778000472279", "value": "3107a015_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f9b056-b9dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564395, "uuid": "f8ba43d8-6f1f-4ecd-b751-8575fff1978c", "comment": "Malware payload (Dridex)", "value": "5b54bd2e78dbb18ddd4306d108f63b53", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564395, "uuid": "e90a81a3-822e-42c8-ba1e-0f8499363224", "comment": "Malware payload (Dridex)", "value": "72ffa4ecdb88dbd98d32138807628e02ab3bcc5c92bb12be80baa324d13c6919", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564395, "uuid": "6c461b09-bf0d-4493-bfec-a8b0d9ce6c81", "comment": "Malware payload (Dridex)", "value": "143deefba57aa9fc789a3382b89c65be865b12c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564395, "uuid": "68c081a3-d175-48fc-b06a-5f794abe9602", "comment": "Malware payload (Dridex)", "value": "28761f8eb704e5f3c569c83ec14621cac9f2630f11342a4999f47f0a69e6b6e40e2858a86368695ed5c9401c59f8f9f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564395, "uuid": "92c057bf-7c25-4888-a14d-4a25e046bf9d", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564395, "uuid": "97bd094f-6e12-4560-8bf5-ac583614d925", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564395, "uuid": "926d84b5-6406-4c8b-bd4c-d5599f81094f", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564395, "uuid": "a6d291b7-256e-4aae-a2c8-f33b9f6ef052", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564395, "uuid": "b1e48aff-e1fc-48ad-adff-4da01f3b6051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564395, "uuid": "00c66a10-b92c-4c4c-943e-4f87b820551c", "value": "5b54bd2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc26c569-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613718, "uuid": "c6512fb0-c726-4790-b095-414a94f10f1e", "comment": "Malware payload (Dridex)", "value": "a972101bce7e755a89b6cc9626a2aceb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613718, "uuid": "c779373d-deea-4938-a72c-c4717287511b", "comment": "Malware payload (Dridex)", "value": "73139d3dd707e22e51f799d5f800c7e1c64968dbfe672e7751c1845b33d157d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613718, "uuid": "2099cb52-142e-44d2-825a-ca2df3853f9d", "comment": "Malware payload (Dridex)", "value": "bcfe0ee318e011210c9ff5bf91a18f6c7e3e55eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613718, "uuid": "2ff95278-f83f-45c9-8462-8308a9004564", "comment": "Malware payload (Dridex)", "value": "b3eb6b0c0f671388cf4a575e61d0171593177287b2cdfa13d78abb035220492ea85060f1839ec9971bdcda0e58628d96", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613718, "uuid": "0b59dcc9-d11a-42a8-b4a8-f1b0a68aa9c7", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613718, "uuid": "2f9e5e0f-cf2b-4012-9673-aafc011d7427", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613718, "uuid": "1fbdba33-ef0f-4aba-be38-4aed49b793ae", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613718, "uuid": "04a5f178-fc1d-49bf-b1e9-7ca3fa2416e6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613718, "uuid": "a54c3916-6b15-43c2-bf5c-296cce9b7aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613718, "uuid": "ded4645a-9a08-4e8e-9247-04aa69594ee3", "value": "a972101b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48693a3-b9d4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621560904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560904, "uuid": "f6fa8e3d-c867-448a-95a8-c821598744b5", "comment": "Malware payload", "value": "8e1166412c97b7eb58d810771416534b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560904, "uuid": "db721244-6383-4577-8689-0b602a5de8c3", "comment": "Malware payload", "value": "7391a97da11e3a2d185c0e61088998bebb5a3a74295bd925c9715df652fe0fa9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560904, "uuid": "075adf54-06fe-437e-bb77-91a40d6a3dbd", "comment": "Malware payload", "value": "5aed6b0d7bcebdd36334736cf29bad6eec4f20ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560904, "uuid": "4aa1b37b-8996-4401-b6c1-1b620997d2cc", "comment": "Malware payload", "value": "5eb59166ae6f7aaef08f6cc543c2daf8bad9a6d8990bb5d65d67d640012ecb4ca5d000927cc28e7befe07e7f1a28033d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560904, "uuid": "d649ef90-eb30-4d27-9092-ab4e75e421ae", "value": "0723F15E6A4F559AAFF2BA3452220D2C455D00A39908FB0F3A59E7E0D8F7C811B4DE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560904, "uuid": "0f03ab14-d2bb-47db-85f2-8690012ddb58", "value": "768:2mpWH1w74/LUrs5gFNBejXSpug+ia95zMr75kDZRj0EzkcEm4pZLPe/uJE89:B61LU98jXSpn+1LzMBk8qkcfMZLPe/xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560904, "uuid": "6b0fc066-24b3-422b-ba6c-ed4a83571d58", "value": 49082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560904, "uuid": "12d75dd3-d14a-4718-9408-6403e5ac41a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560904, "uuid": "650d3733-6911-4a07-a6c9-c49277597be7", "value": "8e116641_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5669cd-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569427, "uuid": "1c4d264c-319c-4f08-86e9-3661baeeaf9b", "comment": "Malware payload (Dridex)", "value": "e25c438698e30e5eb0440f7308568724", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569427, "uuid": "df6184df-aa5b-4a0c-b9ca-66c86a940648", "comment": "Malware payload (Dridex)", "value": "73930fea6787331f4ca2e2e811e2f8912b0cef8804b4ac02b15169dac0375370", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569427, "uuid": "6b10d836-cdac-4167-90e9-7c3a71f55ec2", "comment": "Malware payload (Dridex)", "value": "4f3ddf6d61b1735feeb4373862a5c54f53d2df5e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569427, "uuid": "9237aa48-d7c9-4af8-a617-40d9d25f1614", "comment": "Malware payload (Dridex)", "value": "17cbeeeb1465f0110cff76984a4761223bf956dddf01e63aef84cd4e968c30ef0a0585f13c0ec315f0febabd152a8812", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569427, "uuid": "7a6b9378-1af5-4382-b872-193994289351", "value": "1904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569427, "uuid": "c59e110c-20a7-4b59-b116-ad9538880e82", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569427, "uuid": "b0ee7a15-2b7a-43d0-bb6b-4edeb3dcd460", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569427, "uuid": "fef10d86-5b62-49b1-8fba-257d081921a1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569427, "uuid": "7fd5ecdd-2887-4d28-a4ce-f059a1ed908e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569427, "uuid": "28acb435-20fb-431f-98e5-329c8158e591", "value": "e25c4386_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7e7472-ba88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638205, "uuid": "598aa6e8-7c47-4751-b90f-32ef47206828", "comment": "Malware payload (Dridex)", "value": "c94b8450fc21590ae6a803271e16917f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638205, "uuid": "00e8de18-27e8-4f9c-a1d6-9499ccbf48c1", "comment": "Malware payload (Dridex)", "value": "73a6d2d837ed1c881900c9ae325a17670e60389dd20a7393ec3eec0a52d415b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638205, "uuid": "46f3bb73-ea69-4f0e-abd2-b7a0495c556f", "comment": "Malware payload (Dridex)", "value": "32f03f44656f27e747c6c3a1c85ff30cf8b47a20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638205, "uuid": "dc50c8c2-28f0-4d57-874e-4e17f459729a", "comment": "Malware payload (Dridex)", "value": "5e0c8ef64481a5a89325e4f6b1f4227201cbb1a6e7217369a19511889f4c35218b045b0d74a7f7996ba77485c740efff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638205, "uuid": "258167aa-a1f2-4f53-bef4-e0d4c03d003a", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638205, "uuid": "67bdda37-a4c9-4ba2-b244-9bad7de9c904", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638205, "uuid": "741c21dc-1ed5-4c50-b907-172953637d4c", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638205, "uuid": "cea1e730-24a3-4971-9263-b38c65b7d5c6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638205, "uuid": "d9a8e4e9-fe6a-4a09-8358-6a175fc11a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638205, "uuid": "230ff809-f872-4010-9f5e-9a0de5edd943", "value": "c94b8450_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb859fb-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581566, "uuid": "32bc3358-780d-4813-85f4-516bc720e7f9", "comment": "Malware payload (Dridex)", "value": "cb1841e95521cbd042c76d7c5b486f36", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581566, "uuid": "691cddae-b970-45da-8407-f7938bdb8c6e", "comment": "Malware payload (Dridex)", "value": "73cdaa3093c94054c9e14c017202f2adac4f06a44f155eb9991ce894d664f348", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581566, "uuid": "09566dbb-b908-400e-af68-33828cbd6fa5", "comment": "Malware payload (Dridex)", "value": "9ad3631d2166cbb5ac4a88600c6e838cef4246a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581566, "uuid": "c017217b-3279-466d-8d90-289584851201", "comment": "Malware payload (Dridex)", "value": "eede2dc8edd58bffc2e2657b4b919eaf6e83cad96a58d2a451bebca74d8bb6f6848e662267444f4b6450e6522d293204", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581566, "uuid": "979f0f9f-3a80-4864-9b0f-9db6881ad3b1", "value": "FBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581566, "uuid": "f2711646-cc7b-4425-9668-3be329b03dd8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581566, "uuid": "b45bd9c7-5cd4-4e91-b401-2e43f291bbfd", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581566, "uuid": "2a5acdd4-fda7-4e88-8cc5-4ab4738eece2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581566, "uuid": "6d6f4954-c6a7-4be4-86df-085bd9165113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581566, "uuid": "5fa96ec9-4f53-4f8a-9c57-8fff953df35f", "value": "cb1841e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2af3b-b9f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621576206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576206, "uuid": "67c693f9-4623-4aad-a613-d0985c3fa813", "comment": "Malware payload (Dridex)", "value": "faa32b796875b86ae3b3c0288989b998", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576206, "uuid": "49043dea-73c2-4148-b4db-b6ea0111d22d", "comment": "Malware payload (Dridex)", "value": "73e416fb09bb5892c76524a8b42724f4b325092f93328205017749bf6d746ea7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576206, "uuid": "fc036b66-197b-4412-9668-110fe7198f43", "comment": "Malware payload (Dridex)", "value": "18dadc0b0371a45f2cf7bc495aa5d030cd072017", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576206, "uuid": "03bd23c5-c1bb-452d-ab13-2564dabae88e", "comment": "Malware payload (Dridex)", "value": "eb09c0890a2c0194ddb37bede43603e160eff18fc06f6064d70c9b1cacf1cdf93a3339be3b0d6c959ff89a56a7467c49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576206, "uuid": "a7c419c5-6355-4d22-a422-8c3a295c3605", "value": "D0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576206, "uuid": "d231d08c-b25b-4800-84da-737278a47fb7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576206, "uuid": "95b91849-6dee-44b5-8743-0b77515cfe47", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576206, "uuid": "a4c57fc5-9cd1-4c41-920f-42f64505820b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576206, "uuid": "b25a0f93-52f1-4235-9710-bd5b1def6d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576206, "uuid": "38a8510b-3ed8-4680-876e-bf39212c015c", "value": "faa32b79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2452343f-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621616040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616040, "uuid": "e8329005-4770-488a-b00b-6efadfd3dcb2", "comment": "Malware payload", "value": "3db7097de5b5e387a677528494a453c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616040, "uuid": "63fb6b6c-a7a9-4cbc-8161-9ee08b506f31", "comment": "Malware payload", "value": "73fa4182cdb2d81c0cdca27ec09f70e796385a805c8d1bbb4de97554d27aede9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616040, "uuid": "6aaa4389-8810-4708-91cb-218bde1606de", "comment": "Malware payload", "value": "d02709b9d77a6f3d80fc05b0beee4b8ab6bc87d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616040, "uuid": "b48567a4-f9fa-44de-8f1d-e1ab7215d731", "comment": "Malware payload", "value": "3c3d3fbe4be2c13327817f3178e1353795c7739858155a9148974d8b0df6890a30fca8dba0f6a9fc47760de02b778a78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616040, "uuid": "f37adf6a-0242-4b2e-8146-aa8d05f8d28c", "value": "39B423C18EC82B4EF73168A7D7AA430B3A35A20CD530D1D6BAAD077E418773ADB41579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616040, "uuid": "1964c172-f2c1-444d-bc8d-f6da1205fe56", "value": "12288:v46ua2inh3HK5cFLz4lN2/eaDCsvfWPFT6sYc3AZ9qqHCgU6:g6KSVqwzE2G0ffsdYxZ9qqH5U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616040, "uuid": "0d317632-cf3f-49ca-a956-47076e871abb", "value": 512907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616040, "uuid": "ec48f260-cbbb-4554-8f03-47c08e036fa4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616040, "uuid": "5b2e4eb7-3577-425d-a593-dad21d1a8527", "value": "3db7097d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f7cf4b-ba67-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621624048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624048, "uuid": "1b201d4e-fdef-4bd8-99eb-37f83eed0ec1", "comment": "Malware payload (Dridex)", "value": "97dbeb8b775c83ba0fa5bc214f4cfcc5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624048, "uuid": "ab972398-4ab1-42ff-8fb3-537644aa11ca", "comment": "Malware payload (Dridex)", "value": "743b47785279dbd2c662fecd646862417fbabf1d1703456218750d855443884f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624048, "uuid": "7e9f99f2-370b-4292-acce-27600c585809", "comment": "Malware payload (Dridex)", "value": "a381d992179bd77caf1b7bc449e5ff89d6f1b623", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624048, "uuid": "6e8025b7-9dad-4ea8-825c-a1e5e40e29fe", "comment": "Malware payload (Dridex)", "value": "0379ac2879c963bdd5ce85d39f27e99e0af69d25452ce14e427664920af30e2ca605df2e29793dd460bb047b2c9035e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624048, "uuid": "a9d6edd7-0cc8-433a-8770-e28dc4d67c65", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624048, "uuid": "bb44d6f8-0214-4e56-8717-c6ad10cdb6d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624048, "uuid": "7bbe3a74-77d1-4689-8d4c-5ebe9bf3280b", "value": "3072:gomNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gxLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624048, "uuid": "55ccb254-96e9-44ca-81a2-107bc30f23ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624048, "uuid": "926ed59b-7fad-43c6-acb4-2288a89dbc75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624048, "uuid": "b972f943-7314-4a9e-89b5-6adf1ec9d886", "value": "97dbeb8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4aa98a-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621609506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609506, "uuid": "3a449878-fefa-4834-9faf-d29865863b2d", "comment": "Malware payload (Quakbot)", "value": "4e843554d07e20f9efda889a7ffd72e9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609506, "uuid": "cc55e23e-4bce-4ed5-b959-0c5a795657f2", "comment": "Malware payload (Quakbot)", "value": "74a923b1bf8d46f34b9addcc3dab775c82b00eecfbeac464f84182a1a783171c", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609506, "uuid": "a249e6a6-79ff-4a2d-9dca-9812f0d0c452", "comment": "Malware payload (Quakbot)", "value": "9f0b246f774ed54f62a24fc5e385ae37b785b6b9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609506, "uuid": "45bcb0c6-df5b-4a15-8bc4-d2afd783dfa8", "comment": "Malware payload (Quakbot)", "value": "5633a93b5303ea0e72f7ecf051bcf396683fb9c0af3e6033d989f535028edd17b7863d142936c84ab3e2278d23c9d1c8", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609506, "uuid": "bc6939f0-9adb-476e-bbd0-bbfbbd02fc60", "value": "1404123CD0764D49C2E5543BDC58C2999C262162ADF8B49D658C7998EB237F30FAFB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609506, "uuid": "57ac8dce-0eef-406c-b71d-3f737e458f6d", "value": "3072:wgKAXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGRL:wgK4E5SDvbXAyHbVt15wTQDYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609506, "uuid": "e56d82b1-364f-4617-b990-65c116b05961", "value": 178240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609506, "uuid": "fa2a1f6e-0fef-4295-a892-eeddeb320a60", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609506, "uuid": "2ae63fb0-2605-4e8f-982f-b35c1ee5f518", "value": "95141802805202021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1816c573-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621613443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613443, "uuid": "e3f53c6a-5027-485a-8856-f51bdca46b63", "comment": "Malware payload (RaccoonStealer)", "value": "a3ad46725f8c617e9c5c6e93647f8c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613443, "uuid": "61d89d5f-cd8f-4862-8c42-922420445229", "comment": "Malware payload (RaccoonStealer)", "value": "74cf8cdc229f4ebc71973056e72efce0e831b139b8162d04ecef3fbbfa1c3369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613443, "uuid": "a1394e62-37e2-47bd-a634-394e8021332d", "comment": "Malware payload (RaccoonStealer)", "value": "9c1420b0eab00fc141f8053691a7cb118234ec3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613443, "uuid": "c4424a18-b9ac-4a52-820c-242a30e2f4f2", "comment": "Malware payload (RaccoonStealer)", "value": "6f2c415f33638b8036e4f50266623804c1553ec13e3c151ff7638a608241e4cd30726fceb87a2cefb54321541b2fa317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613443, "uuid": "39f44470-7801-49a1-bb48-f4c7f01c0cea", "value": "0AD4DF30A6A1C036E5FF12F449B9C2B9692A7DA06B3450FF12C52EEE56345E0AD3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613443, "uuid": "c6ffd5ef-367c-4de6-9519-426170ac47ae", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613443, "uuid": "5fefba23-ac98-4242-a7aa-70f20a124be8", "value": "12288:GBKQ3UMRsDXca6FSdaEBchHTyn9HmU2pte/LVI2/9nMZO+GusUaYHC7IXsL:XMRCPHQTTExkgTV1nh+GT6XXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613443, "uuid": "682a94ab-f4c9-4075-8e4b-a31db8b00e87", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613443, "uuid": "f965418d-3fc8-4df4-84c9-fc7f03df83e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613443, "uuid": "719045aa-8914-42de-8e53-a245bcbd1121", "value": "a3ad46725f8c617e9c5c6e93647f8c9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b86c74-ba5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621620529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620529, "uuid": "da85399b-9d29-4081-93f3-cfc355c8ec00", "comment": "Malware payload", "value": "be3f53d6659f0eb5fc029b0e724aab72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620529, "uuid": "dcf5f9b0-a79a-4434-966d-3f95b0dac8c4", "comment": "Malware payload", "value": "74e5c5c1caf30177fcadb2ed4019f65e99fec5050916a7e31de1b3a864830e4d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620529, "uuid": "3b4f80ec-5306-4d90-84e9-3a127cfefa26", "comment": "Malware payload", "value": "9a555aad7b6bfb62d6ff84afb1366618d1efef97", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620529, "uuid": "c7d5a8f7-7a27-4a51-aef0-661e9e5ba881", "comment": "Malware payload", "value": "d5844c76e7577de2a46061cdacafd99bf0d61bbfb211a3b12f7eb3c73fdfc665ef858c72d7a7f2c136fb2425fc60fc41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620529, "uuid": "df596e19-bf10-4e36-8c4a-1e66f20f0a77", "value": "5323F1F2BD7AF50AA3D9212946F4DADE716823E4910B47C041BA0B9F5354BB3F18D18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620529, "uuid": "5e48ed19-df03-4682-94eb-4fe5dd5e36f8", "value": "1536:7UI8gKKpso5Tdgn7lxVkSAxYhVnNmSEvXZDifv68:7M/7lxVkS6gnNmSEv8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620529, "uuid": "79751f85-02a1-438f-963e-99a2d1aac7cd", "value": 49448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620529, "uuid": "ab444127-383d-4192-8420-8178b527a0c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620529, "uuid": "4645059d-bd11-45cb-baec-214d71933995", "value": "be3f53d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cca7444-ba5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621620323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620323, "uuid": "a6323f7c-69b8-4759-839b-44648d28446f", "comment": "Malware payload", "value": "4267aa76f8ed6307a4a0574e2fa0e5f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620323, "uuid": "f2cac414-8070-42a0-afc7-984229ebda0d", "comment": "Malware payload", "value": "751f26f5904fc057154022582141035b962f1593cdb08ef9d27a12e0965d16f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620323, "uuid": "b7073796-895a-497b-9829-608100b4ec7c", "comment": "Malware payload", "value": "09084f9afce859e5a0e5eb8b4f4dfff3b7c68cbd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620323, "uuid": "0f746a24-dcbd-456e-8ae1-15730be756ec", "comment": "Malware payload", "value": "28a8bc01fbfb887934b59668ddedf235e6d09175c9da6419302947b9e8a4d2aecff0d0e773f8639f5929f37ae0903384", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620323, "uuid": "57160612-5d99-4ada-a713-a1d58b71b9a0", "value": "BAD4D02663A4DE05D0BF037D8152562183F0ED258607E75E1B8970FEBDB3362CE666E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620323, "uuid": "de3af4c4-73d3-45ee-96e9-fd375fbe9bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620323, "uuid": "d2ad0df9-3729-47ad-80e5-f764eaf3aebe", "value": "12288:sJwCjrhy3QCS3hDCKzgLAq4dEBRdotb4qhObg6Qd4wlTVeoMbS:EwCjrhy3QCSBzm44oF45H0bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620323, "uuid": "c9f97569-fe8b-454c-b2e1-e95a5b6c5a35", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620323, "uuid": "da3e9251-abd4-42fc-b262-f7ab3907920b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620323, "uuid": "9ec253cd-9dda-4b65-875f-353660839013", "value": "4267aa76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13242991-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609569, "uuid": "9ff75fdf-a39e-45a4-95d2-8cdcae86f648", "comment": "Malware payload (Dridex)", "value": "17413f380a991a80669250aab91f034f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609569, "uuid": "6e142e0b-5408-4bcc-86bb-57e6b8c41f37", "comment": "Malware payload (Dridex)", "value": "753c4975aa0324c9fee835eef2d7db5f6f118f2f94c1b99bfacc38ce667d55d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609569, "uuid": "da66bdd7-d81c-4304-a80d-5f0752d3130f", "comment": "Malware payload (Dridex)", "value": "110b41aab6dd22ef172c76fd187480e41cfc0d21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609569, "uuid": "32657847-cd4b-4ca6-a749-dffd74497ef8", "comment": "Malware payload (Dridex)", "value": "f21ac39f33f26c490545b59698ce83a6c5b420ac8ce865e4e3079462f66da5107017f3847d27d67f59eb38f945890282", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609569, "uuid": "b330870b-f941-467b-a83f-3cee8a368ebf", "value": "F004B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609569, "uuid": "aa31fda8-d1b2-4ed8-981e-7ff9a3184fa3", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609569, "uuid": "efb07620-0473-4fcf-852d-88c910216094", "value": "3072:GWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:GWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609569, "uuid": "ef152561-a635-4bb9-94a2-25472656cfdc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609569, "uuid": "5ff1df21-0765-430b-8440-f71e59afc25f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609569, "uuid": "30db4e6a-fe9c-46ae-adb5-a1c32f3d0464", "value": "17413f38_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a18101d-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569664, "uuid": "1aa203bc-39e3-4046-a02c-5ef665adbcaf", "comment": "Malware payload (Dridex)", "value": "ca954ec328e825f30d76afd4a426fda5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569664, "uuid": "f82c5fd7-38b3-4789-ac55-40c99d4214df", "comment": "Malware payload (Dridex)", "value": "754bbd46d4909ec1a8de29b91904b1e78f702cc22456a554c6d0cb38f219f351", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569664, "uuid": "89fea298-58a7-483d-99fb-4b214582f6be", "comment": "Malware payload (Dridex)", "value": "75e7d9ac43fbc04cfe7eb064d814d82bf9458a6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569664, "uuid": "33fb3c9b-e303-4e89-89cf-7f666ebd8100", "comment": "Malware payload (Dridex)", "value": "2e4f93185496046a77a0b224567f30f3befb7b308c43a3478b72ab4029bf62cfc48a605d56a0b86cf2f65ec5e95054ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569664, "uuid": "8799e243-7195-4f75-beb7-e5b2a8da412c", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569664, "uuid": "32f4ca32-5341-4447-899a-b87cec07395e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569664, "uuid": "c3cc8ffa-a54e-4baf-8e60-b2c1b1bde534", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569664, "uuid": "f55a1a3d-76bf-4608-811c-d2535909541f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569664, "uuid": "925e26da-12d7-4078-aee3-f3daaae44415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569664, "uuid": "b6eb2462-d772-490b-b8c2-c4707f665f99", "value": "ca954ec3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ffa76c-b9e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569788, "uuid": "8021acc0-f97e-4633-8971-0261725012e3", "comment": "Malware payload (Dridex)", "value": "2d0fdbcfe052c7cd112fee2f2674322d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569788, "uuid": "10b645cc-9ae2-45a8-98a0-5493ed372ada", "comment": "Malware payload (Dridex)", "value": "75f4c32e9cb232b0fcd412ec931d9c5217c6389a77a3cec92f9e737313c71af4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569788, "uuid": "e30801f3-5613-41d7-9308-4c18f32a5081", "comment": "Malware payload (Dridex)", "value": "648278d59df4485b2d2c87431a9164174a09f879", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569788, "uuid": "b5404c66-2f4c-485e-9ce2-c69890f26444", "comment": "Malware payload (Dridex)", "value": "1570bf747f588760a23579ed28e6371b7e07afd666ea88c6278795858524313dfae56c7127da1ced912f4be9d3dfb9ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569788, "uuid": "7dc281c2-7475-4573-8ca6-85f43533874e", "value": "3404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569788, "uuid": "aa9510c4-6dca-42a2-90ad-4fde0a751fc4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569788, "uuid": "3faa7cae-2c73-45a0-ba3c-df16a2da3ede", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569788, "uuid": "eff41436-82eb-4136-a5e8-a6a2ca09512f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569788, "uuid": "eff9493f-dcad-4128-9744-e98e304b868a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569788, "uuid": "164cabbb-946d-4ca2-9896-afaaa4ef5519", "value": "2d0fdbcf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63eb9f29-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609705, "uuid": "b23abb2e-acb1-4540-aa04-a61fd52595d4", "comment": "Malware payload (Dridex)", "value": "784525598a0ecf1046d0e5c19b7d8bba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609705, "uuid": "20d4e291-889f-4a5e-9a29-75600e48e19b", "comment": "Malware payload (Dridex)", "value": "762db16bcd150c1aa10e714a5dfc90778c4e5bd65f117badf6db5814457f06e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609705, "uuid": "dd820d33-d7d8-4cd8-8325-050dc963eef3", "comment": "Malware payload (Dridex)", "value": "3922ef7c1725b650d57616bc87e926c0710ce3e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609705, "uuid": "d7bcbf11-d87d-42ab-b53a-87c719c0d681", "comment": "Malware payload (Dridex)", "value": "c46424ad0ddd072daa034b6293e50c6daab854629346bd972c5559d3b4e1ba42b0e263552c689d28c4528e11f1501c0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609705, "uuid": "79ce62b4-ec36-43ef-b08c-48c789785e1d", "value": "90F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609705, "uuid": "5fd77a3c-f8d0-4ffc-94b1-29d3479cef7a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609705, "uuid": "d170e5d8-7951-4aa7-99fe-fbe79e3fe8bf", "value": "3072:jiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:AeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609705, "uuid": "c1f11c33-9efe-4ca5-9ca7-2a7848848526", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609705, "uuid": "95a61b5d-e284-4e35-bb9e-23aebfe019ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609705, "uuid": "184c1739-668a-42a7-963a-17996a52c124", "value": "78452559_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbb1576-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621557133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557133, "uuid": "6ada251a-0e19-46b0-b488-109c35870c31", "comment": "Malware payload (Dridex)", "value": "198c350cd59528f7100f42b685b30b68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557133, "uuid": "1641854d-e1dd-47d8-a232-b0e744ea41eb", "comment": "Malware payload (Dridex)", "value": "762e62826f219c9fd62117326e0d3354066e445c07fdf8c47449981042e2f5f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557133, "uuid": "1a30924f-3bd2-49c9-8b25-0f8304d96107", "comment": "Malware payload (Dridex)", "value": "68e8eb88d1b47a4c12651fa8fe814d7fe943e263", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621557133, "uuid": "26fe1138-0a8f-4eb1-a3cd-4ef62da2db96", "comment": "Malware payload (Dridex)", "value": "ee3ed01ac8c8423cf163e25a1a686562c25e3d714c2e3a45a71874e35dbf8abe8301b4b7cc87ea3ed38f7a11eda72ef1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557133, "uuid": "11dac875-9a82-4ac1-a3c3-58b654379a06", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557133, "uuid": "fd9eefbf-0739-461c-bb42-a75d89370a89", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557133, "uuid": "7565b270-4f86-4318-8d75-d7c3ce651ad2", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621557133, "uuid": "6fd39953-55c7-4468-97e1-004b25586c18", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621557133, "uuid": "e8b3e909-9574-459e-b58b-294399eacdcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621557133, "uuid": "6f227ff0-40ce-4c29-914b-07787d7288cc", "value": "198c350c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dc96bb-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565198, "uuid": "f6f2583e-40ba-4fe7-9491-046ca7f69795", "comment": "Malware payload (Dridex)", "value": "3509f8f79971f15223387e3becfcffb0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565198, "uuid": "97b14fe5-1166-45fe-92fe-fb85c3f2cfff", "comment": "Malware payload (Dridex)", "value": "7636404f4e102ce65d7d19f63f5e47b1d240ff5c3ba42e2c71c5d3886555a5a2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565198, "uuid": "91905623-0f81-4c6a-974e-2e46ab0753be", "comment": "Malware payload (Dridex)", "value": "2c7e85c4949b9c912974750a527e49c68f973c51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565198, "uuid": "54ce0e54-c8f0-4d9b-9e93-3a4a481c93f7", "comment": "Malware payload (Dridex)", "value": "17939b949fe3a6f4d91e9f21c51292e454980d641168bf403b6152a844979f3177ae94dfc3fa0acb79e398ff944e2ad1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565198, "uuid": "0748a15f-9979-4256-b1ae-342bde52c196", "value": "8804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565198, "uuid": "a522aa6e-3c56-4439-ac46-2201d4a04ac7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565198, "uuid": "763fda45-f6f7-461d-ab78-e58ee4798f8e", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565198, "uuid": "88a76774-d696-4d3a-bc47-999a75aacad2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565198, "uuid": "f39c49ee-404a-4731-a77e-e5ba83ed132b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565198, "uuid": "823fd8b8-36e2-44f1-a730-54e16c88b23e", "value": "3509f8f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195d9322-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566200, "uuid": "443c26a8-2fc1-41da-8f67-22d522bbd0fc", "comment": "Malware payload (Dridex)", "value": "8837c019ae605e8ee5b67cd56ed7f0d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566200, "uuid": "c81139be-476a-424f-9e1d-bda7ea01c91e", "comment": "Malware payload (Dridex)", "value": "7690d6b2f43bad23157b7619e5555f05ce06159a9516b4df338b525b500c7c4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566200, "uuid": "98de9e26-fb99-48ed-8366-3cb0f71eacba", "comment": "Malware payload (Dridex)", "value": "0dbb5621604fe204a984ef785df2704251c0d920", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566200, "uuid": "1caccfdf-2ce5-4d8a-808b-b0bbbe5f6e2d", "comment": "Malware payload (Dridex)", "value": "4f467bf4780d9ec3d5b60179b643aa42b9723763a68de2a5c41d5357f83a16324d8ec7ec168b0dd67ea0801f8e4b4c67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566200, "uuid": "cb90197a-6215-4281-8d01-af4fda843503", "value": "5104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566200, "uuid": "05ce85db-f045-4560-a07b-1dd2be257591", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566200, "uuid": "d0652b2e-7bba-4d92-96a8-4fc7b5d598ee", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566200, "uuid": "d35716a3-c357-4b74-8a4f-2c2ee5c6922e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566200, "uuid": "99d5b71e-b5bc-46c5-a72a-8701f0644ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566200, "uuid": "f3c2f446-d394-44d5-b4b7-76f902489277", "value": "8837c019_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae51dcd1-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621613695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613695, "uuid": "7cb9d4d7-338b-482c-9e6b-4feaa535b99d", "comment": "Malware payload (RaccoonStealer)", "value": "20223c62801c7b6891949ec051ced31a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613695, "uuid": "53c6e13c-08bc-4332-9472-c2892191f35d", "comment": "Malware payload (RaccoonStealer)", "value": "76930d2d4c02e546387cc19858c9dcb720d84f43ed845b619d7c0900b18c9740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613695, "uuid": "9955b98f-0d13-492e-a2e9-5ffa71504a88", "comment": "Malware payload (RaccoonStealer)", "value": "1474a4de34024262b067dcc2df80281a324b1253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613695, "uuid": "edf98b00-1be8-43b5-83d7-34cd6274be78", "comment": "Malware payload (RaccoonStealer)", "value": "e8386bff54ce518ae84dc780a7f91f7a266a920f28cba729cb38d204963927829e2aaff21187bb218ad5fe05d47fee06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613695, "uuid": "6d29eca0-655b-4085-9519-01df1d30bb45", "value": "A8D4CF20A6A1C035F3FF12F449B592B9652A7CA16F2650FF22CD2AE946345F4AC3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613695, "uuid": "507096e2-f465-4627-9abf-ffe604bda544", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613695, "uuid": "64f26912-7b94-4f61-854f-35d06a8a4b6a", "value": "12288:JK3bMbnDa1XsxH1XQhoyGsn10qjdTr0jV7s2XZO+MKB7rt41jHtNVXsL:kMbDmg1XTyDW5s2XZOAHt2hXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613695, "uuid": "8f6c4286-bd20-4a8e-9d4e-4050e224f63e", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613695, "uuid": "2988195e-d2c8-4275-83b5-3d7a6429363b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613695, "uuid": "542737c9-2c68-4871-aa84-fadfa9c603b1", "value": "20223c62801c7b6891949ec051ced31a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0544023a-ba5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621618565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618565, "uuid": "501ed91c-20dd-445b-93d8-4a98e7c192ff", "comment": "Malware payload (RedLineStealer)", "value": "f701ac5e7fc53d632b2224d833729836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618565, "uuid": "41964678-876e-4bef-97f9-96fdf088e159", "comment": "Malware payload (RedLineStealer)", "value": "76f169a59e46d51af8cc54f41620f85f018b93c3c15b8ca6ec6874fbc936e18a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618565, "uuid": "209cbe31-eaaa-4fb6-b5b9-d52703b0cad8", "comment": "Malware payload (RedLineStealer)", "value": "07ce78ec19a9ea8b7da4faf875c8d19721cabbea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618565, "uuid": "c7bcce9b-8c16-49c1-ba2f-ec828af4cec2", "comment": "Malware payload (RedLineStealer)", "value": "37565ed5fe10110d339e224e60caa51a97b6632ea9eaf58f14ef1cc75fc4fe5075266a81f352a01a78517faaa5f919e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618565, "uuid": "91c61e01-1a60-4e94-9469-b6a2a7d32593", "value": "E2D425A1EA629861D35834B3C5370D380FF38DF0E681D25FA8AC7E389737647651DA86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618565, "uuid": "5baec887-10e3-4f32-bba5-afea68d684c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618565, "uuid": "80abb35b-a4a0-40ca-ac74-aee11c3fc6c7", "value": "6144:0lgMDsLKzIWdZM6Y/LLLLP7jt9F/x0EqEAFN1C0nK6fjFzhyxS3u0V2w1:0b/h0LLLLP3t7p0E5A3JrFg70/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618565, "uuid": "7e0478c2-c3ef-46a9-bf24-35b491cee76c", "value": 608056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618565, "uuid": "9443dc15-eb7d-416d-8495-cc039d704e65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618565, "uuid": "34ff22c8-4b37-4b9e-9ec1-007ba7d4259f", "value": "f701ac5e7fc53d632b2224d833729836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd5ca8b-ba14-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621588084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588084, "uuid": "aca8643e-4a1b-4b39-a859-868efa28441c", "comment": "Malware payload (Dridex)", "value": "6c94158ac18e937d1c7a35af28bc4c5f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588084, "uuid": "4ef23ebc-8a81-4942-b7c2-2c9c379a7114", "comment": "Malware payload (Dridex)", "value": "76fc5fc64d730dae49c983d260305af82c881ef3a466b1edc0ffd63b0e0b3e0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588084, "uuid": "05fd308e-9f00-4597-8c8b-ebff003f79d0", "comment": "Malware payload (Dridex)", "value": "0058c7d8df0a47b07761b4e355ea892e549ef79c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621588084, "uuid": "1c8cae84-3890-4f46-bf59-085700e3700c", "comment": "Malware payload (Dridex)", "value": "4954d6457b95c27678e6d67962152402477647c414620cfb4c978a4556cf9a68af27d1c3cf65e634bc0784a4302b0654", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588084, "uuid": "f5abc9c0-3880-406a-9302-d528d6d186e1", "value": "3F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588084, "uuid": "5cacdb32-155f-446a-a280-75dc25c226b0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588084, "uuid": "8c9853a4-c5a8-4373-93af-2edfd40bf474", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621588084, "uuid": "6e52e435-6ac5-44fc-a9d0-af2bfe9e1367", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621588084, "uuid": "11d55292-4947-4c35-8dbe-d4397343d04f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621588084, "uuid": "6cdec40e-53b9-403d-b454-bb5e96461398", "value": "6c94158a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7497186-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559244, "uuid": "5aaa8714-c93f-4044-b4aa-47c998d5c1c1", "comment": "Malware payload (Dridex)", "value": "8567d1409df8ac58cd995b105fbf876b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559244, "uuid": "d4e8f018-f238-4df5-ab83-5d4b52a5df96", "comment": "Malware payload (Dridex)", "value": "772afb8363001496c73130476911804c3c596a366c6373fc439b4803cf86ae25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559244, "uuid": "9245d2bf-5efc-4f58-bd36-0d3931633dec", "comment": "Malware payload (Dridex)", "value": "a4d11f2a63fd59bb985d5f58d318654851a834d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559244, "uuid": "ef2eac8c-364e-4de4-befb-2e01e2e3cfcf", "comment": "Malware payload (Dridex)", "value": "1394f6d5b164c4c7a742d538dafbe9f259754f242d8c4fb17c68b8128f1863b4f61634a7016baedb4fbbd2a10434d24a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559244, "uuid": "68b7cf63-2320-4f53-95a5-7c060eb47553", "value": "DC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559244, "uuid": "92aed435-940a-4961-804b-d405deb2e7a9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559244, "uuid": "11258fb4-7ac1-4788-8269-36993b1dce59", "value": "3072:lV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:lV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559244, "uuid": "9cccd937-048a-4597-92c9-de4a2c8cee65", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559244, "uuid": "54e03631-1b2a-42f2-b589-440ba459b20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559244, "uuid": "50be7d59-afd9-4fc5-8afd-d4864b0940fd", "value": "8567d140_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b297b781-b9e3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621567316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567316, "uuid": "7ce1638a-36a8-48d3-b1cf-866cc69ccdc1", "comment": "Malware payload", "value": "ed18a031e78d4108e69f22edabe824d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567316, "uuid": "9da6ffd2-f1f4-49bb-bec2-e734b810a720", "comment": "Malware payload", "value": "773540925e1b4ab5e948c1adba5a94b62f8adaeb1895a15c66ec2d9161d2158b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567316, "uuid": "ada3641d-c289-44a2-902f-440ff006b50f", "comment": "Malware payload", "value": "f26c884c14f831465614e252fdfc6879bb2172ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567316, "uuid": "0aa4c5d1-d714-4023-b48e-f20352a7bf57", "comment": "Malware payload", "value": "d4d0bc884aeb2e9d98ad6c4f7343e92b3e854a8453b6b6e4666066bb7af6ac0effdcd26db664a372d1e9101467cb2979", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567316, "uuid": "38f3496e-0c5e-4e06-a836-18112b9e6491", "value": "7FE533CFCFDF0C178910620BFB45BEF364E5AFE9760C1C7655899E6F8A07088A614689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567316, "uuid": "713dca62-40c0-4e8c-a980-00036ae13763", "value": "49152:hQ4Qox1GVg5NpyXlaQ4vH7i2lHyxC5ea6jnUmUfWrFwQ5cPRSOrlsFBOCW7/d2Ah:hPSVg5N1DDi2lPoDUfZaASr6zw3AMna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567316, "uuid": "e3eea41e-4f57-4fde-a272-220e78eb9cf3", "value": 3270552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567316, "uuid": "a26e39e5-a862-48c1-b259-fd59b7990312", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567316, "uuid": "eaea3015-3dc9-4b44-998b-cf12efcccc36", "value": "ed18a031_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0246c1be-ba3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621605675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605675, "uuid": "06b6c437-5847-421f-be42-dd35e1a06076", "comment": "Malware payload (SilentBuilder)", "value": "33c179ca6840e684f4f806da1d3837de", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605675, "uuid": "d34cc371-477b-4d97-97ad-d48a9adf5c1d", "comment": "Malware payload (SilentBuilder)", "value": "777a53741cfeaaa1a6088d86066c538d6455b4bc3283b9fec9045e802ad926b0", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605675, "uuid": "83723b44-a3fd-4cad-90ec-f09af95b93ea", "comment": "Malware payload (SilentBuilder)", "value": "3a8448a59ea33eff6738087c438dc476c0070987", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621605675, "uuid": "5c06f4ff-49ac-4d28-a0cc-a60fc1e8778e", "comment": "Malware payload (SilentBuilder)", "value": "27e2887e22f41a127090193533c51915f4845b879986eaca8415b49f85d52f4ddd7c54bfab3ffcafd96f4d85d190a6cc", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605675, "uuid": "75cd7feb-daa5-4591-a463-a7bf2ea7ab75", "value": "CAB49D42A309D4A9C3614B3AA5118AE8556BEC52860EBF43374BBF2CDFF4390F718765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605675, "uuid": "3f1dc204-6d89-4f1f-95b8-eafe42ba1174", "value": "6144:C6tIrWqrY5O3NMHGRYc9u/YRTP85XbDu1XYiXBy:Ru1XP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621605675, "uuid": "ff5b624f-7e72-405c-9d9b-2d60ab7ccc39", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621605675, "uuid": "cfdaefb1-46e5-4530-b13b-31bcafe6d867", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621605675, "uuid": "cc3bddb1-5a51-44d7-a385-79740dfa2741", "value": "33c179ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c0867c-b9f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621576153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576153, "uuid": "8da98fa8-8370-48d1-b950-3a18a2adc1e6", "comment": "Malware payload (Dridex)", "value": "9da9a348e37945dc3170c079af860076", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576153, "uuid": "6ba2b3a1-f96f-48cc-bb33-818b8d9f4b1e", "comment": "Malware payload (Dridex)", "value": "778bb807a22695040bd320b31698026b817a72f11cc6c852841746085f76126e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576153, "uuid": "4d74e6d3-0870-4533-8557-993f54acba56", "comment": "Malware payload (Dridex)", "value": "ec2e46a1cba2c975418963afe31f74d48f5b45e6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576153, "uuid": "8f95b526-d8a3-43cd-91b7-9c9d460f1eee", "comment": "Malware payload (Dridex)", "value": "9364dd22e771048a9403861e70624f58825c65205347b87a26ca220c514b70cf16b61d2e93f073d5a1a2c0609a1a5e26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576153, "uuid": "53cfb029-9505-4f5d-a6e9-19322180a84c", "value": "CCF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576153, "uuid": "bc5510d9-b92b-46f8-9f52-31470aa25f5a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576153, "uuid": "9e71a168-7ee3-4186-8499-2c586734be96", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576153, "uuid": "f8fbc985-c99a-4d43-9c7c-16806f33879f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576153, "uuid": "88632e12-ad3d-4e05-9baa-20970658ac9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576153, "uuid": "7b43c8d8-1f2f-4924-a53a-9c9d89819289", "value": "9da9a348_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06b922d-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570373, "uuid": "3646648f-ed8e-4ebe-8734-1299338cbbf7", "comment": "Malware payload (Dridex)", "value": "53805beb99034f88b0a51d604086f1d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570373, "uuid": "daf0d616-749b-48b5-a119-0f79d883abe8", "comment": "Malware payload (Dridex)", "value": "779de471af54d0fcf85ca9f699be8e9fb3da1a5d9fc6180fdb3c903ad58188e9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570373, "uuid": "3c797fd4-17df-4ff5-9603-b499f13e1b07", "comment": "Malware payload (Dridex)", "value": "7d512c8ec0117f6dbb5c8f37cbb4173c18729178", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570373, "uuid": "de5175a6-595a-4a02-9972-c25e6a036e82", "comment": "Malware payload (Dridex)", "value": "5f53c16514120dca25e530f9de5010537408cccbba3eaa84c031f4ce49a3867e5318829f57d13f76bd67c7d3ad85af0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570373, "uuid": "20701713-c576-4315-85a6-dac03bd8f193", "value": "3B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570373, "uuid": "73c86426-f5eb-4bb1-8268-90e990f5a836", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570373, "uuid": "20428b7c-8393-47b9-b380-428243bd4074", "value": "3072:LV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:LV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570373, "uuid": "97aa3ffc-d2a5-48f4-a7e3-9a6df3487242", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570373, "uuid": "fde15abc-aedb-44f7-95ea-48ee657f5e08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570373, "uuid": "58330bb3-1209-4924-bf76-5811709e9efd", "value": "53805beb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a555a13-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574980, "uuid": "160caca5-9072-4036-a9ae-5aba840bab56", "comment": "Malware payload (Dridex)", "value": "e5ff5cff60cd427668f0494c3a7fee0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574980, "uuid": "a8fb6e38-3de2-46ae-96e8-8eda5b0215aa", "comment": "Malware payload (Dridex)", "value": "77e489f27923d0c6cbd149d5424922cf2f9a00c9c2a3a09fcf3173bb10aaae70", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574980, "uuid": "9b452036-4d27-45e0-8f79-bcf6bec740e6", "comment": "Malware payload (Dridex)", "value": "047771d283929b79709e601628a68f80b3a09897", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574980, "uuid": "3ed7a149-b130-424b-b86c-7fc867e5bada", "comment": "Malware payload (Dridex)", "value": "32379fb59bf6c34e69c996d5401f64a90c819b3ce8c18765f5adbbb6b6dcf97d7a900b4135dd0fbfcb5ae401be965deb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574980, "uuid": "9033ecdc-a257-481c-bb76-8651565c16a9", "value": "6E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574980, "uuid": "8306a0af-ac19-4012-aa9f-2060e4542241", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574980, "uuid": "6a84e62d-b65c-4fad-af71-36cde88dbef0", "value": "3072:tV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:tV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574980, "uuid": "f597d15d-3b0c-4094-8ab1-2cf052f10c04", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574980, "uuid": "04c2bae4-0f6f-47a5-bd8d-f0d4389f7555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574980, "uuid": "d82ecbc9-0a56-4a08-8e7b-caed294e5ea0", "value": "e5ff5cff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f9674c-ba0d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621585072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585072, "uuid": "157692c5-75b2-48f6-984e-61c1406d7b93", "comment": "Malware payload (Dridex)", "value": "108aa6dcabf50db2e967b0ec4cc06ca5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585072, "uuid": "d84c8d8b-731c-4dda-ab6e-d06f8a6fa97d", "comment": "Malware payload (Dridex)", "value": "77f5a5d13247886c19e1fb8a8a61aab7e8c817932f70941130e9b83dbd0f4e74", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585072, "uuid": "7db694bf-b06e-4ffc-a3b4-cdfee60dcea3", "comment": "Malware payload (Dridex)", "value": "baf020a435146e8b69fa66ce55babaee67387523", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585072, "uuid": "3e9f3205-1d84-41bb-b170-edc8001b035e", "comment": "Malware payload (Dridex)", "value": "684016d5be67d30de08eb193e4aa408933fff2ecb510f7411504252168756e6fdc50d13b957091a61a648575cc09ace4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585072, "uuid": "e498ea91-c0a6-49ca-b421-52edf4bd8906", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585072, "uuid": "0aab6269-e87a-4a58-a8b3-edb0840b7a10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585072, "uuid": "d5528639-8f04-4d4e-beb4-aa093be7f6b3", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621585072, "uuid": "0215e15e-602e-4d72-b3c1-bd1ddc52807f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621585072, "uuid": "14394d53-e536-4c23-b192-3000ccf7d97c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585072, "uuid": "0951c58b-058d-41b7-b73b-dca173f33892", "value": "108aa6dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18194303-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570493, "uuid": "5547a682-6387-4cc1-897c-9544599260c3", "comment": "Malware payload (Dridex)", "value": "174056195d512dc425e36ca1d5e0b542", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570493, "uuid": "dda92c0b-fd8b-4e46-a7e2-aab39e84baba", "comment": "Malware payload (Dridex)", "value": "77fb674c0502e6e2bbbd5cf1941bf9b2ad09cb45f74df5bcfeb1321867e8c295", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570493, "uuid": "8e22cc57-5515-4244-a8d5-6149e285dd93", "comment": "Malware payload (Dridex)", "value": "3541ae1028181d5e4fa8437cc4ea2bec28aa3c47", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570493, "uuid": "33b51d8d-bb38-4440-8246-ecdc173db55f", "comment": "Malware payload (Dridex)", "value": "1ef9be80bacd0c1c4dd4bcdd39bd41f0997ce7e4a669858043ac57f5e9acde4132b62df96e8dca14b8b264be4f18d2d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570493, "uuid": "279d5b92-79d4-4dee-b998-206f2845a36b", "value": "4D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570493, "uuid": "e5d4b2c4-e398-413b-bec3-4fedb16b9e51", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570493, "uuid": "e070b8bd-6ff7-4753-a86d-44b0bd49271a", "value": "3072:RV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:RV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570493, "uuid": "d7b8d843-45ac-4554-a51f-28b3f7f2f52a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570493, "uuid": "8e247bb6-37e2-49ff-84a6-ef98793f3a0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570493, "uuid": "8f5f81a7-2b09-47d3-8fbf-f69b74faf2e6", "value": "17405619_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef46926f-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1621618528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618528, "uuid": "b9f26f17-2b78-4d15-9b6d-a7e6bf93dcde", "comment": "Malware payload (Loki)", "value": "4bd0f90dd619d191a5c0b3d32e977108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618528, "uuid": "35e6b970-106b-4d10-87e0-cefeba4ff419", "comment": "Malware payload (Loki)", "value": "7811ec92ca80833dd9c261a7c0ee63f4a8d7fa16d1912ccaa08421ebf128649f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618528, "uuid": "bb4fdd69-ba0d-4f78-842e-dcf527caca48", "comment": "Malware payload (Loki)", "value": "74a3025f698c420dd234693dc3a8f30511ae6bdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618528, "uuid": "d1686ef1-6166-496e-8a00-79a6b262f6c8", "comment": "Malware payload (Loki)", "value": "de47ee05a18876c51c2e43254430f4294cadac4158a937d5efdfec2d98091267e6d49a6c86d0efad28e1fb85d4009907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618528, "uuid": "1687887d-9fb6-4f84-b6c3-e83aea49ba13", "value": "04F4B03036EA520CD87A9BB51D7992C5077A7F6A7B00CB1E2494324DDD33A538B21BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618528, "uuid": "820b08dc-62a8-40b3-90aa-933d6014cb94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618528, "uuid": "583e5a21-c5d6-42c4-b99b-309b7a226469", "value": "12288:rAfrGb2+CBd7VCsj8S0TewYVoTGx00fKLikOvX9/JTqI:MOCL7VXhvwYVoC60SLN+T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618528, "uuid": "554981d7-bc35-4b5f-a380-e3180d3a8fc9", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618528, "uuid": "12dd211d-371a-4eef-96e4-299e84c18998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618528, "uuid": "9c1eeabf-3345-41fc-8559-285be08f4cef", "value": "4BD0F90DD619D191A5C0B3D32E977108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1874ed68-b9fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578654, "uuid": "9191a14b-ff5f-4f54-86b4-5a69be59f199", "comment": "Malware payload (Dridex)", "value": "a78b782ef94bd51187286e0e292581bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578654, "uuid": "7173d943-1110-4007-92d9-41da3136e909", "comment": "Malware payload (Dridex)", "value": "7848f23a5e98d25595564079178acf640dba927473fc743ee22ea6e76437c0f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578654, "uuid": "dc88ff55-dee9-425e-91cc-b8c54a927493", "comment": "Malware payload (Dridex)", "value": "084d7434f6dfb4ca48f9df48ca2b37119a616b3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578654, "uuid": "233b0d0f-e9e1-473e-adf3-f38102aaf519", "comment": "Malware payload (Dridex)", "value": "0515beb612ed3bc7a96b9f54229e4a8782a12440797a009a71410c3fdcfafe44948ad6a9be3183573feb9fd3966dbc5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578654, "uuid": "028f062a-921c-4305-9ad8-b7d469b0c154", "value": "C404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578654, "uuid": "cca4fed2-007f-49ba-a862-4dc4904b7799", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578654, "uuid": "27264781-390f-4e3f-8ed1-6097b2a758f0", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578654, "uuid": "7476075d-5e03-4134-a664-cb73f3551084", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578654, "uuid": "65066162-5f31-41fb-abd1-621e81c9d6ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578654, "uuid": "fd1ca64f-f139-4342-ac8a-bce0a999e3ba", "value": "a78b782e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b4750d-ba48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610456, "uuid": "a30982d9-da73-4699-87f5-fad4cf7fabb1", "comment": "Malware payload (Dridex)", "value": "7533c546a99f11b5c82e9159a7817fab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610456, "uuid": "f5a0e7a6-50e1-4c69-8075-40fe85d88545", "comment": "Malware payload (Dridex)", "value": "78516827b3f79adf74de9d94f2ae78c0cc93550beebe5802a754d804ff9bd75d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610456, "uuid": "5eac3e9c-dc79-4676-8bd5-48bdda394c83", "comment": "Malware payload (Dridex)", "value": "f5e5d877e23b1d57189cad99ddd9d28edb622003", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610456, "uuid": "a348194c-baa4-4697-97c0-f750f613181e", "comment": "Malware payload (Dridex)", "value": "b3a0651caba0ad993de0eac221e835afbc4272bf7a5903fa9138bb4db9225d81b680bf2fc2b1aab392d8d5859c6f6fc0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610456, "uuid": "e34c1a21-ab96-455a-abd4-d36f1c88fadc", "value": "BDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610456, "uuid": "a2ec7d19-e0cb-4bec-a33c-f3e2737258e0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610456, "uuid": "0b054915-8f4f-42af-a61b-f6f6d3e79867", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610456, "uuid": "5269aeb1-9fdb-49c0-8ab0-620b8dd98ee5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610456, "uuid": "4a4e0e84-90be-45e4-ac33-5344d1dd3e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610456, "uuid": "e26c29e6-3ca5-4d9e-85b4-127564bed3e9", "value": "7533c546_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b7e1a4-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621609899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609899, "uuid": "5a189eb3-c649-4988-8733-5aa9151430e2", "comment": "Malware payload", "value": "af057a30cdb4d07397e00582846aad7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609899, "uuid": "c22dad34-96df-4609-b50f-33e3a81bf58d", "comment": "Malware payload", "value": "7882b9a3b306f407f439ba6f592a263ad72fcbf239bbda13c168aea8bf764768", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609899, "uuid": "cee5ce2e-6d00-4b01-a579-71e9a18c3a3a", "comment": "Malware payload", "value": "e3f15b53e468f60bb9914a9dadb119a9714a9cb8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609899, "uuid": "66282e9d-c506-45c4-b1c4-86da9ba73c42", "comment": "Malware payload", "value": "e56092f45559d897a5faaf7acfa269a8fea5f7b9933d375ea5e16b6d8df40e7739e65f77e16e6bad25ecf48477d07410", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609899, "uuid": "022ea208-3a0b-4364-a4a1-58311be88aa3", "value": "0304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609899, "uuid": "0e86cfa4-28c5-452d-bb8b-98f84d31c9f4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609899, "uuid": "24e640f0-331a-48f9-a0fa-7613dcd63415", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609899, "uuid": "e356c28b-aaf8-4419-b9a7-d5c14e0dd308", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609899, "uuid": "abf2dfd7-f7c3-4cf0-95ab-e75ecb066c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609899, "uuid": "1206982a-12f8-4462-a5bc-e7c371ea3b3c", "value": "af057a30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc831504-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613397, "uuid": "b0ced12b-809d-45c0-95c2-51065533963a", "comment": "Malware payload (Dridex)", "value": "77c4d7e2a599b638efb423ec79826e95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613397, "uuid": "0122dfac-be4d-4207-8b27-826f2245d468", "comment": "Malware payload (Dridex)", "value": "788f373cde0bee764e32ada5551c74bb7c26d5c323096c7eafa66a71a02fe672", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613397, "uuid": "65fc281e-f0c8-433c-b6e8-30e1f20188c0", "comment": "Malware payload (Dridex)", "value": "2bfcf76bd5636b99c0d0344d31a2c0c601e43232", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613397, "uuid": "81e957cb-46ac-4a18-94d7-f5a7ac49579f", "comment": "Malware payload (Dridex)", "value": "e280bd0660e5881c6dc9d37f065e17eab450940eaa9d2a33a1ad0d9636594efd53be6e48b9efedf144d79f0745ccd3b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613397, "uuid": "82af18be-b0a9-46fc-9af4-1b9093fbc158", "value": "2204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613397, "uuid": "46b9b72a-44c6-4795-b4e4-a2e1b54f3222", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613397, "uuid": "785d6a29-7a5e-4627-b653-d007158a122d", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613397, "uuid": "1648b426-16f2-41c0-9e0e-97168048d399", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613397, "uuid": "82857b4e-f001-46e3-9df0-bbb6cbb4dec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613397, "uuid": "8f3b11f3-e0c3-4d81-85b5-57039d16a347", "value": "77c4d7e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8803d776-b9e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566386, "uuid": "4ec1499e-5138-44cb-8ca5-9c378a7fe990", "comment": "Malware payload (Dridex)", "value": "87644932cdbc3bedfa3ca81e3c180b47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566386, "uuid": "be874461-99a7-4f62-b1ef-46a9f0893c28", "comment": "Malware payload (Dridex)", "value": "78ea09f0a08eab9b21f1d0042a0ba13b83f5871bc6b1908127e8f1517cf420e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566386, "uuid": "2f22fa7d-fede-459a-9e93-313d0a9acad4", "comment": "Malware payload (Dridex)", "value": "69ccd5add879a453bc08acaaacac542be1ff3918", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566386, "uuid": "7e90d22e-3b01-42c7-aeff-9e1b303c6575", "comment": "Malware payload (Dridex)", "value": "f28a391c6f85ebe3dcb1bb48e3a4b73a0a8cb747646c4724effe05e294bdea230929015fd685d19c2dc1c49ce969b210", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566386, "uuid": "50eedced-764b-4246-a9a5-133ef589e1b9", "value": "4B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566386, "uuid": "6119a8d8-bd7d-4a7f-86b3-0fc75af0269d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566386, "uuid": "898fa104-5e6a-4066-af91-c90e5aa0b1a1", "value": "3072:ZV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:ZV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566386, "uuid": "2aa47ee2-950a-467b-8131-863ea71d1769", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566386, "uuid": "c5fc3845-989f-4fd5-9b7d-30592218e311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566386, "uuid": "053c9c7f-6a99-4d0a-9bd7-6644f173bfdd", "value": "87644932_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0955b5d5-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563167, "uuid": "2c0154b7-e2e7-4b67-8259-68946d1ce27d", "comment": "Malware payload (Dridex)", "value": "903ae6cd10ff9cefb00b866c1e12c4de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563167, "uuid": "d5668b2c-4568-4e14-86e3-37a6ea862d9c", "comment": "Malware payload (Dridex)", "value": "791d246a9eb8772d0fe3acf70dd205456ec465a750546d97cd18d75aee751dbe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563167, "uuid": "4e2d3ff0-f3d5-4688-aefd-cec130b88c9a", "comment": "Malware payload (Dridex)", "value": "0a12db36c82151d87d7cffc7520548dec97b2ea1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563167, "uuid": "5746b1ef-fd99-4a0c-be44-3e268c0f28a0", "comment": "Malware payload (Dridex)", "value": "3b12fa0c5d66d7c53a0deaeea444559904b38b7d4a8c1de3cd2265e421e00a938c0a335bdb3d17ce4eb95541134fa88d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563167, "uuid": "71e5634e-abf0-4300-b817-1867d729dcda", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563167, "uuid": "d675b26e-6a19-4cb7-8028-e64400544422", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563167, "uuid": "48c2cc59-7859-4755-8450-ff311937291e", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563167, "uuid": "d6c2b451-4a32-46ee-90f8-a527103a4503", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563167, "uuid": "7f2f198c-957c-464d-83ad-e2ac0a828549", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563167, "uuid": "6e9171f6-8a20-4de9-a69f-eb4c2b0c88b6", "value": "903ae6cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef4c39d-ba2d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599120, "uuid": "99153a29-a3f2-4bec-b296-f60bdc53f088", "comment": "Malware payload (Dridex)", "value": "affcb909b893f9ec1a7d3a705759f54f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599120, "uuid": "a2740955-9e10-424b-ba89-5e3bed227756", "comment": "Malware payload (Dridex)", "value": "797397ab33141cf33525210060e81621b2f36867c2f5d3cf16ad6810cf3d7bc1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599120, "uuid": "9ce33ed9-09d7-4f36-aadd-1ac660a06b7c", "comment": "Malware payload (Dridex)", "value": "c1f1af823472050b3e197485366b8dbceeee4d78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599120, "uuid": "06b71cd7-2827-4f4c-afe9-1d368ccf9042", "comment": "Malware payload (Dridex)", "value": "982014ca0c7a40fd5f766be8f9959e9a0ba85b25347edc3681573ccd9e08826b1a734559caa34a166029998d8e891bef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599120, "uuid": "90345601-0982-4b3c-b5d3-2641a84c0a54", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599120, "uuid": "d2f5d3b3-0f5a-4046-b022-1276de1f44b9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599120, "uuid": "196bbefe-fb61-4b46-b0b6-9ca779ed4789", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599120, "uuid": "d26983de-a786-4f18-b3bc-c7838504aa0b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599120, "uuid": "47b16309-bf32-4642-bd79-829e31d6d9f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599120, "uuid": "5c89dae3-741d-4eb9-9c2b-b744dcad9c1d", "value": "affcb909_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6184f4-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573933, "uuid": "72a424b6-75e8-4adf-b829-dee96bfe3c9b", "comment": "Malware payload (Dridex)", "value": "72a4dc2e3f3065e3b854d6bcde02f261", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573933, "uuid": "2c1c0f4d-c489-4a54-b7cf-610bef44b347", "comment": "Malware payload (Dridex)", "value": "79cc867b2b60fc1a93cde41640eb689216ba9653efd2b401f85792f0e9c011ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573933, "uuid": "777c7f2e-5382-4ae0-aec3-899a1af40ef1", "comment": "Malware payload (Dridex)", "value": "fd229def49aa87ed045dcd6885960c02d1bab1a9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573933, "uuid": "6e6b5f79-91b5-43ca-9201-0ab0be642264", "comment": "Malware payload (Dridex)", "value": "f35b9315d6bc09eb36af72185f9790daf5ef5b5771dfa47cf5d4813665a6eecfd2142c2305572617098cb26bf1a707c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573933, "uuid": "17ead5ca-f096-453e-930a-78668ab971f1", "value": "2904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573933, "uuid": "5ea1da5b-1cb0-4cdc-bc1d-1066ca15a9b1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573933, "uuid": "f8b6b699-7c75-4037-9f83-ae996aed7b27", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573933, "uuid": "c8fc3836-6de5-4029-9dab-94bab46f9d18", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573933, "uuid": "7b3a69fe-c080-475d-b2bf-8d47530aab6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573933, "uuid": "a54442ee-fa63-468e-93a0-620f2168993c", "value": "72a4dc2e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3baf2a1-ba35-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621602510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602510, "uuid": "1fcd70d7-61b4-4909-bbb9-a8bf9cca8840", "comment": "Malware payload", "value": "f2279f91db161489273aa5fa71846b49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602510, "uuid": "00abfea5-b2bc-47da-841c-95c1db2d9954", "comment": "Malware payload", "value": "7a0f753c7fb999c6053180b9727c1d6e4f0b446f15b83eca3832d73ab3dbc076", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602510, "uuid": "21ce3d5d-02a9-4719-9648-edff699a7111", "comment": "Malware payload", "value": "74188ad372c144123b5341cdc3d77d43c25f969c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621602510, "uuid": "ab5c99a7-23f3-46d7-9006-450b857e718d", "comment": "Malware payload", "value": "aeffa02e4c291e9c98b73d611c44c77b7b2de498dca00ddce5034f258055762ace087b3ffb41c430dc11c1d86ea3c96c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602510, "uuid": "3548e3d5-5ac0-4254-b526-f4ce7ac7c0a5", "value": "F804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602510, "uuid": "60bc29dc-a932-4cbd-a255-f9131567bd7d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602510, "uuid": "faa270a7-3c3a-4c99-af45-19cbc4671a34", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621602510, "uuid": "be42ea19-9f0b-4dc3-89e7-544661e5a97c", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621602510, "uuid": "40726845-4f56-4808-956c-84c0c43dd240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621602510, "uuid": "6662e454-2070-49eb-b815-ac760e69dad9", "value": "f2279f91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253808ee-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "adec4756-f932-4066-affc-52e102f31618", "comment": "Malware payload (Dridex)", "value": "9e9c8530c5c82b88ccb9b2264acbac8f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "856afab8-9c1b-4059-8edc-8623100ffebe", "comment": "Malware payload (Dridex)", "value": "7a4b846247c0d1b59ec94556877e3891802cd163d1d3d2eb631a63c1679e1790", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "b67cb37d-6d11-4c8b-ba8f-1703ddde79ca", "comment": "Malware payload (Dridex)", "value": "aa59c47c93580ca1f3abac921a03765686fb7087", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616901, "uuid": "943f9212-968b-4261-b097-acf4deef79ad", "comment": "Malware payload (Dridex)", "value": "faced191f78eefb96f0891ea982674b5604d57d175b4e3dc8d1697791d15af0b8b7173c37058de3224f80271032d9c82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "3bb8ad82-f0dc-4b2a-b19e-d2a16780aedf", "value": "D104BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "10f2b16f-ab03-43f0-b0f2-acb0762999ea", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "ebac9792-0cd2-4829-94f7-1f6f1e8d6f5a", "value": "3072:/i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:/H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616901, "uuid": "c588ea25-8c4f-43a4-9d87-c9c20ddcd172", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616901, "uuid": "202b126c-e651-4c26-a5d6-13f687077809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616901, "uuid": "1261265c-b155-4991-99dc-09eef7a61691", "value": "9e9c8530_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f660b13-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621587739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587739, "uuid": "cd999f92-7c08-492a-915d-6c3a89e4f613", "comment": "Malware payload (Dridex)", "value": "ef39f372ead7d604c936f80610336162", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587739, "uuid": "ed269ba8-fa21-4601-8902-a30be8dfadf5", "comment": "Malware payload (Dridex)", "value": "7a502b069b48c62aaf8597412f09798835b4302c3fb202713484928ce0918808", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587739, "uuid": "fb463360-0f7e-475b-844e-368b01fc17c2", "comment": "Malware payload (Dridex)", "value": "6e7143607e9ba32274efbe9b128c86703bdfbe83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587739, "uuid": "c3283e70-47ea-4434-a228-b46ca5577369", "comment": "Malware payload (Dridex)", "value": "b4b786ad1ec76d08793337fc875fa19d172f3d6010729d34ef7fa2c848c2e4e1491b5cb4aee54d860f7af4c599adf729", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587739, "uuid": "5679246d-022c-465c-b16e-4c21892cdd3a", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587739, "uuid": "5da00a6d-abf9-4a39-9b47-deefc861d3cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587739, "uuid": "8992ca4f-8b8f-4ca4-aa00-ba4a01dd2cbf", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621587739, "uuid": "320eca31-d6fe-4f29-834d-7db2d9cd64d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621587739, "uuid": "f0118273-1173-46ee-8388-8fab7d551a73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587739, "uuid": "5f760a8e-495a-4a8c-aea4-7391ff53b328", "value": "ef39f372_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9bc2a6-b9ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572408, "uuid": "edafdbf2-9d49-4b7a-9258-6eaee31dbe2c", "comment": "Malware payload (Dridex)", "value": "935ae6ee60085fca2b694ae8d5e7b930", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572408, "uuid": "10f9cc42-9e58-4032-9b56-ba6abdbcaca8", "comment": "Malware payload (Dridex)", "value": "7a63247b82988a6d07ef78eeaf7d784986f5757a9c8c289745f5020a0c8e4238", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572408, "uuid": "895733f6-6c0c-487e-a5fd-d0abe2aa02bd", "comment": "Malware payload (Dridex)", "value": "fc56f7ef3be2670c6578ce6bc2e59fd47e126a0d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572408, "uuid": "823cbd5d-d393-4698-96f2-302cabb30fda", "comment": "Malware payload (Dridex)", "value": "07807b9c539ff84dc256bedbb1ff9fff5766f674f257d711bee0c16d9fa41e25c200399e0dd97c21c5f5e65dec0ea5a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572408, "uuid": "9d9f1a18-e134-41e7-b19a-eede9e3a8c89", "value": "CCF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572408, "uuid": "ab14bfa1-f0c1-4e8f-b508-22300eab5e98", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572408, "uuid": "4ee92785-3915-4ae7-b2c3-412ed8ee2a8c", "value": "3072:giFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:LeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572408, "uuid": "8bf93590-bc9b-4175-ab58-66b769e25bff", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572408, "uuid": "5a7600b4-e131-47fa-a4f6-8ffd2048b22b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572408, "uuid": "1aa22b1c-ebe2-4014-a970-44b02b0f0112", "value": "935ae6ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e473d0-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1621612503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612503, "uuid": "39d9749d-ddc7-4ddb-ac5d-e493815b64cd", "comment": "Malware payload (NetWire)", "value": "4bab8d8d23d48c4f737bb709d6515b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612503, "uuid": "60f15a6c-6585-4be6-afea-211c56610b6e", "comment": "Malware payload (NetWire)", "value": "7a66553c936c327966af58c1b967b05767bfab5a68660dbcb79fb0724401e32c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612503, "uuid": "0315f00b-95a0-4194-8eff-d51149712097", "comment": "Malware payload (NetWire)", "value": "99566d5fd779a27c7807348c7d18b4e943f22b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612503, "uuid": "75c55f3a-174d-4b78-bf7e-59873975986f", "comment": "Malware payload (NetWire)", "value": "068e34017ad076c1178d00ffa38d3ed2f909976888a7ad3ac9666f03a1b65aed84ff53dc22b861bc868656b5a3dee5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612503, "uuid": "38c32928-3a1a-4554-bcee-dc653071b28f", "value": "2BF4AF37A1E24877C5971D3DAC0B5B189835BE302D146D9637FA3E486E3E7913A0E2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612503, "uuid": "8165de1a-9aa5-435e-adfa-34753149945b", "value": "ee65274bc19b4d848f45a22b7523accb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612503, "uuid": "5010dcf3-295a-4c1d-8c32-a58dacce9b5f", "value": "12288:2+9Eot2ZQwPHyDc2sATUbJh0vgpz4KKoz5BW6QoNsq:2+2oCPHyQ0TCyvCzXWasq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612503, "uuid": "797471d9-b9db-4074-aa10-9c5ccdf00b77", "value": 755344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612503, "uuid": "bd67e78a-37d0-469a-aea9-457c9590aecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612503, "uuid": "61a4595b-5042-4179-9110-7bbe21d85e03", "value": "Nueva orden_WJO-00534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8411f3-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621575010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575010, "uuid": "ba05c407-562f-4c44-a4f4-26229641699b", "comment": "Malware payload", "value": "1b125a24efadd831c48936898a678531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575010, "uuid": "eb64a2ef-5231-4a3f-8e2b-11f7614bd025", "comment": "Malware payload", "value": "7a6bb6e6952e76a0653988182018f97237773ceb1ed76d5059c24c0aa71bf3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575010, "uuid": "63f4634f-ed73-41bc-b268-ee2037473955", "comment": "Malware payload", "value": "9882e7a3252194a03864a74fa48ca378e33cef0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575010, "uuid": "8d6e10fc-9237-4917-920f-ebab0f9405fa", "comment": "Malware payload", "value": "d382306c1e330941ab589dc839bcc2d5ca08faa32be24d9fb2649fd351ed4a0231d47fd3f4fb3f2cda7223928dd81998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575010, "uuid": "7f074234-a232-4ae6-a98b-e0a29be6ba72", "value": "5C25F0322B6CFE51C52DD6B2663380C75BF0BC649391F65A3DAB792F4078B02CA5E605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575010, "uuid": "cca5491b-9de7-4b12-bc96-3ec752664778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575010, "uuid": "e6cadd0f-b800-4ae8-958e-305deaa101ec", "value": "24576:hVF/btxwqi0oE3aE9MymRI6i50LS499zRn1zu+:Di0Cymm6iWjzR9u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575010, "uuid": "7ad2b38c-2ffe-436b-a1b7-d457556c81ad", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575010, "uuid": "13837018-6a53-4a31-931e-5ff42252ed02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575010, "uuid": "4aa83add-ace8-4f55-9fef-0bb4f25d01be", "value": "Reference GOT - House - Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673d3437-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577068, "uuid": "9d0c995f-2779-4298-b2cc-d1e353529be3", "comment": "Malware payload (Dridex)", "value": "ace6eca999fc1f219dcfb7e97d3e2df0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577068, "uuid": "89e21804-544a-4bdf-9082-d2062aa3e6d0", "comment": "Malware payload (Dridex)", "value": "7aba93edaf630d5d196868a48fd1fb154e701896ece013d06127bbb6d3e364fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577068, "uuid": "5aed18bd-5633-478e-878e-69276c3d25b3", "comment": "Malware payload (Dridex)", "value": "f95a1cfb731e154718e22deb4cf799356f6c2e81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577068, "uuid": "b08e5a49-20f7-4e53-b4b1-a5fba743737c", "comment": "Malware payload (Dridex)", "value": "4f2b2477fe84a7fba3c2a7ef7bc6858ebc49024b44f5ed2aac86b0b8d7890dbc2c3068ca99286da579463f6d65abdb7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577068, "uuid": "cc2e3f2c-e5c4-4af5-85ed-df2aba084ff4", "value": "9EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577068, "uuid": "f3c64482-9788-4a2f-9319-5933b0beeb89", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577068, "uuid": "83dd9bf9-013d-4fb0-bec1-508b5ff69e45", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577068, "uuid": "6457c939-f648-4445-807a-4209a3bd70b1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577068, "uuid": "cdfb4fca-e691-4eb8-a694-37871712e9d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577068, "uuid": "f5cb75a7-e58c-467f-bc00-3787e7d3c417", "value": "ace6eca9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b93cf49-b9dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564701, "uuid": "e5162969-0ff4-41f5-b234-37cc854599bd", "comment": "Malware payload (Dridex)", "value": "6ddd9990d9bf19c3bdcf1bac0d026426", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564701, "uuid": "245336e7-7c5b-4429-83e2-8dbf1c712031", "comment": "Malware payload (Dridex)", "value": "7adae9a27337aae8b486894bd54b86f20e6c9a372b70eb53fbdf25edff1d04f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564701, "uuid": "4392eddf-2492-45b4-a1dd-dbc441d6f040", "comment": "Malware payload (Dridex)", "value": "be67e2c5f55c35d41c5c1270ddc4324bdd6be2ca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564701, "uuid": "3889a799-6249-4fc5-a434-608e51d42570", "comment": "Malware payload (Dridex)", "value": "d038a7ca13dd435f6b0ae2eec3a2cd3c538aa20da13417bfe80d28fa1cbf818fed377dab0338b0e8771a3c4315b28ea6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564701, "uuid": "8a71fa82-0580-4fee-b59b-de9a334a1fc7", "value": "6904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564701, "uuid": "48a3d334-a8f9-4c81-b62a-e5b1f9396dad", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564701, "uuid": "263dbde5-e2b0-4a15-8dd1-eadb6b65bc99", "value": "3072:XV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:XV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564701, "uuid": "4704642d-6fd6-47f5-8f61-dbb0fc491bc7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564701, "uuid": "5488748f-0b8c-4452-8963-7febb96954c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564701, "uuid": "d72bb699-0183-425f-8939-7c79155fb802", "value": "6ddd9990_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89040e25-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580991, "uuid": "3994b538-cdf0-45f0-9476-81e5accfbf57", "comment": "Malware payload (Dridex)", "value": "cc1a94a6cc4febae4a8d85d07363e88c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580991, "uuid": "3e3bf76d-a615-41f6-8f62-575dc177f458", "comment": "Malware payload (Dridex)", "value": "7ae05c41e3083c3023a1aafa7d4dba9125bceb864acbee8801d37d04b6fd4e1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580991, "uuid": "342b34bc-84a8-4587-b7f9-0257e5dbb047", "comment": "Malware payload (Dridex)", "value": "7c84ad2a029644e8798e12a4e2b8ba3caefd2def", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580991, "uuid": "8320382d-2b72-4e61-9721-67286442e7ae", "comment": "Malware payload (Dridex)", "value": "d0935eb6308dd98f957ea23d9167ce2dfb0a12906d0ee5e5bd6104a6c776b72e4c93d43b3c3a26955bcb76f3362e1219", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580991, "uuid": "ee34ed51-057d-40eb-9372-87bab11c6789", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580991, "uuid": "d777298b-b29b-4ff5-bc1b-64f1da247319", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580991, "uuid": "66370891-2645-4b6a-aead-45619c239b6f", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580991, "uuid": "fd280176-ed56-451d-b6d0-1f72f58b0099", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580991, "uuid": "62b933be-996e-42a0-bbbd-d7fc9331b27c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580991, "uuid": "71c60a48-14da-453b-b701-79add0bf321b", "value": "cc1a94a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079ce88e-b9e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566600, "uuid": "ee6d7d49-20e5-412b-873b-e6048321862b", "comment": "Malware payload (Dridex)", "value": "a88430418e45f314b25f3353d7f3cc2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566600, "uuid": "aa1f8407-20cd-4be3-81e7-a417ae70aec6", "comment": "Malware payload (Dridex)", "value": "7b1295b82db2239a4ca12b640df172bb7065cff0f02a941f6b786f2fa4605516", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566600, "uuid": "f089cee9-2ef4-49e4-86af-2a0fd0eac880", "comment": "Malware payload (Dridex)", "value": "0378d9625ab3e4d39a0624b158045083b2c4fc96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566600, "uuid": "373f4de2-f3d6-44e3-88dc-a9f5834a60cf", "comment": "Malware payload (Dridex)", "value": "79f433904bcdbe6dc1054a94f2c93c7ce04936b4c72e291d440b775026b9f1abd7399f2f6a8371741cf9f599d5bbc5a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566600, "uuid": "73138106-6b4b-42a0-ad89-aa15476244ac", "value": "FA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566600, "uuid": "2d32e7e0-c719-4d92-91fa-f8b635ddcf8f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566600, "uuid": "8a4ab0c5-5675-4cd8-b5e1-c183f03e47b8", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566600, "uuid": "04ff99a9-8bf4-48b9-a497-eef731ba1d6d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566600, "uuid": "099d7d92-3b37-4771-995b-e6496b01bd7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566600, "uuid": "981b1b70-bf4f-4365-9578-adf8b8b48f60", "value": "a8843041_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf48870-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580434, "uuid": "5932fecd-7773-4a94-9689-a163fb509336", "comment": "Malware payload (Dridex)", "value": "81d860b96fd355a26f5c051e871b53fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580434, "uuid": "82baa568-3f9a-4d4b-a0e6-3410dc21dd2d", "comment": "Malware payload (Dridex)", "value": "7b1d8f4625123bdeb7d1bc88b93f727730b06712849e3f33d235348b2f80deab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580434, "uuid": "aedfbaac-c893-4178-9951-9246e19a015e", "comment": "Malware payload (Dridex)", "value": "13d0c94f0d8e3a39fc7b271cba2d91bd8d0d9849", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580434, "uuid": "7d0c5660-6afb-49ad-9cbd-d130c9bc296d", "comment": "Malware payload (Dridex)", "value": "314a2089ffd0e4cb0b6c4a7a3e89f701d7e0ff45fc1fbd077bd4ecbd25af652117a5862bf7b4947d1d4777ec81471a1a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580434, "uuid": "59d2a4d1-2d1f-46d6-a2b3-08626f53d0f9", "value": "1704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580434, "uuid": "41bce494-e16c-4293-8ff4-91edccc29bf2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580434, "uuid": "584a46a1-c75b-46fd-a1e2-4c7cbd78bb20", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580434, "uuid": "65efa59c-504a-467b-9473-7aea5f5fd356", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580434, "uuid": "8f7267b3-bbd4-41c2-b534-321a232c320f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580434, "uuid": "d076b203-ff82-401b-840f-c26698b45771", "value": "81d860b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c882bd7f-ba79-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631778, "uuid": "2b19e685-bd60-4eb6-aed7-a6530c7cf2f4", "comment": "Malware payload (Dridex)", "value": "4bb592e0745e7ec0f5fe5a25d8c91363", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631778, "uuid": "87f5861a-2d3f-4b20-86f7-c1940f2e569e", "comment": "Malware payload (Dridex)", "value": "7bb891dfe4c95e1a9326c55170abb54e609cd734a477d87e816087162153b61a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631778, "uuid": "e83ec085-079f-4948-94cf-00ca10d86c3b", "comment": "Malware payload (Dridex)", "value": "54bcb0a294304846e32b15669f05ec00b54dffce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631778, "uuid": "2e7854e9-4735-46cc-aa2b-9bce11d92520", "comment": "Malware payload (Dridex)", "value": "846f6baed97018fc79cc6f2a07bfc496b531316a968ff03fc6a1284319dc3cb706f1002534b9619f99015bce53343fe8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631778, "uuid": "fa770e13-127a-4e33-9836-71cb8b07c443", "value": "F7F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631778, "uuid": "1c6a2f70-188d-4cf7-aac2-71d0eecd3c04", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631778, "uuid": "6c788c9c-352d-4350-86a9-306d1b30304f", "value": "3072:T9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:T9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631778, "uuid": "936b0b11-1ec9-4386-9adf-b6de20bd8c22", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631778, "uuid": "af1d8d93-94d8-414a-b464-41701190d2ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631778, "uuid": "bfff43ca-6def-4581-804d-e29b68fb080c", "value": "4bb592e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b957ad1-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570606, "uuid": "bd77db71-6afa-42ef-8b44-a4d1e26c5474", "comment": "Malware payload (Dridex)", "value": "1b854ba7e28e2418bfd0ed8b1be96e95", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570606, "uuid": "f8b71374-b470-4c56-86d4-cccc11d73964", "comment": "Malware payload (Dridex)", "value": "7bf03f6e8775348c5aa552f347f31565579461139b7cdfc87a24e85ffd646580", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570606, "uuid": "3bd24505-f701-432c-a45e-547e8cbfa96d", "comment": "Malware payload (Dridex)", "value": "90dc6b56292423cdddd3e619129234bcb73278e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570606, "uuid": "4ffb74c8-0d1d-4ca2-9cc8-9f6e464a863e", "comment": "Malware payload (Dridex)", "value": "c7f00628a9aac09fa108eb950417192ab09943596aff2568353b5ee19428664b8b4b047af3b2767f8c42df6b0cfe1a00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570606, "uuid": "9f5fb122-08b4-4d51-b4ac-85ca1a234218", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570606, "uuid": "33ef6223-2420-49f9-9548-65db0f781217", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570606, "uuid": "5e4f39b7-0c70-4f96-8697-622ed04feb09", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570606, "uuid": "14831946-cbc8-49b9-931d-a706dea0b37e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570606, "uuid": "2ca60d17-05df-43e5-9242-8f4a7d389954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570606, "uuid": "546b2d2b-f579-43e1-ab23-a91533c08d02", "value": "1b854ba7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2120f5-ba62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621621830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621830, "uuid": "671440c2-67de-45da-9ed0-9dbf4ad35d31", "comment": "Malware payload (Dridex)", "value": "dc62b8c89f37c14e706041e36382db0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621830, "uuid": "1680d74e-3520-45d6-9dac-8acc6d4d7539", "comment": "Malware payload (Dridex)", "value": "7bf597afe36762de572d51d25d3ebb723a0d917a8f4df8da6f3c33d6a65188aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621830, "uuid": "053a263e-f1cb-493b-be6a-7a5e73443eef", "comment": "Malware payload (Dridex)", "value": "3521a3312cd004b5cc26abaabe955a88a19623ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621830, "uuid": "b32e6e1f-4461-43d7-a2ff-0b65af170ebb", "comment": "Malware payload (Dridex)", "value": "5d76328e969de1459ecdc8126916912ccdf1fea241c9c4d66e93c0ab1d5398b8af98275ad03382d3c8384cf44949f0ea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621830, "uuid": "6f097ec1-07a9-4abc-bbf9-afaccc6681f2", "value": "EBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621830, "uuid": "d1ff47fd-ba46-4440-9bab-130b81283119", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621830, "uuid": "3e7258ad-8b61-43c9-8793-824091c24e4b", "value": "3072:kA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:k3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621621830, "uuid": "b3b5bd3a-fda2-48b5-b298-d0a18cdde5c8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621621830, "uuid": "546c88a9-e15b-402e-ace4-a4c93f6175f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621830, "uuid": "67ba9c3c-5e55-42f6-9c4d-f77bb916b920", "value": "dc62b8c8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e2b727-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609304, "uuid": "2dea378b-4e89-497d-bff0-cfd23628cf83", "comment": "Malware payload (Dridex)", "value": "bdc6bb87bc2292df5f9350b1aacdf737", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609304, "uuid": "3feb52fb-594c-4c7e-aa00-0cc37909e72a", "comment": "Malware payload (Dridex)", "value": "7c0776a041ce3fd8bfd4534b2079e90a7a1489d7f2f17c237396b663c1e38bb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609304, "uuid": "eaf04543-0174-4a96-a444-40b06e24367d", "comment": "Malware payload (Dridex)", "value": "f0510c775b6fa2ed5a6eca963acbd3556be15900", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609304, "uuid": "8fe36831-be16-41e8-a775-b495a1ad5b21", "comment": "Malware payload (Dridex)", "value": "75b857156dd3e9777c9f9371329730b11e86cdb4b0c35e74d6c98ee6e63b63f87229e3876d1d62a9a1efe655d91fa4d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609304, "uuid": "89c1fcfa-f852-402a-96d1-71c83bf62d1b", "value": "2DF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609304, "uuid": "9d6acd83-3a7e-45cb-ab89-e472f936cae4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609304, "uuid": "731a44c6-0f1e-4307-a2e2-9d4cbaeac5ec", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609304, "uuid": "7fa77a4d-c63e-43ff-b8f0-20a1f1cf8552", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609304, "uuid": "448b92ea-fd39-4da3-80a7-32e893a0e016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609304, "uuid": "cd57434a-3106-42b1-8567-9693f6ada8e2", "value": "bdc6bb87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ff67c2-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621575998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575998, "uuid": "d8e8ac00-7024-4e8a-8156-3ed5fed60ae3", "comment": "Malware payload", "value": "22ad65fb02ca082b03beec0e47597bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575998, "uuid": "0c2d7c44-d583-4f8b-a9ba-43935aaf27ce", "comment": "Malware payload", "value": "7c0b42cde745cd2480c40f042e0b9a8ac715ee10bf87d71c1f3861af2443d423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575998, "uuid": "e5509e93-71da-43e5-9788-31ec19cd0560", "comment": "Malware payload", "value": "dc9a426f153ebb1e6e7d379d2fbe8d3cc8fa463a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575998, "uuid": "6e29ee42-0e8e-4051-8f40-e6449731b8c6", "comment": "Malware payload", "value": "de301ca36e83acc8485e2b949e630dca5317a6b680fb007d11c8391ad4fb39ed58d2f1d240fe633aede102c55201a62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575998, "uuid": "c031acb1-1d03-4141-9ed8-9584f300e580", "value": "D5B4F13122E96F5AE5BEB7B8157110001BFBF4A5E732E70D7D6650DD44B6E008BA2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575998, "uuid": "8d2642ab-7fe3-48fa-ad5a-d98cb55ed3f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575998, "uuid": "801da48a-3ab7-4bac-9c16-8f066fc7b852", "value": "12288:aUWxCZkNsqucbsDwEw+p9EPCPbus4SLbDTcKEYKz:aUlkNFucOMcPbusvIxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575998, "uuid": "b18f5fdd-efd6-40dd-9ef9-907e8807b550", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575998, "uuid": "6c865503-2be5-4c41-91ce-a4ac53992ab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575998, "uuid": "b4e3a6bd-16e1-4252-86c7-bf06ff788250", "value": "Swift Mensaje MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35beaf0-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592739, "uuid": "367bae97-89df-458c-a08a-b5ad1938630a", "comment": "Malware payload (AgentTesla)", "value": "71551182f4a6d935efc823d1287537f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592739, "uuid": "8ea2bf83-49b0-4274-9efc-9a99bc2d4f9b", "comment": "Malware payload (AgentTesla)", "value": "7c15e8d88f958963a0f43f9ff0bbbc114ecce7a8c00710d870c9bf01f8c2c0c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592739, "uuid": "b7639bad-7d52-47c6-b0b2-aace9f85c8a5", "comment": "Malware payload (AgentTesla)", "value": "047b9bc9f6cee68a1060ffa78fc4868fb2f0f584", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592739, "uuid": "393ae8c4-0ae8-4348-b7b1-3e1c19d372c9", "comment": "Malware payload (AgentTesla)", "value": "735ec6e3ad2113f92d62f7295119c498192957528c3ffbe89421fed113401ac5349071a5d875d9bc775b864890528e42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592739, "uuid": "3db01082-1149-4683-b259-e98d0d4c05e2", "value": "FE8106F44DDC5D81DE978E728DBEFD7741A3324287CE09A0358DF9520BAE7146A9200E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592739, "uuid": "2dd6b52d-c9f0-4c44-a62d-cd7ed41f75cc", "value": "96:I2hr61sgzkvptDXTDt6MA6X5WYnH1rCjM/M:I2k1XAvHTDt6uX/nUSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592739, "uuid": "e32a3bb5-b671-473d-9f13-3b491980d021", "value": 4156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592739, "uuid": "655ce884-3825-4406-898c-d9da537fc5b2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592739, "uuid": "ea45fb13-80d6-4336-b2c8-a1f2faca8246", "value": "MT103_Payment_copy_SWIFT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6947c583-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584373, "uuid": "2d408436-0e4d-46fb-af3d-ccac026b0d0b", "comment": "Malware payload (Dridex)", "value": "5a22724ebb5c1a57bfea454cc629b0a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584373, "uuid": "cbdff791-198f-4def-89cd-c990e3edbb3b", "comment": "Malware payload (Dridex)", "value": "7c3fc68654f4a5c71b58953f078cb48f9a4ad4f6eafdec915d1ced100a5c4ef7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584373, "uuid": "897cc7e7-d852-4d0a-be4c-37a392054818", "comment": "Malware payload (Dridex)", "value": "940da6ab4e479e71a500cb37bd2c90a289ba8a6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584373, "uuid": "e2a13d05-8a70-466d-908d-f842e932e985", "comment": "Malware payload (Dridex)", "value": "4d0570df693940c0c86ba582dc9d0d1cd92743ba10781eb4a304ce67be15f28f17b2142e2872c0ee62d46e81535275db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584373, "uuid": "ff360836-fb06-4135-87b2-da97d953c439", "value": "B204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584373, "uuid": "ff9fa278-be21-47f6-904f-ae213ed001a5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584373, "uuid": "11c456d7-d8b0-4c26-ae50-ae19e86075e0", "value": "3072:iV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:iV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584373, "uuid": "9646c861-6fb1-4c06-8538-22fbfd540a60", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584373, "uuid": "a02b41ee-dc63-47fb-a47a-b25c7b5fa110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584373, "uuid": "a8ad836d-f39e-46e3-92be-c2509634e890", "value": "5a22724e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564348db-ba89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621638458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638458, "uuid": "e07d3e37-08f7-42dc-aab6-717f3f5cbc46", "comment": "Malware payload", "value": "274ed722e7c27c31c77b80f54269a9df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638458, "uuid": "6781ed8d-4228-4621-a3bf-24614415de57", "comment": "Malware payload", "value": "7c9dad8a173605d62d9025a4e5ef1728542772c21c52446adbe8d10587637ebb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638458, "uuid": "eb2cab2b-b2c7-4706-8f6b-0558d66c93f3", "comment": "Malware payload", "value": "d8686cb3c4cb98de097fac7fc643828dfae41f6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638458, "uuid": "d9d02eef-bd0a-444d-90d2-34102ef73321", "comment": "Malware payload", "value": "2214a38e4299a4d84fe78b771a8b11b90917275eaa3ac0c02d4ad23c027cada5eaaca4088ea1d0c5a27a0a0d68efa671", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638458, "uuid": "2c76e832-259e-4d00-9d56-b449c38be1f3", "value": "99F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638458, "uuid": "6ea6ea4c-0981-4678-a8f8-988ee2bd17b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638458, "uuid": "b4f534b4-3c4b-4088-b87b-92cabaac6729", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638458, "uuid": "9dce656d-4161-418f-88cb-5598e7ad6a60", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638458, "uuid": "dfd05536-e4e7-4026-8caf-cb3ba19dc60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638458, "uuid": "a2a283cd-308c-428d-b6de-6cdf09508088", "value": "274ed722_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e17767-b9fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577900, "uuid": "ab8b3861-321b-403f-a2f8-b75f406d6787", "comment": "Malware payload (Dridex)", "value": "7569c66364cc1a4be98ee568369b1236", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577900, "uuid": "ffcbbda6-f163-4034-9023-472c640f1408", "comment": "Malware payload (Dridex)", "value": "7ccc68275a39560a6e3e22733ebcfdc8a3d20d48b13355e3071c6d58fa975685", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577900, "uuid": "1e3467fc-17c3-415f-980b-86e14ec79e7b", "comment": "Malware payload (Dridex)", "value": "54ca7e0249f9c9d3a659bef9c0c2ff332ade386a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577900, "uuid": "36c09f9b-f85d-4979-a003-228ea45e719d", "comment": "Malware payload (Dridex)", "value": "564609b7e3faed88482dc757eca0cc4bddb883ce93af0359417a118d42a75edfe455d59eed7b272f2e9d0102cb01c483", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577900, "uuid": "5f847fc7-52de-4319-9614-864037c1def1", "value": "A104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577900, "uuid": "e1a2881b-8164-4bf4-829b-f77a567885d2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577900, "uuid": "b69df16a-6139-40f2-9e99-556c4bdfd823", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577900, "uuid": "1a1e3d68-724a-4fed-af5d-3695977c7474", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577900, "uuid": "1aa974c0-d4cc-4b1e-9f7e-eea88c58e20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577900, "uuid": "f5c569fe-71b9-4f25-a448-00d95e2170fa", "value": "7569c663_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11c44d2-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621577166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577166, "uuid": "ee3ec350-5122-4a0b-afa3-0663f97e3f12", "comment": "Malware payload", "value": "bea30b5fd1c756cf22a4f289b80a8133", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577166, "uuid": "d33a6d1f-35cb-45b6-8cd7-5db766daeada", "comment": "Malware payload", "value": "7ce564dd32d9268282095a1df4363e28cf1ec6d8503c4e59e9e1a9e114f33f5c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577166, "uuid": "8813c6d9-a959-4e9f-b9b2-a4d3e74f2022", "comment": "Malware payload", "value": "0e1a5535f929b3c756837a2cd2e1db2e4e68d6d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577166, "uuid": "7fb9fc79-80f1-4ee8-bdcf-95e6ecaa4aa3", "comment": "Malware payload", "value": "a185c2b95f246a99201e108fb353bd68107e69d80ada5d5801f7df2b3f08a3dcd4f27de43ee4c8b1ffc3accb0c531617", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577166, "uuid": "0b12ff5b-2c69-464d-9b34-941a6dfcd7d7", "value": "A7C4F17122E56F5AE27EBBB9097150005BFBF4A5E732F70E7DA620CD1166E0046E2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577166, "uuid": "68ca3012-23f6-43a5-9335-4c0af218bc19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577166, "uuid": "ae22b54e-1574-4743-a4e1-d78dcc604b5e", "value": "12288:acx8qKzu/+d5xhjYXwJ0mn6ezpodqA7QR81ocd3DxfgsoAQKFa+uocpu:aTzuwxarel+qA7QR81hpFvr4oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577166, "uuid": "9f90b2f3-e8f5-4fac-894f-c21b46a1cdd8", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577166, "uuid": "35f534be-e515-49ad-a5bd-a1a0bf78af80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577166, "uuid": "d1ce2229-a75d-49a1-b6b3-26ddb6f41a50", "value": "b8txawvmm0ZV6Nf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675d6c38-ba5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621620448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620448, "uuid": "0ca92b4c-7a0b-4df4-943a-98d0ff816376", "comment": "Malware payload (Dridex)", "value": "83fc6d2ba179a284f419551a345bef94", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620448, "uuid": "107c23ef-cc43-400a-852c-0847a29d3d3e", "comment": "Malware payload (Dridex)", "value": "7d3dec9eb26291fde13f2092c4a017c941ac6e835eaaf1d7b89aaadd0fbaf453", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620448, "uuid": "0fa3eb9c-c99a-4be5-935d-81d895ee2b46", "comment": "Malware payload (Dridex)", "value": "5082dd95b4a383e37ee8dd3ed0ea0fc85db2322d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620448, "uuid": "a72c8389-7019-41d0-b2b1-dfb5d2fb1fc4", "comment": "Malware payload (Dridex)", "value": "5d96ab71172ff79b282b0d81464d4986e6a43972bbaec61638f89e89fd375915b69ae1b0b3a906b0025a8090090f00db", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620448, "uuid": "36b9f12c-d3e1-4696-b37e-cf77419665b1", "value": "7104B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620448, "uuid": "be2f8379-1999-4a13-a289-1f38a89c1fef", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620448, "uuid": "beb056a5-1cf1-44de-b379-eb7538a430c7", "value": "3072:7WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:7WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620448, "uuid": "1894fa26-8ace-4aff-ad9c-ac64487ffffb", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620448, "uuid": "1fbe8bca-465a-42cf-8b5e-b0b563ed13b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620448, "uuid": "49884d23-6d2d-4df2-bcbd-bff038f4f57a", "value": "83fc6d2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e03a378-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562450, "uuid": "67f4ecf7-1ba9-491a-a883-cc497785fc4c", "comment": "Malware payload (Dridex)", "value": "7246ace0bd74567dd3b7827baa096548", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562450, "uuid": "81de58f7-3ba5-499e-95af-f45b04296be2", "comment": "Malware payload (Dridex)", "value": "7d4a6fab0fb704f98cf05c6f2548692c9962cd4ac3f8031e73e94b7982f4e66e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562450, "uuid": "86380e3f-5b17-436a-ae88-d6dda78eaa60", "comment": "Malware payload (Dridex)", "value": "9fee859600fdfd9b7800fb61a0dc0b6baadbbe0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562450, "uuid": "85d7c53b-4ce5-421a-a11e-0fddc1336a72", "comment": "Malware payload (Dridex)", "value": "dc460f3db84c867c650325048496a2c80708e09904a3f50b30441282875552c4ac003fefdd4b87393e8a3f10f56b0b2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562450, "uuid": "f2245462-0e9e-4d2e-9ea2-02a87174438f", "value": "2D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562450, "uuid": "5f9dc922-0983-42bc-9f4e-0bc2646dfb0b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562450, "uuid": "201c82a6-9564-437b-94b1-28af71244dda", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562450, "uuid": "0f4491bc-b50a-48a7-a504-bedb2b985e34", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562450, "uuid": "b2bf1eb6-d504-4f6a-b251-a132a3fb0ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562450, "uuid": "7161c93f-7b44-4dcc-8b23-ddf77bcb2895", "value": "7246ace0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2c3ccb-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575928, "uuid": "e31bd399-2354-4d0b-b080-b98ff15e1bbf", "comment": "Malware payload (Dridex)", "value": "31312b790979809db739480716818861", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575928, "uuid": "db4b7cd6-0e04-4bd7-bc03-66d5e372ed09", "comment": "Malware payload (Dridex)", "value": "7d6ccc41e65a405b781308c34f4b616977edca5d35d365698b05213029feae63", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575928, "uuid": "82a9ecb4-4ab2-4684-b0c9-a1a7ba070449", "comment": "Malware payload (Dridex)", "value": "f254daf9460aad68ec46d217c197920faa76b219", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575928, "uuid": "b5e5f21b-1669-45f8-a549-e096317a0868", "comment": "Malware payload (Dridex)", "value": "685ca511153c436bd0ecb773389fbc12a44679eb1aac80bbd50911681b7dc04b35e8e052ffaf71c429d7d0df225b6440", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575928, "uuid": "648549bb-dd4b-4320-bc54-1897b62f3d49", "value": "4904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575928, "uuid": "c2a83408-fcff-42f1-9130-65693fe930d5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575928, "uuid": "3ae1fdf5-2aa8-4202-bd1b-1cd7d0caa629", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575928, "uuid": "51ff8beb-0583-4528-860b-b6c2ae2cdcbf", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575928, "uuid": "d1915873-3585-4338-b3ad-1cc174be31fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575928, "uuid": "03054e8c-d19b-48df-89a2-759c4dda41c4", "value": "31312b79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c9ca28-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621559051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559051, "uuid": "50866501-ee11-4569-928f-9bb329cd1977", "comment": "Malware payload (Dridex)", "value": "f88b09ab8380c9b8c0d775a36bd16095", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559051, "uuid": "1d242f30-ce8f-4a18-a23e-975f1bae974c", "comment": "Malware payload (Dridex)", "value": "7de9a561e9fb97c7b212589e2419c27541ff32f44cd1d4bc6f7af9959a6442b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559051, "uuid": "a87dfb7d-4814-4ef4-b38d-d4647503e796", "comment": "Malware payload (Dridex)", "value": "ced6b3ca6dc883eacd1432ecbbcac1789ed73e7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621559051, "uuid": "bb462ecc-9a80-437f-bc99-617645fac000", "comment": "Malware payload (Dridex)", "value": "dbfb87bf2809d3db67099e2a6cd5aa41e88009912272b11714212a377dc7af304a35934b8b199ea88cbf4b9a633fe82c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559051, "uuid": "e2bdf19d-e437-477d-821f-ed07edc4a6d2", "value": "19F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559051, "uuid": "6172dfd5-2406-4d78-a74b-b9d9c9b80e72", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559051, "uuid": "283acd2e-3b9f-4ed0-9e07-e021074a4f80", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621559051, "uuid": "573860bc-4776-4939-97a4-a8912402c02d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621559051, "uuid": "0063b4f8-0c13-4113-aa20-f76164e82c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621559051, "uuid": "2a9c1b4f-723b-4de6-94f3-da8218f432ed", "value": "f88b09ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f7a92-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580456, "uuid": "3a289d8b-5ad6-4aac-a5e8-cbe4744c1e48", "comment": "Malware payload (Dridex)", "value": "3713db81dcc6ec51b1e7573a745926b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580456, "uuid": "7da3f955-7df8-4694-9ad4-98ea94278c6e", "comment": "Malware payload (Dridex)", "value": "7e3c96fa5bdc8b1ec5ee0626d54bc76d968332b10eb3cc404120e8503343c53d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580456, "uuid": "92a1ee54-df79-403f-8b78-6473fc2d5967", "comment": "Malware payload (Dridex)", "value": "300bc27edbd903dd33d9759fff3eee43d20cdd4e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580456, "uuid": "01db1e55-c119-435f-a7c2-0afaa3337937", "comment": "Malware payload (Dridex)", "value": "723ce4e1f8013cabf175c786b38216e956b11e6bdc18f47f822dbe8d701179a0a6c9691626ecca803258e808f03fc307", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580456, "uuid": "c4739dbc-879d-419f-b396-1b6bc7722524", "value": "5404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580456, "uuid": "b1ead9ff-d921-4708-85c4-5d7d78f751ed", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580456, "uuid": "fef8f011-6252-4b83-b811-370a0086e12b", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580456, "uuid": "135bf1a6-2941-40e4-a714-a17a8177be7f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580456, "uuid": "0f226699-1882-477c-980b-f14b7b4765fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580456, "uuid": "1af7b583-2f22-42aa-a1f8-45c415f001f9", "value": "3713db81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568dd5f9-ba78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621631157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631157, "uuid": "e44a18f5-5165-459d-8956-1f8477b21aef", "comment": "Malware payload (Dridex)", "value": "b5c75d592db4d1b777ce8d3e4cc2f262", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631157, "uuid": "ecf1e47e-cbf5-4732-aef1-d9d816fe215d", "comment": "Malware payload (Dridex)", "value": "7e722395818f48f8a80471b80873cfabab297e159bf0aac598471e9729e54737", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631157, "uuid": "8b561d07-71bd-4dac-bc46-9805ae2d8641", "comment": "Malware payload (Dridex)", "value": "ebffeb4e1aaadfc7902ac2b72134121d3dcb115f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621631157, "uuid": "f8ff8e58-4f53-447b-8014-4fae9dd770db", "comment": "Malware payload (Dridex)", "value": "e923f202caabc19457747aee8dc8137808d3b4d6262b1edb4018d2a0c697a5e29c6152be7f8c5f0d93c78af90151191b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631157, "uuid": "e2b423e2-3c26-4ffb-8661-563b30b5663a", "value": "28F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631157, "uuid": "f54077fb-c37e-4c82-a185-55d9ceb4803c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631157, "uuid": "a3635ad5-8c35-4366-a842-7380cefa6b99", "value": "3072:wiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:beAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621631157, "uuid": "dc9ac266-75a3-4b12-a738-3e19b7964144", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621631157, "uuid": "93a4f39a-872f-4a12-990e-00b69a6c4682", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621631157, "uuid": "24989d53-8c70-457c-93c3-8ce4796463c2", "value": "b5c75d59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b06b64-b9d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560388, "uuid": "7e447e8f-6fec-44d6-97e7-d64f003a9cee", "comment": "Malware payload (Dridex)", "value": "38b657ee6b774caa2ce63d813fab9fb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560388, "uuid": "683f25a3-2002-41ec-a746-7a3ef6ea0b7a", "comment": "Malware payload (Dridex)", "value": "7e99d9fa86cf101a99fb7db4c50da89bb1ffc37e2d8edd9ac66d592bddee551c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560388, "uuid": "c22a7b05-b99f-4509-83d0-b3cf2bcbe9c5", "comment": "Malware payload (Dridex)", "value": "a389570265c53cda4337901cb443a4da1002d0a6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560388, "uuid": "cb07b5c9-e5f0-4283-a4f0-5afa907a7a3b", "comment": "Malware payload (Dridex)", "value": "7e64f0904e330d00bfffcc77c7802876600c95bb32b4d0d07e2cbcb2e705407e5816bfe6ce715962d5490c1fb47d7ccf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560388, "uuid": "c040aa5b-3f3e-4bea-93fc-065cf1b44692", "value": "9204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560388, "uuid": "0f4d8047-b6d0-4997-8e76-cc3c98294897", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560388, "uuid": "2039c50d-b3d6-4b74-8d38-0047e323511a", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560388, "uuid": "4619a6f3-7db7-4bf7-9f6e-c8aa0992618d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560388, "uuid": "459be3c4-779a-402e-8a14-5267e2625d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560388, "uuid": "2bdbf051-c4e5-4cc4-b9d3-0049e7265c87", "value": "38b657ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860e2249-ba07-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621582704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582704, "uuid": "ccc0faa4-ba3c-4f42-afe3-f7f06964d702", "comment": "Malware payload (Dridex)", "value": "09c48b3c9286c055d2b83d0a84f414fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582704, "uuid": "ffb39dd5-7a99-40d7-8ea7-ba892c3a3912", "comment": "Malware payload (Dridex)", "value": "7edd364f7efcbffb69ca2a628604ca0981e19de1178ead7f2ef24a2b147c4170", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582704, "uuid": "dc418d97-fb5c-4574-9284-3b52cb556f38", "comment": "Malware payload (Dridex)", "value": "214a942d75200391759ec07c96dda8560a3fd121", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621582704, "uuid": "e46a2df7-b096-461e-9aee-786597f78a10", "comment": "Malware payload (Dridex)", "value": "6b07cff6c063437f44dedbe297f0aad3accab0d3ab5d1b08e1f0a96eff7c4ee4877fc92c246ca42028d09fa75924907b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582704, "uuid": "02ae2b9a-a3cc-48b5-b333-2b7ebcac608a", "value": "0804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582704, "uuid": "d5d9dbfd-ffdd-4c2a-a9f6-0ebf5039ac53", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582704, "uuid": "0d9a28cc-3f52-481a-8db4-628ad7825c1c", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621582704, "uuid": "6bcbe970-6ff1-40ca-bdfc-445328b8b5c4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621582704, "uuid": "fe3b397e-644e-47d8-a1ba-dcdb61ff73c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621582704, "uuid": "05a4c5ea-3368-4c1e-9865-afee6956800a", "value": "09c48b3c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46797e7a-b9d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562840, "uuid": "095f1a48-7ba5-406a-96de-d2a58fb6c325", "comment": "Malware payload (Dridex)", "value": "08c3cfa607a5d4c14be1842aefb74a3e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562840, "uuid": "0a16fbaa-3c88-4b67-b6cf-db221d23de83", "comment": "Malware payload (Dridex)", "value": "7eeb8a5fabe02c373b2d7b53b1aaac67a905d196bd039ca604053f0e03ff41a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562840, "uuid": "c4b5fb83-efe2-45ed-835a-5e8f2d747688", "comment": "Malware payload (Dridex)", "value": "799daaf8c888b6ff2256dacb9f1ef251ee9662a1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562840, "uuid": "6e5411fb-9fe4-4412-92f4-5c370bd584ee", "comment": "Malware payload (Dridex)", "value": "3e376e6c347f5c6d90d8400a630abfcd26cf41451a4b4824a57d4e5a2203d6fd0a2b8e810b9cc7828f2d25b2fd65d574", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562840, "uuid": "6e496d94-d488-4d73-9ea5-9c33c7788c35", "value": "6A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562840, "uuid": "e459b324-0c27-46db-801a-db1c6a55af25", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562840, "uuid": "ea7e4802-cf5e-4078-9798-71da217ba09b", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562840, "uuid": "55cb7401-5fe8-4c67-9fef-3bf8f4c8b0e4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562840, "uuid": "0f13f659-8130-452a-a590-c9ac8dbb9c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562840, "uuid": "9405a160-cd99-462e-a40e-2145a5f4d432", "value": "08c3cfa6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bc5783-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570837, "uuid": "020656ad-084e-4210-90ce-71b63fb64c2a", "comment": "Malware payload (Dridex)", "value": "8e26a3e92632a909d92cbf1a7a57c155", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570837, "uuid": "d42937c4-ab51-46e3-8a02-db1034a7fa25", "comment": "Malware payload (Dridex)", "value": "7f0a75757063c39d5e92118c9dcd312b6eb2f5f64587742806bd92102edb2b7f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570837, "uuid": "7fbe50dc-9e4a-43a8-8679-21c79ea53293", "comment": "Malware payload (Dridex)", "value": "6e9040157548601f81723fbbc224b89e8b1425c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570837, "uuid": "40a3ded3-6af1-4a09-af4f-a7d692c8953a", "comment": "Malware payload (Dridex)", "value": "5a8e5d501bec67f1eaa162d3820a7267d33e560fc397b275229a39b5b031ba969a8134dc648366b6e60054a837ffa3b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570837, "uuid": "cf845320-d72b-476a-b384-c490cd93a187", "value": "6904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570837, "uuid": "dd36f4fd-df7e-42ea-bbf6-275e85bded00", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570837, "uuid": "75e2ddb5-9495-4506-bda8-eee10b303405", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570837, "uuid": "e1cafaec-9d63-4615-8d91-8f7c22dd6dea", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570837, "uuid": "98a24ae2-763b-405a-8159-df17761f01db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570837, "uuid": "78f4d0f7-9a44-4201-9fd9-827cd4d9b04f", "value": "8e26a3e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0dfcf4-b9dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564571, "uuid": "ca7fa4ca-fc2d-4fe8-a677-8e6cd151dcee", "comment": "Malware payload (Dridex)", "value": "cf64c2aa04685d9e595dc0b1f4520933", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564571, "uuid": "f669c756-084a-49cd-9778-259e32cbeb50", "comment": "Malware payload (Dridex)", "value": "7f6a53bc7d003db38eb06a5fe52aca7ed93a03a7f1f44ba62644453f17c507a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564571, "uuid": "128641d8-6f77-428d-a816-06750efb7e8c", "comment": "Malware payload (Dridex)", "value": "8d333d9de3b1a91c7a850f4edfe663dcc80a213e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564571, "uuid": "9a8802c6-89b9-4f4c-b23a-886eea72b1cb", "comment": "Malware payload (Dridex)", "value": "879d23e449429d146160808ac1c49dbbc89ac582827b0989e437a180cc554c4998875ded7ba9b0a8535bd881cbd7101d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564571, "uuid": "ed907afa-50ab-45d0-abf8-407cdb930d2d", "value": "8F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564571, "uuid": "d72623e8-0173-4f2f-98e2-7cc2ef98e61b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564571, "uuid": "aaeeac49-a746-419c-9c20-6794c1772dd9", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564571, "uuid": "5f460df7-e798-4c80-bffa-1ff505c09626", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564571, "uuid": "41e06c4f-e72a-4b12-baa7-8a70b9e9655b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564571, "uuid": "67352c1c-b362-44fe-9424-dc6d3911150e", "value": "cf64c2aa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e749a1b-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580812, "uuid": "30c0ebd3-4cb5-4311-9da2-e52dad2c7472", "comment": "Malware payload (Dridex)", "value": "8a980814078f94e27e5546418659c03f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580812, "uuid": "17a8840d-b10e-43f0-88be-bdce5a5cbf18", "comment": "Malware payload (Dridex)", "value": "800fac8c3479db3fd3d4bd4b48f40d918c4aa55c390ed5ce9082b969d7c1ac79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580812, "uuid": "0cca7b14-f95c-4440-ad55-9ddfcb19439f", "comment": "Malware payload (Dridex)", "value": "8683c84e38a93c12e8728cc81a86e693c1e584a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580812, "uuid": "39a5bafb-7812-4018-ae91-4986a8e9f0bd", "comment": "Malware payload (Dridex)", "value": "a29c3a22b235db054eb6b24564727fa182c883cdaf81015a738305ea9a83ef17f124b482381e642e67b307dd579aaa06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580812, "uuid": "325f4553-648d-49a7-8ada-8231fa7ffdbc", "value": "15F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580812, "uuid": "c6efd553-36c8-43ae-a00a-33c9a289ae11", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580812, "uuid": "04352a5a-fb69-40d0-9362-333ec9d6e164", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580812, "uuid": "61378df4-03ed-43f7-afe2-9df509463109", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580812, "uuid": "aa646777-3ea1-426c-85ec-dfad5f2339cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580812, "uuid": "1053bd13-38d6-48cf-8526-03033fafa147", "value": "8a980814_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11694dc6-b9dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564469, "uuid": "e73644f7-899b-4e42-8334-ada9e5a43a54", "comment": "Malware payload (Dridex)", "value": "d78e2d74a0521277e561d03c07fb6699", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564469, "uuid": "31a79daf-e5ac-4021-9ab4-8f6ce031c229", "comment": "Malware payload (Dridex)", "value": "8024f698ba05cf89d2b7d8dfd785276be50f380f23473bfb4b7ecf4f250eb007", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564469, "uuid": "6f09dd6a-0e2f-404d-baa4-0b30e2dabae2", "comment": "Malware payload (Dridex)", "value": "0eda0049e2c91a92d371acf0682120b39fa5b926", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564469, "uuid": "a7da08eb-f08b-4ce5-9238-a022ab8253e9", "comment": "Malware payload (Dridex)", "value": "5ba98d0cf86feabe9bab3b937be1104c7963b07ae91427e5792f20114c044e70538fa61ca087498d0cca8a99e70b6078", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564469, "uuid": "f273c4c6-aa34-4308-b4a3-187292827a72", "value": "C504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564469, "uuid": "fa519dbb-64d4-4dcf-b10b-1a7844e880e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564469, "uuid": "74f4167e-1389-4220-a57e-3113e5b188e3", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564469, "uuid": "bc9d2d65-1a53-4a59-a82e-b1630a7d6009", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564469, "uuid": "5805c02d-397b-4d65-b531-52699c2130be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564469, "uuid": "3f1e928b-edbe-4793-9e52-f5897370a317", "value": "d78e2d74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d895fef7-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621616772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616772, "uuid": "d81b21a3-ccfd-41da-bc97-84055264c5c4", "comment": "Malware payload (AgentTesla)", "value": "99510dd37b1a7d55bd8400af3f18441b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616772, "uuid": "484bcefc-4540-49df-bbe0-08516631f432", "comment": "Malware payload (AgentTesla)", "value": "8079c489c34ad2b7412bd0fcaf69d31639827d60f35d7f8c0df6c58b293e91d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616772, "uuid": "af68b561-4a8b-425b-9d8a-2cb7f64c060a", "comment": "Malware payload (AgentTesla)", "value": "029eaa7d91bcf93e8a14d1106688c977399effec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616772, "uuid": "0dc9fcbb-e73f-48b1-aff1-6eae75a0e846", "comment": "Malware payload (AgentTesla)", "value": "f2bf16dd49a177e4b7e97b47b85a9a87a96b52b806353db36483422db9677e1a8aeb2038c21041eeb3914793cd80f17b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616772, "uuid": "4c1a29f2-e96b-4a1f-8345-f780652dd26b", "value": "28941219AA9D577FC4AD6B7A44656E43637EE1984613FBEB8CA030380CB376301917CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616772, "uuid": "d90c0983-277b-42da-abaa-bb2d315de278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616772, "uuid": "fdc51e8e-c87d-40e0-9180-178a694458b0", "value": "6144:IDMsXMD3rLMXpKOgjWpBTcFjvhj0wnbkV0JRJTl9i1uaw/75Hr0S6naKlf+5bnOi:MXw3XqmqBT4jrnbkAME/7Z+/56L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616772, "uuid": "26ce6794-ce60-47f7-9975-e1c8f9f09d7d", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616772, "uuid": "39edde6f-0986-4908-823c-87c1ec79e76c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616772, "uuid": "a4727599-1970-499e-82bb-8ffdc642584b", "value": "99510dd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecb440a-ba89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638660, "uuid": "822f6727-d73e-4bbf-bfe7-1adf651b181e", "comment": "Malware payload (Dridex)", "value": "42b17ee45f03e4c1458c033c9321ffe2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638660, "uuid": "6327d420-816d-4499-9437-7aac5ea5e518", "comment": "Malware payload (Dridex)", "value": "80a0f1229996b75bbdca42079789f1c377bdf1477b8569e2d3d0cd584efa01d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638660, "uuid": "5d11b858-9793-4962-bc36-17292c3ac6db", "comment": "Malware payload (Dridex)", "value": "2d9f7d91986d4d6932a290778be08816624a9053", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638660, "uuid": "7429ada8-36dd-4d9c-9863-5a04aaa9d154", "comment": "Malware payload (Dridex)", "value": "6c264dc83da5b7abdfb5ca27188760cd124e9d2e74d854ae38a473b37fdc0663a01d175af371d6414f250f2e6b2416df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638660, "uuid": "68fcd857-9f13-493f-8f0a-df0a08e9147c", "value": "A604B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638660, "uuid": "6376bfd9-9da4-4b22-8f5d-45d280c54f32", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638660, "uuid": "46a204ca-319a-4911-ba21-e8f608454dfb", "value": "3072:gWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:gWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638660, "uuid": "206f45ba-acd1-4cf0-bdfe-59d5e39effde", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638660, "uuid": "316fb8bc-6648-4275-ba16-603cec82c32c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638660, "uuid": "8e155bd0-42f8-42b3-8cb8-ee3b886d0bf4", "value": "42b17ee4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b539553-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1621612240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612240, "uuid": "0ad07d47-c62a-47ab-8b91-972ff14d5f71", "comment": "Malware payload (GuLoader)", "value": "a049ef27f3a0c3c47c9e91bd7373216f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612240, "uuid": "fd4b2688-f898-44ac-b26a-5f1754c6342f", "comment": "Malware payload (GuLoader)", "value": "814b21bdcdb81fb5f930e16b5f00eae2ade2ee2057d3c5758a8c80c25650a367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612240, "uuid": "1d692040-50cb-4ea7-bbb4-01821ec1920e", "comment": "Malware payload (GuLoader)", "value": "f494588c01454d21dc4eddb3938d1b5f4d8b99e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612240, "uuid": "58df8518-fad0-41e5-a958-394cab01016f", "comment": "Malware payload (GuLoader)", "value": "d0012ceb9b59b5f53829da9e1d4b11a8cf903c009d646d18c3524fb38330db3700dfc35596851f8051f4fd475395e8c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612240, "uuid": "a287f5b2-7311-4352-b6a9-1da2bbfcf14d", "value": "36348246BA22E579E9869174F466C20F18B67C7332854E07FF837F67B0300475EE8A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612240, "uuid": "88c29f0d-9c7a-4565-a4e9-bc0132478b14", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612240, "uuid": "861090f7-dfe9-4bb0-bca4-7d4dc033f097", "value": "6144:yglsalnSV54T4J78ajrS/+P4okNePJWjQm:bls6W54T4J78ajr2+P4okyWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612240, "uuid": "ace7dcd7-6da5-4cee-94cc-09bbf608f5c3", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612240, "uuid": "abf28dcc-125f-4143-83d2-e15fef628208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612240, "uuid": "4b872ce7-1d05-48bb-b76e-05db4623a6df", "value": "order 2001135249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d31bc7-ba0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584931, "uuid": "966e6871-b17e-4db7-b759-75bd4545a4e0", "comment": "Malware payload (Dridex)", "value": "08c8cd9f28b33a9f3c72aa56ce4d7165", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584931, "uuid": "bbf9272f-06cd-4329-9a1d-6042d93329d1", "comment": "Malware payload (Dridex)", "value": "8192bcdf062a9552fac81e6f1c3ac525a6f3285bd8ec10058c52d6e2804b6d3a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584931, "uuid": "ab9cd7db-2522-4649-9685-ab6888257593", "comment": "Malware payload (Dridex)", "value": "f44f08815d4409d6309713547003ed35f8fde860", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584931, "uuid": "bac0d465-8e26-446a-8c98-eb16085821bd", "comment": "Malware payload (Dridex)", "value": "a85998af9f207e5c89f7d5810acaa4d3d090413228f7694be9602d72c3189114af28994683f3bdbc565dcfe60fc15a39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584931, "uuid": "7b462230-2a8c-45e3-8d36-6b0e99c83113", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584931, "uuid": "50b627a3-ba1f-4f5d-ba2c-c5c30c3b1f3f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584931, "uuid": "bcf581f5-2fbf-4d8e-a54a-44cf4e1bcd2f", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584931, "uuid": "614776dd-567f-414d-86bb-59d2f59f84ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584931, "uuid": "4df6ed4c-1aad-405c-bd5c-0c4fac5184d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584931, "uuid": "3e87a894-7bdd-4c35-ae2f-ae143b4ad6e6", "value": "08c8cd9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa2a57f-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580599, "uuid": "924374e6-b9b7-4d19-9dfd-3cf9727f698e", "comment": "Malware payload (Dridex)", "value": "c1b2d5bf5966eec14904276866b393f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580599, "uuid": "bd148013-d27b-44d5-b24d-ec3cb2a85307", "comment": "Malware payload (Dridex)", "value": "81daf6ce0eaee90301177f266c2b13f6f9f3e5564444a2379873c0fb722a81fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580599, "uuid": "9eccaf5a-2d69-4df4-8499-2df6d6e3c520", "comment": "Malware payload (Dridex)", "value": "ce514155c85b62b5374c7573c0b766ebf11a9457", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580599, "uuid": "196762cc-cdc4-48e2-9865-694f78d868e6", "comment": "Malware payload (Dridex)", "value": "f222c1b486a21736f51104163e3c156654b4cda01f29e8b3cb1a9173a4102f0fd04e56e29ce3077e2c6655a7c3403a69", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580599, "uuid": "60b17e47-0872-41db-bf5c-8951093c2044", "value": "B4F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580599, "uuid": "aa876a0e-031b-4071-8b61-e62eb97e4126", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580599, "uuid": "c46b0dd4-67c1-419e-9c33-369c35f5c7de", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580599, "uuid": "3d503774-0c0c-4bf5-bbd4-32d097b94c9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580599, "uuid": "2948ac7e-8701-4bc9-aed5-af1f42d58222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580599, "uuid": "bc6ebb14-303d-4355-937e-9d71df925a31", "value": "c1b2d5bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdf5ea8-ba3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621606826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606826, "uuid": "f5fe45d5-ec00-4f9a-bee3-324bc76a376b", "comment": "Malware payload (SilentBuilder)", "value": "5edbe2bc368176618975e0dd981ae209", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606826, "uuid": "22bad387-a548-4e19-9c7f-1047ea5fcdf1", "comment": "Malware payload (SilentBuilder)", "value": "81f08599b7fccb01100f002b3c161cf33dbd0dbb2ba0dae9c8c98bf555252982", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606826, "uuid": "12428da6-895e-4641-92a3-beae90e298f0", "comment": "Malware payload (SilentBuilder)", "value": "05eb0626c3013a0de95221fee7c780ceeeb2e245", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606826, "uuid": "1a130713-8916-4286-9419-eacece5122f6", "comment": "Malware payload (SilentBuilder)", "value": "ac18c32fe12bcdfacae5bab0779d2f2a7a3ca35f4ad6b8102b650ca5cafedbbb405106c11ea25ea5d38cb4000e6f7800", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606826, "uuid": "30d3b2ee-112f-4c30-8f02-7291b0750ec8", "value": "14B49D42A309D4A9C3614B3AA5118AE8556BEC52860EBF43374BBF2CDFF4390F718765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606826, "uuid": "014df0ca-9874-454f-9f0f-c28f13fc9ede", "value": "6144:C6tIrWqrY5O3NMHGRYc9u/YRTP85XbDu1XYiXxy:Ru1XPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606826, "uuid": "151fdc1a-8ed4-4070-a2d3-a73b7aadff9d", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606826, "uuid": "055081de-338b-47d5-9993-fe74417def67", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606826, "uuid": "c8c3e7e3-a18f-4e92-ada6-1287c875b939", "value": "statistic-1541927974.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111e53ee-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581219, "uuid": "77331728-7333-4120-ba75-50d76e7af3af", "comment": "Malware payload (Dridex)", "value": "330a11be2d04d954f9eaa8dcfd3c5080", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581219, "uuid": "132beca8-96a7-48ff-9de0-90be63e69f9c", "comment": "Malware payload (Dridex)", "value": "82128440ca999e9a5818213b9ac5825bf9f68fdca44ac9c626a854d3f465a3b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581219, "uuid": "5d232c65-d412-4848-b0da-287419d254d4", "comment": "Malware payload (Dridex)", "value": "52c991ff209b783246a8b0dc2a9406bc2ed38031", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581219, "uuid": "ebc6f78c-e23d-4f5c-a9ef-1f28fbe5c51a", "comment": "Malware payload (Dridex)", "value": "eecf9f25033b8cc421fc843d0bb7fdd44094745a90cd61d4c70519930618a5b9b3c7193a0e92f714268d1164df7672a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581219, "uuid": "4d38b80b-a611-415b-b5e7-0103fa707078", "value": "4804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581219, "uuid": "f2c58eb7-2055-49b3-81e0-b0c40293f441", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581219, "uuid": "7f332d1f-a170-428b-b78b-cca98c59776e", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581219, "uuid": "be6abebe-d8fe-49d2-89fa-f603a5945836", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581219, "uuid": "729016b6-f99e-4c71-ad44-834a62b11317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581219, "uuid": "9084cb0a-7aa9-481f-9ae1-04e424ff7834", "value": "330a11be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c623e3ab-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573792, "uuid": "e4dbade2-e553-4ac0-b36b-ab7d2268b40c", "comment": "Malware payload (Dridex)", "value": "ce9f0cf810fa3fad35a5f0726c5467f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573792, "uuid": "b41ece49-e8af-426b-b8d8-523a8ef7139e", "comment": "Malware payload (Dridex)", "value": "821de6342bffc28080391797f268e6dde61cfc2f1d41b84b35bd9d592e17e805", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573792, "uuid": "42e42c83-171f-4ccd-b980-0e4d93471101", "comment": "Malware payload (Dridex)", "value": "efa37363f2168d70069c1de2efbf805ed99599e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573792, "uuid": "8c10b656-cbc0-48ab-a3a1-af571c8a9e92", "comment": "Malware payload (Dridex)", "value": "15c138e117f6a7e7f53d78b688c1f5716753df91fca73e3c72a3114dc42e08756694d6cb353f1628d32da7f326b1d32e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573792, "uuid": "8e3c8146-2304-43cb-9421-19bb468af2b7", "value": "ECF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573792, "uuid": "8b14380a-0541-4c10-a117-d27d902a62de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573792, "uuid": "a678eb1b-0c56-44d9-8ef3-f680f45bb672", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573792, "uuid": "f3292960-a561-4ef0-a060-b078b2cb1ca3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573792, "uuid": "11371f04-90a6-43af-b8e2-34ff4dfcfd29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573792, "uuid": "3f516ce9-f6fc-4a9d-baf7-346887eb7156", "value": "ce9f0cf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf8e13d-ba01-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580325, "uuid": "c95ce0a8-9124-4ac5-8ac8-3409581a7998", "comment": "Malware payload (Dridex)", "value": "53f39720364a02ad7adb5ecdd8234c92", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580325, "uuid": "4bfc933b-b54e-4cd0-bf03-4fc24826e127", "comment": "Malware payload (Dridex)", "value": "8264ef07a418986cdec18f1fd28bc9954c89861dbda47b3e294b477359e43e27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580325, "uuid": "8a982700-19a4-4abb-abe8-b0fdaa69cc71", "comment": "Malware payload (Dridex)", "value": "8a9f182a4464cdb21bce222c5924b0b8ff91023e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580325, "uuid": "47c8a88e-5ffe-4ce1-9130-b40d24c696dc", "comment": "Malware payload (Dridex)", "value": "5ede10e96df951d5039d2662ff198d2c806985cc719db9507f75693199d04d72b898f3846d4855a8a2615d9d1e248747", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580325, "uuid": "03c8c2eb-ebcb-49c6-874b-6a479312726b", "value": "7904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580325, "uuid": "339d3f2a-a237-4628-8f0a-4d285c9526d0", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580325, "uuid": "8980ab8e-4015-4f13-88a0-c2232db86d36", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580325, "uuid": "ed5c91a9-a884-4cbe-adab-a6c3ddeb6666", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580325, "uuid": "bc3436b2-b1cb-4124-935c-f0911686855c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580325, "uuid": "eca95f91-06ac-4b9f-973b-92e7c74522d6", "value": "53f39720_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de22d694-b9d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560088, "uuid": "c0ea7f50-4a72-4e84-a64b-b42860c6ee48", "comment": "Malware payload (Dridex)", "value": "3dd04dd4951c970e14f801bc07319671", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560088, "uuid": "46819086-d8af-4f2a-a03f-8ccc5c611535", "comment": "Malware payload (Dridex)", "value": "828cfcaa376180704b561731b9e06a0d948285cd9cac1fc6ee062b13e218df23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560088, "uuid": "7cf281cf-5217-47df-bbe1-a43a783182c1", "comment": "Malware payload (Dridex)", "value": "6e1fe2a1f07626b28128a8537f62f1fbc440dd53", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560088, "uuid": "2ea139ca-34dd-494e-b78b-ffe2d0bd6cc2", "comment": "Malware payload (Dridex)", "value": "590152889108f2bd2083c65457e28c75d9506b331b634560ad7a76b2d8c7a27a8b90833234108a9a5fb0dd5b445f9fcc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560088, "uuid": "2b599624-2ca4-40ba-8931-4c104c537798", "value": "2A04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560088, "uuid": "24a3a12f-532a-4b58-b965-b52297a801c4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560088, "uuid": "73796f83-7256-40bd-8145-84e02b13f3a7", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560088, "uuid": "371fd405-9629-4a85-9ed5-d40009362d33", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560088, "uuid": "2c60fa9d-8c17-41d7-86f0-27e8f0a11a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560088, "uuid": "58d8ba97-3d55-43c4-8c29-04eb42f8ddb7", "value": "3dd04dd4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04587206-ba50-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621613839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613839, "uuid": "a61686a9-f379-4b7b-b9e6-b7ae55ad5416", "comment": "Malware payload (RedLineStealer)", "value": "18b6e2c669dc078e297af35aaaa605fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613839, "uuid": "1142232c-842c-4072-b222-5d8683bbceef", "comment": "Malware payload (RedLineStealer)", "value": "82b71a1fc1c575129b572ee2ec5f20e7008e373400b8f0ada298e073fe3d5112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613839, "uuid": "d94a32c9-1717-4a69-8295-809e2a4d2b41", "comment": "Malware payload (RedLineStealer)", "value": "a9267780040b1bab6996198050685da4b8d0315e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613839, "uuid": "3dd98b90-7af1-4af2-bfca-3fd3388cb26e", "comment": "Malware payload (RedLineStealer)", "value": "964f970677092e16d10452532bf87a5297d211273b7af6fdc1c5d42ea5308d419bb689e6a38e318bfc5ea23bbd6ef34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613839, "uuid": "78f18ea4-6bba-4969-95bc-6b28e266e328", "value": "14F4E120A7A0C035E1FF11F449BA4279653A7DA29B3470FF1AC52AEE5A349E49D3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613839, "uuid": "8eb2a25e-5d5b-4810-9439-33bfd7c4ef4a", "value": "5190db9e278edf55d3b5ab1608f0dbe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613839, "uuid": "b847ae6f-2952-4a04-804a-d21dd3bd0958", "value": "12288:X4GKGRiSL8E8DuNlFGbuZerJgsBngki2fuzkwFSPysv+jqA5OM+SCpcBDSYrqHuj:XnRi47lAqZePngk5WzkwFSaljqAsMDSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613839, "uuid": "fee35a8a-e8c5-412f-8bd0-a1f6f50cc066", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613839, "uuid": "dc584eca-47dd-422f-871f-800904f5195c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613839, "uuid": "0e335dd1-e95d-4e64-b523-481d2582c9c9", "value": "18b6e2c669dc078e297af35aaaa605fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f495ab91-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621581171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581171, "uuid": "45507176-82ae-46c2-9b90-3483315388ab", "comment": "Malware payload (Formbook)", "value": "3aede3db7e654977cb5d5cd06868c7d3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581171, "uuid": "f444140e-40c8-4745-9ca0-5df77173f58d", "comment": "Malware payload (Formbook)", "value": "82fb252522cdae2a54e364c18a455aa74487f21b0b7f8292266d82fab7586083", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581171, "uuid": "6a6c04f8-c79f-411d-8711-446b99ed3a72", "comment": "Malware payload (Formbook)", "value": "5695c9d7656bf8467c5abc3963200c5664c7c245", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581171, "uuid": "25f78740-2da3-4f3b-84eb-80cb1107a244", "comment": "Malware payload (Formbook)", "value": "1cf9033247e7c94bc74086abdeb495d0a311f496787d904e2bbca09410ac0f265d3a63468360930181cbc29b75a0adcf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581171, "uuid": "1abf1168-2578-495e-b7c3-30b5c053a52d", "value": "737474E411DB8275E6444A4D75C0B2C95E74FE9230CACC29A3AE8A71CF65AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581171, "uuid": "46713440-8f84-43a9-ad87-b2d2dc1a0aef", "value": "3072:9NBrB2BrBGP5lHKKMV35jldzFDr5RDAw5wf/:VVcVG7KhVppdzFD1RDAUw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581171, "uuid": "bc9ad98b-bc94-4f27-9b3a-81a57c633c99", "value": 368213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581171, "uuid": "ef167089-ab9a-44c3-8d84-017752deaab7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581171, "uuid": "701e4905-6597-4aec-b261-d650e15c55ac", "value": "3aede3db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538f9d63-b9e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568875, "uuid": "f13e01f8-1e55-4476-a7a5-1f7eb1f68818", "comment": "Malware payload (Dridex)", "value": "d35d7add2a662f89b49ff4fb4221d6dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568875, "uuid": "d9cf4244-8138-4dd3-bbee-1e6c49e52b54", "comment": "Malware payload (Dridex)", "value": "83378928aa820e4bb7a12607a4979ff78b818f2b4f65d009f00e05005f6548be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568875, "uuid": "1e25b158-0d07-4472-90d1-a03f8dea67de", "comment": "Malware payload (Dridex)", "value": "8dcdefddb04274f8dfb28856c4312e969d10bfa6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568875, "uuid": "5af0fba0-8b13-4034-8b75-498aa063448e", "comment": "Malware payload (Dridex)", "value": "9d506684170fd905c7a6a00899f2f21bed4db864b2367259ad96abf56a46657a4455928358312ee4269fdda2f9d8d09b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568875, "uuid": "f5e93e72-d9b3-4c3d-8d0d-38d71382de4c", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568875, "uuid": "b1eb8577-12b7-4e57-8b80-b0035504ad82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568875, "uuid": "ab1a23ef-1d08-4bfa-88f1-634a7ae1cfb5", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568875, "uuid": "2a583162-633f-492b-9e91-02a092baf12f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568875, "uuid": "0cc6669e-57ad-4262-befb-fdcf803c5610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568875, "uuid": "66b2ade9-f977-4aab-a3b7-ca7ee54fce73", "value": "d35d7add_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7993ab-ba0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "160d8c8d-f88b-4def-b9c6-4cc033147440", "comment": "Malware payload (Dridex)", "value": "93f7be5fcd4d9091743d4553176df620", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "e9ed615f-6eec-4480-96ec-3f2a0118f876", "comment": "Malware payload (Dridex)", "value": "834025f0bc7883ddb6948153de9368eebbf94fa60e5e38a8acef42db885c467c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "98547053-91fe-4564-a37d-ed57f626626e", "comment": "Malware payload (Dridex)", "value": "a8afc208a510832389c8375f271d9c25885b26c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584110, "uuid": "17856937-6731-4647-b8c9-eb7eaccaf7a2", "comment": "Malware payload (Dridex)", "value": "373e1785f3f7749d551103a05aec96ad8a3d17796e7aac7c34931713195a9930ca0684a6cdc914b06422af11dff43627", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "b7ffcfd5-21b7-4430-9776-dd9d7d0c7954", "value": "E304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "93282fc9-0581-4951-bc93-bce5c3f9eeac", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "a2b13ff3-adec-43c1-8b2d-3913e51c9f84", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584110, "uuid": "00f80a05-4d8e-4fd6-a0fb-a547b3c370f4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584110, "uuid": "ece249f2-cef4-4a58-9dd7-c30101c96291", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584110, "uuid": "4ece3dd5-870b-4e79-a4f4-aaf3da0e0ca0", "value": "93f7be5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3c5f18-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612106, "uuid": "8d50242a-7c70-4561-a9b5-b7d1047a2fa2", "comment": "Malware payload (Dridex)", "value": "a69cb243690af6e90fa9f26fa8439c9b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612106, "uuid": "ecbc83bf-c55e-4028-9422-4b1c0227d45e", "comment": "Malware payload (Dridex)", "value": "8340385e625876a8681eff429c96c06853e611361145ee3926a7c657d5a14ca7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612106, "uuid": "22c2ebc1-6253-452a-a239-81225cf45d8a", "comment": "Malware payload (Dridex)", "value": "796f937df2b8ae1ff22367fdf54e897b5e17a6fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612106, "uuid": "c6506b68-760b-4bdf-bbbf-a332015741a3", "comment": "Malware payload (Dridex)", "value": "0930ca8ce774a58c189b7e371dd14d7fe9a09c8f15dae538954dc217614b888fd1810c1e5692996faee804c7e07b8dc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612106, "uuid": "7a090752-d99f-4dcc-ab93-05fabf063b68", "value": "A2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612106, "uuid": "5ef29766-44ab-44ec-8f9c-7d22a14b311e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612106, "uuid": "f10781cb-07ab-4cde-8dd9-571ce20a85e4", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612106, "uuid": "d7c04b51-7e75-4390-acfe-fa8be039f396", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612106, "uuid": "edd8fb66-fc9c-4adc-a3c2-c2f99df2e85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612106, "uuid": "82d75123-bfaf-4f2f-a00a-933c7d7bfc92", "value": "a69cb243_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcccd66-b9d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621560356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560356, "uuid": "3c72f033-979f-4bc4-ab18-363d31892736", "comment": "Malware payload (Dridex)", "value": "eee90fb7ed9fa3c9287529604766800f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560356, "uuid": "07fa404b-9cd7-4ce6-aee1-0fbbad28fa6f", "comment": "Malware payload (Dridex)", "value": "83492e080c2d0889f6f663934db6bc01feb749f9034b1ad456d8e6d7e3763d3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560356, "uuid": "5f4666ba-4e9d-41d3-9d0e-fc51d230eebc", "comment": "Malware payload (Dridex)", "value": "0eca73e57c9cabaf651e76480e5abed18201e9b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621560356, "uuid": "8e6ef9a5-d7ac-43e3-9b48-6bb04b852116", "comment": "Malware payload (Dridex)", "value": "9a3eda1a315a96d09c0fcbaee6a5ba1643f24481055ee2ded61fad7332ee32df1e089b57808952ea1a8ac6df64d149e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560356, "uuid": "1a48bb88-fc0c-4911-94a4-9209719e596f", "value": "5904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560356, "uuid": "2ef0f196-10bd-4046-a8b5-0419acc07611", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560356, "uuid": "32b742e7-c64f-460e-b3eb-b8b43aed7ac4", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621560356, "uuid": "88097622-d477-4a3c-ab40-44854183f624", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621560356, "uuid": "5dddcf0b-d592-4539-ad08-e22b1905e047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621560356, "uuid": "f0c355fc-0928-47bf-9433-7ce7be04dc38", "value": "eee90fb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b84669-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573905, "uuid": "48cd160b-df54-4acf-b1fb-6f0bcc68d485", "comment": "Malware payload (Dridex)", "value": "cb201237296df724d12da442b3e36eb9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573905, "uuid": "f294c71f-b38c-4e7b-97b4-f68c17f4876a", "comment": "Malware payload (Dridex)", "value": "83c24168485a497d39022011dcb58a8cb8537c5b20df338973f369b54b36b7d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573905, "uuid": "ec8bf15a-3ade-434b-a30e-9fc4303e54e8", "comment": "Malware payload (Dridex)", "value": "a110a37c5c2f30b950de3c23f1feed1f5fc6bf6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573905, "uuid": "aba15199-06bd-4332-9e9f-c957ffa72853", "comment": "Malware payload (Dridex)", "value": "e18466cc19686c03baa0cb008f89fb503808d4093ff8e0b299dcf7c8ab8f4e60332da9d6673b84d2da9e3fd4363eef0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573905, "uuid": "c22dbce0-dbac-4cbf-966b-f67e3447b225", "value": "0F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573905, "uuid": "a8dd498b-aef9-48a3-96fb-868c461fc9f6", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573905, "uuid": "ec0e94e7-7e59-43f4-8468-accf399474b6", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573905, "uuid": "fb7aedf0-f7bd-419c-9d97-4f380a868a84", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573905, "uuid": "3212b8f1-7a96-4721-b608-1c93b2c0c81a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573905, "uuid": "58ce1c78-6587-4b44-ba60-cef5180829f3", "value": "cb201237_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e731e16b-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612502, "uuid": "51ed7190-babf-4d7e-81f4-6dc3413c9efb", "comment": "Malware payload (AgentTesla)", "value": "3fa7e6574e5026a9a88aea7340e3cacd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612502, "uuid": "b91b5c03-a561-4d3a-b199-f27332a67c96", "comment": "Malware payload (AgentTesla)", "value": "83c9dc3f9d721256e62a1c45060ea90b357c8718c8a16dea31627bdd261af962", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612502, "uuid": "8a4aa97f-9c26-42db-853c-5f6217c36e4f", "comment": "Malware payload (AgentTesla)", "value": "84a7db7857aad306df6216d90f1abc96c356d3e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612502, "uuid": "a9bc9c38-dcff-43e7-a4b5-7cc659d31d36", "comment": "Malware payload (AgentTesla)", "value": "07b8bac64e55b3834aedc0ee619876d5dc6d21c4f45f9b52a889231ef8154cf419926ccb1fc53b3b4eb79e6c3bf89e77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612502, "uuid": "01ac5692-a94e-471b-8a9d-4a881c4fe885", "value": "E925AEF03754C264D47B57780436959363B3B61EAE24CA1D3D94BE0E7D727838223AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612502, "uuid": "a2dbf852-b71e-4367-a154-7769a5aaad7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612502, "uuid": "d496614d-e268-4c8d-b9bf-ce96730b8604", "value": "24576:0REhpVd9rfMK1JhzTmsLYq//6BToWwztA:0qVfMK1JFI+SBToztA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612502, "uuid": "66ddec4b-d7f9-42c8-b9bd-cd62450e78ba", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612502, "uuid": "3cd87a76-6e9f-4d66-a76b-a251a58a0edf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612502, "uuid": "3f54c7ac-67da-4188-9a61-e551bbcd2258", "value": "SHIPMENTS FOR INV FNT022202101 FNT054402101 FNT023302101 FNT024202101 FNT089202101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ab34fb-ba18-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1621590004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590004, "uuid": "c1d8055c-42cf-4fc3-87c8-28282a971e68", "comment": "Malware payload (CobaltStrike)", "value": "70aed20d3469087837ad5dc0af0ab1a7", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590004, "uuid": "a4e50223-e7d6-4a20-8bd3-6a6ea4ea2166", "comment": "Malware payload (CobaltStrike)", "value": "844f891f338bcde305546fb85d97ac01bfd2c4db663ce779e6048307af5085f5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590004, "uuid": "990fd37f-9899-4392-9c3d-e7444310bff0", "comment": "Malware payload (CobaltStrike)", "value": "32f3df77b42cf1831422e8a98633e7680b98058e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590004, "uuid": "072d3f9e-2edd-41dc-a5c6-9aa46aaee26e", "comment": "Malware payload (CobaltStrike)", "value": "ab55c92dfb9cbbf0726b6af617a029ab6a8a089a9dac384ffd465360240d5509f9a79378ec2c0c636266ec42d87edb1d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590004, "uuid": "5ce04d0c-a925-45a8-b778-fa9a5c043acb", "value": "12A47B5177E484F8E9A7413E88668645E7727C224B30D5DF23A0376A2F332D1AD3E762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590004, "uuid": "57f145f8-f037-49ec-bc5f-d8d9eef9a2b7", "value": "6144:2KwAfGaP6UczT1LDtrr2X8jmggmS2MP1cNhuBgM86NohuA4iIISqm:26fXP6UoTiX8jRgf1mwBDNoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621590004, "uuid": "0f051fd8-eecf-490f-85e6-b69daaa4b268", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621590004, "uuid": "3402910a-d4b3-4c95-b9bf-68aff1ca2f3f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590004, "uuid": "7c148a94-afd9-4acf-b216-8150d28df4dc", "value": "iOffice_update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33afd75a-ba50-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1621613919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613919, "uuid": "b1ef8dec-1224-474b-bb76-b36188d5efa6", "comment": "Malware payload (FickerStealer)", "value": "0ab571b94763475d8a0b7506a0988277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613919, "uuid": "53a6b882-a356-4d95-a0ee-24debb350351", "comment": "Malware payload (FickerStealer)", "value": "847dcc504fe7f23641351d16f3d05672981d91127fc0452e59dca640ddbedabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613919, "uuid": "a50e964e-1c6d-4693-bde5-363dcd96ad8e", "comment": "Malware payload (FickerStealer)", "value": "c71b8fd9230584a77e3419f13ab1df2dddc9a791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613919, "uuid": "9445866e-5265-4cb7-8707-dc9378da292c", "comment": "Malware payload (FickerStealer)", "value": "60d4c17ebae2a90fe646e139e83575bae780e5244a43c0ff54fc60016964d4dbf17e05a676ebc6e463a9394648407998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613919, "uuid": "6280636d-0f43-4e24-93aa-749492edef7e", "value": "49C49E10A5F49C28FA9F22FC49AB536A573E7D905B32D3F305B625A58B231D2AC70347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613919, "uuid": "1d0acacb-6743-4283-b3da-5ae78000b57e", "value": "6882a0cd32b6c39a2ce56659631cb852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613919, "uuid": "2f60387d-32a9-4464-9433-cde905e92d89", "value": "12288:A2EWG4IcHnrrNqIvPK2WYqeRVFfWlvIsu1vRAxXsLjp1EW0rF3:ASG4pLvyKRyva1v6xXsLjby3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613919, "uuid": "2adf7543-aace-40ac-a1eb-7166533b824f", "value": 593739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613919, "uuid": "9a6949af-bb57-4e3c-a365-0e80cf9baa8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613919, "uuid": "f533fd3b-604c-4800-b97d-7d3e877ae9d3", "value": "0ab571b94763475d8a0b7506a0988277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a293f41c-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574162, "uuid": "9fd71388-a989-4ea6-bf39-6dfad2ef8306", "comment": "Malware payload (Dridex)", "value": "2552db095038153c137824255f849337", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574162, "uuid": "0c130708-7bce-449b-928f-99d0ffe0bf0a", "comment": "Malware payload (Dridex)", "value": "84883ce99242e926703813f61a19633aabcd4200bc50c08880521cd1435b8613", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574162, "uuid": "423d181d-f431-4969-8f54-74c6bebf92ab", "comment": "Malware payload (Dridex)", "value": "1348e6e19145d15e218649dbf91d935cd879c662", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574162, "uuid": "08effecf-e332-41d5-93cd-bb68ac71e1d8", "comment": "Malware payload (Dridex)", "value": "b4f27528256ba3f5b05740d0c70bc14c2263803b3ce89415b2daebc359de4d8c31c03e86e21a57baa467ad2655bb256d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574162, "uuid": "bb72b74c-35b8-43b5-b335-7e634b0aa8c5", "value": "D104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574162, "uuid": "55faad4a-3793-457f-bac4-8bc88a3ab16a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574162, "uuid": "997616b3-1fab-4506-b7a0-396fbc529ccd", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574162, "uuid": "4a58e2a5-269d-4e53-a18e-479f3a65a3d7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574162, "uuid": "729ae0f3-d425-464c-a6cd-1c10c15e67a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574162, "uuid": "bdb06878-e6bc-46fa-9938-bf30d662d510", "value": "2552db09_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a97ecc-ba56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616774, "uuid": "63ebe298-8b21-4843-a862-e3d2205db966", "comment": "Malware payload (Dridex)", "value": "990d42e745a234277d55117a215d3ca7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616774, "uuid": "6150fc2d-7a94-4ee4-9b37-0a8ba4436d8a", "comment": "Malware payload (Dridex)", "value": "8507f972d609c7026082e5970457b91be3c99cfc4f43547c15536f170d93ab87", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616774, "uuid": "4dbe9def-3b09-4f16-8695-9c50ac8a1979", "comment": "Malware payload (Dridex)", "value": "3aed810eda059b35a177ab2e717f6a8ede374684", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616774, "uuid": "6186c933-9919-43c7-8800-369864f21886", "comment": "Malware payload (Dridex)", "value": "b24fcb55015c28c2b19dd09f5e101456a556fe520c2cc36540715ebd9ba2ddd031fdd0701e770c255b507e697d244d71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616774, "uuid": "e1fdb4a7-84fb-442c-9ad7-023432e0d2f4", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616774, "uuid": "a76e7891-91d4-4d30-ad88-7cd3ffba245e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616774, "uuid": "752261af-e596-461d-9b3b-1f282f5662b7", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616774, "uuid": "57887de9-8f46-46af-942f-733779e822ac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616774, "uuid": "658a644e-60b3-4cd1-902d-bc5392ae2bc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616774, "uuid": "393f44f4-52ab-4c14-92c3-66bad4d472df", "value": "990d42e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b47b5d-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581440, "uuid": "41eba732-f2c8-4c02-a50c-f84ae8bb4f64", "comment": "Malware payload (Dridex)", "value": "6f037671e339760aaed37b75ee3a3f47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581440, "uuid": "75934f5d-776b-43c3-b5ab-8135c107ce5e", "comment": "Malware payload (Dridex)", "value": "850a3dcc5863da6610014c9d64d365515246c199923a76cc3ce687e79d672d3f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581440, "uuid": "c325d4ab-2e5d-4a0f-ab24-4aff5f48f512", "comment": "Malware payload (Dridex)", "value": "77856514d111ca0f8dfdc29d35cdd06afee7bf63", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581440, "uuid": "0f26e7dc-09bb-4b82-99dd-74d766af7311", "comment": "Malware payload (Dridex)", "value": "47aeee021abd8d139555c3c179d084cb496d230a416609ce785a3cfb8e5eeb5778b3a207ebf7302b667c67be536d86ae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581440, "uuid": "30b30ba8-e067-42e1-b678-d2d1e1e14166", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581440, "uuid": "d5806d35-cce2-4850-93cb-23a3399b5863", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581440, "uuid": "1e06ab8f-c09d-4249-ab13-d9ef13758d33", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581440, "uuid": "528da44e-0fef-4702-968f-faade31d54b4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581440, "uuid": "51a537ec-1796-461b-b739-29257d3ecfc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581440, "uuid": "bb0299b2-bbeb-4911-b969-e460dc631264", "value": "6f037671_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e390bc7b-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577277, "uuid": "5aff8d1b-210c-46c2-983e-2a4830ff7be4", "comment": "Malware payload (Dridex)", "value": "1408d482156b78e8b7de6b42e7ff5658", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577277, "uuid": "952a85dc-29e1-4c7f-bb4d-8b96bc5e5427", "comment": "Malware payload (Dridex)", "value": "850b35d7d59a22512330afe73ca9fb0d0e12122f0d4cbc4f281cb1490d24f36f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577277, "uuid": "786b41fa-a24e-4a44-bc39-3e8ec40379b0", "comment": "Malware payload (Dridex)", "value": "d79388cd9c7467c14394554e2fca9ab087a26bb6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577277, "uuid": "4c1a425a-8e32-43e3-961b-7c69abb9b4be", "comment": "Malware payload (Dridex)", "value": "7fd7b012fad4db1c25d8890cbad41abdf87f01f632b7f7b91fd21d8d601fa59f60b49d7217cc558541747ebec7ac2315", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577277, "uuid": "d781513c-c438-46d8-bd15-f76f52fc9943", "value": "8F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577277, "uuid": "f9d752b4-e7cc-4c2a-803d-5caf3c8a13d7", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577277, "uuid": "765676af-33e5-4d63-b835-188d9db72504", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577277, "uuid": "707419b9-0333-4f58-ae18-42036719bec2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577277, "uuid": "1e7a5dce-a741-4fac-bcdd-944be895168d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577277, "uuid": "9db7e614-6ed2-468a-a3fc-02cb09b14803", "value": "1408d482_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749c9598-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611451, "uuid": "ac96b2ea-5dfb-4245-ae85-1aadb899e45f", "comment": "Malware payload (Dridex)", "value": "4b6e43e0091bccfe10b98967bb605209", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611451, "uuid": "704e066c-ab7d-436a-bbf5-9122e7997ee8", "comment": "Malware payload (Dridex)", "value": "855d60d0d839f10308b859ee6f7c323f7b28dc44c82feaf9f59836c9f2d1e497", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611451, "uuid": "b4f3e187-8838-4923-a316-335e253658d9", "comment": "Malware payload (Dridex)", "value": "d793dfe4fbf8a5e27a44be95fee242f6b63d8bab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611451, "uuid": "5915bdc9-1fc0-48df-9b51-0f5c220abd52", "comment": "Malware payload (Dridex)", "value": "e9df80afe597eec6f3640ad7b5027418e228d3054122b3c60cb9262a7a2c2a9aa208c00e9e065b10733273f721e01849", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611451, "uuid": "49594562-0480-439b-82b4-e8471f405b29", "value": "2004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611451, "uuid": "e37ce5aa-1306-4ba8-b2e7-89c7a1fbdb9c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611451, "uuid": "6ad7ba55-de48-4700-aaad-e7d0716370b3", "value": "3072:+V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:+V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611451, "uuid": "fbbd61b4-090d-4a28-860f-5bc130452110", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611451, "uuid": "4b7b7d1f-9bb5-4bde-8506-f99413c0e202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611451, "uuid": "c8df8fbb-bccf-4655-9e14-de484917169b", "value": "4b6e43e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7ba910-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612029, "uuid": "2d201e15-fd32-4f10-b93a-08005a2b8177", "comment": "Malware payload (Dridex)", "value": "84a73ad91c0bf7223c14560f3c27bc37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612029, "uuid": "5f3e0e4f-296f-4e0a-b789-cc64931eeb1b", "comment": "Malware payload (Dridex)", "value": "85855998702cb482e658de55c8af7dd533a386bd09efb4bad788160fa5a156e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612029, "uuid": "9a8c9192-5294-467b-a579-5f8e5430bcdc", "comment": "Malware payload (Dridex)", "value": "7049268b519cf7e3aad35245f09f46f6a34735ac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612029, "uuid": "8886ae7a-01df-40c8-b920-74765099be23", "comment": "Malware payload (Dridex)", "value": "2567286da966062aaf918c7340ed069cf6964de57dc5bb3f3469215dab42c3a2897fcfc733759a76fe2faccd46d3dd3e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612029, "uuid": "85d485a1-4abb-4e8d-9426-22d573d31843", "value": "3EF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612029, "uuid": "2c0f5438-8a7f-4d8a-993b-537af4800e31", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612029, "uuid": "6312fc8c-719f-47a6-aedb-42f7d9d1db7f", "value": "3072:HiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ceAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612029, "uuid": "18fdbe7e-d5a9-4abc-8975-cb8c65ff883d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612029, "uuid": "fd3ac07a-7d3b-4d11-8b1c-fd244b0602f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612029, "uuid": "198c49ac-d163-487f-9936-bf89e79b50a2", "value": "84a73ad9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43229ba4-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580873, "uuid": "dbe0118b-0a26-4dd4-a06a-56ef0bd8436a", "comment": "Malware payload (Dridex)", "value": "96616a98ccaf458d37667220c680cc05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580873, "uuid": "a1eb0599-67d6-4e01-8e3e-2111721bed6f", "comment": "Malware payload (Dridex)", "value": "86175413062b63e68ef2d18bab8eb9ed526d89a9db99e658dccc29b7bc066209", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580873, "uuid": "55fdb323-c845-489e-a225-90d04d12a1e2", "comment": "Malware payload (Dridex)", "value": "631e36ece5690e36f41f7371e575e0a90cb52d13", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580873, "uuid": "80674067-9478-49f0-bedc-2e2fabe3c0cc", "comment": "Malware payload (Dridex)", "value": "9c717202a96cbf503f4a26006bf29d889cfe77e6cc90daa39e686b9af71985438042b1804cfaf7b9de00e0d917b6d160", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580873, "uuid": "8c66d1a6-f3fc-43eb-ad2a-8f5938b3afd6", "value": "C404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580873, "uuid": "c4f94680-cb48-4214-950f-243e4394b0a1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580873, "uuid": "498c8428-685c-4b50-a498-828916ea53ed", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580873, "uuid": "7d7365ba-f856-4b09-a890-cbaeb6045fd8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580873, "uuid": "9377fa2a-4361-4860-8730-f89ef7626d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580873, "uuid": "48b336b0-d1b9-4fb0-949a-4faad487d772", "value": "96616a98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab1c946-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612239, "uuid": "af3e54ce-1e7c-455b-a2f0-e227c4a4e2cd", "comment": "Malware payload (Dridex)", "value": "05836346f9d14d89e93512853e072a79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612239, "uuid": "4072712e-6fed-4dbd-926c-e3f592f301b6", "comment": "Malware payload (Dridex)", "value": "8617d08a145fb2bae7e14f4130d4ff4507f579c906903415e1971f0d328e0b51", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612239, "uuid": "d5e2ebed-536b-4604-b85c-20e3ca291861", "comment": "Malware payload (Dridex)", "value": "7afda59b458ba05321aa38c96992629ec94ce7c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612239, "uuid": "4f2c7a23-3475-448e-81f2-bdc9286a4f9b", "comment": "Malware payload (Dridex)", "value": "0f72edbd9f8da5a128979b64430927205782045e055f5d5788ee7604f8ad11f7ca03d40b8def4d51e1186ecda0f04926", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612239, "uuid": "bf0eeba0-4995-4743-8fea-c1a3da39e0ea", "value": "75F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612239, "uuid": "f8616a3f-5a8b-446a-8f27-999976ca1e18", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612239, "uuid": "9c1cd418-64d2-4a67-82de-f41179805000", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612239, "uuid": "ffcb536d-70fd-46a2-b6d6-6e2ddee78655", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612239, "uuid": "978b8e9b-425c-4d34-9028-97cb9524c400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612239, "uuid": "fbf378af-2147-4736-82ea-9d786ab4c31c", "value": "05836346_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6307b762-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621612280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612280, "uuid": "a3df4e3d-54de-44f4-9826-405e2a4d1d63", "comment": "Malware payload (Formbook)", "value": "c0054da0f18c570f545ec1322b398367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612280, "uuid": "f7da0ada-cbe4-44f3-93ff-eb8cd8f32cf5", "comment": "Malware payload (Formbook)", "value": "866496aa4a398485ff3fff066cb415292e89cab50df86551e026fd0850f0a348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612280, "uuid": "713eb0a1-6b55-4b3e-9cdf-0d9df3224cae", "comment": "Malware payload (Formbook)", "value": "3bff903f56dc24e15a0df626184ddb535ee54cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612280, "uuid": "8f429070-07ae-43db-a9f4-a9397ce4dfb6", "comment": "Malware payload (Formbook)", "value": "0cd4a07e4961d9c46f1d9b828e169aa45a710ca74443dd0777698fa4e04eb6b0d1844a013baa42bf47d1545808099724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612280, "uuid": "eb9b4106-dce9-4ad4-94c4-c35e8d5ad9b1", "value": "B415E03037999258D43E5B34183291C163F3B926FB25C72E7D94618C5EB3A938722BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612280, "uuid": "72ea2263-b3bd-4fa1-b7c0-2808ee03ca2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612280, "uuid": "18197254-04c1-41ad-b205-07d2cc98dbc5", "value": "24576:VEhbJzPLMPDr028bHtNsoRYXm+pWQIV3h:ozPw7g28btNsoRMJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612280, "uuid": "5d9582b7-487e-4c9c-b34d-9bcbe5f58c91", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612280, "uuid": "3533014a-e580-4744-a231-67a6d37faad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612280, "uuid": "3d72ae68-32e1-499c-873f-42d4135c2592", "value": "payment_proof_Copy,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a34df8b-b9ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571866, "uuid": "e90ea9d2-22da-4779-aea1-1454667f424f", "comment": "Malware payload (Dridex)", "value": "786b062ec968a0002cf443b0e00a0f8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571866, "uuid": "5975f7dc-24ca-4d89-a375-bf4643bb5ecb", "comment": "Malware payload (Dridex)", "value": "867519ec71a3952e9bcf9139f1e2f13da7666699f75873f72a26d4dc5f09fd22", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571866, "uuid": "9bdf75e3-9824-4211-8ad2-9148542a1814", "comment": "Malware payload (Dridex)", "value": "7b04c77a3fc01cb388aae1c1c4cad5ce17d183a3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571866, "uuid": "7de337cb-72f3-45dd-b5a4-e1c274ce9810", "comment": "Malware payload (Dridex)", "value": "3a3c63a232cf42f0707020d016d4ff0777cc690a91c426d3b6e5113e491e22bb61ac54ff05446d5432fb3a8db33fc689", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571866, "uuid": "6f56a7fe-c2b0-44f8-a7d9-5f49180c5ad0", "value": "8BF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571866, "uuid": "e557fe0c-d31a-418b-8603-8a11343f79cc", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571866, "uuid": "3cd5f88c-77de-49f1-82e7-8bcd32376c29", "value": "3072:Q9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:Q9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571866, "uuid": "296c607f-d7ff-48c2-90c2-35005d39de99", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571866, "uuid": "2e17342a-2ae9-4804-abac-c813e16f528b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571866, "uuid": "ec30dcd7-68e9-484f-a9ea-42baa46a3280", "value": "786b062e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e506e4-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591619, "uuid": "f3c21722-3af1-490e-9715-913760bc7f73", "comment": "Malware payload (Dridex)", "value": "a05570b2b0e10294d78507c13ac74fb4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591619, "uuid": "cfb1d97f-95c4-40be-b1b9-88e14d8a3efa", "comment": "Malware payload (Dridex)", "value": "86eddde43a188c4775a66a644618d7f19ffd3520e22e40c2c90aa2787273d8ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591619, "uuid": "d964b16c-2c57-4194-9765-efa342da9d1c", "comment": "Malware payload (Dridex)", "value": "fce7d2c43cc15576f6afa8b1937b9e91a39710c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591619, "uuid": "255745b2-ae14-4aa9-8dd7-70c86b72a557", "comment": "Malware payload (Dridex)", "value": "f45868a9aa7269a73acaa8c367731964f22361760d352ba80a57c67c3043439fc6201cc112ca8806cd19d465bf2118df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591619, "uuid": "ab29727c-e963-4a43-a3f6-ee9e58203887", "value": "1B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591619, "uuid": "5abde71a-55fc-4cb5-ac0e-0067cfc12942", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591619, "uuid": "4c58780d-ba20-4f80-b3f7-f4f0df7ff8ac", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591619, "uuid": "578a2b88-0b2f-4e0e-9568-bfd8c998e40e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591619, "uuid": "e9a8d57c-8fba-4ae3-995e-9b30a4131004", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591619, "uuid": "a24b7933-450d-41be-bad5-65b1f1ef29c8", "value": "a05570b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de35f79-b9ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556356, "uuid": "e3755bcd-52f3-4471-acff-ac7e3d21c8bc", "comment": "Malware payload (Dridex)", "value": "74bf24935d8e03a42c4313f16739f568", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556356, "uuid": "687c47b8-1db6-486f-b450-2a774138f679", "comment": "Malware payload (Dridex)", "value": "8757328b49f6f9834b101e1b102b22beed78f0da1ef8d087980cd22e2b1af9e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556356, "uuid": "f025818c-e115-4d48-bf83-231f6ae8006c", "comment": "Malware payload (Dridex)", "value": "e7305bf4a2e025884a274357ceb60ad38c8f5b8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556356, "uuid": "3f71e115-2230-407a-b94d-c2e5af50910a", "comment": "Malware payload (Dridex)", "value": "0b73429bea3d3064c4277dbedcd38fa62b5121f9c945f1e7626c91f7457e39b372b7fb81864a136fa4860477e091b8d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556356, "uuid": "67ae7ba2-b1f5-447f-838a-3e5594e0f2ae", "value": "86F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556356, "uuid": "6826d4da-1270-4fd7-88dc-693b492da496", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556356, "uuid": "1f9d056e-27d6-4734-8e55-732596cb6531", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556356, "uuid": "c43c6675-785b-4dd3-885c-62892693ce34", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556356, "uuid": "9733dafd-61c4-4fe2-9ebe-eb9ec12aa358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556356, "uuid": "dc746081-73dd-414c-90ac-6550a67eb736", "value": "74bf2493_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52c37d5-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612525, "uuid": "c32a227b-f5f9-4187-81c3-fed710e937a9", "comment": "Malware payload (Dridex)", "value": "7b0bc34cbf73f36c21d05893c1abecd6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612525, "uuid": "d62d77a8-6190-42d3-a5a7-f38891701eac", "comment": "Malware payload (Dridex)", "value": "8764ec5af657a04ea405c344c447b17b44767f56d5fc65ee03a5a2c7b414ffa6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612525, "uuid": "c405a9d4-fbf4-4da6-93d2-0c3d76c76ff1", "comment": "Malware payload (Dridex)", "value": "528236f360d7afa84625d5c680ad27efc0c8e973", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612525, "uuid": "13e77a88-c127-4da3-ab96-d3b28642f94c", "comment": "Malware payload (Dridex)", "value": "7fdaf31cf77ee4ae251711b7f1bf4de94afb98ffa3864566fb95ad381d548bb978b4fceff3986c81cc7b431dd4356b26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612525, "uuid": "b43a6ce6-ddab-4c03-a676-46b8d1e2049a", "value": "8804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612525, "uuid": "6723b222-4cc1-4544-9737-a100d3dba3d3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612525, "uuid": "55d4af14-4237-4fe5-9444-a15341a128e4", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612525, "uuid": "e39d9320-8d57-4b66-ba26-3864e9cc7a94", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612525, "uuid": "d3080009-edae-4d50-985b-8a1adc91d779", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612525, "uuid": "f0e8dd46-999b-4662-8a15-362bd8cc8230", "value": "7b0bc34c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2062a28f-ba19-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621590264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590264, "uuid": "72171596-dc0b-4abb-b651-eb717a33d2e9", "comment": "Malware payload", "value": "73750e56706f742514190d5ce28deb8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590264, "uuid": "cefe4d31-440a-4636-b76d-cff3f45273d7", "comment": "Malware payload", "value": "87d63a41603486863096c870e9c88355c6299a7f077e3bbf08dbb823d2e7fb6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590264, "uuid": "986590ef-296f-40f1-98fd-6dcd8cc8a540", "comment": "Malware payload", "value": "6504c62951430d33539e749d6ab56dd0388947ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590264, "uuid": "d05bcfa5-42ed-45cb-8b61-b70a500f0e2f", "comment": "Malware payload", "value": "7e8cfd73db8e0edf1af1872c39015e9aa2925b5d8e198a34ea568adbb9eed450844c328b6b751b87e63f61d4b8bf557a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590264, "uuid": "e375acfe-3506-4349-b9fe-8c3e515172b1", "value": "8044BE846CE0CF646484C7427F50C29D4852F5FCB29CE3F56696307B9A64AE6FE08E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590264, "uuid": "93435f6f-0683-4242-a509-e40957bd904a", "value": "6144:/5OeO5MHvpihcUu1HY2zhL31oYys/+2nYQsGwkqm:BxzH8h1wdt3BN//nYQmkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621590264, "uuid": "5960b26a-c3a9-4b7c-8db7-1d42bcc31fe0", "value": 261703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621590264, "uuid": "6bd84475-e3b8-4c96-ac3b-c0524636424b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590264, "uuid": "ed4a6fe7-3e3c-44ff-9749-a5c51fb1ad43", "value": "3Wdo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59f2405-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563483, "uuid": "f9e66252-fe47-4c2f-9935-78dd2509ba21", "comment": "Malware payload (Dridex)", "value": "9eeeab85998f7c13a894fe5945307114", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563483, "uuid": "9edf95b3-aeda-4c96-88f3-6b1f95fd88d5", "comment": "Malware payload (Dridex)", "value": "8821ec8f7c95b387afa28cbea2fdf5dc600b6fc0e14ada4ba4066bb29ec1f8d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563483, "uuid": "783b3b73-943c-4f47-a88f-31289a8d3359", "comment": "Malware payload (Dridex)", "value": "68c908f4655004c849022b0c58304ebd2cbc8147", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563483, "uuid": "3c2c32d0-15c3-4783-95d4-a8add3e51736", "comment": "Malware payload (Dridex)", "value": "0928370fccafa2c4ec13710b39ac4114a53ddf6460b28fc74ddede66f9886451b72b499df95c1a456cd52c73025fd4f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563483, "uuid": "75103b21-5c98-455b-bb02-b2f12d0ffa95", "value": "0204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563483, "uuid": "4551866d-eb1f-4dfb-a7c7-dedad8c9db0f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563483, "uuid": "8e6748f7-4a98-454a-a2ee-00c5367a50f5", "value": "3072:9V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:9V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563483, "uuid": "0eff5067-2ab9-459d-8906-9fe2446a084b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563483, "uuid": "608060c0-f733-4753-b06f-8122d554623b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563483, "uuid": "99b69845-5615-453e-b18d-3c6531c742dd", "value": "9eeeab85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64a7a0f-ba5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (OrcusRAT)", "timestamp": 1621618540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618540, "uuid": "3df96bcb-a239-4a63-adf9-afe4fc0f36a3", "comment": "Malware payload (OrcusRAT)", "value": "658cb5f3bd26b13bb619c625501d7283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618540, "uuid": "155f6b70-ed8f-4436-b69c-2ed47ed7fc6a", "comment": "Malware payload (OrcusRAT)", "value": "88f3320f4bcd533c568b9ba53205deb1b0e430c3c32a1dfa0bfded03851114a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618540, "uuid": "0f2d56f7-893a-4531-8b37-d8fe965e60b5", "comment": "Malware payload (OrcusRAT)", "value": "55ed61f7bd39147201a022ec3f83edfc8c58e002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618540, "uuid": "02a5f4f2-b711-440f-a926-aa15567e8892", "comment": "Malware payload (OrcusRAT)", "value": "ef171b1f5fbef83580d554ac0bf70b5650dd81755a885faaca82ba15f94e8f57a880c639d4ef46b6ea6540d4acdd0657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618540, "uuid": "2598aefa-75b9-49df-a45e-52170a4c9f5b", "value": "EC15BF013FACBD07C1BE3679B7731ACA07B8E90A6052FB4E195851AE1D9BB01BD11367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618540, "uuid": "5e737ef1-d2ad-440a-904e-27ba4d96252f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618540, "uuid": "e2ea8622-f60a-4d39-8811-64f9c8734253", "value": "24576:LAw4MROxnFj3IrkxrrcI0AilFEvxHPtiooq:LWMi1UqrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618540, "uuid": "c7f5f6b2-6880-4119-84d1-ec150c86a0e7", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618540, "uuid": "ffdaf45b-2f6d-4d8d-8a86-6494d142c8f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618540, "uuid": "f9c31f8f-e21a-490b-8085-4ef7e5895398", "value": "658CB5F3BD26B13BB619C625501D7283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957c889f-ba48-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610647, "uuid": "eaea0d8b-8477-4de4-887a-f5a3e0d75965", "comment": "Malware payload (Dridex)", "value": "b53717784f3033b092d24f4fbf2e57bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610647, "uuid": "08df2213-c397-4f8b-89bc-36dadf8b9b4d", "comment": "Malware payload (Dridex)", "value": "896ccf047ca908bf12a1f88e9ea113c1f738e858ca5552c7b0941184570117c8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610647, "uuid": "dce4b456-a000-4a3f-836b-b5efe124f0df", "comment": "Malware payload (Dridex)", "value": "769cb1b9f4a1912fca0e48859ea853e6e028f503", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610647, "uuid": "153247c5-658a-43f3-b57c-29e9b665fc0c", "comment": "Malware payload (Dridex)", "value": "16145b2847bc9671d58ba7342cc121d99701baa448c823f164c7922ca73d29c0f6616eccee9333aafee5d135e9777c31", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610647, "uuid": "27053570-e7a4-437d-a82e-c92a9b1c990c", "value": "EFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610647, "uuid": "b5d70df8-26bb-4b87-9e68-32a83792a1be", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610647, "uuid": "1d9c6eb8-bc01-4591-b7bc-ffac797e1533", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610647, "uuid": "f52eb963-3774-4dcf-a3e1-1cdcdd3fed4f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610647, "uuid": "719b2726-95a0-428c-afaa-5689a6f8cbe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610647, "uuid": "07bdd47d-f3a8-4ccb-a506-5a20b2d96037", "value": "b5371778_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8e5bca-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1621587709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587709, "uuid": "986f066d-ccd2-4ac9-ab97-9f31e84e5a20", "comment": "Malware payload (Gozi)", "value": "1a3318fade09fb39e0f2fa1eb7b1d1f0", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587709, "uuid": "ba901d04-6896-4712-b783-c7802a820696", "comment": "Malware payload (Gozi)", "value": "89715973a65b66748e529c22d96dea4c12ecce66ae53feced89c2135584a4d43", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587709, "uuid": "18291223-2f3e-4ded-8ff6-2cb0ef20c95d", "comment": "Malware payload (Gozi)", "value": "61017d9e7660f5e379aac838a6f5458e2d21cc0a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587709, "uuid": "f2d05c15-28fa-4752-8bbe-4c9610075ca9", "comment": "Malware payload (Gozi)", "value": "4c339db93c61b1796f080ea9f8ecce0527c2c96c855ab2b7d3d20ed71a9fb2b99865550f3366e7cb5934cde600aec4a5", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587709, "uuid": "b2c7873d-ba6b-4e78-8ea9-ee21e50f58de", "value": "88245B6AA2E40695E9BBDAB5C953C61BE7F334041B24D70F03B0CE696F57361F218352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587709, "uuid": "91b830f7-26a4-4139-80ce-0eb1619226ef", "value": "3072:5WLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYQRr9fGWg+Bm5kdCDLm:6qO/rsPHN7Q6l7Bz9zhvNJYQRrg1ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621587709, "uuid": "085e75a9-1f12-40df-a5b7-21f02c5b419d", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621587709, "uuid": "5f6cd0b4-5338-4ff1-bb68-598d434ad16a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587709, "uuid": "f4a6de2d-9c31-498d-89ec-3606cfeaf85f", "value": "1a6fd6d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc44c089-b9ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570447, "uuid": "3ec474f5-b86d-40c1-95e5-316f7043d7e3", "comment": "Malware payload (Dridex)", "value": "9f880de359e63b6c16743afb80a2ea38", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570447, "uuid": "1f333444-4e2a-4932-be3d-7ad8a064c67b", "comment": "Malware payload (Dridex)", "value": "8994ed9f018045b6524d03f287eb042b2446e6d70b096bde6df8ca661c7867b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570447, "uuid": "c85b74a4-73ef-4efc-890b-cceba8d61ee6", "comment": "Malware payload (Dridex)", "value": "922e58449c7a0a071fffab0f66ac3eb704547476", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570447, "uuid": "57cc3d32-8448-4e20-94b1-cbba2d100d58", "comment": "Malware payload (Dridex)", "value": "eed8d629ac89c133d9603c8c57ffcdcc122d2289fd6e153c9186f4390ae824b87c04d082f925aa8aaaae988a83c6b302", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570447, "uuid": "dd44a041-d8ae-4e6d-83cc-daf1b53051b1", "value": "0204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570447, "uuid": "f5a6fa65-02d5-459f-98af-1baaf693a71e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570447, "uuid": "949a2e87-2946-4ece-ae69-7c817217d8d1", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570447, "uuid": "55e7939f-b56a-473b-b29d-ec5a52d8411e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570447, "uuid": "4a4ad537-c60a-443d-b680-645d15ce28d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570447, "uuid": "f6fc51ba-bc12-45d9-a1ce-fdb73d845dc6", "value": "9f880de3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cd2093-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555801, "uuid": "10bfce82-a5c8-47d6-8dfb-f267642fa26f", "comment": "Malware payload (Dridex)", "value": "f6afb41523cb1428a5fd4a58d903e905", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555801, "uuid": "0c02764c-5189-45fe-8fc5-1fd81d0f2d2a", "comment": "Malware payload (Dridex)", "value": "899e6a3ec8514f8c13fbfa1478c79b837b1385c6209f43e6618ad9ba02114d56", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555801, "uuid": "7a00cbba-f7bc-403a-b8b3-206e3b7a952c", "comment": "Malware payload (Dridex)", "value": "39e42d7cda7024ab3ba80b66e218dbc9ed86d31a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555801, "uuid": "83eb38bf-d6bb-4010-8b93-3f5e786eb425", "comment": "Malware payload (Dridex)", "value": "e7725b52cb0bb9685faa30689df2054d1eb80ccbd55f5885bbfc3a740130a9e0392572272e8e3f9c61923cbcf0f3fe21", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555801, "uuid": "dc83510f-f8c2-464f-971b-e658072be723", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555801, "uuid": "67b8950b-a844-425e-982a-80c76d598ebb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555801, "uuid": "410bcd0d-cec4-47cd-a40b-00d327f453d6", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555801, "uuid": "6ae6027c-7d43-4552-bd72-9f485a864f02", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555801, "uuid": "ec916192-d50b-428b-8e38-7773642b1838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555801, "uuid": "8c6bb13f-4ade-47fa-abcd-56821683a4a7", "value": "f6afb415_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9518d41c-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621635127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635127, "uuid": "13521d10-dde6-4d66-8ea6-857b871655bb", "comment": "Malware payload (Dridex)", "value": "031a55a3ff8ac769847c0860cdf7fb17", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635127, "uuid": "4ff91dd5-839a-45d4-8bdc-cd46f89043a9", "comment": "Malware payload (Dridex)", "value": "89c412a68235a8a299c99f9981341d3f41112fedfc42e3f418d8f14b097108ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635127, "uuid": "56af93a5-6172-443c-97bf-f4e219ac3563", "comment": "Malware payload (Dridex)", "value": "8d86bdaffdee2875a3f2d1786f664938bebec958", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635127, "uuid": "94992736-e4e3-4b79-8f39-35c6bd19e3ef", "comment": "Malware payload (Dridex)", "value": "88898743c43ec85b3ed58d6b1cd3d7a83a472662927a90b2050b718f887c524fb8634ad326918b052982f027b09f86e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635127, "uuid": "40c9ff48-46af-4d0e-bfc8-c747dd6450dc", "value": "48F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635127, "uuid": "e3d86bcf-ae36-440e-b908-26c8ba449c92", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635127, "uuid": "9aa18a35-6825-446c-b991-0b6899f7b2e5", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621635127, "uuid": "8ef7cebe-a3db-45fc-98a3-0729b5bcfdae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621635127, "uuid": "a18f7179-439d-4920-84cb-8404a2be7b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635127, "uuid": "d2b75b56-9210-4b38-af55-6dd0772fb84e", "value": "031a55a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e821d90b-ba5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621619375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619375, "uuid": "82dcc81f-d786-4d8d-89bc-8c89853b4a8d", "comment": "Malware payload (Dridex)", "value": "b96242706bbe9f8cee685cad2c68e38a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619375, "uuid": "66d4727e-87f6-49aa-b4c4-f736ac55e3e5", "comment": "Malware payload (Dridex)", "value": "89d11f9597c0ec247541d1cab270b632ca78015ca98f92541604462f84225d80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619375, "uuid": "764e0a68-a507-4a8e-a0af-0bbe0cff7870", "comment": "Malware payload (Dridex)", "value": "ff26b21afa9e241ed182cc0dd901fab85caa18b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621619375, "uuid": "9bedfd1f-a8fc-4d8d-a325-971c18896f31", "comment": "Malware payload (Dridex)", "value": "ab81985d7795ac2a572da248dfaf066795d05facc88746161790d8c1d0cba1c173d6af530686cf9a13d02189772c75a6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619375, "uuid": "f0073e3c-4ea0-49a1-a6e9-c90beffe9120", "value": "9BF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619375, "uuid": "477d5140-1abe-4a45-8b21-064ebe8e6740", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619375, "uuid": "9e518570-b007-4d23-86a3-232336013d7f", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621619375, "uuid": "0ad8024e-6762-4bd2-8dcd-0462c0940205", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621619375, "uuid": "0de156ef-eeaf-4080-805a-794010785a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621619375, "uuid": "35b10fab-fb24-4300-8282-df445e5bb508", "value": "b9624270_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72c2a4b-ba45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609522, "uuid": "33411112-a1b3-40f4-a1b5-6ae53b3702eb", "comment": "Malware payload (Dridex)", "value": "ba0daecf321aa9844f13f788bbb24fed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609522, "uuid": "2e3e64f6-9475-438a-8265-170fd58e0707", "comment": "Malware payload (Dridex)", "value": "8a712363eb6f3227e62cc11ff6acb04af1d850705467790a16915738e473ec34", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609522, "uuid": "43a25f2a-814f-40be-a451-b409797a9dbb", "comment": "Malware payload (Dridex)", "value": "9dbbb5cc851a6f7562a6ddba4129e26daf24afe6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609522, "uuid": "392b2168-caf1-4560-9d49-e64beb5cff76", "comment": "Malware payload (Dridex)", "value": "a9b4987f153bcc2ccee0194816664bea533738f6a08744c55153a9817e924decd41e780d899a37419977049fb4380637", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609522, "uuid": "14f3ff11-b42e-4f3c-81f1-6064d87fa097", "value": "D4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609522, "uuid": "0d0951a0-fe92-4f41-9c9c-d36d800133ee", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609522, "uuid": "5b69d5b7-6083-44da-a69c-a7bce946b4ac", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609522, "uuid": "fcdf20af-e027-451a-857c-e8196f815999", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609522, "uuid": "1a273881-4f36-4ac2-bba2-ebf0a3529bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609522, "uuid": "39d8a709-ebe5-4669-9abb-d5efd235ea8f", "value": "ba0daecf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f449e2a6-b9f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575158, "uuid": "56545928-177e-44fa-8b3f-511bb2d84253", "comment": "Malware payload (Dridex)", "value": "8c4d7216210b972281d3fc0795d620f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575158, "uuid": "9ccdd86a-3c15-4439-8b9a-d154206973ce", "comment": "Malware payload (Dridex)", "value": "8a8f68ac0562a64b858693b04e3d692418fa85a3ce1c542a19dc4794343ae2cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575158, "uuid": "dd0d644c-f92a-49be-b8c4-379692fdeb61", "comment": "Malware payload (Dridex)", "value": "ccdde1974848ceae372fcc78cb13adf07cc090b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575158, "uuid": "e55224ae-7058-438d-bafa-e55bad7958af", "comment": "Malware payload (Dridex)", "value": "aab1e09c714f92a81e814ce4702cb3065b083cb770839f8b98d863da79031dfe138cf309132646cff1b1a5fb96fc2ba6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575158, "uuid": "21ca6d2d-e461-475e-9785-ad33acc1f3be", "value": "3C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575158, "uuid": "a2cadf75-b2b6-43c5-8694-83b66cfb5cff", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575158, "uuid": "10b8029b-4e93-437e-bf3a-8e0a52786483", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575158, "uuid": "5040982a-5017-413f-b451-11c61a00aea0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575158, "uuid": "64a7ac1c-68cb-4c7b-a31e-8711e30f1d4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575158, "uuid": "9ab9b32d-04f6-463a-8e77-2d3bab63a1a6", "value": "8c4d7216_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9990d205-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612372, "uuid": "fa73884a-b0a0-4614-9ecd-7c94f5426587", "comment": "Malware payload (Dridex)", "value": "f8be7d04449894c76c9451a6e9f4ac81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612372, "uuid": "af00246b-e503-4117-870f-04375408df47", "comment": "Malware payload (Dridex)", "value": "8ac00bda7e480406fbac5c47b6f01076b571f1417dc73b151e644a4a58b8b39c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612372, "uuid": "b18e1b5f-c973-4a23-a201-d8a299d94de2", "comment": "Malware payload (Dridex)", "value": "0ef7f3eb065eacea58c2dd51236e075ff03526f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612372, "uuid": "5ebab663-0950-4973-9187-7b5742d0e0bc", "comment": "Malware payload (Dridex)", "value": "c6f415f04270378d83b5ec8d87d2bbce735314a07e1b87607611b308b73eaab234304161a750dabb293030fe612f49a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612372, "uuid": "6dbb0c5c-6e0b-4699-9611-a7ebfaa30969", "value": "FD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612372, "uuid": "c9f38786-36bf-4e3a-9180-08470ff1c8aa", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612372, "uuid": "1953a77d-98c8-4f47-817b-92c4b4f30662", "value": "3072:8V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:8V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612372, "uuid": "86220d13-fc23-492e-a192-b5c43d106e11", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612372, "uuid": "8d189ca0-7cc2-4e3d-b047-49bb856e05f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612372, "uuid": "78df5ddd-d845-41f6-8707-f69966975cbb", "value": "f8be7d04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1561b4-ba44-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608937, "uuid": "8be49f6e-fe19-4fbe-b868-ca540275a680", "comment": "Malware payload (Dridex)", "value": "425ca03aaa03453faf65a7f150e4a761", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608937, "uuid": "80eddcc2-877b-436b-a706-35ea33953216", "comment": "Malware payload (Dridex)", "value": "8ad4a4a5f5b7a06cd7a3a7765f000540133c60f5cdabc69a1856db8d87da46a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608937, "uuid": "a361ae65-41ca-4d62-af09-50530118d097", "comment": "Malware payload (Dridex)", "value": "cea3ad471278fdf7e9e075ca02d824d99130956e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608937, "uuid": "dd742927-cf05-4f04-af89-5426d113ac01", "comment": "Malware payload (Dridex)", "value": "e0111c751fbda05ccfff353f20c79a98344b27369308c01928f195a96696d42b9f7c51d20fc6db3e09dd88257f101f88", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608937, "uuid": "16d1346f-73bf-4a49-b4b6-d15b9d15b27c", "value": "29F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608937, "uuid": "8227441f-f08b-493f-be90-14e76b23f89e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608937, "uuid": "d5efb7d3-98e2-4154-b2bb-79f99a51b13a", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608937, "uuid": "cc144985-73df-4cad-b879-1481722fe359", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608937, "uuid": "aa1e5f35-06fe-4a24-a3fd-d30b1ae1468f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608937, "uuid": "4bfc32c6-ca8f-414b-b822-5535638c22a6", "value": "425ca03a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f2534b-ba5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621618558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618558, "uuid": "5e341f1b-5655-457f-8531-7068a1b52a4b", "comment": "Malware payload (RemcosRAT)", "value": "c12bce4ab1e7af6e6aadb798e83216f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618558, "uuid": "597b399f-8822-4411-8824-c1f0bd73dca2", "comment": "Malware payload (RemcosRAT)", "value": "8b2596e73c754b0590b95e6245538874729bec5c62267719ef9bc8b9de21d01f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618558, "uuid": "ac211a64-4242-4d9e-b30d-bb0e42c27afa", "comment": "Malware payload (RemcosRAT)", "value": "7e1f29946891f1eac2482a37d211ace670b899b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621618558, "uuid": "76d2acd6-5e0f-4ebb-aa57-7fa52843e5b9", "comment": "Malware payload (RemcosRAT)", "value": "2ad26f837ed049a3abe4f3bafc8c6b6f390d65dc2027b268eb6f11d53767e71e18ef5e95bbd567b32b05e3d693eab45f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618558, "uuid": "65e1b066-8066-4b56-bca9-17b240ee5b74", "value": "86B3B276B5FBF470FE5884F0275C93AC41972AB8C815498BDCC629586BF16329A103FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618558, "uuid": "d8994ee4-9977-4a81-b620-b97970a65421", "value": "3ad518cf51907bc8ca22f7a1354a4250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618558, "uuid": "c706c1ff-60f3-4216-b710-22f9d4776c83", "value": "1536:ymbrFYxQqr3fZG3lTPME+FnL0E+NTF9nw0KhZry2ftwn3p8Ke9Km:5lYxB7YF8FJ+NB9nNKhZryEtwn3je9Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621618558, "uuid": "931b9554-e06a-474d-8e27-892d755b3277", "value": 112376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621618558, "uuid": "d1d841cc-1fa7-4f62-8c2e-1ff3101ae8da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621618558, "uuid": "7ef37836-335c-45a1-ab09-f6868e95f1f6", "value": "C12BCE4AB1E7AF6E6AADB798E83216F5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737e7dcd-ba59-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1621617891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617891, "uuid": "59591415-af1b-4a65-ac0b-a3c2ff1bba8d", "comment": "Malware payload (TrickBot)", "value": "1271494c4b9f580b340c94b1341ac4f8", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617891, "uuid": "9766fd3b-c995-44cf-954b-b7fad746dbb0", "comment": "Malware payload (TrickBot)", "value": "8b422f3b04dff6e14b54f28c10d6ed3b5ae0a439e1d6de8361413cffaf1ceacf", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617891, "uuid": "d579cef3-99a6-4b3e-8c89-0584038f047a", "comment": "Malware payload (TrickBot)", "value": "109fb08167b396c89c54fccf93d0307333feffe2", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617891, "uuid": "2e15f22f-8e1d-4e8c-9069-98777166fe95", "comment": "Malware payload (TrickBot)", "value": "9d9232a7bbd4fa9674bf3d30da32e91531b26f0a5542a53d5e03d69e24929473c39a7eeb11d78be707b5fbf3c4af81e1", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617891, "uuid": "2066c570-e421-4f9a-9555-a62cc39421ad", "value": "B30402AEBAD0E525E7A40CB3D4405B831CB75AC387873C6E7B11919477B0DF782C4AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617891, "uuid": "5b62023e-5d32-497e-bcde-5bcad82e47ce", "value": "3072:lievjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHG28:liov8cKSsYodBXC0YnW49MarG19m28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617891, "uuid": "2f9a8706-befa-4488-b8c1-18b3e67b2a78", "value": 186718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617891, "uuid": "6714070a-c8b0-47eb-b157-150b46842ef5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617891, "uuid": "81214024-06bc-41ff-936b-964770e153eb", "value": "1271494c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cc549c-ba02-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580344, "uuid": "8ff6f582-c4f4-485a-bfb4-08381da0da54", "comment": "Malware payload (Dridex)", "value": "35717ff100e6cb7c925591baa09677ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580344, "uuid": "1217e947-494f-46af-b786-b17d549825d8", "comment": "Malware payload (Dridex)", "value": "8b6d744cb9cd97eef123a1de106789236c5355e90a7f96985fca703d6ead214f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580344, "uuid": "47f00d15-c9c7-4061-a8e6-57ae29d34700", "comment": "Malware payload (Dridex)", "value": "510b6a9e707c2e62794877007fbdc07991b4263c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580344, "uuid": "2af9ec84-3729-4b6e-a4d2-09b7d560c672", "comment": "Malware payload (Dridex)", "value": "ed519daf44476a00ac37be6fe516b9be799f4f64280782f9fe980bdf0438b2be3d18b0db0d453d55f16e647fce4af90c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580344, "uuid": "a5e8aaaa-8e05-4295-9594-88a6ba4427a9", "value": "8E04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580344, "uuid": "2f966f02-94ae-44e9-a56b-efcde3456740", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580344, "uuid": "999ff2da-4e26-4633-83ac-b9a5c099fa5b", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580344, "uuid": "59fa5980-cbaa-49b8-a064-942b91cec9ad", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580344, "uuid": "5eaba317-a6a0-4b53-92f0-aee144d8a709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580344, "uuid": "c486d409-48e4-4e38-a32c-0a3ef0aba18b", "value": "35717ff1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100c7ecd-b9d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558883, "uuid": "c3478a8c-5798-4371-b8d7-2bf88a47d065", "comment": "Malware payload (Dridex)", "value": "4fd24d01c987593b67c36d7ffaadb258", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558883, "uuid": "0521b55e-3e5e-4081-90c2-40f7cf46db8e", "comment": "Malware payload (Dridex)", "value": "8bc9f71390a0e8f569c615be63b6abf66d0d6c5076a4b1dbf624caf0c8fc1e89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558883, "uuid": "05737645-6610-4e88-95ac-a45840dde22e", "comment": "Malware payload (Dridex)", "value": "67f28aa101e5b6cb22d99127da5debd8e7d7607c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558883, "uuid": "80158baa-85e6-440d-b78f-3a55006a2a5f", "comment": "Malware payload (Dridex)", "value": "8b9a2b72afa730d06cf12af45acafac6f0f70bee827d6ceb9e468af1357dd8fd24c5d3a779bda546d5de4120ca5cdff3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558883, "uuid": "6b5a86cf-503f-4a0b-a1da-4657294d2e19", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558883, "uuid": "900468e9-6ef1-4dae-b83e-c3a8bebc3ee2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558883, "uuid": "7a3cdea8-f9b7-435b-8778-1f4a6250ab7c", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558883, "uuid": "e3faa8fd-3bd1-464c-834f-4bbabd947673", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558883, "uuid": "ffa3e1c9-3108-451e-8453-971138552407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558883, "uuid": "5828bd8f-7f17-4758-9955-ce12a601b9e6", "value": "4fd24d01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653e611b-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621612284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612284, "uuid": "893fd630-09f3-49ec-a732-86357aba3ad0", "comment": "Malware payload", "value": "c40c80bfc4233d74225238ca09128227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612284, "uuid": "a5d3da21-aad3-45dd-bf90-951ad12808fc", "comment": "Malware payload", "value": "8c48765f9e88fbdc738d2f0801fe6befcaa96484f8b6362d7f0b3fcfd13a4438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612284, "uuid": "320ab852-2517-4301-921f-1b5f1ab007e5", "comment": "Malware payload", "value": "f48ac4009cd31cb69280699f287b2904fed5c335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612284, "uuid": "77a88cf7-05c6-4f64-9c93-906d2176bb58", "comment": "Malware payload", "value": "44a6bc930c99734bddaa4599a8013e81fa426f897623fbe4bf51248fe9c44b468c78bb09e3adf47529db1a051390ff4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612284, "uuid": "7367be01-a408-4123-9927-398048cfe4ce", "value": "E634A486BA62E479E9C591B4F426C21F18E63C7332854E07BF832FA7B0301475DE9967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612284, "uuid": "7bd061d9-5ee2-42e2-8b32-51a3bf4d5a2d", "value": "6362bc17930cc127ae2b7ff37e9122d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612284, "uuid": "df89e9e2-e426-48d4-822a-56c8f3f57637", "value": "1536:7TEvVbJks3cfYF70TUvSqWxXBsTDsISE23bXkjjDFMgv8cqfcVkUjgxHTwih30JW:W+IYYhWMyx2EDGjDFMTcABzzJNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612284, "uuid": "7cace1e6-8644-417e-a60e-41fa80701b53", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612284, "uuid": "f10c165c-1bfb-4b2a-8e8d-9286c342ab35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612284, "uuid": "31cbb253-e241-4683-92a1-3aab3022455c", "value": "LISTA DE ORDEN_PDF (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d792e1b-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621575817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575817, "uuid": "a32cba16-8ee3-4f27-bdd9-3c058b104ebd", "comment": "Malware payload (Dridex)", "value": "c61cff180ccca5e3b288c9cb2bd55de6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575817, "uuid": "0f02ddf7-2577-4457-b93a-f7c6804e5ccd", "comment": "Malware payload (Dridex)", "value": "8c67c3d2c68947eadb4b5aa370cd20d0bd56bb0f2e5a5b2c1dfeefb016bda4ac", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575817, "uuid": "6771664e-c1ea-45b9-af73-8f36259f11d9", "comment": "Malware payload (Dridex)", "value": "70c421e1c9e4f4e6818835808d3c2832ce3e12b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575817, "uuid": "103bddd0-0347-4eaf-ab4e-804d64b34b36", "comment": "Malware payload (Dridex)", "value": "87d8ffd97fa0ef43b4626cb481fd1be8cf740309372e4794dca401d24cafcaae5dc127fd4be5aea232e9296b08a0d125", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575817, "uuid": "e13b5493-9eb8-42af-ba00-6d2b4bfb8662", "value": "FA04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575817, "uuid": "6d07419d-455e-454d-a9aa-9dbb57832342", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575817, "uuid": "40cbe8d3-5a2f-4f2a-b5a3-80a787ffbcb9", "value": "3072:oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:oH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575817, "uuid": "ead542dd-3771-4f60-8bb1-ef75f2b7b5a6", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575817, "uuid": "118b23c1-19d1-4d9f-a37b-b377b93dbffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575817, "uuid": "efb65f63-ac4e-435d-acf3-e67115cd2999", "value": "c61cff18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca6ae8b-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574742, "uuid": "f956b744-3297-4ae9-a1d5-867b105e3d56", "comment": "Malware payload (Dridex)", "value": "fbd2e4084df572c5587216c9aaf1413d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574742, "uuid": "e56bf11b-10ba-4e64-9dfa-74fb83be36be", "comment": "Malware payload (Dridex)", "value": "8cab65a04d93e9a67e1b1408baf608c205488c196d6ea414674622b8df5535c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574742, "uuid": "362d34f6-b54c-4d63-a154-43f8b8a3713c", "comment": "Malware payload (Dridex)", "value": "f8c22eb80b9625e9a32911911e95aa9e3172f85a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574742, "uuid": "16189f46-c46f-4bd7-abfe-0a3abf5c5ec8", "comment": "Malware payload (Dridex)", "value": "7df5a0ca4302a9fab80605f0910e1abc50a269af3eb5e0e74be7d1efd9f047c512d0350ccc210837b163713147d4c678", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574742, "uuid": "76bbeb61-40b6-4eeb-a60d-45234944d21a", "value": "8604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574742, "uuid": "58e549e1-2f28-4fed-b951-418f792ccd2c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574742, "uuid": "cc0d6b42-57b3-4bdc-a350-20cbe7bc3daf", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574742, "uuid": "bd202662-4c02-419f-b28f-af85857238e1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574742, "uuid": "ddc565ac-642a-4cf8-9bec-b8334aa31e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574742, "uuid": "a31a473a-ca35-4814-a162-f9827a2bdb98", "value": "fbd2e408_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbdcaab-b9c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555386, "uuid": "a297f975-dc34-49d8-8329-7627be0aa32d", "comment": "Malware payload (Dridex)", "value": "e296e0079e64c07910d5b63970705a4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555386, "uuid": "b34b81b9-68cc-4583-afd5-9cbbec105e3c", "comment": "Malware payload (Dridex)", "value": "8ccc73d03df9306cd114fca2c095da86fb22b2cfbcddfb4e80e93b0be4c3aba4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555386, "uuid": "c3b3d4fe-92dc-4d79-8d81-f422770117d6", "comment": "Malware payload (Dridex)", "value": "e2a87a1851214fafabcbdb692b1862d2fda03a7c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555386, "uuid": "b3001dfe-b0ed-4530-8362-b75dcf1dafce", "comment": "Malware payload (Dridex)", "value": "23df38212b0ed4dfa604f86acbc9866bc0da710cd99d5df0e21b14e3c753ee51e940ce0db65b712e9975914e8444fb76", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555386, "uuid": "d78efc23-821e-485b-9d0a-fe3b19b75b9c", "value": "1C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555386, "uuid": "75a5881d-4a1b-431e-adfd-d9518526d03e", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555386, "uuid": "1dd754eb-4ef8-4476-92d9-bc9d2f522974", "value": "3072:Gi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:GH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555386, "uuid": "d9f2f82b-4207-4a48-bb36-036c7498e461", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555386, "uuid": "2913b2e0-bda0-43d7-9aee-e7913eaffe91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555386, "uuid": "58fd5e31-9287-4b77-ab14-5fe0bdc35758", "value": "e296e007_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc00eb01-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621611195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611195, "uuid": "96bd0155-04df-4a1d-b07f-ecc7d315d45f", "comment": "Malware payload (RemcosRAT)", "value": "a2d496660c0a701037bac36f2e35ab80", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611195, "uuid": "33f2a8e6-3104-47d4-841c-25d9d3c2ec58", "comment": "Malware payload (RemcosRAT)", "value": "8cd6edb9c0a515287d3b778d8c2f69b108476a8a02f69619595b25c6ce4c91c2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611195, "uuid": "a38897b2-60fe-43d1-acf2-5682c0c82dee", "comment": "Malware payload (RemcosRAT)", "value": "32494726af08be6db30a3c60d18dcda1aac886e8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611195, "uuid": "7333098a-1951-49d0-8e3e-cdd6fbeb6a2e", "comment": "Malware payload (RemcosRAT)", "value": "0c8145cfececc549fa6b3180901b9e56b123b0a508cbb1387d8932137b4ccf7308afd369a1cfc17e8b6d39db974da4da", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611195, "uuid": "8082c52c-d754-4db0-9166-4d80447bfa38", "value": "89A53338CF31D74EB31DD0B1748BC1DA0E15C97048649782E96BA689397F86B8BD6CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611195, "uuid": "a230189e-678d-459c-93d9-dd4570257723", "value": "49152:zYcKPXZUwR5EdqX6QRbgNwg4xi1ZLPGwAuKkjzNqWbXqpXmuv7a:zF5wR5tp+wK1ZLPhKkjzrXqza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611195, "uuid": "4c814e22-c199-4dcd-aae3-6c290ec73317", "value": 2227443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611195, "uuid": "d720f852-143c-4ae3-942e-0d7dbe5a6ce1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611195, "uuid": "7407e13a-e971-4851-b320-0e9acee76ab9", "value": "Pago May_0294 PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c4d933-b9ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571484, "uuid": "d0813c0e-ffc0-4a5c-8ae1-1525e67e8441", "comment": "Malware payload (Dridex)", "value": "f2ccf26c9e7df05352618308baf56532", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571484, "uuid": "b1ae627c-da32-47fa-b540-c5710a9c6aa8", "comment": "Malware payload (Dridex)", "value": "8cdedc72a97fc068fa51ff7725041c078dd472c0d7e1b4326423ef17a82f06eb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571484, "uuid": "dff2e776-2a67-4c4f-bdd1-132f8d7afa12", "comment": "Malware payload (Dridex)", "value": "bc2ee5b3affb744cb50fbdaab5ea4fc229c0d0de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571484, "uuid": "648aa502-93c9-4d56-899c-6d86bd884cfa", "comment": "Malware payload (Dridex)", "value": "5ab168d5023a7a5d29759c518a76e9fbea6aa157c317b116e616e7719caf98dbaf0c95b8967a83468bff3377157a210d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571484, "uuid": "49bf15ea-a571-4f76-b159-1a813ff8d753", "value": "5604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571484, "uuid": "da5dd5e4-332f-44fc-ac2a-9c6de944600b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571484, "uuid": "81181e49-3db5-48bf-8e70-5e0ae0fe28c1", "value": "3072:2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571484, "uuid": "2ae59b28-dd8d-4140-945b-bedc14f8d470", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571484, "uuid": "c29e2076-c094-4d96-b30c-a1176f16dae5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571484, "uuid": "24932237-8ed8-40af-a2c2-ed405d3ae188", "value": "f2ccf26c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171eea2d-ba00-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579511, "uuid": "35d1679c-5db8-4c17-b4c7-2a772c7e2007", "comment": "Malware payload (Dridex)", "value": "defd50596dac1c107d050b657b4f0fc4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579511, "uuid": "b95ea42d-6c5d-459a-b1d0-ae2e53c85be2", "comment": "Malware payload (Dridex)", "value": "8cfa58a4a341b4199c37c3bd2ff78df7440f6f6642d1be9898d888538670c1d9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579511, "uuid": "765f3e19-7992-4dd4-91d4-7cb891c9e595", "comment": "Malware payload (Dridex)", "value": "78b53d69fa263c8073b19d22755cadc3b2542b0e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579511, "uuid": "03657fc4-74f7-42da-961e-6ab48ade8cab", "comment": "Malware payload (Dridex)", "value": "3baad66de32f602cc02310652d570855b2d7e01164fa01ada478e6b9c6b2abd1357a6ad6fd9e98dfa355c7446da89c00", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579511, "uuid": "d800f50a-902e-48ea-a043-d01181899bbc", "value": "9804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579511, "uuid": "73313b4d-5320-4336-b801-21ad900c9fb5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579511, "uuid": "84bedf2b-a312-41d9-a0a9-87029cb780be", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579511, "uuid": "0dc6d94a-2f22-402a-b88c-c0b8a0f897e8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579511, "uuid": "18adb6e0-6314-404d-9a3d-c3a29d564aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579511, "uuid": "8eee64de-9c61-49ba-a38e-cee9d7bf038a", "value": "defd5059_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efeaf1e-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621611361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611361, "uuid": "8cf4b5d2-61db-4358-b88a-8e3767cbb65a", "comment": "Malware payload (NanoCore)", "value": "a6ac8ad150a8c4781793e73be3fbb121", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611361, "uuid": "e1c8c059-0784-4cb5-a434-8d685495b5c4", "comment": "Malware payload (NanoCore)", "value": "8d3fde104daed4ea247d38c763872e1617c6d9143f85a657de2c42c7ee17f104", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611361, "uuid": "f2d19350-53e4-41b0-9111-81f6016bc6be", "comment": "Malware payload (NanoCore)", "value": "4ecb8946a937944b20b5536bceb3f40acf0d474a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611361, "uuid": "6140a3b8-a367-46fb-8091-1105f7cd4572", "comment": "Malware payload (NanoCore)", "value": "e616e26db83f74345603ba4216fada9a281c85cb1367414eb76927c1bd497b6f193e7606c2568b280a4a51e394711ecd", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611361, "uuid": "86c640de-63e2-4ef5-b6b6-ced85fc4b105", "value": "CD85AD318905BD1B8EFF2F46B5502FD33C38257BCF141058E98F09B999682389A7AF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611361, "uuid": "99aa2ebd-2872-4c61-8f88-b935563f9107", "value": "24576:NnRRgj4W0oGE7AzM0Ev78hwv22qrC4dzzH6hC5Y3mEabOXDBKu:FReBAzDET8hwGxZCXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611361, "uuid": "65d0a5e0-0c97-473d-846f-95a83521b5b4", "value": 1735224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611361, "uuid": "5e41936a-bb02-4a13-8aaf-2167e267e171", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611361, "uuid": "0152b7e7-dd31-4085-bcaf-76666120d7c8", "value": "Invoice No B1019855_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6cb5e3-ba13-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621587813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587813, "uuid": "58fc39bb-47d9-4ebe-86d3-6b7e80c5d17a", "comment": "Malware payload (Dridex)", "value": "4a2a87a169c319e412585074e1365e24", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587813, "uuid": "ac34f74e-215f-4df8-b49e-53aa4227989c", "comment": "Malware payload (Dridex)", "value": "8e198f3c121baa67fb615054ec588c069b6c137fdde71b72d57c5d6cc9feef1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587813, "uuid": "15b94fe5-55bf-4a78-9ac9-205ce9f91bc2", "comment": "Malware payload (Dridex)", "value": "e64f9a828ce9d1f79887126a115cf67bbb976346", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621587813, "uuid": "ac2c9a1f-ca89-468b-be7d-755bde6eacb0", "comment": "Malware payload (Dridex)", "value": "b1b9af6c67b11ac53ed028b0207b15fec71630e750533af246c2494fe99bb425ef96669a113bf7db61eed8fe0bf126d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587813, "uuid": "4678d2cf-7f83-4f1e-9df8-d210798b7ecd", "value": "7CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587813, "uuid": "4eac7812-2b5d-45c9-bfeb-6eddc24ff16a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587813, "uuid": "729d0c19-e174-4e31-ba5a-2fc162fb88be", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621587813, "uuid": "0007bba4-7737-4c2d-837f-f0fed4f2a047", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621587813, "uuid": "9a34b66a-b4d2-45a6-863d-3ce11b0ef1ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621587813, "uuid": "f00426d9-ceda-43b0-8c35-63be5730f63e", "value": "4a2a87a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb31814-ba4a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1621611308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611308, "uuid": "e71e1125-1f86-4a9f-aab2-9e171eb02c5a", "comment": "Malware payload (Vjw0rm)", "value": "da2054c4d6c5a5051a82ef276afb3342", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611308, "uuid": "3a1efbad-7229-4c55-9890-b0ce5f1cbe5a", "comment": "Malware payload (Vjw0rm)", "value": "8e5146485d183e60079662c903e943a3deaa854d2de07b764811385748381c46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611308, "uuid": "c99233b7-9586-4026-b3b9-292fa0d02d82", "comment": "Malware payload (Vjw0rm)", "value": "924772e4c5112c6463bf986377c17b1e6e529642", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611308, "uuid": "c841b0ff-2f72-41fa-9bfa-c32988acb399", "comment": "Malware payload (Vjw0rm)", "value": "8fa8cc2966c67afb98aec2d0bc3b17eb8c97f35e65b1154fd75eae582f37f76f6ac37ccecfb192780cd58a0fdfe49be8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611308, "uuid": "34ffbba4-0a90-40a4-adc0-e8877b985bb1", "value": "A0D2391B709C4BA1ACAC5D703DB4EB8E981A70F451B832C46FE4999CD2E8DF8144D79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611308, "uuid": "f33ed7ca-ff73-463c-80d2-7a79e0eb53c3", "value": "768:Brs4rt0mRPLAL2DqpZEwrQnCxPxQW/ah79l6x/9U:Br9t0mRPLALyqpKwrQC5xQW/ah79l6xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611308, "uuid": "2709e105-36b0-4a65-b09c-bd60c74d35eb", "value": 30488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611308, "uuid": "0ac65d11-f42b-42d1-9ac1-af36164b5f99", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611308, "uuid": "6607659b-38e0-401d-8d82-80edf8636292", "value": "ID99827299202.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc76d80-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612216, "uuid": "dd396f30-8896-4685-8df5-2b4898e9bb5d", "comment": "Malware payload (AgentTesla)", "value": "92b5f1ef8c9e6eafde3b9293d247d838", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612216, "uuid": "8a7ac1d5-615e-4051-9614-0cee1e332172", "comment": "Malware payload (AgentTesla)", "value": "8f1c6087ec7992ecb1a30e6c156d10fc573641525d4f1cad05acfff0526ab5a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612216, "uuid": "e3013992-dbc2-4e7f-a337-99c808748a90", "comment": "Malware payload (AgentTesla)", "value": "987da360790bcab2aedb63727ad2543802eafecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612216, "uuid": "f20c968e-81cf-42d8-8409-5ed53abd9e3f", "comment": "Malware payload (AgentTesla)", "value": "24e9cade01983483ba746653b69050496441a4efc8419c1688458ef180303970f2c60f59859aed9a4cfb8acf5596a7a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612216, "uuid": "67fb54bf-5f18-4b8f-b227-49f71eabe0b8", "value": "3D15DF3427A99348D07E5B340876C1B163F3BD52B715C72E3DD44D8F7A22A928722BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612216, "uuid": "7c7729a3-894d-46c0-a271-132fa781073e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612216, "uuid": "2a66be7f-3792-4df8-a857-a9e7febbe862", "value": "12288:3dNEhlMgKz0eE23SarAuDrIgoJKod4rzXMfZzfWPvbDITtBux9Wf79l5y69I5:3zEhWJz0jXmIgMVd7JfMXUuWj9G69I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612216, "uuid": "7fb19c66-f471-4879-af54-7743c35df741", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612216, "uuid": "8220a7dd-3bb6-4618-8d80-51608814d0af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612216, "uuid": "ef72add3-7b0c-42fc-9e95-58c254f3206a", "value": "BOQ-21-5-2021 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e5f50a-ba0a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583829, "uuid": "df9ec4b4-c315-42ca-b532-ba254300243f", "comment": "Malware payload (Dridex)", "value": "64dce6112bf6c5321017bd5171674e76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583829, "uuid": "4cfd1b66-a960-4955-b3c8-4caf8609d7cb", "comment": "Malware payload (Dridex)", "value": "8f716a8adbc08a4c3298beab9adecd11adc586e1c3d652f8f658291eaaa5c5a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583829, "uuid": "f7d4fc01-d34f-45b4-96f4-f5df39809a84", "comment": "Malware payload (Dridex)", "value": "43906e645a4a6a35ba7d1e6d3c7ee0bd8947661a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583829, "uuid": "938bb004-4088-4c46-b784-a8226acec1fd", "comment": "Malware payload (Dridex)", "value": "cb902de4b16182d0c9f22df74a3e3ca0cabddf344d5a4416a620e8c61eb8430b5dad88a290a9e694b4788674eb7ed5a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583829, "uuid": "d5e70a43-bbe8-4669-8d1e-eb1ab6aaeb09", "value": "AD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583829, "uuid": "cf1d5a9d-2857-47ec-afba-bbc107135ad2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583829, "uuid": "6d96f0ab-223f-470b-96e5-f7fa5342a696", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583829, "uuid": "1b4a0d30-d09a-4a05-a97a-6b7a2785150d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583829, "uuid": "93006aa2-43fc-4e69-9a61-b43cd3f38e42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583829, "uuid": "582490c5-36a1-4f26-832e-b8f6e93cf182", "value": "64dce611_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89221274-ba58-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621617498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617498, "uuid": "93b8ae49-a7a2-4d39-ba90-dd1d1aeb831c", "comment": "Malware payload", "value": "275a47978832535819c940a4507ea4c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617498, "uuid": "6b5e1007-d9ac-446f-b677-ae6ef31b6f08", "comment": "Malware payload", "value": "8f83f8bd18a77de254c3ba3da5b4e13bc9834f7d02f0f02128503bceb07fcaa5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617498, "uuid": "55bb4adb-4e73-4573-b225-364deb2cec8f", "comment": "Malware payload", "value": "c8d753059542a25552a73c5294b3ea2582c48484", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621617498, "uuid": "6cda0733-8ec8-4385-90c6-003c0903c35c", "comment": "Malware payload", "value": "c681f62e0aeb33e29cd3d1ee745bae99c7b3c9f543af3e39c6492700150c40db605df079c119ac97d9be66cef120f7f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617498, "uuid": "198ef9da-4754-4cc1-a651-e03311e3eaa8", "value": "96149B138865DB52C56897F8BE534D8D2B0B2B0D59C535ED309E5E8FAFA83A20CCD05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617498, "uuid": "22e1fe97-c9ca-4721-bb3f-80957152e730", "value": "3072:VRZdmLQj2wtPO88Ew5AIsPixqYtVYeFH4ZwHrcRd7Ay2rf4KGn5hk57dY:jmLex0VAIu4bVYeVHrK5AySfahkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621617498, "uuid": "89a2f052-bb2d-43ef-950a-3afea8a5e68d", "value": 201358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621617498, "uuid": "3e812d2f-ae62-47e6-8aa0-4d69de88fc4f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621617498, "uuid": "74de4974-3261-425e-8ecc-14e71a960e29", "value": "275a4797_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6c9b1f-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613019, "uuid": "21dda978-9dae-4b67-8571-5a1da9b7d7ba", "comment": "Malware payload (Dridex)", "value": "f6fa0bf8f96f4e9236189011ddb592fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613019, "uuid": "8af1e1a8-c2ff-4619-a27c-a66f6a0c1056", "comment": "Malware payload (Dridex)", "value": "8f85cb4dccdee1fc7aef31b488636e247f9e991eb92e1cb793409fca83d1d7ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613019, "uuid": "9a77c99d-eff2-4274-bbe7-8f7d7f727d28", "comment": "Malware payload (Dridex)", "value": "318306b2456aa331fac7520392e96019a1f1dab3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613019, "uuid": "e12c153b-cea9-40ca-a0f7-2b591264cc9f", "comment": "Malware payload (Dridex)", "value": "7c36283790448521325dd4ac2bb33ec40fed930f910aa2c9204bad7ad88214b4b44c1c75f4cf7bc3ca4d16375b5f32e1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613019, "uuid": "13b7e0f5-ce4d-4f5c-b6fe-8195e212a028", "value": "9BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613019, "uuid": "32d13b36-aee6-4f7a-96a5-d9449bbe7d24", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613019, "uuid": "b27e8834-4472-4a67-881f-9112aa50facd", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613019, "uuid": "c2948727-60b9-437a-9458-897d1298cb59", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613019, "uuid": "aedf12e5-025f-4ae4-a2a6-c465c05cb308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613019, "uuid": "808ccf7d-8e53-48b5-891f-75e5d8aa8d08", "value": "f6fa0bf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8519eea-ba3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606437, "uuid": "4dbdfa2f-16ea-496a-85c4-68452bed72a4", "comment": "Malware payload (Dridex)", "value": "03a46ba83eb5b6e97e3b4a581746c607", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606437, "uuid": "304a1347-7143-4de5-ae7f-0824ffa3f9cf", "comment": "Malware payload (Dridex)", "value": "9041e7b246fff8506038bb8bbff8c10919ffaa543c0eec7ee6a7fe1d19a102ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606437, "uuid": "4956f822-3056-4a2f-8e42-c498cd05b18e", "comment": "Malware payload (Dridex)", "value": "6127943b8454e5f137f0703417e1b3f630e2caf2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606437, "uuid": "eae019db-3322-4edc-bfa6-06abf99af9c1", "comment": "Malware payload (Dridex)", "value": "1e3f35792cc9778d3813fbd3410496c3a360b838124e82d99a415f0de15cdadc655a6be55e776539e40c661e338b8f43", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606437, "uuid": "7a113d16-4834-47fe-9e18-b972685e6785", "value": "61F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606437, "uuid": "2ba824bd-fff4-47b3-8589-43d25315f259", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606437, "uuid": "e8ef8851-f839-44db-a517-687c5df206a5", "value": "3072:Elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606437, "uuid": "82e91b9c-b71c-4353-8737-255d9911b5c8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606437, "uuid": "0c0ba742-5e3f-427c-beb4-4c5553c352bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606437, "uuid": "32e83115-f0d5-4dd7-9ecb-96379346134a", "value": "03a46ba8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb2b7e5-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621576002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576002, "uuid": "58ac3fd8-46d5-4a6f-9b4b-c09a0b8dbbc7", "comment": "Malware payload", "value": "11c6aa1a60f19ffeb501d36648a788cd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576002, "uuid": "540db156-45ab-4cf6-b39d-00c823447140", "comment": "Malware payload", "value": "9082a74c5d4576e78b51bea55ca294a6fa7e8c526f178dc7c241aea82e64d15d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576002, "uuid": "cbf63c70-d809-4cf0-b84f-a1824ed11876", "comment": "Malware payload", "value": "9a3368a903d0211b07cc470faf4a3454d41df32f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621576002, "uuid": "add66064-b8c5-4a37-b914-916061d144a1", "comment": "Malware payload", "value": "9d98569b8d85c9feaf7688006aa81f80d8d1d753f0d5585066b73cad12594b9680491034bb54d32956fb32a2ae4bc655", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576002, "uuid": "d47f73ab-20b2-42f7-9578-0e983773d436", "value": "C7C4F03123E92F5BD57EBBB5197150000BF6F5A2E732E70E7CAA50DD44A5E4087A2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576002, "uuid": "ccdb5bb9-ebd0-49d0-8e2f-2442d81bdb91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576002, "uuid": "79ccbd3f-0234-49a1-b694-4dae357f34e6", "value": "12288:7lxOyKztjGNUVX4j33ADIligXV/QxqDt07qGzJTwyydN9:72z0UVI7uBgX307Ztfyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621576002, "uuid": "9bada363-44b2-49ef-aec3-50849e402a4e", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621576002, "uuid": "4292e9b0-c1ac-4be5-bb99-cab65d76028c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621576002, "uuid": "ab7e9bc1-db76-40b7-95f1-c3048ad82fcc", "value": "DHL_AWB NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110ca1de-b9fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577353, "uuid": "79545210-7fd7-43dd-844c-bb38cd74fb51", "comment": "Malware payload (Dridex)", "value": "9bd3db046032af9b1a533ce2bc2dfdf4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577353, "uuid": "3d24ac5a-a33e-4823-9bc0-1cc9ed46b24f", "comment": "Malware payload (Dridex)", "value": "9099cc43f87263c0da6e19c820f844a70eb77558916304863022f29ff413f32a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577353, "uuid": "2f451d4b-4457-4852-b307-d5e9ca8e6eb4", "comment": "Malware payload (Dridex)", "value": "115cc3c6336c608f84865fc990ecdb163568f67c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577353, "uuid": "7f170fcc-ae3c-486e-aaa6-814c13d2f60a", "comment": "Malware payload (Dridex)", "value": "d90a6b3b129a7b686a2cf4e7ed3a1077d6e268ae9c77dfabed5b1fd2b1912aea0b012051797bfa7b899125675ccdbade", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577353, "uuid": "1ec97b63-054c-46d4-8497-ab975e6214d3", "value": "C104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577353, "uuid": "39a06036-7fd2-4366-bb51-4c20533fa08c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577353, "uuid": "e60c4198-c8e3-4676-8613-cb2b5c26e887", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577353, "uuid": "0235b990-33ea-401e-a060-d0d3e62fa045", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577353, "uuid": "6c9ede73-9ee9-4a21-8189-61e523d94952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577353, "uuid": "5d091e48-767d-4240-8e09-8b1adc33b4d6", "value": "9bd3db04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b106fa-b9dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564025, "uuid": "31ed0375-bc32-4c19-b6d8-46df98abc248", "comment": "Malware payload (Dridex)", "value": "95be7e4eb4093918f67f79c145333c6e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564025, "uuid": "13de21b5-1950-4af5-9349-3d4ea7b2697f", "comment": "Malware payload (Dridex)", "value": "90e79e16111ef3f81809b6fd28c512a12e487f15728d24c14baa71c619661269", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564025, "uuid": "71c28ca3-ba4f-4a72-b892-d1572259d84c", "comment": "Malware payload (Dridex)", "value": "acdb1925479297b919e91d18e596425765f2b862", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564025, "uuid": "a7b80397-6d9c-4b09-842d-8ef7cfa8b034", "comment": "Malware payload (Dridex)", "value": "65ba32045bc36a977051d1bd55b055898979e20677db1b8a6cb9b3dbbd8a1b57f21e527dcf5612335afa6b5bd9c00a5a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564025, "uuid": "6d2f0477-1908-40fc-a864-ffb8099b8158", "value": "E004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564025, "uuid": "e5d9fa0b-311a-46d0-b760-17da005773d3", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564025, "uuid": "fa62c92a-b794-4cf3-be99-08ee84606927", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564025, "uuid": "fe399e89-b74d-4f6b-ab44-c05a5b6c5d33", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564025, "uuid": "d019a4d4-9d44-4197-802a-923485241f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564025, "uuid": "01f77527-b425-4f04-b180-2fc3aae38b7a", "value": "95be7e4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89146604-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573260, "uuid": "f6971900-8ed0-42c4-ab8d-cd9f8a601b8f", "comment": "Malware payload (Dridex)", "value": "13d778a83e56eb2c2ffc1c07d19c67e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573260, "uuid": "4bf214b9-d729-4999-9aa8-83544b2d8d77", "comment": "Malware payload (Dridex)", "value": "91345bb38f58db8f99bc6e79f5f00f86c128d773ee0b64200586ffdda88e072b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573260, "uuid": "8317722e-45c2-45f4-b2cf-07ba875b37a2", "comment": "Malware payload (Dridex)", "value": "4a3e1768d62629b28ad4b1da21717f060b216641", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573260, "uuid": "07b2f06d-048b-49e0-9349-523b472e7a83", "comment": "Malware payload (Dridex)", "value": "56abe4df058e2d68b97692895dad0f05c63bd1edc12f6f5a6f320a4642447b1b35293666525e6862d8e2b738dfcec352", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573260, "uuid": "e155beda-45c6-4da7-88ce-b5797efb93ee", "value": "4004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573260, "uuid": "e22599c6-8407-4ba4-8e74-cc137444c643", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573260, "uuid": "2b17f551-f703-441c-a28c-68c5b090be51", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573260, "uuid": "ec48d208-4d35-4de4-b116-756654a8cb11", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573260, "uuid": "f536886d-8755-40f4-8f87-917f04e5b313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573260, "uuid": "65718971-37a9-4022-90a4-9e9e1c40d600", "value": "13d778a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266384e8-ba09-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621583402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583402, "uuid": "66b41300-d62a-4a25-bb6c-8300faba3390", "comment": "Malware payload (Dridex)", "value": "fbcb017eec78ab5c6f29fda4501ebef7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583402, "uuid": "4c0349dc-820b-4a41-838c-ecaa8a846ed4", "comment": "Malware payload (Dridex)", "value": "913827985d6de0ba4eb47e85cf88cc44090896cad6ef8f02d7865d8d4f84c260", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583402, "uuid": "beb2573f-c1c0-48ea-8349-34850c36d9ed", "comment": "Malware payload (Dridex)", "value": "a7c2635a36e4a2c5a558f6a9a7b9af109fbf2c59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583402, "uuid": "e4b247c5-77e2-4fb4-9867-ed902415e266", "comment": "Malware payload (Dridex)", "value": "d689157e7a8a44ec1a6948a89a17d59b0f7a5ccf0a749fc5e7cd9e5678aab4dd5f593f76e84ba7703d0174906b617dfe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583402, "uuid": "935bda97-9dbb-48ba-b17a-b6bc3101d428", "value": "AAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583402, "uuid": "06eb4063-7f5b-4c17-a86e-3ecb43fbcfe6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583402, "uuid": "8a860b1e-e9c7-45e3-b118-36f690bd248b", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583402, "uuid": "c8e8a724-2c23-4932-8ee5-9385fb0e0ec7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583402, "uuid": "84e61df2-d7f8-47d9-94a3-696798d347a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583402, "uuid": "6cc1a7d0-043f-409d-936d-1416fc83e7bd", "value": "fbcb017e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4625f5-b9f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573347, "uuid": "1ebdcd5e-983b-4835-9577-ead81875a01b", "comment": "Malware payload (Dridex)", "value": "2f76af513ecfee078cfd772f4f0a9b10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573347, "uuid": "32144d1e-6c59-4b2f-ad65-f19cdf344319", "comment": "Malware payload (Dridex)", "value": "9148fb4b6e915183867385afa28f4cc85904da44b22f3803de26477dee0b3e9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573347, "uuid": "cc72222c-43f4-4f78-b5f6-2e09ab7c6ea2", "comment": "Malware payload (Dridex)", "value": "5b438534ff609b2e46b5198828cd92a74bdabb9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573347, "uuid": "ef4d1662-6906-421c-9622-fc27a15675f0", "comment": "Malware payload (Dridex)", "value": "fe246589f2bd9d0438b8b0645fdc99bf05b228752841c009fb1b301c7a36c7e8a40c6044f387ca732840f2f620c80ede", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573347, "uuid": "d633651a-c688-4e48-b45b-40ee2b2b288f", "value": "FC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573347, "uuid": "8fdf28ab-0953-42c2-a1d8-16bf562c850f", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573347, "uuid": "d13c1f01-407d-438d-b4c9-53a98c79b68e", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573347, "uuid": "30283bb7-57fb-45c5-85a2-704718ac9566", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573347, "uuid": "79258a11-116e-4a82-b480-ffcadee66491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573347, "uuid": "095da0a6-6301-4751-bce4-058ae619086f", "value": "2f76af51_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef26f28e-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612515, "uuid": "00fbf077-3a9d-49ae-96a1-f29d6ca06555", "comment": "Malware payload (AgentTesla)", "value": "24cb6ea99fb91ca07205c4610dd8690a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612515, "uuid": "e28c2a0e-3d07-4df5-97d1-2a78310991e1", "comment": "Malware payload (AgentTesla)", "value": "9152b31b0c1b7baa6722d1fad2a5657659da5eb4ffbc21b4e64d85fd4ab8b28c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612515, "uuid": "44c4d97c-6d76-46f7-82c0-2b22add5e44f", "comment": "Malware payload (AgentTesla)", "value": "92b112826057992b720e1c2f76d48847f876c598", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612515, "uuid": "60fc1be7-d0d2-48a1-a9b2-2720fdd77705", "comment": "Malware payload (AgentTesla)", "value": "b2b7fb94c9bee530f91781ad64f572fa8d2f7057cb0df262298215b1088caddd47a407b12bbe15c2065190f58adb89e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612515, "uuid": "a952c358-29b8-4020-ac74-975f2811b9f3", "value": "72C49DAC32A075DFC86BCE728E642C64EA2174A7531BD207A157115CAE0EAD7CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612515, "uuid": "062d61bb-61e8-49be-8339-3fca87cf709a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612515, "uuid": "eaa7e5f3-b600-4505-9f6f-369ade32f111", "value": "12288:3XwpvBULCU3+m9AlDivHYzoFBRN/O4glhVB9WXlJOlsMe3qAFf9XEBZ6ATRtWI:3XwFBfUum9AlyHYOBHchVrW1JxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612515, "uuid": "31533b24-4dff-42dd-a024-abe1ebbc646e", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612515, "uuid": "fc235733-e7ab-4b98-9c36-7986a13e89cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612515, "uuid": "366cc783-140a-405a-b322-ce58560b0f24", "value": "Factura comercial................................pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eec7072-ba50-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621613857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613857, "uuid": "9c0feca2-231a-4e9b-954c-da2a9a9ae50e", "comment": "Malware payload (RedLineStealer)", "value": "ab901b61de9694b293e588a1accc4d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613857, "uuid": "f5b38eff-dad6-4328-b6dc-6d778257f2d0", "comment": "Malware payload (RedLineStealer)", "value": "91e01b2c053bd6ebb4a00d3f9dd0ab710cd051ac1ccc1a0bd6feafbd915a00b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613857, "uuid": "59773da9-a79c-49c2-9b1b-231c2e0bf0f7", "comment": "Malware payload (RedLineStealer)", "value": "3019dfc5a82be4d59f9ad6f8486d7862970f5459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613857, "uuid": "e31beb9b-59bb-4ee6-9f33-808be3f90432", "comment": "Malware payload (RedLineStealer)", "value": "5012312e36e4fe13ac309c9944d431913076ca43045fab31b13d48054319f1c9833f1ea0da371b799e25e2deb3f85e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613857, "uuid": "43df1fa6-cd4c-4427-8082-a3e8eb603207", "value": "BB658C543014CD49E72AA63ADC9A10F403FCDE85D661822B786C7FD837F2B25652BF98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613857, "uuid": "75428119-0454-45e0-beb8-e96656403477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613857, "uuid": "330e9987-1563-499e-83ae-a8080a336f21", "value": "24576:d4ta9sPwHXaRBA91toSsOA3uvZS3ZX9KPwVzLGt6q:d4GbGmtoSsOA3ukZX9Kucp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613857, "uuid": "3c98c11d-82d0-4941-bde0-f2103aead146", "value": 1449688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613857, "uuid": "52c565b2-e617-4226-a712-0e84dafa54cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613857, "uuid": "f7dc5e98-c6a1-4137-9172-cedc24f0f2ed", "value": "ab901b61de9694b293e588a1accc4d8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044ed097-ba72-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621628442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628442, "uuid": "822afc9e-8978-424d-9adf-615317c84271", "comment": "Malware payload", "value": "4ab8d1b69a906dd13cae80daa8f5e1e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628442, "uuid": "e91c5b80-d81b-4ee0-9966-c15bb4cce5b3", "comment": "Malware payload", "value": "9212b2ba6c634df0743deb9249efb2cbe1891443bc22a94373f9ad50b70eb739", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628442, "uuid": "ff2430d9-cf20-454a-a0e7-5bb84b28c7d3", "comment": "Malware payload", "value": "add7b81dd74b1588e096ad803666930fb2d4d994", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628442, "uuid": "829578a8-670a-4f20-a1e3-fc112f288645", "comment": "Malware payload", "value": "faf6bcee8309fc739ab3bb86c27ad121ddb3db158b771339120a1e51450a733bff62756db7a7e26484ec897e9f3d9298", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628442, "uuid": "6058dc44-6770-49bb-b583-6171b0247d61", "value": "28F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628442, "uuid": "f5027301-1e3a-4d7a-aa94-c9cee070861e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628442, "uuid": "79842524-5426-4bab-ba00-0d9c38b243a8", "value": "3072:ZIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ic7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621628442, "uuid": "71e92e88-f0a6-433f-8deb-99739fe0a0fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621628442, "uuid": "899b7fab-2937-40d7-b38f-2c530273f888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628442, "uuid": "fde0556a-80eb-4971-8b13-5ef2b799f717", "value": "4ab8d1b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16075bd4-ba0d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621585093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585093, "uuid": "602292a6-4246-4a7c-a241-6e3fa43a565b", "comment": "Malware payload (Dridex)", "value": "ce8db9a08672bc77612b3eeb51fcd47a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585093, "uuid": "e9ea6276-3498-458a-b08a-52e77bec0d08", "comment": "Malware payload (Dridex)", "value": "923389c47c6d60ec3a6e4dd03718c912edfe7c644e5212b9deb521b522aa0792", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585093, "uuid": "66b69518-dd3a-4c24-9904-84281bb9143f", "comment": "Malware payload (Dridex)", "value": "72316d4681e6a629d3d78467c7211c548d4a4df0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621585093, "uuid": "3512340b-ff85-4ce5-88e5-afaad8679f89", "comment": "Malware payload (Dridex)", "value": "2dd45057042d7e6361625830609bb4a9f76139a83737c63284228233da0da014e61686274aad8b841d3e1d1140b10d8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585093, "uuid": "0ca0ebe9-feaf-4598-b00c-f2bb1f7a89cb", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585093, "uuid": "9c251210-b297-4cc1-8f99-18d074d50e99", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585093, "uuid": "7c9e2104-4d54-4cb7-81c2-7a16b72b6cff", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621585093, "uuid": "bf270b89-5327-41a6-9a21-64b51fe87002", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621585093, "uuid": "1299c0d0-c0d4-4d29-b445-ccd99938c077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621585093, "uuid": "e36cb0a2-9b48-4bfb-9b29-743cd515d2c0", "value": "ce8db9a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e9eeed-ba82-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621635347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635347, "uuid": "639a4941-0145-4a77-ab3c-2aa02b811440", "comment": "Malware payload (Dridex)", "value": "2b8d3ed064b79cb8968fa0e95d5f9aa8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635347, "uuid": "e62b0d48-840e-4a63-a607-6671a5f6b0fd", "comment": "Malware payload (Dridex)", "value": "92cbecb1e4fb26bd046b24c535dc864feb52bf074792c183b2ee0e12521bcd7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635347, "uuid": "aeac81aa-1264-412d-8dd6-f2f376a76595", "comment": "Malware payload (Dridex)", "value": "dda3fd846fce53f5be1cc3832376c2bfb63d0158", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621635347, "uuid": "5d1f20ba-f9e7-4faf-996b-099fd5b0b136", "comment": "Malware payload (Dridex)", "value": "c6ee6a9fd169a1043a4f95ced6366616c56964645902bac5736a7bb3e0e60f0227c1309511e78d8678cd0abe87918bb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635347, "uuid": "66f82529-ea1f-47bf-989d-8bebb8115663", "value": "10F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635347, "uuid": "b1d0456c-3986-4c4d-b719-2c491691bc70", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635347, "uuid": "8f1db70d-b31d-4faf-bcb2-7364742d49ef", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621635347, "uuid": "2566c342-cd58-4a50-b6d2-42e838370fba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621635347, "uuid": "90a13d6b-442d-44c6-a5bd-c4cc510c0e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621635347, "uuid": "af18456b-ca80-4968-8cb8-dfe3f13be8de", "value": "2b8d3ed0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc0f4e-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581329, "uuid": "4fa8bb58-f99a-4ffa-ae03-c61a577ab1d9", "comment": "Malware payload (Dridex)", "value": "2cbc15a17e79baf8c6f986cc45a5e639", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581329, "uuid": "c34cca84-ffbc-4d1e-aab4-a71e114a550b", "comment": "Malware payload (Dridex)", "value": "93098506c3fbc087b490190d6e73d924ca7dbfe2de17bf0f400eb73ce8e2113b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581329, "uuid": "42548c55-2248-43e3-a631-d2e30c6af567", "comment": "Malware payload (Dridex)", "value": "7b52de0bd6dfe8338a2a2f4787e1d3c2735d6db7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581329, "uuid": "8d1307e0-9c58-4b18-8217-e33d4e28573a", "comment": "Malware payload (Dridex)", "value": "46878ac1834345179ee7c2a23d50abeebcd33252c11d9320a1475857862ba6f2c44e33291f6b9feb0352602fc2b6dad8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581329, "uuid": "9e2573f7-1a75-442a-9139-6fa8f66899b0", "value": "14F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581329, "uuid": "c955f4f8-1c6b-4331-91da-91723d3d8f9e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581329, "uuid": "20236985-c607-48bc-a139-d049259f304e", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581329, "uuid": "340117cd-e024-4312-9ec0-d4986b80269d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581329, "uuid": "04bd7be2-e366-4437-ba97-0909da05b51a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581329, "uuid": "c9a8ee4d-e982-424b-b1fd-cce69cc0aec9", "value": "2cbc15a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fe5f69-ba5e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621620100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620100, "uuid": "0ae4e6c7-f54c-43f2-a771-7f8cdd6f8d23", "comment": "Malware payload (Dridex)", "value": "a8d847766095c257517dfb84cfc15fe1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620100, "uuid": "afe94785-1f60-40ba-a46c-9e17511c5682", "comment": "Malware payload (Dridex)", "value": "93548f9b10f27269b5cdbc7053cdf9f69ddb41af17319dd542f44f3cb2bcbd29", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620100, "uuid": "db988b5c-13ed-467c-8a06-46d22349cf17", "comment": "Malware payload (Dridex)", "value": "64e867146452b9af0f6eeeaf61a34518a52ac7cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621620100, "uuid": "0eaa3f9a-3d5d-4138-9d18-5f4d47547608", "comment": "Malware payload (Dridex)", "value": "1244cb1d1ee0d3cdf34ec57a59a134546cf3be9d975a018e9e12a90cbb8b05c10957fef3948d7cf793fcabd93591151c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620100, "uuid": "cf0753e4-48ce-4560-9ab3-24c78706c449", "value": "9804D05CDA6B6D43E8FF67B1625C602A3869AE1D0730CC27CD94D7828A753631AB4733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620100, "uuid": "616ba988-c6d3-440d-84d0-ab1114dfdf7e", "value": "ac1340561f04ce504a15af805259cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620100, "uuid": "3485f7a6-6caa-474f-b507-0b9be0a9ceea", "value": "3072:6qWLBTrGNr0gl+CI3bc4ThMXu6GkqFmLqmjcRVmkHkKFhG2wwUJ5/lB:sVqNd+CIQHXu9VFmu0qU2CJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621620100, "uuid": "6852472f-702b-4156-b8c3-10c5376c1e8e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621620100, "uuid": "770e9114-6bee-46e5-a405-73ee09578c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621620100, "uuid": "6b0c1610-cc1e-4093-9a66-b974fd2a135a", "value": "a8d84776_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fffa66-b9cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558786, "uuid": "444c0af2-e26d-48e0-b26b-4bd12e62f5f0", "comment": "Malware payload (Dridex)", "value": "50149d82e55f6289496d4aa2c8cbd242", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558786, "uuid": "c5d98927-40a6-443b-91d3-9b5d5f17600d", "comment": "Malware payload (Dridex)", "value": "939d69af19fc6d9c0fdc54a8b06cf6d08efa7a72a73702783716089065699d41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558786, "uuid": "fcf4c8bc-995f-49a6-bf2d-91e693b5f42c", "comment": "Malware payload (Dridex)", "value": "b16cadbc3a0040406f82364e5d8b030d6a442c10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558786, "uuid": "93658337-b8f2-44f5-9d4b-fb664a36ebf2", "comment": "Malware payload (Dridex)", "value": "1c6067d66f713620c04e56d0327c5ea1b72cdecc94067a167f389b37a4dd75297844fbb16f7cf1d7f154c48c4255ae2a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558786, "uuid": "39944f5c-c0b9-499c-8ead-906b30c640ff", "value": "5104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558786, "uuid": "78055c55-2a66-4895-a978-2326314091da", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558786, "uuid": "0b378eeb-540c-4ec7-836a-5926af6bdd1e", "value": "3072:mV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:mV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558786, "uuid": "e2829867-1fb0-4c7b-b557-98e8f7d163b2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558786, "uuid": "89889119-ba42-4fa7-9620-705e0c212f0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558786, "uuid": "59c95830-ed4b-46ed-a9c6-4fe5312728b5", "value": "50149d82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eda5407-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581296, "uuid": "1f5070f3-f538-46f1-a4fa-50b1727b3100", "comment": "Malware payload (Dridex)", "value": "e7e94e10e71ed604fd66ffb8b0da5a1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581296, "uuid": "fca80ed8-de29-4cd2-bf01-72ccdcae8e9b", "comment": "Malware payload (Dridex)", "value": "93a30ee51e3a82c25744125936bb504b8c5e003648a8609e13ce3cff310c9c43", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581296, "uuid": "dfbddc13-afa4-40e7-942a-59e3cd4c178e", "comment": "Malware payload (Dridex)", "value": "2887ea385dea36458b68236793d59cf4e85654ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581296, "uuid": "deb2d1d7-7892-41a8-a552-5cf02167c5fd", "comment": "Malware payload (Dridex)", "value": "e954f2198b5940a36374269ee91a8c832beb87635b4397161218a0f06fa95185da7bab259049ada9d072f3ee4a39839f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581296, "uuid": "75bae241-40f6-4475-a7b8-a48f59808926", "value": "7C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581296, "uuid": "cede7d81-f579-4dbb-8420-d94a51d00f6e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581296, "uuid": "329daa49-3ff1-46f7-aa70-fd6aafd4d3cf", "value": "3072:YV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:YV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581296, "uuid": "bfbeac95-835a-45af-8152-0a72501f4efd", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581296, "uuid": "f23e155a-4de1-40e6-bc50-3dcebd342cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581296, "uuid": "e8afaee5-1e81-4009-bc15-b4bbbdeb0c7d", "value": "e7e94e10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d8bbef-b9eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570812, "uuid": "2dfbf3d3-ef17-4611-9b4e-19063b70c591", "comment": "Malware payload (Dridex)", "value": "213a7722e0787fa761f05970985cc3b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570812, "uuid": "d991829a-cbc0-4930-8742-4a529aea60cf", "comment": "Malware payload (Dridex)", "value": "93a3ba0ab155f9d8a705f83c829192b9e97dbd8751caf44acf7562bfe867b1ca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570812, "uuid": "f4f94f48-e36e-4c9a-86dd-b80a0b72f1de", "comment": "Malware payload (Dridex)", "value": "dc6ae6f625cfe8468bc995ee5d3b5d1fe3d5b650", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570812, "uuid": "a3f14324-5b3f-4375-8391-5ed01af23e4a", "comment": "Malware payload (Dridex)", "value": "e60b33491a64405647ee492ab2d03fc6759eee210032199dcfcc6e363470878c6ac0eab5c9792b017b75220c7c901ad1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570812, "uuid": "4d4c89c4-421f-41ee-8650-2c6b46847753", "value": "4304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570812, "uuid": "75a09a5e-3c2f-411d-ae88-3fe7ee6f70d4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570812, "uuid": "38a90297-3d5d-4733-aece-d04568717026", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570812, "uuid": "0bc4433a-5c9f-4a87-9098-d23bca51ea5a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570812, "uuid": "1b4f5739-4636-4346-8dae-3ceffc57836b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570812, "uuid": "f3449cdf-6552-4577-a537-4e58cece5e4a", "value": "213a7722_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ee8906-b9d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621561123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561123, "uuid": "a36db29e-c5be-4a9f-9cd5-72ef9558ba19", "comment": "Malware payload (Dridex)", "value": "36d034f39af77ff2f569493175d1861c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561123, "uuid": "bf38079c-c1da-4d67-ab66-262b9a1ca45a", "comment": "Malware payload (Dridex)", "value": "93d45645e9889e44453e787ee038a547f9cd713e6bbef59abcbad980d4219b23", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561123, "uuid": "05c00e36-ffda-48b8-8735-2d44130e3156", "comment": "Malware payload (Dridex)", "value": "4d6aa9fdfd397ccdff238a13323f40c47fe5dd27", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621561123, "uuid": "dc6259ca-d0b3-4524-95d0-d0db81da02fb", "comment": "Malware payload (Dridex)", "value": "762fff47b2e479265ff8db294522eb65eb720a1f31d8bd33bcefe1d184caf7eada15edef83b1c0e63daf0542cf6b1c78", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561123, "uuid": "11e8afcc-20b2-48ae-af88-8e23e3479285", "value": "F204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561123, "uuid": "35d55f8a-c82e-43b5-8be8-f79b6b5876df", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561123, "uuid": "317bdb90-fbad-484e-ad9f-fe92d187c101", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621561123, "uuid": "9c6b7abc-661c-44ea-b7ee-df54242eb86b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621561123, "uuid": "3252d3c9-2f1b-412e-963c-6563aee6080d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621561123, "uuid": "1fdb9e21-6dac-46ff-9a1b-23bbeef3f74c", "value": "36d034f3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7224e8-b9e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621569509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569509, "uuid": "8a351bf3-e305-4f22-9d25-64da1f2fc3c4", "comment": "Malware payload (Dridex)", "value": "ee4fbae39fee2db8b81bdce6052cb5de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569509, "uuid": "ac6e8df5-b062-4df3-9b96-be26a635a39a", "comment": "Malware payload (Dridex)", "value": "93e67c185a3898386bca9c430336fc235469baec6220358e652011ca33c9a469", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569509, "uuid": "6b9a4291-87ad-4b68-b83c-2cea631a093b", "comment": "Malware payload (Dridex)", "value": "403cf36c5759bea660fd697799a45b4e4f018e1d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621569509, "uuid": "9f8e5e4b-56d2-4cbc-aba7-8e77639477b5", "comment": "Malware payload (Dridex)", "value": "162b6fa8faabc3b7326d8621fedf5381809ec7d5774b3cf462286d9e3463062f6842bdee008e301ba0758c39c8b6e5d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569509, "uuid": "c8673190-5449-4b70-a395-80f54b8d191f", "value": "AD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569509, "uuid": "2f15aa22-48cc-4565-ad71-976fa967af76", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569509, "uuid": "68e3ba7d-4a66-41f2-a4c4-0c11f1f4b854", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621569509, "uuid": "651f7613-dbe7-4020-87af-d7cefbb1bd7e", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621569509, "uuid": "97463e0d-7d9f-42e1-8df2-862b4c9d21b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621569509, "uuid": "411ada58-c540-4e9a-8574-a4becd7d8714", "value": "ee4fbae3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b251c549-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566028, "uuid": "c6817ed8-9580-4576-b43a-ad4a823c939b", "comment": "Malware payload (Dridex)", "value": "5149bbc7781f3117cdb1df6f88811763", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566028, "uuid": "b516017d-3c2b-4ec2-89c3-0ee43365c3a5", "comment": "Malware payload (Dridex)", "value": "941ee6da777cdbeaa11c8447ad73ba48eb2b2ec480c09cb692040a5dd3ead874", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566028, "uuid": "711836d2-3d16-4ce1-af9e-5d9fe71e4c8a", "comment": "Malware payload (Dridex)", "value": "78ea5b724e55e0e90ada47d01e6dfe1b3a095878", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566028, "uuid": "32041da7-0bd6-4c8d-8712-6b8633e7b7df", "comment": "Malware payload (Dridex)", "value": "cafec39af512c5eb1342cc7c05722300f83969c1524d319f528c00c42ea2b44433cab0b9512aa31ba7d5ef6f63b103ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566028, "uuid": "bc2565cc-6adc-4d11-b98d-38824297529c", "value": "DC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566028, "uuid": "8cab300e-7fea-4c11-abe3-9df7e1bef46d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566028, "uuid": "2394adf3-37b8-46e5-a6a5-4ea6d80438a0", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566028, "uuid": "321c14a0-6906-4d15-bde2-4bae870dcec9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566028, "uuid": "00905232-f3b9-4a6c-a87f-fcfbeea2ef89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566028, "uuid": "8d69272a-5e6e-4191-a7d8-67f5f95136e8", "value": "5149bbc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ba75b9-ba34-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621601891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601891, "uuid": "1bd67757-bb48-4dce-8db8-2651c09f2f29", "comment": "Malware payload (Formbook)", "value": "6f3058b9069c9145d9b00138fa2ce5bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601891, "uuid": "f199afa9-5f80-452d-a80c-3745f87bd4e2", "comment": "Malware payload (Formbook)", "value": "9435bf4ae05e98f0e1b3fc55188dba5d50ac937cef36d69112776e39b8584ce4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601891, "uuid": "556ae95d-7f82-4639-9a10-0acbf592e5ee", "comment": "Malware payload (Formbook)", "value": "d1b08be6e2710d602054fdaf3d3010d084eafa4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621601891, "uuid": "4a23317e-fd8b-45a7-a0eb-8c6eaa201cc7", "comment": "Malware payload (Formbook)", "value": "37a579fc2d405dc212641a3bca2ae81ce507315dc481dab6a6c092c69eefb6a0be810868549b54345f9f9c584c7784b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601891, "uuid": "caf529b4-584d-4da9-ba6c-cd4bef15f59b", "value": "EA359DE06E8AB51DC02E6770342180FC93B33D22569CD7EB2AC7FDCA9B635514661BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601891, "uuid": "cc50b56d-89e4-4971-a184-9525ed01e849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601891, "uuid": "a7217056-cf03-462a-b0cb-8b707305f24f", "value": "24576:sEhajzK8hTbVK101xL+CrLJFrK27CfLc:czNpbV+01zG2SLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621601891, "uuid": "6563e9f3-0ba3-4eab-b793-777abcc1f9f5", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621601891, "uuid": "497724d4-1d2e-40fc-a216-a730008a5a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621601891, "uuid": "f0fff408-ddd1-465d-be58-d0f4ad19dc8d", "value": "PDF Purchase Order #RFQ7787HG00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09be8864-ba81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634894, "uuid": "42ad6e9e-5bdb-40a1-bb60-7c1506bbe7b0", "comment": "Malware payload (Dridex)", "value": "8b5b5580900b38ee7c595d741e35148c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634894, "uuid": "99e414fd-bad0-47da-aef3-acd210d492ae", "comment": "Malware payload (Dridex)", "value": "9494fbe2384396690fb50c9052f434f8ac459c541ac4b06565a23747d065c97e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634894, "uuid": "a46319c7-234c-4eb0-959a-056e98a3f989", "comment": "Malware payload (Dridex)", "value": "3ed9397409145eb9c829a7353af33a235d490fa8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634894, "uuid": "4dda02d0-860e-4c21-b651-052166692378", "comment": "Malware payload (Dridex)", "value": "5f80cd2d8e021de4ea09dea49aa0bfcd863e28d7773386772d765a5938d123117acdf362befb4dbc3f6e6881ded54610", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634894, "uuid": "5f028648-623d-4332-afa9-f5b9bd0fc425", "value": "31F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634894, "uuid": "c6d9350d-a0a4-49d6-b676-9c0fcfa94abe", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634894, "uuid": "40a42550-bc92-426b-945e-7ad5ad3d9ab7", "value": "3072:vA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:v3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634894, "uuid": "676cedc3-e969-41de-a935-ab9467399f19", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634894, "uuid": "506294f8-456b-45c9-8ed2-6f30bdc2164b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634894, "uuid": "ceccc906-ed90-496d-a13a-27fe03480904", "value": "8b5b5580_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087c13b5-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616853, "uuid": "fdd4e9a2-b041-4cf9-aed9-833c4f6e6a41", "comment": "Malware payload (Dridex)", "value": "138c237c377e85d6be8d3f0fa68f8c0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616853, "uuid": "a2de7105-18b6-477c-9953-869e51661d3d", "comment": "Malware payload (Dridex)", "value": "94e30cb95bde8231f2a361132d3d5d52d573335e4dcf26e9d89b7bff779d0273", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616853, "uuid": "3e0960b1-b814-476b-839e-96eeab68e0be", "comment": "Malware payload (Dridex)", "value": "8c42a85a7424315005387aec643439c0c9d2340f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616853, "uuid": "37e81a89-3fd6-4b85-9ff6-fd5210fc3a52", "comment": "Malware payload (Dridex)", "value": "bcacd9d271d6a464a350fe353442c83015e544e7d32250790c0c4d39d3103262b83fec597dacdea7b4f66242f9c26197", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616853, "uuid": "5b79bdda-ab98-42b6-8177-8b1d0e9f4c52", "value": "CAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616853, "uuid": "5ad765e8-717a-47e6-8e47-d3b7c12d4c49", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616853, "uuid": "58c850c3-426a-48ae-bad2-8ba57d88cd1b", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616853, "uuid": "77a72ed3-8be9-48a5-83b7-1ac87575332d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616853, "uuid": "cb4deef3-4789-47c7-b57c-434727aff261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616853, "uuid": "c7eee4cf-405c-431d-b11d-1a60a91e09e5", "value": "138c237c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edc9ba1-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555902, "uuid": "918936f5-1eca-4f57-bb95-1798a37fa217", "comment": "Malware payload (Dridex)", "value": "2e575c76e797a94f1e9854e751a1eb3f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555902, "uuid": "bd879f83-f2b2-416b-b405-a326a69409f4", "comment": "Malware payload (Dridex)", "value": "94f3fbe25124cb7c9928be86fc5f4ec00727b113d59a6bca65798eae12416529", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555902, "uuid": "93d86627-0941-4b97-aba7-1d20f2ef5be4", "comment": "Malware payload (Dridex)", "value": "17293e61220319daf4de288aead4d7a48342ec97", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555902, "uuid": "3c268d3f-a2d2-4385-b3b0-903672590073", "comment": "Malware payload (Dridex)", "value": "65d8066a1a1bc122f83c3dd093a54c7c96bd3a9e2a87923125c67caded1a7d875d1d21c951104c7fd9e3072ebf98bba7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555902, "uuid": "a074f156-1052-4cc3-b9a5-0a885f845cec", "value": "5104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555902, "uuid": "711653ad-7021-4752-b9e5-93a53a0b6b91", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555902, "uuid": "b4cf5752-5d79-46c1-8836-b86da2980a4d", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555902, "uuid": "1075f372-f71a-49a4-98cd-6052647e9aea", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555902, "uuid": "26c9308b-7bc4-4253-b5c0-fa05df855e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555902, "uuid": "110725bf-cfee-4d3f-b023-36c0e87c2db6", "value": "2e575c76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74534798-ba05-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581815, "uuid": "cff114de-6ada-49d5-be40-3bb0bde38807", "comment": "Malware payload (Dridex)", "value": "308aa3f5b34a104158ccf3fd1cbc2553", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581815, "uuid": "d4430daa-5ecf-4728-aeee-2a7070e44559", "comment": "Malware payload (Dridex)", "value": "959d4fd869e5f3d7370155c59e3b2b2dae5aa8c0db28bde751b328bea0495428", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581815, "uuid": "9aafb5a1-9ad9-452d-b5dc-c866fb35bcba", "comment": "Malware payload (Dridex)", "value": "cf53061aad397bf1587ec1ed9b80df50d365389e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581815, "uuid": "e0b809e3-86d5-4041-aa6a-226619486121", "comment": "Malware payload (Dridex)", "value": "ec0dac05b11bd196337baee90e5c174340acfac431afbb9b08cd7e7ffd07c9472277d33726524c780505791a61139118", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581815, "uuid": "dfd8f733-837f-459f-83fc-ae4abc87b222", "value": "FEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581815, "uuid": "a7854d4e-6e35-4b48-819a-84b150d9abb4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581815, "uuid": "6a6673d5-911d-46c3-b408-82a42d7889b7", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581815, "uuid": "741f5cc1-a6fd-4f29-8f8e-2e612dc49121", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581815, "uuid": "854e8fb2-9b75-4f9f-aa6b-18cb37f2cbaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581815, "uuid": "df9c5402-da45-4cdc-8ada-780243faf2d5", "value": "308aa3f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facb6578-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581182, "uuid": "b0eccc44-db5b-43d1-a8b4-98e7f941bb14", "comment": "Malware payload (Dridex)", "value": "0a288eedeac45fb7720254b1762a6dc0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581182, "uuid": "7d667993-c554-4d3b-8ef2-e92e964293d0", "comment": "Malware payload (Dridex)", "value": "95bade29b6bf4f03e82c7fc83cce68a8d14c3c8389992afe777c7352d6fce2ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581182, "uuid": "4bef86af-741b-46d6-8d41-fdeee893a3ea", "comment": "Malware payload (Dridex)", "value": "3d94f72889594c2a7835c090ba56a48bb56cb135", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581182, "uuid": "0c973d38-45f8-4ba5-9909-c6a0b8179807", "comment": "Malware payload (Dridex)", "value": "4b4ffddc4b6d7b001db3bf6605ee268540f20bff687cc0587ed6d03eaf20cf963dc94a14e714cad875447b04d87b1f24", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581182, "uuid": "2c43c8fb-b6d3-45d8-902d-8e4e81521336", "value": "B004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581182, "uuid": "69509f09-c1bc-463e-b0d3-8dae43777670", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581182, "uuid": "6f73c5e2-94c5-41f1-bd12-39ff19dd6c15", "value": "3072:zV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:zV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581182, "uuid": "34fa148d-fae6-4e53-9a9f-e623a1c41363", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581182, "uuid": "bb50f998-bbdb-4216-a013-6324e7a75959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581182, "uuid": "6bf1d7d8-bee1-4495-9700-5c4b7834de7d", "value": "0a288eed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50525249-b9f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621575742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575742, "uuid": "87f76615-890d-4f58-ba84-4a9ecc4b8ed5", "comment": "Malware payload (AgentTesla)", "value": "e04b583425e5b0ed5cc66532b897107b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575742, "uuid": "c2da1d0f-ab80-47a6-8a8c-34794401e8f1", "comment": "Malware payload (AgentTesla)", "value": "95f09e032a3c803a4104efd4bb56166edb75dcd7d4c872913b7c51e716cd5893", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575742, "uuid": "d72ad0a8-da2a-425a-bee0-21a28833550b", "comment": "Malware payload (AgentTesla)", "value": "fb37196453dc645419433e3e555e8a2c48bf1782", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621575742, "uuid": "a30ff892-491d-4973-b150-6b67ac0901a2", "comment": "Malware payload (AgentTesla)", "value": "3117a6c7b0826917beb5f4b5343332fc787b1a31fb6db58fbe45c26e16196331009aab2f87d1d8900db647bae6b68af5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575742, "uuid": "2b72f410-ccc6-4c6d-a8b3-03c31b1c9651", "value": "F615D0AC325475DEC86BD27ADE781C68EEF07467931BD10BA02700AD994C9C3EF615B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575742, "uuid": "185c18c9-5ab7-4dd2-9c09-d3e70e79108e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575742, "uuid": "1d16b425-8559-4bb7-bb0f-a4a1979389e6", "value": "24576:Dzym5kdEND+nAng1PX2aAJ50kKvBmbekF:DzaqND+n8A2jJ50klPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621575742, "uuid": "f7613d80-ad86-428a-a0c2-d02719a33439", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621575742, "uuid": "f4bf34b8-bc25-446c-a1fe-c77c80ba304a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621575742, "uuid": "c5fc15b3-0366-4fda-b638-a8634bb7d0cb", "value": "32A160705USD187,000,00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f92ef1e-b9fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621577056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577056, "uuid": "4e2c8579-c801-4b6e-afb9-77b92b5b759e", "comment": "Malware payload (Dridex)", "value": "25d1b7ad5fe7f1898d5600b7b9761912", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577056, "uuid": "2b3e1a95-a115-4288-8612-18dc797360ec", "comment": "Malware payload (Dridex)", "value": "95f9f871c48cc041d19257ffe877c0bf3a24da64271eb548ed82810b303d0a7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577056, "uuid": "88424f06-fe48-4076-b415-9e9e5ac51a36", "comment": "Malware payload (Dridex)", "value": "6ee9e505293b8360e147fa342812fd4dede6e93c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621577056, "uuid": "f46a4ad6-5c2d-46bc-8819-7dce01404d72", "comment": "Malware payload (Dridex)", "value": "d4e77e1eeacc6c5acaab0e6440a50eceda5861b64f4781d7ffd22ecae587ece89553ae09c002423746f4fabb8d9c4ecb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577056, "uuid": "4a407ac4-2989-4478-8585-5f894543e0ca", "value": "0904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577056, "uuid": "6fdd9432-17f4-4f0f-90a3-eb6bcef90573", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577056, "uuid": "b51141e1-4410-41f5-b53d-88d56babcbde", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621577056, "uuid": "0a719ef4-9092-4c89-8b3c-d1c2a817c863", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621577056, "uuid": "2a0fc42e-34f8-4e6d-9395-61827aadd4fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621577056, "uuid": "9a90f55c-3e5c-48d3-970c-7ea03b1c5e97", "value": "25d1b7ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b845da3-b9e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567680, "uuid": "6f00d4ca-2019-4be1-86f4-9854d24cf661", "comment": "Malware payload (Dridex)", "value": "0935c4a3ffdf692a5a214040a9006008", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567680, "uuid": "152c7f68-e83c-44d6-a0a7-1f959009b0fc", "comment": "Malware payload (Dridex)", "value": "95fa05992edc992c2f9b17551ba9e30b294f81106295c8d2f38ba0b66fe57710", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567680, "uuid": "28865934-68f8-46d9-a866-8a8bc7f8d836", "comment": "Malware payload (Dridex)", "value": "640ae667afc12f1caad4372e792fa478582b558e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567680, "uuid": "bc658f43-f43e-41ca-a018-3ccb3d3770a0", "comment": "Malware payload (Dridex)", "value": "e078c2fed985bb38491e0e4a4d64ac97c4046e13729fe09fe458e5fe3b11c4939758543484f0e3759ff65e1a5b406fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567680, "uuid": "fd8c7c36-1a16-4264-9d2e-c02e75c8f485", "value": "A904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567680, "uuid": "45acb0de-565d-436b-a72e-58d2f0b9d7a4", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567680, "uuid": "10c53d58-7d64-4b6d-b5dc-bedd55c13bf2", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567680, "uuid": "046efec6-8e5e-4003-a23b-996d9fe124c4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567680, "uuid": "2660177b-911e-4ea6-b4bd-cea76510e577", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567680, "uuid": "1044899c-f717-434d-b2d1-792c851ca970", "value": "0935c4a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bf9bce-ba57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616875, "uuid": "6f11c8b3-fd22-46b9-98ff-378dfbffa829", "comment": "Malware payload (Dridex)", "value": "7f78e3daa343cd8a2f409c9e94609952", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616875, "uuid": "5aa693df-8adb-4ba3-9933-9f21c3b87fc3", "comment": "Malware payload (Dridex)", "value": "96c9ee87478a569f533ec64c6105cd11480e566971e49e00978b623524354581", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616875, "uuid": "199383e7-ef36-422d-806c-87e3e320d631", "comment": "Malware payload (Dridex)", "value": "b160b80216f95724a390e837ab120d71103351c0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616875, "uuid": "ff8b2b27-6023-4b0a-885b-58b178a27401", "comment": "Malware payload (Dridex)", "value": "997b9c988503196509ed8ced953d899e145155bd3744eca53de5c189680015740a12da2c7e5c29dc81c6a47c388b9317", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616875, "uuid": "0cab82e1-eeaf-4ceb-aeb6-161d6455728a", "value": "D6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616875, "uuid": "d82fc7b4-d51b-4227-9a96-3312cee57deb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616875, "uuid": "29b4e5b6-8f15-45e9-82ef-d27550d51024", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616875, "uuid": "f3a19370-2156-4e19-a43e-fc91770039fd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616875, "uuid": "6ee649c3-6353-406a-8b3c-2f7a117ff530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616875, "uuid": "1f9864b9-12d3-479d-a054-3d2f817de46e", "value": "7f78e3da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734da542-ba2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621598564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598564, "uuid": "3e7bba92-a171-4ad3-a012-c7e2d512983c", "comment": "Malware payload (Dridex)", "value": "0d8531e8c72801768cf3ecef7464f7e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598564, "uuid": "0ba229da-f571-41ca-b0d6-6691ff8cf8a5", "comment": "Malware payload (Dridex)", "value": "96d7db7c4adf83ec3c6f782fdbe231d95abd81d34851c9c973cff45adf13089a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598564, "uuid": "9fe843e2-d513-4e25-b693-c11fa0243142", "comment": "Malware payload (Dridex)", "value": "8aeffe95a65842f5ba978bcecb4c384ed2dcd058", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621598564, "uuid": "cb49235f-9fdb-4678-ac09-6bed4cb56db0", "comment": "Malware payload (Dridex)", "value": "6e71344095d2402a8885892281545f8b48f829bcc38b7227ea6d090f2e4b79fb2f9395bb23be23caa08bdf322c84e988", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598564, "uuid": "1112f910-eac0-4b02-8ae0-d8dcf0ed7733", "value": "3BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598564, "uuid": "8cadf8ab-bf07-490b-9536-bd95bd38fd22", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598564, "uuid": "9e40e6c2-1b37-4f34-98e7-2ab346536058", "value": "3072:fiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:UeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621598564, "uuid": "93733c47-f51a-4401-8e1e-ef2e09b1f58d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621598564, "uuid": "b4f34c1e-28a9-48d9-8775-ed235788ba96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621598564, "uuid": "8c574196-2696-45d0-9e1d-76ceecdbf9a1", "value": "0d8531e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1096b42-b9fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621578454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578454, "uuid": "f5178a5f-9a2e-4d0d-8ae2-e50bcefa2723", "comment": "Malware payload (Dridex)", "value": "68ef6a1b8bd3ff189063466b249c1b43", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578454, "uuid": "d794637c-5e31-44b1-9f81-ca8b6a07c9f5", "comment": "Malware payload (Dridex)", "value": "97163452492001cd176e525a243e68645182655b5eb483aa26ec8dba98b52685", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578454, "uuid": "86b1bea3-8b87-4236-a483-a0455a0be6be", "comment": "Malware payload (Dridex)", "value": "06e5091a076eee098a454326683b6088c59dec93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621578454, "uuid": "d10b9658-a4bc-40b6-a208-1815c9f88d47", "comment": "Malware payload (Dridex)", "value": "08988a8682a70bba34ba0686c1230dd89767705d6d0d981b1ad07bca87362f69090a6c2c6043b6220280dcaf8e6f0179", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578454, "uuid": "45c7f049-4eb1-4a27-a51a-7974942b11f9", "value": "BA04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578454, "uuid": "21674bc4-57a9-4400-aad8-a50215390ace", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578454, "uuid": "8a266698-f433-4252-bcac-8a100dbb6af9", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621578454, "uuid": "32a07770-5f08-4bd4-ad85-6744188ab8d7", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621578454, "uuid": "a6fcf8f0-9c48-4717-92e0-58c11b4cc9b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621578454, "uuid": "262d192e-65fa-4da5-a162-c7209e036dea", "value": "68ef6a1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aa1c93-ba0c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584798, "uuid": "551dfc1e-8ed9-4635-98bf-bf64b585483a", "comment": "Malware payload (Dridex)", "value": "239f72572e58a9d900de1c055323a980", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584798, "uuid": "bfc9d4d9-cf82-4fec-b2a3-69a128b73819", "comment": "Malware payload (Dridex)", "value": "972b9dc1136dada68db19209181c0f830006f9e5d0aae6548fcadcf458e2abc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584798, "uuid": "18606ad7-526e-45db-82b7-b903bb7cbf24", "comment": "Malware payload (Dridex)", "value": "a5d742dc2b7c08c7412dfc9eec53815e85de4c6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584798, "uuid": "47f7b642-445e-41fd-a05c-dfa8bb3753be", "comment": "Malware payload (Dridex)", "value": "3cca5e1d4e7a6343fffe78c55e15696c170727bb53e86f68306a80d1cb0725a233b13bb98e262ffe8bcd3f0fc8790a7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584798, "uuid": "faa338a0-8127-44c6-8865-267b2fa0a218", "value": "C804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584798, "uuid": "c1f966c0-97e3-4d18-869f-04ab574a2220", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584798, "uuid": "17be131f-3884-4cf5-a81a-49f084b8e9b1", "value": "3072:EV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:EV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584798, "uuid": "48ded738-bc3f-4cff-adde-4860a7760cd8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584798, "uuid": "ec7c1fba-bf44-4079-b8a1-e7e96cb20b83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584798, "uuid": "9620797a-0778-4661-a85e-a5246c770f9a", "value": "239f7257_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03af32c-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621592733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592733, "uuid": "b6df53a0-18f8-4a51-a8a6-1d6e8f83c27d", "comment": "Malware payload (AgentTesla)", "value": "f0da1d32af69eedbd1123476cdaceeba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592733, "uuid": "cf85739d-a4e8-4529-818a-954f05c0df1c", "comment": "Malware payload (AgentTesla)", "value": "9780dde2830b70b9f5078c8f70678329b04d2e1e24ccf351b773677e7c2f93d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592733, "uuid": "66e55006-7b33-4eaf-81a0-8071051be7a2", "comment": "Malware payload (AgentTesla)", "value": "7ae6b5e887dde1bd537210ffa2c620f890dc8434", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592733, "uuid": "661ea1d0-f3b7-40ab-b220-024060e43970", "comment": "Malware payload (AgentTesla)", "value": "ae404d6153ffa1e6fa2db2bcc6953413b65c52db268ac85241e0642db3ea3f7adf5a8e15eb576feb4cde9f5b4c940de5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592733, "uuid": "224a336d-328c-4b21-a30c-6b07b0387594", "value": "23714B79004ECC10EB2D59D64710BC79863AB35242C3524D76DEB2C903670F9EFA7891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592733, "uuid": "9a3c311b-4dc7-4912-be92-4bb29e8610cc", "value": "96:jN5dLjcjYW22dxuthzTWkyzVkvukrngHpu4:jNPw0cSXWkI8rngHM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592733, "uuid": "d5fa2170-235f-4893-bd95-84ca3ef39f03", "value": 3527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592733, "uuid": "600921da-4d1d-44b7-974c-1bde80c86b38", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592733, "uuid": "d3be96d7-0269-45ac-a381-423835173989", "value": "Inquiry Ref S-400049-021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4967a7e5-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612237, "uuid": "24c7db24-2ef6-4fac-aa06-b5d262c34857", "comment": "Malware payload (AgentTesla)", "value": "833be45254c047371e0265408f8eb9e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612237, "uuid": "6c1dbe9d-f9ce-42c3-a889-50bd7b6cef94", "comment": "Malware payload (AgentTesla)", "value": "97dbc5858ce0766f2b27387dadc6487d67cd6444f0e91b3c89124bcaff42a5be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612237, "uuid": "7a3033ae-6e17-4104-bb73-7564ea952f2a", "comment": "Malware payload (AgentTesla)", "value": "8179d1c1a0ddc6703e451fcebea590ba6aabddcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612237, "uuid": "ec50072a-1f2d-4397-b0ec-378284313dcf", "comment": "Malware payload (AgentTesla)", "value": "2abce4cfab153f074b98702d5449236e2d18803595c00a678a9c1006396cde70e49d5c720455508ecb6c1bac20c8f4e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612237, "uuid": "5dc24812-1127-4225-af9f-0ffc36964881", "value": "7215E13037A99318E43F5B74147694D063F3B616FB15CB2E7D98018C9E63A928732BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612237, "uuid": "3cbc8e03-11fa-4722-a37c-cd35f0ba38a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612237, "uuid": "ef8b76d3-d34a-4d32-b496-41b446130901", "value": "12288:1nEhaM0KzisuUQD0+xzJICK3Oz9Ktg4OmzLP1NbgdreTa2Wv5dtXiCut/7XLH:JEhZNzilmCYt3nLP1NbGrKabjRuNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612237, "uuid": "42b67388-7342-48af-aeb3-0c5f92740af1", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612237, "uuid": "ec0ca6f6-abd5-4f56-b9d7-31a74981904d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612237, "uuid": "17c58367-b018-4a34-b38f-b2e8a0734907", "value": "Scan_Doc 98000000700000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f4d857-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584525, "uuid": "c66bedea-6f13-4467-87aa-517cef22c238", "comment": "Malware payload (Dridex)", "value": "e961d2ae0e20fb20176573410085109e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584525, "uuid": "501a2afb-6d15-4c03-abc7-4c3afffd2d7c", "comment": "Malware payload (Dridex)", "value": "98447316d2b5c137912b6452927a35eb132f75f82e9c18a8e21e31a25fdfd4ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584525, "uuid": "8d147234-0469-431f-83d5-638590188eff", "comment": "Malware payload (Dridex)", "value": "63abe83f2e4a3b9e8810727412628c4f77180c58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584525, "uuid": "cb8fc8fb-7ebe-41da-a1cb-f23fd919723a", "comment": "Malware payload (Dridex)", "value": "4735a5c45078f471ddc4c2b468f8f86c198fc2f86dbc29da269028176e518b6e4249a084f75f91cc951fbf397583ff61", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584525, "uuid": "e1942044-7420-4187-811f-b2cda8235d3c", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584525, "uuid": "be89a986-97e3-4247-a03d-c37caf8b3d86", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584525, "uuid": "9e2c7419-98a4-4a30-a74d-2c9bfedac5df", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584525, "uuid": "0a4909fe-899b-481b-a97c-91248c881444", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584525, "uuid": "4c3a9655-bf53-46fa-a803-6a43f871e868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584525, "uuid": "5f5415d0-de35-42ba-a1fb-1fc8e817a6f0", "value": "e961d2ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca5f939-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581050, "uuid": "dcb6a7a7-675e-4db2-8681-24f30f255bb4", "comment": "Malware payload (Dridex)", "value": "cd96f1a7e7d1559cd355bb01215e5778", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581050, "uuid": "2c828656-e13d-41bc-afb5-0690637d2fd8", "comment": "Malware payload (Dridex)", "value": "985ad6de143476083ae5d8d1ba0b80770939d820d9fbd499c25596e4241fd5a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581050, "uuid": "82f5acb4-e1ef-4fdc-9da7-abfbd677cb97", "comment": "Malware payload (Dridex)", "value": "834f13a4fdcbbba00ba11feb046f0b97174c4750", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581050, "uuid": "e37ce19a-e87e-426f-90b3-0661c4c419e5", "comment": "Malware payload (Dridex)", "value": "f677faa096dd5065f3cd1399b3fabeb25ed0e6bf4027d509c666b03015564b30a2171fc7f00af00dccb3481394fd4689", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581050, "uuid": "93eabd3b-6de2-4525-abf7-794eb33a39f3", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581050, "uuid": "9c3b1e2c-215e-49a2-a7a7-139a58bd535b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581050, "uuid": "78a00e21-c1de-4a00-a07f-d063f77a4db1", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581050, "uuid": "be9e6da9-df21-4f2c-98e4-55999eec49b5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581050, "uuid": "a1df64ca-eb0e-4169-9a30-f2b0a610aabb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581050, "uuid": "84d08f6d-77f4-430b-9f52-808716f5ec40", "value": "cd96f1a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765e842d-b9da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621563350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563350, "uuid": "499b4d45-aacb-4876-9995-ba46fdf7b614", "comment": "Malware payload (Dridex)", "value": "d3220e374fd6482735a6dcb5497a81a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563350, "uuid": "d1c70591-1b16-4b13-8593-983642e272c1", "comment": "Malware payload (Dridex)", "value": "986c46fa22345c6e86a9f5290e9eeb23f07b8126fde11d4fc76a7b01377324fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563350, "uuid": "fefb366b-ecaa-41b3-9e95-7c0cf7358373", "comment": "Malware payload (Dridex)", "value": "cbc042ec03a9c3a83c3bb13b2d53c237144ec4ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621563350, "uuid": "3692147f-60b8-4b43-9e9d-a37dd951b74b", "comment": "Malware payload (Dridex)", "value": "add0548f39139913858e69c835da4df2cb9ea9cb37855a3f638574fe92b3d5b0150a423814889b73a0be4b2863d0429c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563350, "uuid": "96855aad-ec44-45f5-8e22-2425f1c05adb", "value": "4504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563350, "uuid": "82112dd5-36a5-4d49-99fe-51f2014bc37e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563350, "uuid": "29ead85a-62f2-42f4-88bc-bf73c01ffd74", "value": "3072:oV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:oV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621563350, "uuid": "5cf3ab85-9799-4cf2-a375-130bf7de108f", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621563350, "uuid": "99a05d45-3ec7-4b69-ae4b-78798052f2bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621563350, "uuid": "6243995b-6fbc-4aaf-bcdb-e850fad0e54e", "value": "d3220e37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5733c412-ba40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621607106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607106, "uuid": "0add54ac-1a06-489e-9c89-9bbeac849c75", "comment": "Malware payload (Dridex)", "value": "b660d95118152bb1d2b4d8139e78a236", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607106, "uuid": "a1f069b0-38b1-4344-90c5-440c9f24ba88", "comment": "Malware payload (Dridex)", "value": "98a9f056799cc48c38977cdf436e67aa26232fc9b62c7ecc4364de64610da497", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607106, "uuid": "d3bb826a-1a17-47c9-84f5-04b98cb80ae1", "comment": "Malware payload (Dridex)", "value": "01754c8c02b119296726ce5164caa59149cfc8e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621607106, "uuid": "6a5d2ef2-db7b-4ec2-8d9f-592b5849916e", "comment": "Malware payload (Dridex)", "value": "595f12665744d3866657f450e5fbf4530d2be3e8c63ec250001d2b64dc4a4a4f32ddb80e45f54ca061a924842f84ea67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607106, "uuid": "5b901a43-f9fa-4dc9-8f6e-ba864926eba0", "value": "F3F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607106, "uuid": "6b9c9b62-0093-42a0-b191-19c3ce383c1b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607106, "uuid": "e021757b-ef90-41e4-bb36-81d22d0ba72b", "value": "3072:JA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:J3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621607106, "uuid": "c7fb86a6-7ff2-4440-9fd8-d86c92c61f80", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621607106, "uuid": "df97a90a-b2ec-4dd6-9c97-1598adb90161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621607106, "uuid": "3911998a-ab51-48ad-880d-7cbde04128b8", "value": "b660d951_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c31c5cb-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621613477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613477, "uuid": "acf786fb-fa75-4d47-a650-975d89f6b00c", "comment": "Malware payload (Dridex)", "value": "8566ff2b1744f906381dd51f19cc5531", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613477, "uuid": "e32482cc-fa13-409c-acf6-ff6aec73baea", "comment": "Malware payload (Dridex)", "value": "98cdb68b00440123374110657a8c93f0e921d6acc3c7b7d9511d1d9c98ede76f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613477, "uuid": "e2db2bce-538f-4ee3-84eb-93dfb5030869", "comment": "Malware payload (Dridex)", "value": "4f8c03aed00986d7f42f6bd325c3068d24d5573c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613477, "uuid": "3eb724f1-26f6-4cbe-883a-d8bc80310f60", "comment": "Malware payload (Dridex)", "value": "a524043aaaab402e667c349b2e7e410b2e9ce7a0812f56f3dbe1b263e17b4c89a71522e655f8a9fa51745e7d0c9ac593", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613477, "uuid": "4691502e-242d-4b68-89c4-96ad8be5f016", "value": "5704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613477, "uuid": "78291068-1f1e-4a1e-9165-bbf3606660b9", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613477, "uuid": "7be77eb2-be09-4ab4-b41b-9f66dee9f0fd", "value": "3072:/V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:/V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613477, "uuid": "b51e0511-eb74-4929-b1a0-9e9e29c21984", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613477, "uuid": "921443aa-bc16-45fb-83b1-c91f78adea2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613477, "uuid": "add5ba8a-3319-4eb4-85a3-12108445386e", "value": "8566ff2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca732e1c-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "4611f35a-0b29-4242-bb78-0498f0461430", "comment": "Malware payload (Dridex)", "value": "1592b78a3b86bb6331466ef3eac6781f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "4a147643-3c4f-429e-9747-67131dcb46e4", "comment": "Malware payload (Dridex)", "value": "99101d094f628fa0bc863a666a21261b3dce6a11674199a0d0c2848c1b7dd52d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "00cef590-6cf6-4b7a-88cf-0d27d71d92ce", "comment": "Malware payload (Dridex)", "value": "36f3b7ec97c05439d5255dab99b24a19b97018ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562632, "uuid": "c4b2cce6-1f70-48a8-97f2-400f06d43ffb", "comment": "Malware payload (Dridex)", "value": "cbf5d09f2251e1e6cb8f0b940d11e39b958700f3544689433428274a70dd80c82f20f25af708406dfd5b7430c4499d23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "cf85ba1d-b6f9-463f-8b28-a22dea03a701", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "c9479145-dcae-4247-a6c5-0318ff9446bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "17d2dd9c-29e5-41fc-8951-44846e97e477", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562632, "uuid": "7318dbc3-c4b5-49e8-8e50-cffa992a7bf5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562632, "uuid": "75e28276-dd28-4406-915c-5be393f11b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562632, "uuid": "a8120552-b9f4-47b2-8c51-11ed5fff43a9", "value": "1592b78a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312e460e-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1621613485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613485, "uuid": "d70ba510-08f7-4ea6-96dc-7313a1c2b840", "comment": "Malware payload (Formbook)", "value": "21f942eb973340f0b1948d929ff5fc6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613485, "uuid": "248093ef-ec4f-418e-99c6-c7a205aede2a", "comment": "Malware payload (Formbook)", "value": "993062780284d866c72f85069edee0bd933fbe3e18eae1f39f6cbf3898278ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613485, "uuid": "3f9845b2-1712-4d2d-a8ff-ba530da68caa", "comment": "Malware payload (Formbook)", "value": "6f9b6cc4d1ca24f79c03488695014e99bca55fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613485, "uuid": "e858835a-53dd-4d61-a776-181eda132388", "comment": "Malware payload (Formbook)", "value": "0d0a223b3ac103180f7cd4181205297d67f5df4271fb96f3b0797cd2edcd80c76a3c94a9472f22689a5667defbffbffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613485, "uuid": "a9885275-f0db-41c9-a25b-463a9747c27e", "value": "A7255A5A2154218EC59AD3F7D96C0C349760BC2AE6B68D0FD023BC5D7F7C5A39A20DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613485, "uuid": "52e24a14-4cba-453a-a40d-e462d0712195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613485, "uuid": "22a31da7-0312-4392-b063-ee776616ef50", "value": "12288:zKzKp1wKKCv6ePv5EXl9u7wyu9pkVVOjWsbwwy/iD1F8p3dNJ1NZIc8TyaS9UuHV:2zKrltv52lLyu9drYk78DNsTy7XSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613485, "uuid": "a3153e74-ca86-4940-8f55-0e4f965cf979", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613485, "uuid": "8e5fb26a-610b-4d67-bcda-8074201a01c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613485, "uuid": "3968c99f-488d-44d1-80f8-6fdc37e8b7ce", "value": "21f942eb973340f0b1948d929ff5fc6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067975e3-b9cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621558438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558438, "uuid": "95eaeacd-264e-4c57-a727-78986cbe85e2", "comment": "Malware payload (Dridex)", "value": "e0e2ce448bd3f2c4f74705b8d74e63f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558438, "uuid": "c55d1c90-36e9-4e6a-bb15-773bd5c0134d", "comment": "Malware payload (Dridex)", "value": "995c02a8e25b93c6f6c34face235d30a12ba877a24e5cb7078e710a86a1b8743", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558438, "uuid": "201c977e-d0aa-44ea-95f2-b19a453201e1", "comment": "Malware payload (Dridex)", "value": "8156007a733ad418b6dc3ae983e59c4bb0bedac0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621558438, "uuid": "415ca020-a331-47df-8805-4abe17bc4d24", "comment": "Malware payload (Dridex)", "value": "789b65a2803fb8e616553ec206cb2fdd946a7562ec0ce2feab750211f3c810f52d0e15c645d086034a7a9208f749e15c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558438, "uuid": "7976ebdd-dcd3-476e-8308-9e7c2be18bd6", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558438, "uuid": "71149e3a-dc35-472b-a581-80f8bd0456ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558438, "uuid": "066195fb-6113-4e81-a39b-fb595498dd70", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621558438, "uuid": "ae5245f6-5734-407e-b15c-bf780a6073d9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621558438, "uuid": "69270e63-3e0b-41e8-bb92-3dc385ef59fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621558438, "uuid": "a0ad1ca4-0380-47ed-8eb8-598afb9cf9c8", "value": "e0e2ce44_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17185547-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555459, "uuid": "d34ca498-9227-4c64-97cc-02aa3a463de8", "comment": "Malware payload (Dridex)", "value": "deba8c9f18336aa82debcf6469942037", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555459, "uuid": "7600ec11-0181-49e9-b795-3769709c089f", "comment": "Malware payload (Dridex)", "value": "9a00c9039221a2580b76e3c84bab6252a79f378e4e57fdf5f0bde0e3a681b22f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555459, "uuid": "11195452-a606-4657-b5d5-3259c85b6361", "comment": "Malware payload (Dridex)", "value": "0fee13b43945d3ec81acf35de42722caa28dd26d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555459, "uuid": "5d1a1d6c-14c8-4c71-8443-9a345182c975", "comment": "Malware payload (Dridex)", "value": "2882865941f943a66bc3a2881de9f18816962460ebbee83fa37fda3334cc5dc665595df44e5f5c3e227072ff6a9e9bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555459, "uuid": "1da5b1aa-48dc-40a8-a1d5-3ee2694e50a4", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555459, "uuid": "d1522cfd-fe41-455e-ac5c-57510522e91b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555459, "uuid": "5faedac7-15c7-4067-90ef-dd090f549b6a", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555459, "uuid": "54f8ba97-b9df-4317-b039-3eb70bfbd0f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555459, "uuid": "35171d5d-6557-40e4-94f5-a1e230618ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555459, "uuid": "b10910a3-8d08-4cd6-bb4c-d400cf71ddd8", "value": "deba8c9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb825341-b9e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567788, "uuid": "7c6f71dc-7a74-4d72-83bd-5d78cb351fa1", "comment": "Malware payload (Dridex)", "value": "07181ef6102b4473f0eebb5cb69c71d5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567788, "uuid": "801d822c-69fc-4d0a-9200-0c6d739d0b4e", "comment": "Malware payload (Dridex)", "value": "9a09eda6d41b6dc53defa4a26f2e1fa93787f40bd31ffe9b2ccae5b03123c3f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567788, "uuid": "e9ba8775-6e98-42d8-a34b-3f82de45e96d", "comment": "Malware payload (Dridex)", "value": "7e464fbf2066523a56e57b213744bfa3b1bbe5cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567788, "uuid": "97c01250-b23c-4276-9afe-1aedda189d34", "comment": "Malware payload (Dridex)", "value": "a82b014a278dcd7034ca79af400cd9b7920b3db97370339975b1625786e21a174c6ee1e98ddee926a0236f37c9e246fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567788, "uuid": "044efc5b-4086-46f9-895e-617cb193ce11", "value": "8404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567788, "uuid": "870c844c-7c40-476d-ba38-c71d7614d2ca", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567788, "uuid": "b6e33662-82ef-47bf-adc5-ea0e9e4358de", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567788, "uuid": "2d599d1d-e196-4a5b-9308-f4ce157d26ec", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567788, "uuid": "e04b53d0-1c63-4c19-9368-bd5dc6a29d36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567788, "uuid": "63cf2b6a-72b7-415a-a082-329c6531dcec", "value": "07181ef6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b2352f-b9df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565416, "uuid": "ca1c4106-c2bb-4c96-9d12-c4b292c9afe4", "comment": "Malware payload (Dridex)", "value": "b2d49237fdebde7512a6e391822bb83e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565416, "uuid": "2c96d373-c1c1-40e7-b61f-d6cf2dc5b459", "comment": "Malware payload (Dridex)", "value": "9a24a31a4a78124c05e3985d20640a68966bb67ed79434cc23ae4319d6f7cc6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565416, "uuid": "a3ea8b0b-99f7-478b-a273-1434a2524c49", "comment": "Malware payload (Dridex)", "value": "d85bce9ea7a0755781305a1280e0aedb9ffdcd49", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565416, "uuid": "63c86804-82e3-4fca-9ced-986c2d75250c", "comment": "Malware payload (Dridex)", "value": "b17f3ec6687b73eb4f2f380edbdf42682511b33f148a60d25f18b599f6bf2c61b61b729af68ddb1572e8ca10a7a3893c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565416, "uuid": "42a90def-fbed-461d-af55-f89d53e11911", "value": "2D04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565416, "uuid": "727ece85-70ff-49a4-a339-c28858519daf", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565416, "uuid": "2d6ea210-a3fb-4f79-9234-64042e3d076c", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565416, "uuid": "e351833b-3602-4133-9a61-b156b8ab31a4", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565416, "uuid": "618b1cec-7565-4cc9-8d37-635e64d59158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565416, "uuid": "cc84ab94-5029-4076-9c85-f0d4bd968866", "value": "b2d49237_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c15a353-b9dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621564138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564138, "uuid": "6b49f7de-c808-49de-ae66-661483fa9862", "comment": "Malware payload (Dridex)", "value": "7cfb6f6b28127c0ec8ba230db3ee54df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564138, "uuid": "c3a2dfb9-c4ea-42a3-baa9-58b773db7420", "comment": "Malware payload (Dridex)", "value": "9a24b85249e265808a481d43e76105e1b69308d0342d0a1fe13105e29028cf8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564138, "uuid": "f94f1943-e4d1-4602-ad18-86279fcc8950", "comment": "Malware payload (Dridex)", "value": "82918a004f6b4dc9be070df35f43f9dc21880ce4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621564138, "uuid": "f29ccfc8-8bd3-4048-a8f0-f616de0d9477", "comment": "Malware payload (Dridex)", "value": "fd6cbc3ac0279ae46fa976f8716229bed0814dcd82505a6355ce3dfe45fe390ddc407a754d63e612eb902692270c3e67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564138, "uuid": "26469c26-bc5f-48a9-879d-270be4b689d5", "value": "6704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564138, "uuid": "b9697e36-c48c-4f34-babf-b68aad326544", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564138, "uuid": "d38b940d-5c21-4c6e-9f92-ee8a75fa5109", "value": "3072:MV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:MV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621564138, "uuid": "8b1d33f9-55c3-429c-9939-062e83683bb3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621564138, "uuid": "a6a4c00a-8e7d-4ae2-a72e-b9d5d712f848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621564138, "uuid": "beb0a502-6349-4c93-9323-82d0cbc05d7d", "value": "7cfb6f6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652eb5ed-b9c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621555590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555590, "uuid": "a48fd0bd-fc73-4434-b8cb-6196f71c71c1", "comment": "Malware payload (Dridex)", "value": "5d3118a6852775704f2f34a2f2d5e274", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555590, "uuid": "c6417d03-c012-4c0a-be7b-a6806363cdf3", "comment": "Malware payload (Dridex)", "value": "9a7093aa2ce39424e2d34226a010ca8f8abb0d0042a0f942770acbf7d6905c37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555590, "uuid": "2abe7d14-110d-4e1d-abce-923926dcb791", "comment": "Malware payload (Dridex)", "value": "206e205a4f92001dce9dbc6cbdd6f6701b3d7a8a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621555590, "uuid": "41f5ede6-1ee9-44a4-aab7-d5693ca9a2c9", "comment": "Malware payload (Dridex)", "value": "c7f86ca48cc0dc4ff5a35277c8d0e8ca90b56ebd8dde3cae5d9aaea2453c08b3061718a776672a099e753711c8c2e661", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555590, "uuid": "c9e5decd-0cc1-460e-8371-52c3953f6cd8", "value": "2604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555590, "uuid": "c997c2c3-0766-4913-9740-af017ce4b61a", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555590, "uuid": "37bf5d83-cfa5-4f71-a450-53ed3b7ef179", "value": "3072:KV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:KV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621555590, "uuid": "2f78348b-0018-471d-b053-6bb3ee9ae317", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621555590, "uuid": "1fe55c7d-90ac-4237-9034-17721e734238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621555590, "uuid": "242b47c1-1c35-4744-9c8c-e13c723ff686", "value": "5d3118a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38963cd1-ba6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627241, "uuid": "6b83cc8e-eb02-4114-add2-20682fc8af7c", "comment": "Malware payload (Dridex)", "value": "1fd5e27f1c9353da2b05b2962f789f46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627241, "uuid": "4eadf213-1263-4f50-af3c-4215750cb888", "comment": "Malware payload (Dridex)", "value": "9a75e2f5069bef0495343dfdfe067658ded9bc6aed30621acaf73a7fc1698b0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627241, "uuid": "1b9c139e-bb90-42dc-ae68-0c489e0cbc52", "comment": "Malware payload (Dridex)", "value": "d45e02947826608db05eb1dea54a15736fee67ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627241, "uuid": "5ec219b4-07a7-404f-95bb-5f47c8f52105", "comment": "Malware payload (Dridex)", "value": "f69bbc0ffc3bac7f4882098c35c0a78f784ba61e1438669cf7e2f38a381f194777394907b2ee90b5abeca2760cbe3574", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627241, "uuid": "05ddc9b1-9d69-4d0b-82e3-a0de60f041ec", "value": "ABF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627241, "uuid": "d1b22b16-504c-4076-bd6d-60ba34d93e98", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627241, "uuid": "a6a59ebf-74fe-4523-8a49-39a7cfedd366", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627241, "uuid": "f1b687bb-3dc7-4e92-9e43-ec8c1bb454d4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627241, "uuid": "0964776d-b34a-4a98-9a04-4e0035e4e60f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627241, "uuid": "7d980baa-8c87-4cf7-91cb-9dbcafc8c6ae", "value": "1fd5e27f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ca531c-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562517, "uuid": "f9d2bd74-1876-48e4-a0de-010803b9adb0", "comment": "Malware payload (Dridex)", "value": "6839e96cdddc61a5342febdaf068861e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562517, "uuid": "8b9a29e2-e53f-495e-80c4-4dca07112415", "comment": "Malware payload (Dridex)", "value": "9af60626246b7e18479eaefdb6c101f2a9d589ba320483b08281b8a6848053fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562517, "uuid": "a1af2d76-099c-4a01-aea3-0fb0f2072a9a", "comment": "Malware payload (Dridex)", "value": "8e6b8a077fad4d32d2863fc143859e8b44a68fa2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562517, "uuid": "85a78906-b48b-40e9-b8a0-c43d1175f7b0", "comment": "Malware payload (Dridex)", "value": "80f610d49fc32c91f9793be77a78fcb7a368a6bef8041c95a9d3d2f027ba74f616fe198231a396620d6b5e2a244572a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562517, "uuid": "8f84fb55-cf92-453b-98ed-1efabd9291c1", "value": "AE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562517, "uuid": "6d0b5a83-eb59-4b3d-b04a-a7576bce3015", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562517, "uuid": "fd654689-e6b5-459f-a866-375de34c4770", "value": "3072:1V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:1V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562517, "uuid": "b37089f1-07bf-409f-b7e3-bcc9aed9e488", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562517, "uuid": "cdecdf6f-9ef1-417c-9980-54557da26d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562517, "uuid": "e762909e-66b2-499f-bd66-86fef9ed4d90", "value": "6839e96c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cb19fb-b9e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565971, "uuid": "6f16de4c-1227-45f1-8956-c706fa7b9d12", "comment": "Malware payload (Dridex)", "value": "ec48495569ffee1a6da1cbdb81c193d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565971, "uuid": "d3c36ac2-4e01-41ee-8ea3-d7f5fc502f07", "comment": "Malware payload (Dridex)", "value": "9b288b0dc7e1fb383874da5aa64c85ad326e922070933548c790eede8736bba5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565971, "uuid": "b362d60f-42ff-4ba8-90ea-b938b141e85b", "comment": "Malware payload (Dridex)", "value": "e0f4e7b698aaeabba1f6d55d8da859a3e93d08dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565971, "uuid": "de5e6002-6ffe-47b2-a7db-7532ab45f587", "comment": "Malware payload (Dridex)", "value": "4f64d7182be97291dcf9d99898a3090998badd06ccef664592c2be364da2771b9e5d12ee480a5e5b681886ff7e83d914", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565971, "uuid": "7d845846-246b-4dd0-8f0c-bd0fea0f96fd", "value": "D5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565971, "uuid": "bec58fd7-31cc-4db3-9bff-2c0af2cd1506", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565971, "uuid": "d06cb272-e0b4-497f-9608-961d2874910f", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565971, "uuid": "c2d2d975-3e8f-4490-9357-30e69fdc9697", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565971, "uuid": "30ebccee-36fa-41f9-b637-45ce46f68aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565971, "uuid": "5f02a21e-dea8-417b-8bf5-3e937ade1fa5", "value": "ec484955_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5027faea-ba2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599364, "uuid": "b00d80ae-a7ea-4651-a505-7e27da83d45b", "comment": "Malware payload (Dridex)", "value": "a36cf84c2f94ee41e5015a4b177c9e0c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599364, "uuid": "8fd7524b-7dd3-4301-93aa-314b800f7ba1", "comment": "Malware payload (Dridex)", "value": "9b57011752ffb400aa6062a6084ffbd2983cce97b6369077245159cd307436b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599364, "uuid": "d4408fac-634b-4c95-b958-1f497a6ef071", "comment": "Malware payload (Dridex)", "value": "939d75ae87e750a89f3f06c98f5bc6162143972f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599364, "uuid": "c9af63f2-51e7-42a9-b07c-341c1c0eced1", "comment": "Malware payload (Dridex)", "value": "6bdfc3a52d0d81ed491db15fe2672a194ce85f8bc1c660588c0397b0dc0d5ae56953403599557d1380d60a97e969ebfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599364, "uuid": "bd0f0b20-49d6-4f04-967b-33c055607cac", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599364, "uuid": "cfa426a2-6d4f-44cf-a906-96090dee18f3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599364, "uuid": "413f9585-9506-4c4f-b908-cedaf6592bf2", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599364, "uuid": "1adccec0-5fa5-42b6-bc13-749ddbd843c0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599364, "uuid": "4c8967f6-86c0-4f79-b0e0-fcd18658ec4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599364, "uuid": "6a32e583-d643-4502-a29c-96d55044d538", "value": "a36cf84c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb97f3b-b9e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621566849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566849, "uuid": "4bf07850-0c6d-4d2f-9f3d-53cec4923331", "comment": "Malware payload (Dridex)", "value": "f5b64322552e625e4d2276332aabed74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566849, "uuid": "9646f389-f0ff-467d-9abe-7af7b0f1af05", "comment": "Malware payload (Dridex)", "value": "9b67c71b4814e439f3c6c2456f23fb172c882dcd6b253dc6880dfe9a6c70d310", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566849, "uuid": "c39a1d33-11b7-4371-9a31-279c66e4a750", "comment": "Malware payload (Dridex)", "value": "a935071e3f282d5d10b96cce19de42f5acfd2f78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621566849, "uuid": "0eb69ebb-b807-4794-bd63-c81f77c25aad", "comment": "Malware payload (Dridex)", "value": "d9a02a3591e3414cb8f19fa29fdae8fcdbbeff42a9d78425578c908395894b47387eabbe1f783480aa710ac69f067178", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566849, "uuid": "65d1f113-3205-41e2-aea0-d6cebc6a24ae", "value": "9C04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566849, "uuid": "6aa7a6c4-2ef7-4695-b47d-e0823c3a15ab", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566849, "uuid": "c86c64e9-67b4-446d-aa08-f65a3394ad2c", "value": "3072:+i49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:+H9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621566849, "uuid": "2101950a-3d78-41e8-884a-730031539a5d", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621566849, "uuid": "c2efcec0-05cc-4c0c-aa05-925a393e771e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621566849, "uuid": "f05e279e-0b29-4f66-8279-7945f9d5f18f", "value": "f5b64322_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da2d6fc-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573670, "uuid": "e35c510a-f5cc-48ec-b3d5-11979eeb42e8", "comment": "Malware payload (Dridex)", "value": "4fe5c4d9e9176c6175f5ef48c3a9f48e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573670, "uuid": "a6a378a1-a7e6-41b6-939b-f8b02a1155b0", "comment": "Malware payload (Dridex)", "value": "9b79dfe8b53581c926f3d394019b5a5a74391c8a4252a0458a8e13a5b30e54fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573670, "uuid": "f82512af-ae1b-4366-aa7a-1f3ff5bc2012", "comment": "Malware payload (Dridex)", "value": "7bfce7afd942bc7bc193b2bc630d7a240800377e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573670, "uuid": "239c3c5f-e1d0-41c0-a568-9febc8f0fa6e", "comment": "Malware payload (Dridex)", "value": "45371dccb512baacc6b32d4fcbbcdaf24de78924eb60d08fa89501a466afbf73bf2084bb063cca59521998550ba41b42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573670, "uuid": "a77b0259-e614-49dc-9c63-1bad2d717a42", "value": "E4F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573670, "uuid": "6844ac46-6245-4a35-b50f-ada3a7974019", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573670, "uuid": "c9bcb5ef-9f7e-4c1a-878c-079d8e718354", "value": "3072:DIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Uc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573670, "uuid": "b219a10b-0340-44f8-8411-6966145971dd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573670, "uuid": "67cc6938-3dd5-4d84-8485-34b3aea7d6f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573670, "uuid": "039b8470-65e5-4fb3-b22e-8484d41753a3", "value": "4fe5c4d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7318c449-ba63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621622186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622186, "uuid": "e03a795b-5d82-44f1-9c65-305af7def507", "comment": "Malware payload (Dridex)", "value": "5b2124d6954a7945990f3089b2d2d7e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622186, "uuid": "a1988ad5-84a3-417a-b11a-89a6065e64fa", "comment": "Malware payload (Dridex)", "value": "9bb1afd7a0d96697c5d1b483c7163de7c9c5e1014f18eb547c93ab1dda5d3420", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622186, "uuid": "ad73668e-cfba-42d9-84e3-5e980e5895a4", "comment": "Malware payload (Dridex)", "value": "6af77f23e6bc875b8ad65eb8bd584a49eab3a801", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621622186, "uuid": "20470b5e-6b25-4bb0-acbd-38ce2e925620", "comment": "Malware payload (Dridex)", "value": "d0b75fcd4340a5c58246f03ee242cfa6d70f31ce8e990d3cb417d22605ddd1261dc12d5c7a55f3f51d373585d59a00ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622186, "uuid": "52b17f59-fc54-4288-9852-a62b38716c2c", "value": "00F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622186, "uuid": "c5ed0cb2-78e6-42ab-acb4-09e13d0c0c7b", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622186, "uuid": "6c350318-3905-4e82-9f13-1bd157361424", "value": "3072:T9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:T9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621622186, "uuid": "8ac1596f-087e-4df5-bc2b-f236eb2042b8", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621622186, "uuid": "8e49ed0a-c275-4dda-870e-5b20ac3770b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621622186, "uuid": "b9e48fee-c10a-4a3f-9b0a-c3c47bbfa443", "value": "5b2124d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871df2cd-ba71-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621628232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628232, "uuid": "f73cc3bd-4a01-4923-a25b-752f77949157", "comment": "Malware payload (Dridex)", "value": "a9a624bd1307b683d0427bb0a5c76f39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628232, "uuid": "cbc59571-db05-4c90-a84b-0656cc889dcc", "comment": "Malware payload (Dridex)", "value": "9be3d11f065180df23cfd38e1be6ab4e7224ee73264f035f0c2dfeaa11caee39", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628232, "uuid": "b33d9e09-2137-4634-ad3e-0d79993b4b13", "comment": "Malware payload (Dridex)", "value": "93cbc0f0fc9db6fdbd5dd5e2a7c65f7b4379773b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621628232, "uuid": "ef986a7e-f375-474b-84e0-1d187d0f42b7", "comment": "Malware payload (Dridex)", "value": "8b5df4da763d130a004a9b5b6154135da9589055d074973600bb872cb56d2ccad88422ab1f6582cabffa6459ce9c1d19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628232, "uuid": "36525391-6be5-43cd-bcaf-76d7e8f70f0f", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628232, "uuid": "debb4419-9bef-4bc3-aecb-6bb786e26601", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628232, "uuid": "4f62442b-e2ef-48d7-82da-b3c3ae3206f4", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621628232, "uuid": "51c5db96-dac9-4b16-b98c-c476c0f8503a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621628232, "uuid": "0a1ecdbe-dba1-4949-a261-0a99b7b2aa86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621628232, "uuid": "08af3c35-7f0a-4e45-b50d-07ac8c491325", "value": "a9a624bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c61d18-ba39-11eb-abe1-42010a9c0039", "comment": "Malware payload (StormKitty)", "timestamp": 1621603970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603970, "uuid": "ace60a95-24af-41ec-9bb3-6992c2eb6233", "comment": "Malware payload (StormKitty)", "value": "e168160bdbccec40c97897878f5c9568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603970, "uuid": "3ab8d8a0-c8a2-4d64-bc34-c2e569cea812", "comment": "Malware payload (StormKitty)", "value": "9c1cebd2549add4ada109cafa5e0101aa98fc68ad14b5133ea041ee3d00301f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603970, "uuid": "41053713-fadf-4ea3-b511-83591fa097bc", "comment": "Malware payload (StormKitty)", "value": "1e102f30f06b73669d7cfc1148393f78bb7d20fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621603970, "uuid": "77b6a27e-a0f5-419c-ad76-9b69d80237a7", "comment": "Malware payload (StormKitty)", "value": "f9959513fbd4ed7e4cc49f25d4b97d232e1cc32ff6ba4fd739589e9323d34648466d97310191c8c77068de85800864e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603970, "uuid": "3d7bc81a-b6ec-4aa1-8082-c973ea4b4689", "value": "E463174177EC9220F7FF8EB9A870442407B2B827AD22E71D1DC5609D1A33B9495A5FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603970, "uuid": "7062c0f7-e938-45a8-b1bd-f6fc49922fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603970, "uuid": "0b33a966-932c-412c-8942-557200d46dfa", "value": "768:4b5fzfrnTjUzYZzZbvINP2hTlCio1cIBB6zTTCkvbIcwlwLHT1C4kh3ZsXULI9eN:W5bTnBIrio1cKeTDvbIcwqdUEPR+pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621603970, "uuid": "05a37c21-fdad-4a71-a870-951d4f323883", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621603970, "uuid": "4ce6947e-08f0-444b-b9dc-356fc87ec3ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621603970, "uuid": "57fbcb76-3c3e-4dee-8320-b69dfa0d7a91", "value": "ChromeRecovery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c240d9-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573581, "uuid": "da7a7b69-09cb-4aaf-a8d7-02d5b388c0e7", "comment": "Malware payload (Dridex)", "value": "1aaa49e4203b6fe2d39a820c65719d2c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573581, "uuid": "e4349082-0b4c-4df3-b58b-3cac7e51e4aa", "comment": "Malware payload (Dridex)", "value": "9c5ca559000aaf1ecb79120951ebe5d9061951c1b48345e77aee1c02a3b7108a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573581, "uuid": "63b26741-6a47-4d88-a3e0-2d66d58f51c2", "comment": "Malware payload (Dridex)", "value": "00be05446a17c0b95f23338866f02d035f06cb76", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573581, "uuid": "6b8349a8-0f1e-42cc-8287-f79ca150369d", "comment": "Malware payload (Dridex)", "value": "3f5c641da857e0fbe61780112872ebadf9b23a8c1b28f302f64332d974f81556af42ed89c25b57afc0858f77751e13ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573581, "uuid": "7faa9e3e-f7a1-4984-b792-6f5f82be5c3f", "value": "9104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573581, "uuid": "e00e9851-1378-428f-a99a-caf283e5da7b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573581, "uuid": "127bdd87-b265-4d51-8e6b-e605d4c5bbd7", "value": "3072:TV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:TV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573581, "uuid": "45100b2a-9bca-46a1-881d-8fd9b54c1b08", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573581, "uuid": "741b2a08-4b97-4223-b71d-2b0a17b85c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573581, "uuid": "433155c7-1f42-48bf-8fca-d7947eaf7674", "value": "1aaa49e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c9732e-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611907, "uuid": "8b2b7d63-0f1d-4a66-ba92-60c808d0be15", "comment": "Malware payload (Dridex)", "value": "e877eed02a784559c6f47a188e027fa8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611907, "uuid": "3704dc91-0937-4652-8fb7-1770250987a2", "comment": "Malware payload (Dridex)", "value": "9c5d8bef26c2f0bf186c93b359c86528322e2ad84d35a9df6f3ee126675959db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611907, "uuid": "ee8bf2ef-b950-4b91-809b-f215c5f64133", "comment": "Malware payload (Dridex)", "value": "fd791c6144eb6d10154ac1543c451dfade8423c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611907, "uuid": "b790604f-bc2c-48aa-905c-932339fa134b", "comment": "Malware payload (Dridex)", "value": "d02fdbf5bec982cf0d468ff48efac8fa7f2aa5cbf7df9581525386c3334790df1061d9acfbe38183a35290e106d084a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611907, "uuid": "ad089c87-4851-453c-83a0-7e4d100359ba", "value": "A4F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611907, "uuid": "48c1eaaa-900d-43e6-a7b5-0a580a3c2024", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611907, "uuid": "784a6017-e301-40b0-9d3b-3fdb11e8bdc5", "value": "3072:T9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:T9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611907, "uuid": "8a3f33da-c2e7-4a6f-8c24-a92c9ee06419", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611907, "uuid": "6c00f126-05c6-4cd2-bcfb-62eee5422c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611907, "uuid": "1ed9ebd5-613b-4c56-bb46-57bdd5080455", "value": "e877eed0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8d2c7-ba68-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621624265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624265, "uuid": "2a6daa72-326d-47df-9478-4b480d5e63d6", "comment": "Malware payload (Dridex)", "value": "8f39309be6939aa5032b5da41abeda05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624265, "uuid": "ea10a5b3-efa7-4072-a6ab-16b8482ec8bc", "comment": "Malware payload (Dridex)", "value": "9cd2f7f133eb0644162525f8832c2a732673d773e09003667b7430bb317bea1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624265, "uuid": "4ce67645-e2aa-4e94-934b-542bcc7cb1f5", "comment": "Malware payload (Dridex)", "value": "85bb41ac7cdd24324b63d8f7d760dbabbabb137e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621624265, "uuid": "6d19aaf3-ad04-4e55-b030-f9e41c30c4d5", "comment": "Malware payload (Dridex)", "value": "f51f7a733ac83e1ee9fe3eaf290a26b86248972f13185e0b13b88b8f7af0770447b58c350977743f83c8251a18354464", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624265, "uuid": "7e1ca27a-a011-4d7c-98fc-0c472a67f231", "value": "0FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624265, "uuid": "47b839bc-00a5-49a8-bec8-863a220e4ed2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624265, "uuid": "8ea6dbe6-9777-4324-9b6b-fa6aaa0d66f1", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621624265, "uuid": "53641b71-15e1-49ac-a6af-2ca891af6d7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621624265, "uuid": "b8eee410-6e0c-4a8c-8fd0-f962c1834caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621624265, "uuid": "3f2c0f93-6918-421f-83be-955baa08c24e", "value": "8f39309b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72382cb0-ba62-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621621755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621755, "uuid": "2bba6bef-d365-4c54-a59e-b28ef80dcc4e", "comment": "Malware payload (Dridex)", "value": "ac2f6683a2710db08c72b2012a7a0444", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621755, "uuid": "e04422c3-60c0-47b2-a50f-61bce9a10bb0", "comment": "Malware payload (Dridex)", "value": "9cd6cad92e5b5c1d049e9b9d6a2c9f7826341ff57eac1f232928b8f035ba3464", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621755, "uuid": "0bd6ff2d-e2c9-4868-8eda-fed5087918dc", "comment": "Malware payload (Dridex)", "value": "44fbfff012d137c034dabf5fc1d0d587c9408875", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621621755, "uuid": "77f654d2-8854-411f-bf15-fb28f3e644de", "comment": "Malware payload (Dridex)", "value": "055f8e49bdd0d910ce442cdf4700a7a723b8c7de904206ce4b971d788f593d7cdfa969e51b5b53a94ee8ccf2b20c4b19", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621755, "uuid": "cbacbb57-6241-4eab-af93-fa3ba2d9f709", "value": "3CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621755, "uuid": "ecfdfc53-fe5c-4258-9a26-d6c323d7bc85", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621755, "uuid": "d69589bc-d699-48b5-b8fe-dc28165c39d1", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621621755, "uuid": "140acca9-a3ac-489a-920f-9737e51bfcf1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621621755, "uuid": "3e9a023e-8cae-44d7-8ace-047d3c654c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621621755, "uuid": "82d1a1b0-ff44-44f9-b15e-ef24740ac85b", "value": "ac2f6683_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727c7c7e-b9e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621567638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567638, "uuid": "ed0b83c5-8d2a-4e98-8aa5-90efeb4fa1a4", "comment": "Malware payload (Dridex)", "value": "94296d5ec64c8b3bca25f7a25b9bf0ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567638, "uuid": "ef055f81-2b61-4114-9a8f-0574b4fc6450", "comment": "Malware payload (Dridex)", "value": "9d6b9c7539a7f6aeea29d3d909e0961f6b5f760e9f92a3fa966149bc58bd76c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567638, "uuid": "9ebd388c-b0cb-48b2-bd66-ad9deb56dc2a", "comment": "Malware payload (Dridex)", "value": "6e69d114545f27a9aa7efec763414ef7058de5ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621567638, "uuid": "6c60ee6b-54a5-47fc-9408-3aea19ce9bb5", "comment": "Malware payload (Dridex)", "value": "dd02743af2153fbd17456d1444dd430c9472b64bc30452e5d538d7cda735dc48c7ce7473e3a358260d605d178904f4fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567638, "uuid": "f2cde2d5-56c2-4be2-8202-e8ddef8b0f3e", "value": "2104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567638, "uuid": "cbe83284-ab98-472c-837e-925e2640c4e1", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567638, "uuid": "be6d1625-b8e6-4a3e-98d2-a539097a8064", "value": "3072:4V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:4V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621567638, "uuid": "88f3ef1d-d5ca-4eac-a66e-43363fe05e27", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621567638, "uuid": "87e500ea-951f-4cc4-93ae-34ed9016ba77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621567638, "uuid": "def77dcc-5a08-4c7f-9967-b4731e71481a", "value": "94296d5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db8bfe-ba1e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621592422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592422, "uuid": "99c5796f-abbe-4eb3-8f3c-f6b914830504", "comment": "Malware payload (Dridex)", "value": "5c915e7ed137d0423c7ce25bff030ad9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592422, "uuid": "42cdbe41-61a3-49da-ba3b-171dfc185378", "comment": "Malware payload (Dridex)", "value": "9df48d66bd7e356a2d048e6e45d0702c6fd4822278a1e57c272d8236db2f0e90", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592422, "uuid": "e77e098f-52e3-4ad3-b6c3-ce5a920bc58f", "comment": "Malware payload (Dridex)", "value": "ef96d9d8ea1922178b9bf8484dd4851607f31d8f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621592422, "uuid": "758ca911-33f2-4426-92ab-e7579b923722", "comment": "Malware payload (Dridex)", "value": "3ae36881bfab75dfd7811055a5e93ef33417aef37393587c1e9b4c6b507c82ad49e7e63ea028dc558a27fb2c6f048da5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592422, "uuid": "6380bd73-dd73-4a5a-be75-35ba18f07e6f", "value": "D004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592422, "uuid": "3982befa-2e15-49fb-b8f2-809a7ecf91b8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592422, "uuid": "aa8c3fe7-adab-478e-a02a-f5e99b7e98fd", "value": "3072:lV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:lV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621592422, "uuid": "4f03eafc-09db-46c1-90e1-d1fd53be2605", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621592422, "uuid": "fef45d8a-4301-48f9-aeee-f3db8eb68b1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621592422, "uuid": "b4b8154d-73c8-47ed-a2dc-fd90aa4bfeda", "value": "5c915e7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11537d5-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571287, "uuid": "c0079c3f-6379-4914-b012-902cedbbd6d3", "comment": "Malware payload (Dridex)", "value": "8d76b12a8a7b20825b6c65964236156e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571287, "uuid": "c386961c-ddc8-475a-b048-081b316944c3", "comment": "Malware payload (Dridex)", "value": "9e08c86af6dd904097b90289e9beb62b2ba5561325ef9eb689fc4a36fb143169", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571287, "uuid": "f69efeb9-e064-4d1f-8659-007e053d30c6", "comment": "Malware payload (Dridex)", "value": "d6d80e66ca3d1ad6360955335d4d2a1eca7f671a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571287, "uuid": "7419a220-6983-4bf8-837a-f6fe9b5f5eb6", "comment": "Malware payload (Dridex)", "value": "110e323bd775085252b11ccd34539c2e5dd7fc9ad5f0962f7078ca146d5735860f02e0eb6cd4358fdba7febe8495f00b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571287, "uuid": "9f92bf3b-8a4e-4448-a6f2-c07dfe17fdb2", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571287, "uuid": "db154657-e998-47c3-9f42-b7d9f8a6b730", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571287, "uuid": "280020dc-24c4-4ab5-82a5-fafd22d94628", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571287, "uuid": "6145f307-86f9-48b0-9a94-fdf4db3793cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571287, "uuid": "084c9fc5-eb35-48b2-a3df-d218f118c635", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571287, "uuid": "e72dc2a1-22a8-4d45-8bff-5bc8f40e2151", "value": "8d76b12a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaf0ebc-b9f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621573778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573778, "uuid": "5a9a4b81-b982-4762-9668-94fe237281e9", "comment": "Malware payload (Dridex)", "value": "a71d761c72b019394aabc4ce5284e9de", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573778, "uuid": "de0bc0c5-6341-46ea-9da2-eb488d097210", "comment": "Malware payload (Dridex)", "value": "9e0af6ceddb2c6bba9102b8db09f1476700174a5f823558025e75728281e3462", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573778, "uuid": "2a52b5f7-00de-4339-bfef-a78c4b81be91", "comment": "Malware payload (Dridex)", "value": "31421b46da44d2df380ef94c734b989aba5ba3d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621573778, "uuid": "820b30a9-ed05-4f20-aad0-a8029664b71a", "comment": "Malware payload (Dridex)", "value": "5afca33fc778dc7e819e8798b9c2003c62f45000d42337ee7225552f3071a2c84fd8c6ed480834c41ef8ab38db5c1294", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573778, "uuid": "a292fc6e-9fe2-4029-b1ce-43347bc06e73", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573778, "uuid": "728cb9f8-b530-41e7-8cc8-fb6a8b89d528", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573778, "uuid": "9ea24d3a-de91-4274-9def-82e69430d0e7", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621573778, "uuid": "95dfa1d9-e4ba-40fa-a251-cdb625d77b6b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621573778, "uuid": "a0e99bbe-43e7-4598-bf96-6767e9eb1aaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621573778, "uuid": "42a679b9-1e35-4aa7-a62b-3d577332952a", "value": "a71d761c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f21d80a-ba77-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621630849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621630849, "uuid": "f04b7efe-fee9-4d3e-86f9-7f50951f8518", "comment": "Malware payload (Quakbot)", "value": "4d28361c5099f51da48b36d126347777", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621630849, "uuid": "52611c5f-5d99-4b4a-9fbb-bf7b36bed506", "comment": "Malware payload (Quakbot)", "value": "9ed4a8e3eac6a2ad0f9cfaeecb8716c270dbe8df557c2553e8abf8133db8ebf9", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621630849, "uuid": "41db442a-9d8b-41de-a808-0b9cbbf50215", "comment": "Malware payload (Quakbot)", "value": "8137ffdbc9cc98b5f4041187720d526f5878f23b", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621630849, "uuid": "b14d1838-73e6-4ca2-ad29-c94d153085ea", "comment": "Malware payload (Quakbot)", "value": "2d5321ccfac0fe8f5f2e06d8cc0264dd30aaa867cb20085db7379e83726f7e130cc19b7d1cd849086ca5284e3046e169", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621630849, "uuid": "ce08159c-0920-4251-947c-81f1c948fed3", "value": "D7056A67ABDEC412FB371FBEB1938A0405F2EC936472513E01E03A15F976AB428A5774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621630849, "uuid": "38ad58e5-5290-41ad-b5c0-94cce55d8bf7", "value": "4ebb40257a7792dd9e5301598ac96374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621630849, "uuid": "084c3302-3b9c-4509-82f3-8357c12ba823", "value": "6144:TPTvcjuQ/9zoaV3EeVHq/Ca6VbrdRNrqau5wHvDvREJNFtH:7IjuS9zoadEYHq/CjtNrLHDEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621630849, "uuid": "882357ef-5fda-4d02-b1fd-806f63b30b52", "value": 871700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621630849, "uuid": "dcdd6cec-8951-4305-8932-2106ba714541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621630849, "uuid": "47beef49-b912-470c-a52a-2138f06b61e8", "value": "4d28361c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68d6d73-ba08-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1621583241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583241, "uuid": "0d8a242e-e088-4f88-a824-99a87110100b", "comment": "Malware payload (NanoCore)", "value": "a7d213b1607efe86faedd2134a759505", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583241, "uuid": "2273d132-70ec-4ca3-a064-40de76e81919", "comment": "Malware payload (NanoCore)", "value": "9ee08282d40e3bd34c507e16f7c89ecd824e7605c59a8458cb3299c5c8928a42", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583241, "uuid": "8718bb3d-c598-4878-b483-e37006e5f586", "comment": "Malware payload (NanoCore)", "value": "e092ba3622d3dee0beb60aada21f5513d08003cf", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621583241, "uuid": "e711f89b-07ed-4604-bc93-697eb1cc455e", "comment": "Malware payload (NanoCore)", "value": "b998c7c13f8fefcfbad83efbff1ce328f01dcb6dda10cdd3cfaf13af7c5f61d4d7011c610c404d23b8740e3cb0e4d08a", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583241, "uuid": "30dc144d-dc4a-462c-b7f5-44743a96cdc8", "value": "C7B4233D0E8DF75748500FE169863429D76506E12DF6CE598816FCBABD4FB8782A0398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583241, "uuid": "136c2cc5-3d99-4d0a-bab0-53d458637f74", "value": "12288:3JVFTrUHRmo581NZBmLnfVbBLEqFtZFhJ65:3JVFT4HRL5gZBmb9bVEqfh05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621583241, "uuid": "f6649b58-2acc-41a3-b9c5-31e50dcbded7", "value": 517113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621583241, "uuid": "7b748110-4df5-4bea-8b77-fe3fb0c3e714", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621583241, "uuid": "45e62c70-8da4-4fab-a8c7-18b46fe0eaef", "value": "Bank Payment Copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736c1e2e-ba2f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599852, "uuid": "210380ec-9d3f-47f3-b666-637808db2020", "comment": "Malware payload (Dridex)", "value": "f4e2d8db5540ad5ec0534f964f9d9f7d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599852, "uuid": "f974a5d5-1a52-4790-976f-2f24713d99cf", "comment": "Malware payload (Dridex)", "value": "9f0cf4ee5cf7088680486b39c9166f1b755290828a6353932cf68b40924799e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599852, "uuid": "dca28d51-40e6-46f8-913e-907f177a552d", "comment": "Malware payload (Dridex)", "value": "376743e56ddb3b4149df1b42dc68fef403db680c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599852, "uuid": "9a4a651f-44de-4c7b-8283-bef73a5c68d9", "comment": "Malware payload (Dridex)", "value": "357e97062ab78af47bfa2b286650393e74ec9342830bac6c7feeba6e97a1566e37d4df1d2c5b7940b5b00ab25fbc055a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599852, "uuid": "7759e679-7460-4ea2-bc5b-41da092ba723", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599852, "uuid": "9948546a-f4bf-4b20-a9bd-ad480096fd23", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599852, "uuid": "de6c0ce0-cd30-457f-8df6-06641a6432f6", "value": "3072:qV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:qV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599852, "uuid": "038f96db-e3d1-4370-aecd-a9ca7e3cbbb1", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599852, "uuid": "29ea1c8b-84ef-42b8-9f34-c918eaa3f478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599852, "uuid": "d2cff08d-c33e-4b8f-81da-fb3de5fecb88", "value": "f4e2d8db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2120b134-ba8a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638798, "uuid": "f814ca3a-e7d4-478c-a8e4-a43622f08d8d", "comment": "Malware payload (Dridex)", "value": "5809bd1f279da1c308defeb4eee421a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638798, "uuid": "e0bf01e1-7b22-4ac9-b510-dd022facae52", "comment": "Malware payload (Dridex)", "value": "9f34f12e269bb65dca4a9a48e39a6647d94f8f0f97e31cf0f8e65b8c92837745", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638798, "uuid": "b3efca42-e45f-4bb2-a082-7da796875669", "comment": "Malware payload (Dridex)", "value": "8077dfd6521b9646ac80bb2d5458262d673405b6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638798, "uuid": "324262dd-31ad-4915-b502-b9f62b9cc7d3", "comment": "Malware payload (Dridex)", "value": "f8fd815ea0f400ff136a7ce649420becc76eedd7f78f36ff2fd26341e46f139a4b19bdefc22163a0433e85ae69104464", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638798, "uuid": "1328c490-1c75-48f1-bce7-2f262516f7da", "value": "6AF3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638798, "uuid": "d1dc8ae6-a539-45a9-99f7-d44dd9e82558", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638798, "uuid": "77e2a4f6-643f-4935-88b9-a9eb02b0f78f", "value": "3072:Q9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:Q9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638798, "uuid": "e4db8aa2-b649-4852-befd-fa55e5548082", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638798, "uuid": "ae7f0a31-775a-4102-8987-a732ff41ae46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638798, "uuid": "71033fff-aac0-4044-8f7d-05a25e1daced", "value": "5809bd1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990dfacb-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610223, "uuid": "70a56020-21b5-4102-8943-e486937cba5e", "comment": "Malware payload (Dridex)", "value": "d096ae8b5b5a9670e2f9fff2636ff952", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610223, "uuid": "0b93571f-af66-4821-8fad-92f221cfe67d", "comment": "Malware payload (Dridex)", "value": "9f5b9e8e8e2478fe63377828a8352ebd5b26834de9c0c7827495dfbb41913ac2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610223, "uuid": "d58ee8a7-dbd0-4d5e-a302-96bf7e89586a", "comment": "Malware payload (Dridex)", "value": "6b0c600c807f4597c5534811f171ce81c529a608", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610223, "uuid": "9bd976bb-af9c-4e46-89af-96ba36847704", "comment": "Malware payload (Dridex)", "value": "6881b03741e2df25fb81b7afa5355af14f0a4ec5265efbb3e96b96b7608dacd533fa37176007b6c4a234b391a1a51e05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610223, "uuid": "b535061d-d1c0-41c8-9180-9166ff5a6830", "value": "6FD312F21F9AC481AADD131F9497B3CDAB447DC24BE3193B9525806E4307B533835AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610223, "uuid": "85791236-668e-47cd-825c-0977c1b381d4", "value": "3072:Q0Pq5OL6ylDj1FcIBAr2HW2i1sELWgiKjqcLrpy+ZlIL0:Q0N6yl/OrIqF6g3jqc3py+Zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610223, "uuid": "a9467749-ce80-4527-9702-6e90f84f46f1", "value": 133790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610223, "uuid": "8ac6c9bb-33ac-4c5f-a820-3affaf65bab3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610223, "uuid": "242cf706-8234-4d76-b409-08c8b331967c", "value": "d096ae8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569e7f82-b9e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621568451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568451, "uuid": "20aa2c4b-d4b2-42ba-af2a-241808dd2b44", "comment": "Malware payload (Dridex)", "value": "561573289966ccc646138d847479c114", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568451, "uuid": "8ae63e63-47e7-4f10-a5c0-d28c367be18d", "comment": "Malware payload (Dridex)", "value": "9f5ce0e9ec5d4067c259e10c121a3569f1841b01ac05ea75265b0c92777f0223", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568451, "uuid": "b4a7d202-ca71-4a05-918b-74fa1e53c3d3", "comment": "Malware payload (Dridex)", "value": "02e6565a184c5243b1d96e218371463ccf046804", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621568451, "uuid": "f3a3bce8-c3f3-4527-85ad-0cb7fa6b5293", "comment": "Malware payload (Dridex)", "value": "b754626afbd5d5db535f2dfe0aa6124811b58d12057ae4edba77f573afd1f77bd5f2b5f124f304566e1363d90b78e7bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568451, "uuid": "1f91d7f1-705c-4df8-9528-0d319b559df6", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568451, "uuid": "a2ed4b70-1862-43ab-813b-f5315816c8f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568451, "uuid": "624163ba-67ff-407b-84df-b81e3b2d48b4", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621568451, "uuid": "fb3a1064-c924-454e-a82a-f167f0b839cb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621568451, "uuid": "707428ae-9955-431c-9491-70458ef63d7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621568451, "uuid": "e6623069-6748-4d06-9f5b-6880c9bae750", "value": "56157328_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d434dd43-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621616336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616336, "uuid": "3bb72311-81c2-4155-8c6a-e560c201d211", "comment": "Malware payload (Dridex)", "value": "d884393e92ceb8bb0971719565d9cb16", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616336, "uuid": "608c8ebf-4a21-4710-968f-692312febaac", "comment": "Malware payload (Dridex)", "value": "9f706f2f28a5d556041f44273771117b152d1f47352453b342b90094a177a060", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616336, "uuid": "86c4dce1-1873-439d-a8bb-10cd740d85fe", "comment": "Malware payload (Dridex)", "value": "1f8c0903635bd8584a98081b7ebddb04c5ee0d17", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616336, "uuid": "7b3fabf5-2d20-48ab-bcd4-2b0a721cb8db", "comment": "Malware payload (Dridex)", "value": "2751f42d688b26c3378fcf25a34aa96bef0d74d2c3611830e7ddf84b79fbad93425872353a33152daf2ea36850183dae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616336, "uuid": "adfe03d4-246a-4105-90c1-dbc397403e48", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616336, "uuid": "b0279e55-304c-4512-a928-fed3d5e51337", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616336, "uuid": "bbf4f8de-ffd2-402c-b8d0-daf590f8e1b7", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616336, "uuid": "3ac37f16-6467-410e-a34a-e5c6c7331acf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616336, "uuid": "5b50d6f9-d3c4-49aa-9e88-4a74f0ade45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616336, "uuid": "5f9202ce-096c-4ea4-a306-5d6b229f0e57", "value": "d884393e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b34a41-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1621613253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613253, "uuid": "65d9f59c-d87e-474c-a5bb-9b1a9176f209", "comment": "Malware payload (Quakbot)", "value": "4ea1586a5caabe8e4e5441663685c488", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613253, "uuid": "2f078162-ec07-42cf-8b0e-0142c0471ff8", "comment": "Malware payload (Quakbot)", "value": "9facd8274de4a8a60ce2efab5dba17c4a3acf9a88f52c52ef5afb2ca35f68196", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613253, "uuid": "a24a4a82-cf2d-482b-8da3-d5d4fdefc343", "comment": "Malware payload (Quakbot)", "value": "0f1b97ea64df41c0b6f9aefcf4e2ea16e54c7be1", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613253, "uuid": "8052e172-cae0-489b-90b6-6f3fceb0f395", "comment": "Malware payload (Quakbot)", "value": "37c6d9f20bae4c23b096e22237fa0ed8fb7c1eedbf9a4dcb13833313f68e65d6d608343fc1d06be283f31ed7fe89cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613253, "uuid": "6b2ee4ed-78dd-4735-9a6d-c3eb30aea85d", "value": "540402EDBAD1E525E7A40CB3D4405B830CB75AC74B872C6EBB11519437B0DF781C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613253, "uuid": "89029274-6b8b-4ea0-8a85-02672837baa5", "value": "3072:WYevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHi+:WYov8cKSsYodBXC0YnW49MarG19C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613253, "uuid": "6054f176-3469-46aa-9a16-7338e11517d4", "value": 186718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613253, "uuid": "da6b453f-9880-4a05-b842-22f7f5414014", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613253, "uuid": "34a2e631-7303-47e3-b88f-e1ec234ef574", "value": "Outstanding_Debt_2126383242_05212021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b86f66-ba43-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621608357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608357, "uuid": "e884669f-960c-4203-b8e6-3e3e21c5d92d", "comment": "Malware payload (Dridex)", "value": "6b6c4789d65c99ab2022e75870ad4b23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608357, "uuid": "a6b92413-0bc1-4c44-adc7-f4aa969cccfe", "comment": "Malware payload (Dridex)", "value": "9fc5d8fee2c78a2d7877588640804c2219ad559a028da5c7f477af37e4ddc70f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608357, "uuid": "30849ee9-156a-4cd5-b231-b3d3ec38ddad", "comment": "Malware payload (Dridex)", "value": "bf961d372b5b91f64be88b1fdb6c2f8cfb283b1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621608357, "uuid": "3843855e-80e6-4902-8162-c6b7b5ba41ce", "comment": "Malware payload (Dridex)", "value": "5ff8b30ae3ed799d2292e9ad6fcbbef4107a58786d5a492dc404d096e3a21e7081688ae1e2e5458a38d049f48720fc92", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608357, "uuid": "c370ef06-22a5-4bf7-a4b6-0a89e499825a", "value": "1204E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608357, "uuid": "aa826538-a934-4c54-95e8-c14e6d05504b", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608357, "uuid": "d4794b5c-dfc1-4bb5-a052-0ee14df99f82", "value": "3072:OV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:OV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621608357, "uuid": "64f9580d-aadd-4490-b02a-0af98bc09b94", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621608357, "uuid": "3d060b14-e441-43f4-b77f-c63c34c266bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621608357, "uuid": "1fe142cb-083a-4f56-a349-762eb2e96812", "value": "6b6c4789_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7fcf9a-b9d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621562560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562560, "uuid": "fcfaa1d2-c06e-451a-9505-5c7992adcc04", "comment": "Malware payload (Dridex)", "value": "7d2008c7d3573990b062c94b3b0b55b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562560, "uuid": "df0fdbd4-7a02-432a-8c9a-f32a690ac639", "comment": "Malware payload (Dridex)", "value": "a039573b4b9dba0578d8e602c79fe7df7de1c7883d6bad93b207bf8bac915609", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562560, "uuid": "80140786-3866-4921-9a71-1992b3d81c0b", "comment": "Malware payload (Dridex)", "value": "f4741da445b1a3c845d3e16c1358c860ae7a9c7d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621562560, "uuid": "1d3d764d-8a10-445a-8a8f-f3c2dba03924", "comment": "Malware payload (Dridex)", "value": "931a7015f2eb606b70ddaff792e7de1a4785a1bf6128dbc1dfd8e5272f49e9ba72e4dab59b8b6f356a176a07fbfdd4c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562560, "uuid": "3cbbd8c0-24c2-438a-8a18-780a088a9f6b", "value": "B8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562560, "uuid": "46e86ddc-7ec0-411b-a8ed-7b05cd8fadd0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562560, "uuid": "cb93e856-804e-442b-83cc-bac7b234f574", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621562560, "uuid": "bec6e441-873f-4cd8-b709-e23c50a77277", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621562560, "uuid": "275641ff-837f-47b0-9a3e-e5ee861016bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621562560, "uuid": "2fa9cfeb-c706-4dc9-b24c-0f3a134cd94f", "value": "7d2008c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e4884d-ba19-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621590251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590251, "uuid": "c3d72cc1-024c-4c5f-92ea-423ca9bf6645", "comment": "Malware payload", "value": "62ca86b673fbf8b89b81694c88768a16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590251, "uuid": "237cac7a-74aa-4c47-ad52-4deb4cf7ca8f", "comment": "Malware payload", "value": "a03cc84194c411d5a6d33b4bb805d7231623c5c19fd0304f595dcf83353904d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590251, "uuid": "c0d5352b-a596-4401-972a-5aa075bedbf5", "comment": "Malware payload", "value": "dca47ee730c71382a4e7da2bbfb39b1f5eb7b333", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621590251, "uuid": "c6bb6e35-efb8-4a9f-b9b6-db9d46434559", "comment": "Malware payload", "value": "a8abb38bccac5c3fdf47a38b366245bd3805c8e640e068d53a410e6c76085efea08c4971c2c798cc2ffe98bc8cb4af04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590251, "uuid": "df26e9c5-c6c9-4954-aa19-357404f796fe", "value": "57547C59B3E508F8EC77813DCC529606E672B8520771DAEF03A046672F272D0AD7EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590251, "uuid": "f68231f1-62ee-4317-8514-29cd4f2ab181", "value": "2817f5838f6c025a8f0457277424aa38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590251, "uuid": "73dcd66e-a7fb-49fa-95e1-db4973af45cd", "value": "6144:/8jlggmX2MG1cNhuBUMM6yohKA4iIlSqm:/8jGgN1mwB/yok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621590251, "uuid": "baadc881-c302-4f7c-985f-e17bd62743dd", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621590251, "uuid": "4758f2cf-51cc-4438-977d-5d24cb7d92b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621590251, "uuid": "d58e181f-e04f-460e-a285-fd5e416abc1e", "value": "bder.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcda1431-ba4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621613827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613827, "uuid": "1fc56475-20b0-4bfd-8623-3d809b1f01a7", "comment": "Malware payload", "value": "b081058b8bece327bec2c0e733891fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613827, "uuid": "ca8cf0c7-1fcc-4e54-a4cf-2bd40d5914a4", "comment": "Malware payload", "value": "a05426521e144845448ee09a8e8c8472096ddbab3b65d080268982d16d1e8334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613827, "uuid": "91319ae6-20c2-4305-939d-615e7191f3f4", "comment": "Malware payload", "value": "d602d1f0b536494b46d68c017ff036b9b49314b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613827, "uuid": "3bf65c52-bcca-4a2d-adbd-c9c7d8b28eaa", "comment": "Malware payload", "value": "b051f39a1317ff6101f592ae777cfeb1a1a0e7a02db68f1dc0c3c4025c19c45ca65b66facbdc082751e30146044e16cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613827, "uuid": "07520a53-f649-4c37-b56f-a01b6b566d0e", "value": "76545C20A6A0C035E5FF22F489B9C279653A7DB16B3450FB12C63AEE56345E4AC3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613827, "uuid": "15b3e21e-8a60-41fd-92ba-7a4d13ecfce8", "value": "769049f8e01ecc40b9ce31916b22312b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613827, "uuid": "5e777e23-ae9a-405f-be5d-a9b7a834aabc", "value": "6144:+91BTMTpj6DRCmtMocZMTPz+EqVXsTRV:+9HTMT4DRC8wMXXqVXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613827, "uuid": "888758e8-02d4-402b-aa18-18729d9eb5d5", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613827, "uuid": "05be0e7c-26be-4432-8268-ccce7ed129d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613827, "uuid": "2fef9b96-3de4-446b-aed2-fb80ccb49109", "value": "b081058b8bece327bec2c0e733891fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb0c39c-ba55-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621616402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616402, "uuid": "1db94277-46fc-47f1-a911-57f67d0ee250", "comment": "Malware payload", "value": "efb4a20d270e815946a2ed015916fb30", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616402, "uuid": "98ef6b94-1bbb-449b-af57-b34849885a7e", "comment": "Malware payload", "value": "a072edeb8887bb0354b6126b03a641633e9e514d1feadc59f5feb97b2dd615fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616402, "uuid": "9199ff64-6937-4057-8035-a66736e5bfbf", "comment": "Malware payload", "value": "be82ba4adbd37041a50689cbc5a9182df0b6d152", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621616402, "uuid": "3d3b682f-4ed3-49ad-bb4d-0a82c8f9ecd5", "comment": "Malware payload", "value": "852d3e896c95e5817954e07e2778bad06211b888485c5e8debc8158ab50c0f47a0bcaefa022abdf291aad6c1df5e1c19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616402, "uuid": "eb683cf1-941c-4e17-8d0d-64bb583c567b", "value": "ED942393AD522A23B7AD06C3178A7EDE4E753D3F4B80C05C036E9221D9699375E33D61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616402, "uuid": "8cfb3f90-7678-424e-9528-94b43c778ecc", "value": "12288:tXFSkIVrmDNSokqdMbVTL3OFh4gf2L9KMgLXI9:B+rm8H8MbVn3OEPwM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621616402, "uuid": "4ac51ca4-d4bf-44e3-a64c-0544d34f28a3", "value": 441011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621616402, "uuid": "35c44e22-e853-4761-8a75-2099c566b5c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621616402, "uuid": "e55d9564-f1aa-4872-aa20-ec1c20269a40", "value": "efb4a20d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab579863-ba30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621600376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600376, "uuid": "fde87434-33de-424b-8403-51fc928d732d", "comment": "Malware payload (Dridex)", "value": "82d794eab6820ed3f486ae851bf847e3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600376, "uuid": "90e59ddb-7ec1-42b5-bb79-ff63cbc3d8dc", "comment": "Malware payload (Dridex)", "value": "a0a38e722bc647ff949d36d15aac9cfaf97cba730a0d0cec55422338a8b27021", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600376, "uuid": "8bc55a4b-e564-4a06-b10d-a37fda8d6f2f", "comment": "Malware payload (Dridex)", "value": "fc10ad71237963aba3bc48090db5f804f9a4ad2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600376, "uuid": "d2ddc442-4a38-4bcb-81a1-d262591fefeb", "comment": "Malware payload (Dridex)", "value": "d9d3456e351f0ef14bc9ebf484796c469cf94c1bb2a7636343988b25c4eaa5e09e84cc423dc2cd8c14e5b48a365413aa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600376, "uuid": "d66144f5-8f2f-4b0a-8d17-1c08b77cf2de", "value": "8B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600376, "uuid": "2499c7c9-9b5f-4d5b-8aec-917fcdd65de2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600376, "uuid": "6710efe0-ce0a-465f-9c9e-63b6a3762ae8", "value": "3072:aV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:aV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621600376, "uuid": "3683aa26-1b37-4b30-888f-9787935d5988", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621600376, "uuid": "6a1a0bb7-8e8b-4424-a959-91cace67a865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600376, "uuid": "55c90ec3-d707-43b0-951f-cebb33a37f83", "value": "82d794ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef891c5-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581108, "uuid": "034b5cdf-d0ea-4574-a319-7efa291ad5c9", "comment": "Malware payload (Dridex)", "value": "297ba26210a3a728e252541c9aeaa340", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581108, "uuid": "935c5516-ead2-4643-9529-c17282c9afbc", "comment": "Malware payload (Dridex)", "value": "a0a54abe1e65f51a2d3f6595e4c0bdfd3cd6cff1591a4c51aa10c10a1556ef6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581108, "uuid": "2a2165a4-4af3-4d0f-b89a-170f9e407c7e", "comment": "Malware payload (Dridex)", "value": "6ac063818b315a7a65e1a00453411773071034e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581108, "uuid": "d8680d90-5941-4424-bf17-851c01d34a55", "comment": "Malware payload (Dridex)", "value": "d4ef168a176e505003dcaa462771b6374cd97968c9a9df4d9837de514581f4c0677c8b0acf2ba5382d5f0ffbcc8f08f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581108, "uuid": "3bf3dd00-cedf-469a-97b0-62efe2eda896", "value": "DD04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581108, "uuid": "02ecf8f6-0566-43dc-b37e-113711b90c25", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581108, "uuid": "66979c89-707d-47f1-978a-8f79f3934dda", "value": "3072:VV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:VV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581108, "uuid": "6bf1c01e-be05-4562-8f18-259b4b0ac13b", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581108, "uuid": "b1e5283b-046a-49b6-84b5-c46ce02a279a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581108, "uuid": "3b4565e7-8dde-4726-ad4b-c1481b6d7569", "value": "297ba262_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c0726-ba04-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621581441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581441, "uuid": "a0c0e693-2756-44c8-b188-e206166eef9c", "comment": "Malware payload (Dridex)", "value": "155e9ed5bcbf8bbeda4b07d48cbf5767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581441, "uuid": "33080beb-43ec-4b8b-a0c5-5789aac52fad", "comment": "Malware payload (Dridex)", "value": "a10dfaf0bfe2d848c09fd996911c343b01e0ab4888057de59d792b2f159759ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581441, "uuid": "09d7c12b-5f96-4630-8a42-bdd37dc5dd70", "comment": "Malware payload (Dridex)", "value": "4caf872a05529a6198359b0c44b32cb2949ebb8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621581441, "uuid": "e4b8a6b4-5481-457c-a39b-2072be5817c8", "comment": "Malware payload (Dridex)", "value": "67027bee3f1fceb2b3c30fabb56577fe9887e9d3d18089b550196a0fc9aed99afef63ea773122426946b7684faab7390", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581441, "uuid": "de200fa6-8d56-4888-81cc-0b1952323fdc", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581441, "uuid": "36c6d1f2-aead-4318-976d-4fc97e6a2616", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581441, "uuid": "94abeca6-11db-45df-b294-7efe33af63c7", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621581441, "uuid": "352a0b35-ce29-4309-aba7-ae0fa2173a71", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621581441, "uuid": "f0161c0a-7bd2-483c-8543-074c8a45aa1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621581441, "uuid": "8428c2df-44d5-4f5a-8a0b-39a71f26ef23", "value": "155e9ed5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a26a910-ba47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621610037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610037, "uuid": "01ddaa83-7663-47e0-a5b1-a67747c4fe25", "comment": "Malware payload (Dridex)", "value": "b7dcb434948fbe0bf37e3bcec5d4e87e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610037, "uuid": "e7a2d710-827b-4ce4-8ffc-d392273d6849", "comment": "Malware payload (Dridex)", "value": "a1202209b49bb16ca4e51565aac35aa6642a2ac27f943901b335fe54a02718f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610037, "uuid": "b30b7626-eaff-46b6-9cae-4434f4939d0f", "comment": "Malware payload (Dridex)", "value": "7df0e8d58cd33394a9f40af971dc1e93411abab2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621610037, "uuid": "4a82a419-0562-4046-9c93-2eedc1977535", "comment": "Malware payload (Dridex)", "value": "1a63148da56bfdf59e0a9bc92dac5f0b8040cde9baea2f4b0e843e89ca8a31917d60bdbdddd00fde6b5945299b9e96fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610037, "uuid": "af74e98f-98d6-486a-a813-73e24d976697", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610037, "uuid": "068eb6e2-82e4-41af-86a6-63dc302396be", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610037, "uuid": "13401239-6fdd-40cc-918a-ec738b06d10a", "value": "3072:hV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:hV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621610037, "uuid": "b82b837b-2fcd-409f-a14e-e9c228cbece0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621610037, "uuid": "7be50dbb-527d-4a85-83a6-6b3c1e63847a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621610037, "uuid": "cf1f1292-95f3-426e-8727-671e72363e8f", "value": "b7dcb434_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1692ab0b-ba0b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621584235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584235, "uuid": "a906d3d2-5452-401f-bcd7-1b4b5d7653b4", "comment": "Malware payload (Dridex)", "value": "a7cf398c2effcdd71e845d4b3a4f45dd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584235, "uuid": "f6a927ab-127e-4f25-b31f-d02133e72573", "comment": "Malware payload (Dridex)", "value": "a1423f274e459421c01c3eca39e7b7028144547407b8ac263ca43bd81286e457", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584235, "uuid": "0c1f0f8b-9d8a-452a-977f-c7ae68f14ed6", "comment": "Malware payload (Dridex)", "value": "563a320bf75785856393c9c9ca7f092b59476177", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621584235, "uuid": "311a0594-da78-4674-9476-83b0a35e85b6", "comment": "Malware payload (Dridex)", "value": "ced270b03964601ea86362b38668a7ad06c40207eaa2d795fb9428c1d69b7347a32e945e1c7a418a1014353c4d922211", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584235, "uuid": "1c6254a3-d2d9-400d-aae5-18cc3ec7cc0a", "value": "E1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584235, "uuid": "5b3072cc-717c-4fe1-97db-3cbe0eb68ce0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584235, "uuid": "59a6c72f-abf5-42ce-9a60-c6afcdbe4632", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621584235, "uuid": "fc0e8857-e996-435b-8877-317a0b5ad6ad", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621584235, "uuid": "2bc8811e-e581-4640-8c72-02b4ff2db4c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621584235, "uuid": "df32c490-c081-4c03-adda-fb8bdf78b767", "value": "a7cf398c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a6365b-ba30-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621600126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600126, "uuid": "3f60fbcc-855a-4a90-87a4-2dd8340b599b", "comment": "Malware payload (Dridex)", "value": "b9f2fcc038131e953d56381ed6046ec0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600126, "uuid": "1c909839-fbee-490c-b0b7-589e9d713f57", "comment": "Malware payload (Dridex)", "value": "a15b29a6ad58c8e979bfedc1cbe945a04fcb76cf981e8813fce0877956718787", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600126, "uuid": "e62218d9-9dc6-4903-9563-b493d65b0029", "comment": "Malware payload (Dridex)", "value": "422db02e2a39c61b57f5a546982398ca1c5b870a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621600126, "uuid": "2cd9406c-c663-461d-8659-8af80f05e7e3", "comment": "Malware payload (Dridex)", "value": "3e20e1f38579c5331a166f16861b669b32da4524dec03f75eb58317c46c4f64f4eba6ab9b89cb65da194c54079a89f51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600126, "uuid": "ad5e6fa9-a391-4cb1-8970-1c172279772b", "value": "E104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600126, "uuid": "8a2aa5bd-52b3-4f63-855b-df4d91ea8033", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600126, "uuid": "6b00fd96-4cf3-46c2-8b93-aa8a6f097296", "value": "3072:IV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:IV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621600126, "uuid": "e1acfc18-a10e-4cfb-b963-37f0cbfcf9dc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621600126, "uuid": "8a1e13ed-9c6a-4b58-ae63-d417c8ee2c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621600126, "uuid": "482d3270-e73f-4f84-b235-110609d23bf6", "value": "b9f2fcc0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81834ce0-ba16-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621589138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589138, "uuid": "4891a8fb-b60d-42a5-ae2a-31863bd565cb", "comment": "Malware payload (Dridex)", "value": "70a30645b4e9af3528b839cf4f5af7ba", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589138, "uuid": "f4192643-5927-4ea7-877b-c8c645ffb909", "comment": "Malware payload (Dridex)", "value": "a178092b0d920aa8322f93efdd7262368202dd8f888bb3252b2053734d9db00b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589138, "uuid": "4d10f5a0-f1d9-4183-a5c4-51da531f2790", "comment": "Malware payload (Dridex)", "value": "03ab7c2f4848ac21dc288a6950680437b625ad88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621589138, "uuid": "a1defb13-8e78-47d8-80c2-4efa2ddcd46e", "comment": "Malware payload (Dridex)", "value": "e8e62c3d05a3ecf9e489b7028a66e2c16ee49546dfbd2a9d5c9bf665e7ee5c6cfc9df87ad291a71d672656e915db8c9e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589138, "uuid": "f9af6a4a-174c-4491-b159-d1719204315a", "value": "7F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589138, "uuid": "af0c164c-aff9-4b86-8379-9b1d5833e64c", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589138, "uuid": "ad9ada39-bd09-41b0-a091-923fdb88897f", "value": "3072:wV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:wV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621589138, "uuid": "7acd15c5-927a-4a24-8010-c278753fcbe3", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621589138, "uuid": "e8b92612-248e-44e6-b32e-a5ff735f3333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621589138, "uuid": "8cb20991-48c5-4a02-9878-64debfe36001", "value": "70a30645_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c2de3c-ba49-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621611245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611245, "uuid": "8dad3a46-1d02-4216-b4ad-120602ddeb50", "comment": "Malware payload (AgentTesla)", "value": "9c7b83640cbc08025786c969ee2e4996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611245, "uuid": "4342568e-0d8d-4b06-9b7d-44e61527a763", "comment": "Malware payload (AgentTesla)", "value": "a25797a6879ad04625c6b8fecccde2c0c657a1964144de7aa6951efe1cb00794", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611245, "uuid": "44c801ba-92dc-472b-8210-0995bb66db03", "comment": "Malware payload (AgentTesla)", "value": "b76e38300b9374678291bf186a9bd3c04ab86f64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611245, "uuid": "c1d13cee-5627-49cf-b95b-8417210f9b57", "comment": "Malware payload (AgentTesla)", "value": "c6c74f7dcbcdb514d9c7df69c754068b4651b107520970c0ea5f3536491655b6f74ed08fdb068b1d9bafe23ac8a2a187", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611245, "uuid": "3dc93ff0-b976-4ded-8bc3-376b6fcf5556", "value": "86F43397F61D111F1812799602213045A5CFF86BB4AE77B85DC2A0294E7A09C61EFF39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611245, "uuid": "1d76f0e3-36ee-4efd-a989-350dea9d7b61", "value": "24576:Pfey1GbEIi9++Recqljv6utOcQjqOGGY3vfl3NRroe:OCGRi9Dec2zBlxGY3V3N2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611245, "uuid": "9f843f00-5aa6-4341-b2c2-853d0217c096", "value": 791787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611245, "uuid": "812999c2-79ba-4df5-9ac9-a96af615edd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611245, "uuid": "ca7d3576-6124-405f-9122-337f261d555d", "value": "Inquiry.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3b00ea-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "40de5c3d-318d-4ff4-807e-ef764a767ed7", "comment": "Malware payload (Dridex)", "value": "1b422e18a93cdb8347ba287458e4df59", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "8ada3f90-0fbb-4065-8564-6ed4485db199", "comment": "Malware payload (Dridex)", "value": "a2987d89bf97ca68a907506ef2d5edbe2ea1b6fdfeeaf309bc6adbfc4a5d109a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "178b8896-ba59-408d-a081-2ca00b57a9bb", "comment": "Malware payload (Dridex)", "value": "172b9b33b721ab4ba4dba704fc7c6e5a89fc74ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "8783ee77-f48a-4b63-9831-e6931f16cac0", "comment": "Malware payload (Dridex)", "value": "23c5833e33ece6e8c9a35597ba12591984acd7d22d34e504dbef8780cb72c324797957f65436897b65da6e5adbde0006", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "aba1a456-648e-4177-a046-42aaee8622ac", "value": "AD04BE5EDBC7A84FDC0A06B5B0762E7B14643F0345D8ED4FD68DD282D1D2723A25A638", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "ccf08d4b-0151-4d61-98e9-3605bf734e1a", "value": "536e9ff534cd2465d5ed4c3f5c6dd4e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "88dad05b-9686-4340-8c27-45df72b435a9", "value": "3072:Wi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:WH9RVaPEmsdHdbQUbd2H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571067, "uuid": "e1daab31-598b-405a-bbc3-fc395535fe65", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571067, "uuid": "17cafb3a-ba15-4cc9-afd8-152644c7d0cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "ff028292-c4b8-4c81-88cb-788f3b575119", "value": "1b422e18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4aa8edb-ba7a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621632147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621632147, "uuid": "0eabbfa0-80f3-4e56-8f2a-1b01f0fe83bf", "comment": "Malware payload (Dridex)", "value": "31cb7f3e53d67e915dfea130d213de6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621632147, "uuid": "b69d100c-6657-4fbe-bc56-ea2b04ed3770", "comment": "Malware payload (Dridex)", "value": "a2a15c37b0dff2327d31fa58b17d59ed80b0518009ae847493de0da0df448b73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621632147, "uuid": "e1c71f6a-05f9-4979-b961-1c83607f3363", "comment": "Malware payload (Dridex)", "value": "2f79c041a9922b83d4988da8f293d8e2955c3ada", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621632147, "uuid": "1ad0b8fd-28a7-4830-9fcf-eb47d6f11a34", "comment": "Malware payload (Dridex)", "value": "a30e8ea7ee09fa976b1c0890e04adac6c6834c6000053583c45aa561a68ee5fdeaa7ffaf3706d1bc773f38c742ff3d36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621632147, "uuid": "c9469813-e9b2-430b-8d17-e46ab5dbbb42", "value": "6DF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621632147, "uuid": "3f623f91-314c-4ca4-ae4a-1f4564cff880", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621632147, "uuid": "3dc60bf9-4736-4e0b-8ebd-e57f67a92617", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621632147, "uuid": "a1274136-dfa7-47fa-9dd3-ac3231965785", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621632147, "uuid": "15cdadb8-a478-44a6-a8e5-ee4d13683102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621632147, "uuid": "a1e6fd7f-49fa-4f44-8a72-10214788e35a", "value": "31cb7f3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637b5c3b-ba4b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621611851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611851, "uuid": "47ca9dc8-494f-4160-88ae-1dbc84b1d27d", "comment": "Malware payload (Dridex)", "value": "85a4a966acb3f0d44463cf586fee562e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611851, "uuid": "ce8f990b-4593-4e17-8078-0da2f8aa9694", "comment": "Malware payload (Dridex)", "value": "a330cb6268786b8b72fa8cf0f401a918a6d87f1d16d28a982d84f01e617328f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611851, "uuid": "12f0f5d3-79ca-466c-b711-7ae94da83ff4", "comment": "Malware payload (Dridex)", "value": "0707015d609cec3a00fb42f6fd90f10028c67447", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621611851, "uuid": "3f8b2eae-3b53-4a8b-89e0-41a7ab283706", "comment": "Malware payload (Dridex)", "value": "2224f56fff56b9d9e544cbbc09266e026ee9e31d99987b5a6f1e890cf6d5ad1e2cb5549ca9c0bd11a1d1ab51c67b66d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611851, "uuid": "81a76259-d631-41f1-b792-4d423c2c008b", "value": "9F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611851, "uuid": "44cd8051-2cbf-4084-b5b9-6e7bd9828786", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611851, "uuid": "ab48d80e-41b0-436b-b650-aaa0082364f9", "value": "3072:2V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:2V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621611851, "uuid": "79c50fcf-df0c-4d5b-bfec-ff70ac1c7def", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621611851, "uuid": "50dfeb05-46dc-4857-8bd0-893da326c271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621611851, "uuid": "172d0aec-3277-4fbe-8ce0-187dc3d0193e", "value": "85a4a966_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5645e5c6-b9f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574034, "uuid": "6f943fbd-9a29-4f45-98ff-24e65aa2a186", "comment": "Malware payload (Dridex)", "value": "e975b25b715246ed7e9ff4b97ab5f30a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574034, "uuid": "4abfa4ef-19af-4c8e-9369-6db9e84e6387", "comment": "Malware payload (Dridex)", "value": "a351cf04f5084f7742ff11849e07a7c845dca741ee3f389331b1b50309ed05f5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574034, "uuid": "cdf19241-6cb6-4e9f-a075-a114a92518e0", "comment": "Malware payload (Dridex)", "value": "3762db2e1348320eacfda96ea975bcd4bc1302a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574034, "uuid": "e310e39a-6467-4a6f-ac3a-8b517333a27a", "comment": "Malware payload (Dridex)", "value": "72edb4e31bb571523b2d66d343ca773b24a7a268d0b3a1d8d92367737dd718fed9c68576ae50e620e89ae511bc0971e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574034, "uuid": "88b478c5-05af-496c-bbbf-a68274e36a61", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574034, "uuid": "648e2ad8-d700-4f8c-a5ae-59b8f0d03d35", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574034, "uuid": "8a8591e8-1b28-49bb-bcf7-5f217f9a6a2f", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574034, "uuid": "4eea8593-837b-4715-8539-e8cb682f091f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574034, "uuid": "bb92079d-b6d3-4ed2-ba72-cba287e9ecac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574034, "uuid": "737107c5-664f-4561-8f93-edf434930313", "value": "e975b25b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27069c2a-ba03-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621580826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580826, "uuid": "1e6d8359-316e-4cac-91c8-98f36419c115", "comment": "Malware payload (Dridex)", "value": "89642bd1ce4844631add671faf58e408", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580826, "uuid": "5b46ac59-6e24-4064-a6d1-ac01f6fca96e", "comment": "Malware payload (Dridex)", "value": "a45cb341e1a0b69eda0dece501e7bbb9759142f0bf9ee553c79ec2bc3e645c08", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580826, "uuid": "d5f00db8-857d-4d61-9b06-e4298be9d72d", "comment": "Malware payload (Dridex)", "value": "4d55e063bc4281b7c349955e99359b30a730969b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621580826, "uuid": "71214232-fec8-497c-9ffd-b0b4a274fef0", "comment": "Malware payload (Dridex)", "value": "d6e5856825d1a0d5ad32ffb2c7b9fdb133c138c0b0ed888aaea25dae32592726837af01fc2b8eab389c29fcebb07cd3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580826, "uuid": "01c25008-ee7f-491f-9ddc-d4444acc1307", "value": "9B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580826, "uuid": "5510cc12-b421-4078-900b-26cccbaf6c56", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580826, "uuid": "be291a61-68be-4c4b-8996-2df8dd47df5a", "value": "3072:uV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:uV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621580826, "uuid": "86929b89-5759-435a-86f6-544dc552b3e0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621580826, "uuid": "307acef7-4b64-4995-90ce-3714b7b69d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621580826, "uuid": "b27a79c2-b946-4521-86a6-9a35d4f9b9ae", "value": "89642bd1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb84779-ba3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621606154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606154, "uuid": "53de7ab6-bd3e-4c0c-886a-7214b60c7c39", "comment": "Malware payload (Dridex)", "value": "5693d58c4ba67a301554a1630b9c301e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606154, "uuid": "70c310c0-cf94-4b03-9df8-1609450c4ed7", "comment": "Malware payload (Dridex)", "value": "a4e7d8ee3fa2c911f91a66207ab149a5d05ad2f8279762bad17f40ad01e99377", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606154, "uuid": "8fe7064d-bf30-41b7-9fe2-bbeb65e8f01c", "comment": "Malware payload (Dridex)", "value": "8255f4e4762bb3fbc3ffb7d5e67d09fef3292380", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621606154, "uuid": "69834c48-0bf4-435b-9a56-56b2f7e99639", "comment": "Malware payload (Dridex)", "value": "eda504b1accee393f2a9d4bd8b2d675ca79508609ec5a9ced0f77c52cb292bf136d7f5180aa3f4452f9a21dd38b15497", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606154, "uuid": "4c00ffdd-9cfe-4341-9097-01617d9bc131", "value": "8EF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606154, "uuid": "5cf50c20-0e26-4ab4-b131-7d7e5da07e64", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606154, "uuid": "3a998761-a26e-4993-bf88-2733650bb344", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621606154, "uuid": "0d78ca16-fbfb-43dc-9a19-7938b662289f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621606154, "uuid": "37e5ff74-a8af-4d4b-97b1-0c284ac7ecc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621606154, "uuid": "61e02ef7-b437-4de2-b668-568efdabff22", "value": "5693d58c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9559564a-b9cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556960, "uuid": "85907f09-dfe0-479a-a5d7-c5340d038a11", "comment": "Malware payload (Dridex)", "value": "1f493adc4a513f312541a737fe88d691", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556960, "uuid": "dc3e24b7-3857-40c6-a1e2-8eea0bc0e2c4", "comment": "Malware payload (Dridex)", "value": "a561fab5219da29b1874e23203867dcfdf8059da983cc51885848984d5419804", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556960, "uuid": "aabffe50-fa29-4f35-ac36-7b8a4f02afa5", "comment": "Malware payload (Dridex)", "value": "bcb5c6edc747988eebaed2f97f4c7bc8301184bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556960, "uuid": "401e2cfd-3957-4e05-a452-4962ff1ad467", "comment": "Malware payload (Dridex)", "value": "d678df5aa84e348d6da4129462fc29864efbcc8e6f38f6c1d9197d03a7a761d791aa4e9ad3f3a31112b4ad2940b2fe94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556960, "uuid": "ab49509b-3e24-486b-894f-0fd8e1201234", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556960, "uuid": "a03e5412-8228-4f31-ab30-4e72e3d3c1cb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556960, "uuid": "370241ca-e947-43c1-ac87-b659db53bc8b", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556960, "uuid": "d771b13b-6bef-472a-841b-a804849988fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556960, "uuid": "0bf8cff1-4eb4-41c8-91f7-b0299943cfcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556960, "uuid": "0f9b8fed-373b-4d21-8561-91a68428cb58", "value": "1f493adc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c13ad9-b9f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621574321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574321, "uuid": "51e0213c-195e-426a-80d7-b8324a82e303", "comment": "Malware payload (Dridex)", "value": "4d2c1edb6a024e9cc44990ce0848197e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574321, "uuid": "f004e51c-84c8-4634-af35-6779c69efdbc", "comment": "Malware payload (Dridex)", "value": "a6185b17fdc8dd5881ef4614894b07524cfaa275717105c947daef9d877c06a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574321, "uuid": "caa1a9c1-82b4-4ab2-babd-146f40242ad0", "comment": "Malware payload (Dridex)", "value": "9d69b1c8d58ce6268cc8a916ca20f18ce303e946", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621574321, "uuid": "32f1705e-e325-4c7e-b435-d7e79f47884d", "comment": "Malware payload (Dridex)", "value": "b4ff3b430135a8e8b6847b53bc7633ab3acf903968d691796791dd047bcd735e57be85e490d119fe6d038904c096d064", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574321, "uuid": "0c966f2b-1014-4421-8594-f7b21ea3ff24", "value": "4904E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574321, "uuid": "8c8add13-19d0-400a-bade-8f54fc2b54c5", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574321, "uuid": "8e35f85e-4c28-4930-985d-e49e8a1e7df9", "value": "3072:jV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:jV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621574321, "uuid": "c5956872-ee23-4330-9269-c95a48b5e615", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621574321, "uuid": "50abff35-c123-43c2-9710-fc49408c0009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621574321, "uuid": "060d23cf-d39a-4515-92b0-729303309977", "value": "4d2c1edb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb8fa58-ba80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621634682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634682, "uuid": "98f05631-60b5-4456-849e-140fbe2aab36", "comment": "Malware payload (Dridex)", "value": "557b5a50cf42c2ec538ea1d5f7d2ed81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634682, "uuid": "661548ec-b96c-4b03-b58f-b5ed840058c1", "comment": "Malware payload (Dridex)", "value": "a6a33f7fa0d0ebf8a0761c1677f998b6df4c3f59d68237210fadf25b3ee468bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634682, "uuid": "027ec165-9ffd-4172-935c-c37b30d67dc1", "comment": "Malware payload (Dridex)", "value": "857c12be3dda06faf1b6d74cdc281051dcd4a769", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621634682, "uuid": "85e449cf-2c7c-4f97-ac14-4ce17519c968", "comment": "Malware payload (Dridex)", "value": "d9d684a2cc6ba3d0fc2de74906862eeaecd4d7b3c841040cbac0e75bb18f708d711e9077ed685f9f9a2cd479dd64dd5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634682, "uuid": "ae3d4d1b-0ce2-4f8a-8914-ec37181519ad", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634682, "uuid": "3045e79c-6302-486e-9fd5-389892b19517", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634682, "uuid": "1bae1621-888b-4229-84dd-9f0a424737b8", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621634682, "uuid": "c9ce33ea-6c4d-4aab-815e-69c61bc2f0f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621634682, "uuid": "3f384bf3-34df-4d0a-acd4-fc3f47ebd119", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621634682, "uuid": "e6ef4a5e-27c3-442f-82a0-766a96809455", "value": "557b5a50_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a497fb9c-ba2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621599505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599505, "uuid": "01124c2e-a21e-4ae2-9cec-be3e8403ece7", "comment": "Malware payload (Dridex)", "value": "7ab65e5ee0a2e942be90af34dd085e70", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599505, "uuid": "459e203b-60d9-478d-afb7-d1304cc968bd", "comment": "Malware payload (Dridex)", "value": "a6de464529aa739cc69de25dc641b678136c0aef008fa049dcc81b50a8d831a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599505, "uuid": "c0d81fe9-812e-456a-a239-40d0f566929b", "comment": "Malware payload (Dridex)", "value": "3116b825158f418cf229c544f2e7dbba1fefdcec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621599505, "uuid": "c951e034-35e7-478c-bb7a-b29ab6dc7300", "comment": "Malware payload (Dridex)", "value": "e084085a895bee9ec773abb3e6c3c621d9ed66f1db485a9c20690b6f1571da1243b46c12c5a2dc991694f2455e2f7963", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599505, "uuid": "e3c30a30-5f59-4fcf-b1c3-b8853ab4c20f", "value": "A304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599505, "uuid": "dd967d71-d461-483d-9cf7-bfafe0d473ec", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599505, "uuid": "7cdebe10-34d2-4986-82d9-61de4c535524", "value": "3072:xV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:xV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621599505, "uuid": "54253af0-68bc-4473-85f2-2ac3aa86d16d", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621599505, "uuid": "608d41e0-0525-4405-b0cd-b0b4d3b366d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621599505, "uuid": "c59502b6-d42e-473e-b8ab-50cbb2ac9053", "value": "7ab65e5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d13da2-ba46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621609731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609731, "uuid": "e8d32ec2-53d9-4004-a091-a17b7a718fc4", "comment": "Malware payload (Dridex)", "value": "5c6afe4ee3859b9aaa95dd39c2605c28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609731, "uuid": "400854f2-c71f-4141-8462-454828b7b60f", "comment": "Malware payload (Dridex)", "value": "a72c60a977159e80c14a29d3e7dc0034ef273c3ea2e0db89cf1c215e5f036e1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609731, "uuid": "f073b04a-f926-425a-9d10-311f51baecd5", "comment": "Malware payload (Dridex)", "value": "3e1d79a2a4a1ca75e86ef31c954fbf80f8ec1cd0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621609731, "uuid": "4d29142b-581c-466e-896b-96b2418f4ae3", "comment": "Malware payload (Dridex)", "value": "6c8984e288bf52847f6649a39161a855d1aff5ad05b163e2cebc0b87f2011d0c1323793951fdfedad4fe7bff24b43868", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609731, "uuid": "217201a6-c786-4e8b-b003-84f762e1a5f6", "value": "6704E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609731, "uuid": "b3a1dac9-1148-4e76-9b04-bbdcdb1b2838", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609731, "uuid": "230b87d5-9e86-47f2-b6ff-730b398b29c6", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621609731, "uuid": "2abbb407-0b5e-40cd-ae3e-a120e220fd34", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621609731, "uuid": "48b00a1c-ed54-4750-9d91-d89504b4a826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621609731, "uuid": "32348fe9-e587-44b2-84b0-1dcbc40499ac", "value": "5c6afe4e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621d2b55-b9c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621556015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556015, "uuid": "79d73c50-7de0-411c-ad86-ede8e24765b8", "comment": "Malware payload (Dridex)", "value": "3a25d83e1516eccb46afac119c084bb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556015, "uuid": "432e430d-00d0-448a-b9db-74726b5f288e", "comment": "Malware payload (Dridex)", "value": "a73f3b39cf86505d70649040df7d7a78ef3918a06a3bc4b23d283e003910e70f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556015, "uuid": "199b21b7-9694-4eb8-a5bb-5363aa8db176", "comment": "Malware payload (Dridex)", "value": "f21a93454ae67ecea9d884a1562e733ca92fd0e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621556015, "uuid": "5ef7f03c-d3fe-4a2d-b1e8-c789dcf12d36", "comment": "Malware payload (Dridex)", "value": "6f480460176105d59754a2f95af22f3e215cef29d4f68fcbd4abaf92a7f4eab0436362c3d13a6f73d037cac220136952", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556015, "uuid": "c0fc976a-3b07-4073-9770-d505b2454598", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556015, "uuid": "12d2addb-252c-42d4-b35b-46b6d57749c2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556015, "uuid": "5a353b97-e073-454c-8799-613602a65d58", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621556015, "uuid": "ceb3de32-e543-4256-928e-cacd3d708c12", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621556015, "uuid": "646b554c-dc7e-457f-9dd5-d4a65d2bd525", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621556015, "uuid": "a0618d5c-85ae-48ac-bc7c-2714e7acd163", "value": "3a25d83e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e25a727-ba4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612782, "uuid": "438b1d23-cded-4fe2-a65c-3f4ec8ec520f", "comment": "Malware payload (Dridex)", "value": "9b1496e2f6fbf48e9e57cec988478d9d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612782, "uuid": "c0732107-1cad-4831-a9e5-6554173b3cdd", "comment": "Malware payload (Dridex)", "value": "a746c7797663430b1779641750aaed89e9c7142dd775888fdf31fb88b3229fb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612782, "uuid": "d237fcd0-dc3e-4075-ad99-a5ae9aff78e2", "comment": "Malware payload (Dridex)", "value": "de07a34a8ee7f99509d9bd8223944fef01a14e37", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612782, "uuid": "7bb3b356-3d4f-42a1-88fa-938bd835b448", "comment": "Malware payload (Dridex)", "value": "07819371aa1aaa67123dcf7eb819e76e0b4802c1493078c79fb500bf846fe4d6c5feaa07aa5fe26ea9968e00561a7f67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612782, "uuid": "d35f02b4-bb86-443b-9cb6-da0336de199f", "value": "B8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612782, "uuid": "f0a4c7d3-08e2-47f7-9535-761353641515", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612782, "uuid": "3dd13702-3055-4222-8b0d-0faac9d9aac5", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612782, "uuid": "cafb7883-db25-4939-9425-145bf9118ae3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612782, "uuid": "e725b9bf-be11-4685-8101-b148732fd194", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612782, "uuid": "341f4626-42c1-4779-9f37-3ce100fa1aea", "value": "9b1496e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e668b-ba4d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621612807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612807, "uuid": "30fe9108-913d-4715-97b1-a76f4395123e", "comment": "Malware payload (Dridex)", "value": "41b8a9dce64c109d4bee224d783421e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612807, "uuid": "b75f61a1-e021-4bcc-bb2e-cb5a1ada36a9", "comment": "Malware payload (Dridex)", "value": "a79bdd8a4f95b9486ba81b164101adaf523569cf33934a9a0e749807f68b4a8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612807, "uuid": "48b3b8b9-6a26-4545-8c10-59cd7e579309", "comment": "Malware payload (Dridex)", "value": "75a4ae2e966adf6f9a036cffea3caa621896beee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612807, "uuid": "66d7cc8e-fef1-49e7-bdd2-2fbcd312aa84", "comment": "Malware payload (Dridex)", "value": "a5c780254a3b60fe11bd571f63c8a0059eec9f05118fc33d32f0a759b31fcf714403f45f94f2ce2f0a4c7ec03bd1ba6d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612807, "uuid": "e7fc399f-ba03-40ab-861e-ed7cb42b732c", "value": "9604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612807, "uuid": "8e867d8b-f4a5-4cea-970f-086704b94f1e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612807, "uuid": "2425a67d-f693-4530-82a6-19602bb27237", "value": "3072:QV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:QV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612807, "uuid": "f981e508-2013-41e6-88ad-743315abf151", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612807, "uuid": "745089ac-758c-44a8-8834-f1fb3b8dba6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612807, "uuid": "e1e8976e-e41b-47cb-a8e1-1d139df3f256", "value": "41b8a9dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d754a67-b9de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621565053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565053, "uuid": "ac0682df-fa2b-4eaf-9692-583f1bc10bd9", "comment": "Malware payload (Dridex)", "value": "721ddc9805ccaaca73c208a01b94e217", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565053, "uuid": "cad0612b-209b-406a-8b3d-49484f027b02", "comment": "Malware payload (Dridex)", "value": "a7e01e1948a3a50694b3e86bcfd4e04bbf6d75e6b19c16536f8427c0899687de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565053, "uuid": "07a39b62-5030-4d98-8a13-76cc76d20e4d", "comment": "Malware payload (Dridex)", "value": "027599f88518baa3111f37a91441efc516c01711", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621565053, "uuid": "27ad90f9-73c5-40d0-96c2-ab0f7cabafe5", "comment": "Malware payload (Dridex)", "value": "e5d143ef55976969c778748d6600ba3df3f094c4befd3338e0ed9ba31a3c4261ed6115933e20e8c8c16d2fd3f17026b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565053, "uuid": "b26e989d-ac0c-4663-a18d-d5dd9a805208", "value": "E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565053, "uuid": "2110fac0-2627-49f0-88c3-6209c203c1a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565053, "uuid": "95fdb2cc-0396-49c1-9974-ee83db2fd9e9", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621565053, "uuid": "032757e2-b944-45d5-9d47-c6fdd2bc0590", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621565053, "uuid": "10f168ad-bc9d-42af-b9bc-91f86d503ae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621565053, "uuid": "27f871a2-5948-450f-8926-2dcf395ccf50", "value": "721ddc98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2380c2-ba1c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591842, "uuid": "71f84596-0bc3-4c98-b96e-fbba555359b2", "comment": "Malware payload (Dridex)", "value": "ca4c8fcbf078d4d69f96c862ff4c443e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591842, "uuid": "71a4bd1f-0641-4575-8e27-d9f6430cd357", "comment": "Malware payload (Dridex)", "value": "a8043f1d220780e434752f7a62bd658451a8d29d61850fcdab835e704f0f9491", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591842, "uuid": "716fb21b-e63b-4c51-b397-71f5d905790f", "comment": "Malware payload (Dridex)", "value": "92cab2dcd87f6aeea87934d2767c9da3fd740309", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591842, "uuid": "fdbe3732-091c-49ee-89ba-6030d1c97dd3", "comment": "Malware payload (Dridex)", "value": "a20b91b04b7026d1228a13b2f16423e7a77ef4e8540686ff36ee28fe046ce4820fcccecf0386de8f55f9aeb479412160", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591842, "uuid": "79e2c9d9-8bdc-491e-b264-305835742e33", "value": "C0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591842, "uuid": "77837ba3-6d1a-425f-9982-646ea39a1349", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591842, "uuid": "f90c86cb-8ccc-4e4d-a584-b05865879f24", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591842, "uuid": "2b183e9a-52be-4880-a0ab-be7fa062da4c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591842, "uuid": "be009d27-1e0e-41e9-bd89-a5ab05ceebb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591842, "uuid": "39316ce2-e43e-4101-b620-f7f62d09f389", "value": "ca4c8fcb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c330a29-ba4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1621613235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613235, "uuid": "169db36b-ab19-4934-8b76-5624a40d2a97", "comment": "Malware payload", "value": "fa2fea3306bdcea84697c2f148245de1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613235, "uuid": "8436bf9f-796d-4d2c-9d85-f93a78abdde5", "comment": "Malware payload", "value": "a86365748561f42cde5fb8cfe6fc105a4b9a535196d29d541de7ee243af11608", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613235, "uuid": "22551f7c-55ae-41dc-90db-10e98bc94246", "comment": "Malware payload", "value": "fec5c3b0aff20b68e5b9dc2f155c290f60cbf3bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621613235, "uuid": "e5f1033e-4287-40c1-af74-16a0cd3dc156", "comment": "Malware payload", "value": "fbe452a61aa25634535995a66a9b8250071938e5bcfa4d59d9596cc110827c1dc6bf3f8ec9c08e8cc07921e57bd93731", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613235, "uuid": "99a8049d-65c6-4868-b6ce-8278fdb406c3", "value": "230412B17CB1CC177FB38E6AE01562B30ADB37934A5B0E5DE747945872721ABC100AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613235, "uuid": "02b35f32-1abd-44dd-8f51-cefae771b059", "value": "3072:r7IY3XHsOjtv8c6SIUHITBasCFifaZxiXd49TNZ10OHf:/3XFv8c6SIUoTBXC0ins49H19/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621613235, "uuid": "746815c0-5d7d-4607-8035-72ecaf861543", "value": 176451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621613235, "uuid": "3d999415-5b74-482b-9542-56131bbda70a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621613235, "uuid": "fbe526ed-8d37-45a4-b0d1-62f29730b76d", "value": "Outstanding_Debt_2126383242_05212021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893bc52d-ba88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621638114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638114, "uuid": "e174b982-8c36-4116-88d2-be64644daec0", "comment": "Malware payload (Dridex)", "value": "31f2a12a79cc45c4440d853ff135c7fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638114, "uuid": "3a157e0b-fe77-4916-83ea-4a43daa4d1fe", "comment": "Malware payload (Dridex)", "value": "a8f352d68fd0269785a5ea78c6b956112b35f9d630252c553d7e52ad488693df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638114, "uuid": "327ede85-c817-42f1-81a8-eaa031262f10", "comment": "Malware payload (Dridex)", "value": "f0c0e7af607cfe8616c058a359ea5523d26bbcad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621638114, "uuid": "3be25df5-4aa9-474d-b37f-44c1c8d1d1eb", "comment": "Malware payload (Dridex)", "value": "8a1112c1c5bb1a7571a6c7ced7b3dd55d18cd4789a22d0c2ccd6b0762fc803e8388eb88f68920a881451f1a00c19e767", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638114, "uuid": "29caf41b-e512-40a1-83e1-c340d03f471d", "value": "D0F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638114, "uuid": "35af6ff0-9236-4264-b789-1e464e0a1be6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638114, "uuid": "c9358f82-d078-4350-b2d7-d65cf6de845e", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621638114, "uuid": "60bcfc1f-aff1-4add-9e98-bbcb6229bb45", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621638114, "uuid": "ed7d4971-d855-4af3-81b9-976cde8cbc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621638114, "uuid": "d679a2b7-ba1d-434a-8cb7-3c0e6cb6008d", "value": "31f2a12a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3541ee-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621571067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "942f8c2f-ab22-4219-9153-d97ba4bf409d", "comment": "Malware payload (Dridex)", "value": "3fb1117f0068e578bd029b419df5c8f9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "b68b53c8-4ea8-4b78-b439-b0f624b1b30d", "comment": "Malware payload (Dridex)", "value": "a9027814ad4e28d570a3056f85b253e9a208e5be462f3ef35471501b8ded554d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "a68b8244-53ba-482a-805a-c9f30306ec91", "comment": "Malware payload (Dridex)", "value": "d10b13a21ddc0a8bf3926ae6a2c8a6286962de2d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621571067, "uuid": "c60248d8-90ac-4727-8e37-ef00b6283a4d", "comment": "Malware payload (Dridex)", "value": "7dbd9ae2ca9635f64fb12a544dd08f5e8bb5562e669fa320e2531b7f1e345761bd0b52964458ec7fc084e0c724d0e633", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "d426cacb-3bf4-4363-8c58-db886d942b91", "value": "E804E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "95cb7ace-0e3d-4365-832e-3e4fe1472fdb", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "ce78a0a7-bb0c-4b74-b9f9-7bfeb0a9af49", "value": "3072:JV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:JV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621571067, "uuid": "9d6c4804-3e9f-462b-8449-61c576968538", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621571067, "uuid": "8e42ab09-2611-406c-9b24-2119c243b98c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621571067, "uuid": "72274a96-c981-4862-b6b8-3565aab0f628", "value": "3fb1117f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a4b977-ba70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621627614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627614, "uuid": "8fc8dec7-e35b-466b-9670-6d636835ba2f", "comment": "Malware payload (Dridex)", "value": "9343422214353ccc43b1d863e3b2cb67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627614, "uuid": "9afce8b0-8c2b-4e14-9a05-413a9679ec5c", "comment": "Malware payload (Dridex)", "value": "a92dde849637ca58b452dd282189d06442d3a7de53053299890fd25fc675de46", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627614, "uuid": "d88ff1fc-fb54-4dd8-9209-8ec6d596d49c", "comment": "Malware payload (Dridex)", "value": "e2050640b2a207d603e50295ee75429f27081721", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621627614, "uuid": "df1fa4db-c223-4c09-bc5f-bdea6ae56422", "comment": "Malware payload (Dridex)", "value": "96baa1a13529d6dae491d1d6ab2fca47a1156dad7f3ceeeb4e3862e27e7e73e56c09e64d025087c4575ae735095c0842", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627614, "uuid": "bec0ed9d-6ccc-4c6e-b78b-cd1f5f2ab483", "value": "5504B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627614, "uuid": "55aa1e67-6d82-4f23-900f-aa05f50d0019", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627614, "uuid": "fb8d1cc0-a748-4fc6-83c5-322e1ef646f7", "value": "3072:DWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:DWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621627614, "uuid": "2ddbdbe4-db96-410f-a8d8-85fd6548eb48", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621627614, "uuid": "3cafbcd0-4e53-4c2f-9b34-394a9d629e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621627614, "uuid": "5214bdb5-1547-4416-9e87-3dbbd233e538", "value": "93434222_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df171abc-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621612488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612488, "uuid": "8a536c9f-897a-4751-b6e2-0efad49bf8fb", "comment": "Malware payload (RemcosRAT)", "value": "087f41af68a9d06f2a8e8c69ee03a0f2", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612488, "uuid": "aa5be736-7a32-4c04-acfa-93298e9e3720", "comment": "Malware payload (RemcosRAT)", "value": "a945b79aac37747c2662abfbddce86f26b20f3f789c05999ffae204a69115edd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612488, "uuid": "e047b047-8c51-481e-a894-3397b0500629", "comment": "Malware payload (RemcosRAT)", "value": "37836287d2a2aa2d8bb812f14e79e15eec1a0ada", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612488, "uuid": "6758bd47-d281-4e76-a44c-3004ba00279b", "comment": "Malware payload (RemcosRAT)", "value": "f3808c69115b04fa58a064864d0fadc505178585fa241ad27dffa3025a23b8fc4a50aea7546e040cd6b7081b501558e4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612488, "uuid": "173dcc4e-d94a-4576-b298-6c47b43e2a4c", "value": "09F4BF32A2A2847BC1AB197D9C071F659936BD302D1429E237F93E985E3D6C1391F3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612488, "uuid": "94581722-135a-403d-85a1-aa6478db2de6", "value": "ee65274bc19b4d848f45a22b7523accb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612488, "uuid": "2ad50eaa-41e4-4f39-932d-3274693a0d2c", "value": "12288:2+9Eot2ZQwPHyDc2sATUbJh0vgpz4KKoz5BW6Q4NsS:2+2oCPHyQ0TCyvCzXWKsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621612488, "uuid": "01421ee3-8fa0-4f9c-8de5-81c1d964d41f", "value": 755344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621612488, "uuid": "898dc2d7-5b0c-4803-a181-899fd8a32b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621612488, "uuid": "8a320d55-100d-4364-b3f6-fc3f432f6307", "value": "DHL_4422333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfc5615-b9ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621579333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579333, "uuid": "9c93d16a-275c-4307-a8c2-75f7d635fc48", "comment": "Malware payload (Dridex)", "value": "559d026dd673b722d5c78531c5434c8e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579333, "uuid": "ed7f5982-4933-4334-b36a-4d17f2fc8bf3", "comment": "Malware payload (Dridex)", "value": "a9a360961d8a456fab0a2ee57886e555ee0f2afc59fe2f1af4de4256e711adbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579333, "uuid": "7eefeb21-dfd3-40ab-bcca-945d2c2f5299", "comment": "Malware payload (Dridex)", "value": "a63a81fce06fabbb963921570994d5f84b3a7ae1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621579333, "uuid": "da56e1d9-103a-4017-80bc-363d2c3e8d29", "comment": "Malware payload (Dridex)", "value": "608303340d385d71760ffa3ce29e6d21efdda183c5e43297e229155d7cebd40eb29509823597be03a2375b9ab2cf0a35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579333, "uuid": "69fd2174-019b-4c5d-807f-51a63ef6cf24", "value": "4C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579333, "uuid": "a934ced5-0a6b-4761-aaaa-f41c58c5b75d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579333, "uuid": "50950bd4-8cc0-4464-9d87-91cfdc45b205", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621579333, "uuid": "2eaafdb8-ba38-433a-99c8-55f4f41d3921", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621579333, "uuid": "6d2a7bcc-7e5c-411a-864f-acf65c1e1cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621579333, "uuid": "8f188acc-f74d-4780-9f0c-a9cd75f259b3", "value": "559d026d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eceb40-ba1b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621591483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591483, "uuid": "196b6c31-6760-4142-8538-330e5b8023ec", "comment": "Malware payload (Dridex)", "value": "d392c0bd4a983a951d14630b9ed31c7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591483, "uuid": "12e3a978-cb86-4e70-978d-62c76c92b01f", "comment": "Malware payload (Dridex)", "value": "a9aab2895eb5060b662fc97b48fc5ba72fb6715153d364ae511a06a39f27c3f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591483, "uuid": "1e94309e-d509-4200-9b30-6285019cb52f", "comment": "Malware payload (Dridex)", "value": "bf72176d9620655bea08e4d4298436c4afb6138b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621591483, "uuid": "0d9e3691-ad05-4028-9b4b-85476e1e9a7d", "comment": "Malware payload (Dridex)", "value": "f8283391f33c65372aa760d9215a1954a009d5b6b79cff5b50f219cdcab42271294f13dacda88934c4892ce5fa233638", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591483, "uuid": "dbd37dfa-a88d-4095-9b43-f36fc13236e1", "value": "4604E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591483, "uuid": "8c62ccf4-b23a-4611-ba4b-c5abcbdc8548", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591483, "uuid": "d8996873-2e63-479b-a394-fc6052c93231", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621591483, "uuid": "97782d50-1e68-406f-9099-38c9f4c52188", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621591483, "uuid": "9c9755c8-016d-48dd-b86e-8df47be6d0b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621591483, "uuid": "88371db9-a4dd-4b4f-a961-4d6979e7f766", "value": "d392c0bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dd9224-b9ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621570941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570941, "uuid": "ace3b17e-4d4a-4785-b8a3-7060f09c92a5", "comment": "Malware payload (Dridex)", "value": "258250e01b7bd3e609fdf283fa506672", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570941, "uuid": "bdf045fb-3500-4307-8dc1-ae604f978833", "comment": "Malware payload (Dridex)", "value": "aa1aed7ef0611985556ef1dfab09ab173db66d0bc9becd63d71f82cc171ef9d8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570941, "uuid": "2dccec9b-553a-4ee8-a099-f61148af4ca4", "comment": "Malware payload (Dridex)", "value": "19e0cd69aeabebf4c93fb952953e3d7a0964f8e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621570941, "uuid": "59b1a1bb-27f5-4390-877c-a5c1d1383a7d", "comment": "Malware payload (Dridex)", "value": "ffdb9a6f99700656a780c78812e5142d31a758528f18c8cda55af9f69ffdf07210c12a7ad0b2f8f2ef1f8ecd72be9477", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570941, "uuid": "dbb6076d-ec5e-4898-8a00-9a1d7c73feba", "value": "F004E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570941, "uuid": "88066c7c-2f1e-4186-bf70-564cf5d15168", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570941, "uuid": "c8c1586e-8e84-44c6-8c55-013470f46b47", "value": "3072:7V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:7V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621570941, "uuid": "4bb8fe2c-a06e-4569-a846-83de0a9ec9dc", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621570941, "uuid": "421003c4-7a27-45a0-be16-8fa77f01d05d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621570941, "uuid": "e769331f-ac07-4d36-b27c-a3f59a2b29c5", "value": "258250e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4930639a-b9ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1621572294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572294, "uuid": "e9b31e1a-08dd-49cd-aec1-b3ef3470a50c", "comment": "Malware payload (Dridex)", "value": "8c2d2310c5372141ae6893c99853c6a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572294, "uuid": "630e8848-4957-45fb-820f-efc03a9c6443", "comment": "Malware payload (Dridex)", "value": "aa29ba3e6d2ec3851b96fa8403dced4ac65ca78356fb77ddd5acf057953ac2e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572294, "uuid": "9f41cc54-fd16-4ad6-a3c3-120ab078c0c2", "comment": "Malware payload (Dridex)", "value": "5387653c6b8b7246966a80d72c824b1bb3e7f8f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621572294, "uuid": "efc5bd13-5fb3-4650-8190-2ce40c883d7e", "comment": "Malware payload (Dridex)", "value": "3c0844097653b2fcd8cafa64165de1b72421a6e164bb88f666f218132a37bf3b8754421dc870740e467ffd1ef17ccb97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572294, "uuid": "f549efc6-b503-4ca6-92da-cb9bc5bfda81", "value": "9504E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572294, "uuid": "cfec61d8-576b-4aca-9fec-fb3c2e130f23", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572294, "uuid": "a93adfe1-4a02-4436-a117-71b88fa5a3ed", "value": "3072:WV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:WV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621572294, "uuid": "ad680413-b58a-4565-a259-a8959877cd95", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621572294, "uuid": "d303bd2f-e38d-4e66-ad25-5b9e6ac3136e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621572294, "uuid": "a1b91d8c-1782-4e9e-8943-8124ade0831d", "value": "8c2d2310_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddc1aa2-ba4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1621612433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612433, "uuid": "351fd66b-b005-41a2-b35d-d498f6ca3bc5", "comment": "Malware payload (AgentTesla)", "value": "ddf2e04277adb62ea9865dbca195d37e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612433, "uuid": "90f44d46-1a0e-403e-9600-6728a4e946ed", "comment": "Malware payload (AgentTesla)", "value": "aa754ccf463b921f49369755886c541ab96055af506d09e89f6ec1c231e1790f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621612433, "uuid": "4a3e1180-9038-4a90-a9fb-193a074d36bd", "comment": "Malware payload (AgentTesla)", "value": "89c38ef80c5d65ce3fcbb32834b8321a90adb680", "objec